release: VK Wallet public-offer link escapes the Mini App WebView (#281) #282

Merged

developer merged 2 commits from development into master 2026-07-17 18:34:47 +00:00

Conversation 0 Commits 2 Files Changed 3

+66 -4

developer commented 2026-07-17 18:31:13 +00:00

Owner

Copy Link

Copy Source

Promotes development → master. Single change since the last release:

#281 — fix(vk): route the Wallet public-offer link out of the Mini App WebView. The "Public offer" link in the Wallet stranded Android VK users (same-origin /offer/ opened in place, no way back); now routed through the host escape hatch (VK away.php / Telegram openLink) via a new onInAppPageLinkClick, bypassing the cross-origin gate for this non-SPA static page. iOS / desktop / web / native unchanged. The "Rules" and ad-banner links were audited and already route correctly.

UI-only. No schema/migration, no wire change. Local ui gate green, contour green (#973).

Promotes `development` → `master`. Single change since the last release: **#281 — fix(vk): route the Wallet public-offer link out of the Mini App WebView.** The "Public offer" link in the Wallet stranded Android VK users (same-origin `/offer/` opened in place, no way back); now routed through the host escape hatch (VK `away.php` / Telegram `openLink`) via a new `onInAppPageLinkClick`, bypassing the cross-origin gate for this non-SPA static page. iOS / desktop / web / native unchanged. The "Rules" and ad-banner links were audited and already route correctly. UI-only. No schema/migration, no wire change. Local `ui` gate green, contour green (#973).

developer added 2 commits 2026-07-17 18:31:13 +00:00

fix(vk): route the Wallet public-offer link out of the Mini App WebView ... 584384487c

The "Public offer" link in the Wallet pointed at the same-origin static
/offer/ page with a plain target=_blank anchor and no click handler. The
Android VK client ignores target=_blank and navigates its own WebView to
the page, stranding the player with no way back to the game (iOS opens a
child browser, so it was unaffected). The existing onExternalLinkClick
router could not help: it escapes only cross-origin links, and /offer/ is
same-origin (a static legal page, not an SPA route).

Add onInAppPageLinkClick, which routes a same-origin, non-SPA page out
through the host escape hatch (Telegram openLink, VK away.php) while
bypassing the cross-origin gate, and attach it to the offer link. Outside
a Mini App host it is a no-op and the anchor's own target=_blank stands.

The "Rules" (About) and ad-banner links already route correctly
(cross-origin + a handler) and are left unchanged.

Merge pull request 'fix(vk): route the Wallet public-offer link out of the Mini App WebView' (#281) from feature/vk-offer-link-escape into development 9eacb9b115

owner approved these changes 2026-07-17 18:33:00 +00:00

developer merged commit bb0330fb9f into master 2026-07-17 18:34:47 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

owner

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

owner (Ilia) developer

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: developer/scrabble-game#282