democratic-money

drjones/democratic-money

Fork 0

Commit Graph

Author	SHA1	Message	Date
root	7eac42e820	Legal pages, Threads OAuth, live wallet pill, PvP money flow + resume - Legal: /privacy-policy and /datadeletion (shared LegalPageLayout, footer links, sitemap + integration tests, NEXT_PUBLIC_LEGAL_CONTACT_EMAIL). - Threads OAuth: server-side /api/threads-exchange and /threads-callback page (Suspense + client component, noindex, no leaked secrets). - Username + live wallet pill in top nav. New NavWalletBalance component polls /api/wallet, refreshes on tab focus, and listens to the `wallet:refresh` event bus so cash-outs and refunds update the nav in real time. Flash animation on balance changes. - useLiveWalletBalance hook now broadcasts `wallet:refresh` after every fetch so games, exchange panel, wallet actions, and nav all stay in sync without extra polling. - PvP fund-locking (`POST /api/games/rooms`): creator funds debited atomically with room creation; ledger entry tagged with `gameRoomId`. Joiner debit happens at join. Old double-debit of the creator is gone. - DELETE /api/games/rooms?id=... lets a creator cancel a WAITING room and get an idempotent refund. Coin Flip + Pong waiting screens show a Cancel & Refund button. - Pong/Coin Flip recovery: expiry sweep + boot-time `recoverOrphaned RoomsOnBoot()` (runs before listen()) refund both parties for any ACTIVE/expired rooms so a server restart never strands locked credits. - Schema migration `20260520000000_game_ledger_links` adds optional `gameSessionId` + `gameRoomId` FKs to LedgerEntry (with indexes) and extra indexes on GameSession/GameRoom for resume + sweep queries. - GET /api/games/active returns a user's active solo session + open rooms (sanitized — no mine/bomb positions). Mines and Tower clients rehydrate on mount so a refresh mid-round resumes instead of dropping. - ActiveGamesBanner surfaces unfinished rounds on /wallet and /casino with Resume / Rejoin / Cancel & refund actions. - ExchangePanel unified with useLiveWalletBalance; per-game header gets an "Open wallet →" chip; Dice clears stale result on roll; Blackjack reveals full dealer hand on natural blackjack/push; Mines refund label fixed; Tower final multiplier fixed; GameHistory error path; Prediction "Resolved" tab. - Site audit + redmeFIXES triage notes (REDME-FIXSES-TRIAGE.txt, SITE-AUDIT.txt). Co-authored-by: Cursor <cursoragent@cursor.com>	2026-05-20 06:43:26 +00:00
root	c6a7b2e08d	Fix all critical/high/medium/low audit items Critical – money integrity: - server.ts: restrict Socket.IO CORS to NEXT_PUBLIC_SITE_URL (remove origin:"*") - server.ts: validate userId against DB on join_room before any debit/credit - server.ts: atomic coin-flip joiner claim via updateMany(where:{status:WAITING,joinerId:null}) - server.ts: await pong game_over payout+room update before emitting result; log errors - prediction/route.ts: wrap market resolve + all payouts in one Prisma transaction; concurrent PATCH returns 409; dust remainder credited to first winner High – data truth: - raised/page.tsx, leaderboard/route.ts, cards/route.ts: add status:"succeeded" filter to all donation aggregations - polls/next-president/route.ts: replace full in-memory row scan with DB-side groupBy + bounded 14-day window for daily activity chart Medium – ops: - faq-board/page.tsx: add admin approve/reject tab (visible to ADMIN role) Low – UX/consistency: - faq-board, billboard, spotlight, cards: replace hardcoded "BWT" with creditTicker() - faq-board: read submitCost/voteCost from API response instead of hardcoded values - WalletActions.tsx: make refreshBalance stable with useCallback; remove eslint-disable exhaustive-deps suppression Co-authored-by: Cursor <cursoragent@cursor.com>	2026-05-16 00:56:13 +00:00
root	391d90a754	Add Democratic fundraising platform. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-05-16 00:47:44 +00:00

Author

SHA1

Message

Date

root

7eac42e820

Legal pages, Threads OAuth, live wallet pill, PvP money flow + resume

- Legal: /privacy-policy and /datadeletion (shared LegalPageLayout, footer
  links, sitemap + integration tests, NEXT_PUBLIC_LEGAL_CONTACT_EMAIL).
- Threads OAuth: server-side /api/threads-exchange and /threads-callback
  page (Suspense + client component, noindex, no leaked secrets).
- Username + live wallet pill in top nav. New NavWalletBalance component
  polls /api/wallet, refreshes on tab focus, and listens to the
  `wallet:refresh` event bus so cash-outs and refunds update the nav in
  real time. Flash animation on balance changes.
- useLiveWalletBalance hook now broadcasts `wallet:refresh` after every
  fetch so games, exchange panel, wallet actions, and nav all stay in
  sync without extra polling.
- PvP fund-locking (`POST /api/games/rooms`): creator funds debited
  atomically with room creation; ledger entry tagged with `gameRoomId`.
  Joiner debit happens at join. Old double-debit of the creator is gone.
- DELETE /api/games/rooms?id=... lets a creator cancel a WAITING room
  and get an idempotent refund. Coin Flip + Pong waiting screens show a
  Cancel & Refund button.
- Pong/Coin Flip recovery: expiry sweep + boot-time `recoverOrphaned
  RoomsOnBoot()` (runs before listen()) refund both parties for any
  ACTIVE/expired rooms so a server restart never strands locked credits.
- Schema migration `20260520000000_game_ledger_links` adds optional
  `gameSessionId` + `gameRoomId` FKs to LedgerEntry (with indexes) and
  extra indexes on GameSession/GameRoom for resume + sweep queries.
- GET /api/games/active returns a user's active solo session + open
  rooms (sanitized — no mine/bomb positions). Mines and Tower clients
  rehydrate on mount so a refresh mid-round resumes instead of dropping.
- ActiveGamesBanner surfaces unfinished rounds on /wallet and /casino
  with Resume / Rejoin / Cancel & refund actions.
- ExchangePanel unified with useLiveWalletBalance; per-game header gets
  an "Open wallet →" chip; Dice clears stale result on roll; Blackjack
  reveals full dealer hand on natural blackjack/push; Mines refund
  label fixed; Tower final multiplier fixed; GameHistory error path;
  Prediction "Resolved" tab.
- Site audit + redmeFIXES triage notes (REDME-FIXSES-TRIAGE.txt,
  SITE-AUDIT.txt).

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-05-20 06:43:26 +00:00

root

c6a7b2e08d

Fix all critical/high/medium/low audit items

Critical – money integrity:
- server.ts: restrict Socket.IO CORS to NEXT_PUBLIC_SITE_URL (remove origin:"*")
- server.ts: validate userId against DB on join_room before any debit/credit
- server.ts: atomic coin-flip joiner claim via updateMany(where:{status:WAITING,joinerId:null})
- server.ts: await pong game_over payout+room update before emitting result; log errors
- prediction/route.ts: wrap market resolve + all payouts in one Prisma transaction;
  concurrent PATCH returns 409; dust remainder credited to first winner

High – data truth:
- raised/page.tsx, leaderboard/route.ts, cards/route.ts: add status:"succeeded"
  filter to all donation aggregations
- polls/next-president/route.ts: replace full in-memory row scan with DB-side
  groupBy + bounded 14-day window for daily activity chart

Medium – ops:
- faq-board/page.tsx: add admin approve/reject tab (visible to ADMIN role)

Low – UX/consistency:
- faq-board, billboard, spotlight, cards: replace hardcoded "BWT" with creditTicker()
- faq-board: read submitCost/voteCost from API response instead of hardcoded values
- WalletActions.tsx: make refreshBalance stable with useCallback; remove
  eslint-disable exhaustive-deps suppression

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-05-16 00:56:13 +00:00

root

391d90a754

Add Democratic fundraising platform.

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-05-16 00:47:44 +00:00

3 Commits