developer/scrabble-game
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

feat(payments): trusted platform signal on the session #216

Merged
developer merged 1 commits from feature/trusted-platform-signal into development 2026-07-08 01:37:39 +00:00
Conversation 1 Commits 1 Files Changed 39
+970 -221
developer commented 2026-07-08 01:32:14 +00:00
Owner
Copy Link
Copy Source

Record the execution platform (kind vk|telegram|direct + device subtype ios|android|web) on each session, captured at creation and carried gateway->backend as a trusted X-Platform header, so the upcoming store-compliance gate has an unforgeable execution context. Signal plumbing only — no user-visible change; X-Platform is inert until the gate consumes it.

Backend

  • backend.sessions gains nullable platform_kind / platform_subtype columns (migration 00011, CHECK-constrained, jet regenerated); session.Platform captures them at mint, resolve returns them, middleware exposes platform(c). kind is derived from the establish endpoint, never a client field; the account-merge session mint inherits the caller's platform from the request context.

Gateway

  • Derives the platform — VK subtype from the signed vk_platform via vkauth (trusted), Telegram/direct best-effort from the client — and injects X-Platform on every authenticated backend call through the request context (sourced from the resolved session, never the body).

Client

  • Submits a best-effort device subtype on the telegram/guest/email login requests (new FBS subtype field); VK is server-derived.

Semantics

  • An unattributed session is untrusted (view-only). VK/TG self-heal on the next cold-start re-mint; a reused direct/email session on re-login. Subtype is cryptographically trusted only for VK (the compliance-critical VK-iOS freeze); TG/direct subtype is best-effort and the gate never keys off it.

Tests — Go unit (vkauth subtype incl. iPhone/iPad->ios, X-Platform middleware, backend-client injection), integration (session carries platform through create + cold-cache resolve per kind, untrusted path, CHECK constraints, migration 00011 forward+backward), UI (subtype normalization + codec wire). Full local suite green: build/vet/gofmt, integration, UI check/unit/build, Playwright e2e (Chromium+WebKit).

Docs updated in-PR: docs/ARCHITECTURE.md §3, docs/PAYMENTS.md §8 (+ _ru), PLAN.md.

Record the execution platform (kind vk|telegram|direct + device subtype ios|android|web) on each session, captured at creation and carried gateway->backend as a trusted `X-Platform` header, so the upcoming store-compliance gate has an unforgeable execution context. Signal plumbing only — no user-visible change; `X-Platform` is inert until the gate consumes it. **Backend** - `backend.sessions` gains nullable `platform_kind` / `platform_subtype` columns (migration `00011`, CHECK-constrained, jet regenerated); `session.Platform` captures them at mint, resolve returns them, middleware exposes `platform(c)`. `kind` is derived from the establish endpoint, never a client field; the account-merge session mint inherits the caller's platform from the request context. **Gateway** - Derives the platform — VK subtype from the signed `vk_platform` via `vkauth` (trusted), Telegram/direct best-effort from the client — and injects `X-Platform` on every authenticated backend call through the request context (sourced from the resolved session, never the body). **Client** - Submits a best-effort device subtype on the telegram/guest/email login requests (new FBS `subtype` field); VK is server-derived. **Semantics** - An unattributed session is untrusted (view-only). VK/TG self-heal on the next cold-start re-mint; a reused direct/email session on re-login. Subtype is cryptographically trusted only for VK (the compliance-critical VK-iOS freeze); TG/direct subtype is best-effort and the gate never keys off it. **Tests** — Go unit (vkauth subtype incl. iPhone/iPad->ios, X-Platform middleware, backend-client injection), integration (session carries platform through create + cold-cache resolve per kind, untrusted path, CHECK constraints, migration 00011 forward+backward), UI (subtype normalization + codec wire). Full local suite green: build/vet/gofmt, integration, UI check/unit/build, Playwright e2e (Chromium+WebKit). Docs updated in-PR: `docs/ARCHITECTURE.md` §3, `docs/PAYMENTS.md` §8 (+ `_ru`), `PLAN.md`.
developer added 1 commit 2026-07-08 01:32:15 +00:00
feat(payments): trusted platform signal on the session
CI / changes (pull_request) Successful in 2s
Details
CI / unit (pull_request) Successful in 11s
Details
CI / integration (pull_request) Successful in 18s
Details
CI / ui (pull_request) Successful in 1m7s
Details
CI / conformance (pull_request) Successful in 10s
Details
CI / gate (pull_request) Successful in 0s
Details
CI / deploy (pull_request) Successful in 1m42s
Details
92633f935e 
Record the execution platform (kind vk|telegram|direct + device subtype
ios|android|web) on each session, captured at creation and carried
gateway->backend as a trusted X-Platform header, so the upcoming
store-compliance gate has an unforgeable execution context.

- backend.sessions gains nullable platform_kind/platform_subtype columns
  (migration 00011, CHECK-constrained, jet regenerated); session.Platform
  captures them at mint, resolve returns them, middleware exposes platform(c).
  kind is derived from the establish endpoint, never a client field; the
  account-merge session mint inherits the caller's platform.
- gateway derives the platform (VK subtype from the signed vk_platform via
  vkauth, Telegram/direct best-effort from the client) and injects X-Platform
  on every authenticated backend call through the request context.
- ui submits a best-effort device subtype on the telegram/guest/email login
  requests (new FBS subtype field); VK is server-derived from the signed params.
- an unattributed session is untrusted (view-only); VK/TG self-heal on the next
  cold-start re-mint, direct/email on re-login.

Signal plumbing only, no user-visible change; X-Platform is inert until the
gate consumes it.
owner approved these changes 2026-07-08 01:37:18 +00:00
developer merged commit 711fabe9cc into development 2026-07-08 01:37:39 +00:00
developer deleted branch feature/trusted-platform-signal 2026-07-08 01:37:39 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
owner
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
owner (Ilia) developer
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: developer/scrabble-game#216
Delete Branch "feature/trusted-platform-signal"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?