# Telegram Shop — Version History

## How to update version

1. Edit this file (`VERSION.md`)
2. Add new entry under `## Changelog`
3. Commit all changes together

## Current Version

**v1.2.8** — 2026-08-09

## Changelog

### v1.2.8 — 2026-08-09
- **chore**: repo cleanup — removed stale `docs/admin-frontend-spec.md` (old Express/EJS admin), unused `templates/` (SmartAdmin copy), dead `scripts/sync-agents.cjs`, committed `admin-next/.zscripts/dev.pid`
- **docs**: added `docs/API.md` (admin REST API reference) and `docs/DATABASE.md` (DB schema); README structure updated
- **env**: `.env.example` refreshed — removed stale `ADMIN_PORT`/`SHOP_CONTAINER` defaults, added `ADMIN_URL`, `HEALTH_PORT`, `DEFAULT_LANGUAGE`, `CHATBOT_API_ENDPOINT`, `CHATBOT_API_KEY`
- **ci**: added `npm run lint` script (syntax check of `src/`) so Gitea workflows no longer fail
- **chore**: rebranded web-testing suite from APAW to telegram-shop (package name, container names)

### v1.2.7 — 2026-08-08
- **refactor**: Remove old Express/EJS admin panel (replaced by Next.js admin in admin-next/); bot now has standalone health server; SUPER_ADMIN_SECRET for admin auth

### v1.2.6 — 2026-08-05
- **fix**: dead admin callback buttons — `prod_district_` (Back to Categories after adding category, pipe-delimited format) and `admin_users` (Back to User List) now registered
- **fix**: no-op placeholder buttons (`current_page`, `current_quantity`, `no_action`) no longer log "No handler" warns
- **fix**: `getLocationsByCountryAndCityAdmin` added (admin sees disabled locations in nav)
- **audit**: all 78 generated callback_data cross-checked against registered routes — no overlaps, none missing

### v1.2.5 — 2026-08-05
- **fix**: crypto deposit error — handleDepositInstruction/handleDepositSelectWallet use editOrSendCallback (photo-safe fallback, fixes "no text in the message to edit" 400)
- **fix**: chat clutter — lastInlineMessageId tracked in showProducts/showProfile/showBalance/showPurchases and deleted in resetUserContext
- **verify**: answerCallbackQuery before dispatch in all callback paths (v1.2.4)

### v1.2.4 — 2026-08-05
- **fix**: missing `shop_district_` / `shop_subcategory_` callback handlers — Back button in empty categories now works (handleDistrictBack)
- **fix**: state.location pipe-delimited (encodeURIComponent) — multi-word names (Saint Petersburg) no longer break navigation
- **fix**: answerCallbackQuery moved to start of callback handling — no stuck "clock" spinner on buttons
- **fix**: empty city fallback in "Select district in :" (district_unknown)
- **fix**: guard against stale underscore-format state.location in handleDistrictBack

### v1.2.3 — 2026-08-04
- **fix**: empty category menus — districts with no in-stock products show "No products available in this district" (getCategoriesWithProductsByLocationId filters by real stock/mono)
- **fix**: duplicate "Select your country" messages on rapid Products tap — 1200ms main-menu debounce in routes.js
- **fix**: DB typos + desync — migration 012 (Centr→Center, Chiken→Chicken, Brusel→Brussels, Sever→North) and re-enables locations that actually have in-stock products
- **fix**: answerCallbackQuery on no_categories branch (no stuck loading spinner)

### v1.2.2 — 2026-08-04
- **fix**: BUG-01 — disabled locations/categories/subcategories filtered from bot menus (getActiveLocationById, is_active checks)
- **fix**: BUG-02 — graceful handling of disabled entity during purchase flow (location_disabled notice + main-menu redirect, no crash)
- **fix**: BUG-03 — per-user callback lock (1500ms debounce) prevents duplicate messages on double-tap
- **fix**: BUG-04 — resetUserContext clears stale inline keyboards/state on main-menu navigation and /start
- **fix**: handlePay uses validated numeric quantity for price/stock/purchase writes (was raw string)
- **fix**: Admin delete feedback — locations/categories pages now render error/success alerts; delete errors include blocking counts + hints; 🔒 lock hint on rows with links

### v1.2.1 — 2026-07-18
- **refactor**: Removed deposit amount-selection step (redundant); deposit_wallet_ now goes directly to Mercuryo instructions
- **feat**: Updated Mercuryo button text to include VISA/Mastercard branding in all locales
- **feat**: Added deposit_important5 note about Mercuryo authorization limits and top-up reserve
- **fix**: Enforced description + photo required in admin product create/update routes (products.js, catalogProducts.js)
- **fix**: Added defensive guards in bot purchase display — description fallback and no-photo placeholder (userProductHandler.js)
- **feat**: Added i18n keys `products.no_description` and `products.no_photo` in en/es/de
- **fix**: Marked description and photo fields as required in admin forms (product-edit.ejs, products.ejs, catalog modal)
- **feat**: Added edit + enable/disable (toggle is_active) UI for locations, categories, and subcategories in admin views (locations.ejs, categories.ejs, catalog.js buildTreeHtml)
- **feat**: Added Categories nav item in admin sidebar (generated-navigation.ejs)

### v1.2.0 — 2026-07-08
- **fix**: Disabled CSRF checks in admin panel for Tor / onion zone compatibility
- **fix**: Fixed "Invalid wallet type" error in Telegram bot purchase flow (`main`/`bonus` types added to validator)
- **feat**: Added version history modal in admin sidebar

### v1.1.0 — 2026-07-02
- **feat**: Mercuryo gateway integration, crypto QR deposit, mono products, wallet auto-refresh
- **fix**: CSRF cookie `sameSite=false` for Tor, auth cookie fix, async handlers
- **feat**: Draggable dashboard panels + business KPI redesign
- **fix**: SmartAdmin template redesign + security hardening

### v1.0.0 — 2026-06-24
- **feat**: Initial release — Telegram shop bot with admin panel
- **feat**: Crypto wallets (BTC, LTC, ETH, USDT, USDC)
- **feat**: Product catalog with locations, categories, subcategories
- **feat**: Purchase system with hidden content delivery
- **feat**: Admin panel with dashboard, wallets, users, purchases, audit log
- **feat**: Tor proxy support (.onion access)
- **feat**: i18n localization (en/es/de)