telegram-shop/VERSION.md

Telegram Shop — Version History

How to update version

1. Edit this file (VERSION.md)
2. Add new entry under ## Changelog
3. Commit all changes together

Current Version

v1.2.8 — 2026-08-09

Changelog

v1.2.8 — 2026-08-09

• chore: repo cleanup — removed stale docs/admin-frontend-spec.md (old Express/EJS admin), unused templates/ (SmartAdmin copy), dead scripts/sync-agents.cjs, committed admin-next/.zscripts/dev.pid
• docs: added docs/API.md (admin REST API reference) and docs/DATABASE.md (DB schema); README structure updated
• env: .env.example refreshed — removed stale ADMIN_PORT/SHOP_CONTAINER defaults, added ADMIN_URL, HEALTH_PORT, DEFAULT_LANGUAGE, CHATBOT_API_ENDPOINT, CHATBOT_API_KEY
• ci: added npm run lint script (syntax check of src/) so Gitea workflows no longer fail
• chore: rebranded web-testing suite from APAW to telegram-shop (package name, container names)

v1.2.7 — 2026-08-08

• refactor: Remove old Express/EJS admin panel (replaced by Next.js admin in admin-next/); bot now has standalone health server; SUPER_ADMIN_SECRET for admin auth

v1.2.6 — 2026-08-05

• fix: dead admin callback buttons — prod_district_ (Back to Categories after adding category, pipe-delimited format) and admin_users (Back to User List) now registered
• fix: no-op placeholder buttons (current_page, current_quantity, no_action) no longer log "No handler" warns
• fix: getLocationsByCountryAndCityAdmin added (admin sees disabled locations in nav)
• audit: all 78 generated callback_data cross-checked against registered routes — no overlaps, none missing

v1.2.5 — 2026-08-05

• fix: crypto deposit error — handleDepositInstruction/handleDepositSelectWallet use editOrSendCallback (photo-safe fallback, fixes "no text in the message to edit" 400)
• fix: chat clutter — lastInlineMessageId tracked in showProducts/showProfile/showBalance/showPurchases and deleted in resetUserContext
• verify: answerCallbackQuery before dispatch in all callback paths (v1.2.4)

v1.2.4 — 2026-08-05

• fix: missing shop_district_ / shop_subcategory_ callback handlers — Back button in empty categories now works (handleDistrictBack)
• fix: state.location pipe-delimited (encodeURIComponent) — multi-word names (Saint Petersburg) no longer break navigation
• fix: answerCallbackQuery moved to start of callback handling — no stuck "clock" spinner on buttons
• fix: empty city fallback in "Select district in :" (district_unknown)
• fix: guard against stale underscore-format state.location in handleDistrictBack

v1.2.3 — 2026-08-04

• fix: empty category menus — districts with no in-stock products show "No products available in this district" (getCategoriesWithProductsByLocationId filters by real stock/mono)
• fix: duplicate "Select your country" messages on rapid Products tap — 1200ms main-menu debounce in routes.js
• fix: DB typos + desync — migration 012 (Centr→Center, Chiken→Chicken, Brusel→Brussels, Sever→North) and re-enables locations that actually have in-stock products
• fix: answerCallbackQuery on no_categories branch (no stuck loading spinner)

v1.2.2 — 2026-08-04

• fix: BUG-01 — disabled locations/categories/subcategories filtered from bot menus (getActiveLocationById, is_active checks)
• fix: BUG-02 — graceful handling of disabled entity during purchase flow (location_disabled notice + main-menu redirect, no crash)
• fix: BUG-03 — per-user callback lock (1500ms debounce) prevents duplicate messages on double-tap
• fix: BUG-04 — resetUserContext clears stale inline keyboards/state on main-menu navigation and /start
• fix: handlePay uses validated numeric quantity for price/stock/purchase writes (was raw string)
• fix: Admin delete feedback — locations/categories pages now render error/success alerts; delete errors include blocking counts + hints; 🔒 lock hint on rows with links

v1.2.1 — 2026-07-18

• refactor: Removed deposit amount-selection step (redundant); deposit_wallet_ now goes directly to Mercuryo instructions
• feat: Updated Mercuryo button text to include VISA/Mastercard branding in all locales
• feat: Added deposit_important5 note about Mercuryo authorization limits and top-up reserve
• fix: Enforced description + photo required in admin product create/update routes (products.js, catalogProducts.js)
• fix: Added defensive guards in bot purchase display — description fallback and no-photo placeholder (userProductHandler.js)
• feat: Added i18n keys products.no_description and products.no_photo in en/es/de
• fix: Marked description and photo fields as required in admin forms (product-edit.ejs, products.ejs, catalog modal)
• feat: Added edit + enable/disable (toggle is_active) UI for locations, categories, and subcategories in admin views (locations.ejs, categories.ejs, catalog.js buildTreeHtml)
• feat: Added Categories nav item in admin sidebar (generated-navigation.ejs)

v1.2.0 — 2026-07-08

• fix: Disabled CSRF checks in admin panel for Tor / onion zone compatibility
• fix: Fixed "Invalid wallet type" error in Telegram bot purchase flow (main/bonus types added to validator)
• feat: Added version history modal in admin sidebar

v1.1.0 — 2026-07-02

• feat: Mercuryo gateway integration, crypto QR deposit, mono products, wallet auto-refresh
• fix: CSRF cookie sameSite=false for Tor, auth cookie fix, async handlers
• feat: Draggable dashboard panels + business KPI redesign
• fix: SmartAdmin template redesign + security hardening

v1.0.0 — 2026-06-24

• feat: Initial release — Telegram shop bot with admin panel
• feat: Crypto wallets (BTC, LTC, ETH, USDT, USDC)
• feat: Product catalog with locations, categories, subcategories
• feat: Purchase system with hidden content delivery
• feat: Admin panel with dashboard, wallets, users, purchases, audit log
• feat: Tor proxy support (.onion access)
• feat: i18n localization (en/es/de)