Spaces:
Sleeping
Sleeping
Commit History
-
fix: Flatten nested src/src/ and public/public/, remove invalid eslint config key
eeshaAI4a70912 -
fix: Use npm install instead of npm ci (repo has bun.lock, not package-lock.json)
eeshaAI5aa58c3 -
feat: Migrate frontend from static HTML to Next.js 16 App Router
eeshaAI- All 16 buyer pages: home, login, product, cart, checkout, payment, categories, search, seller-profile, profile, orders, wishlist, videos, live, live-watch, group-buy, ai-chat, link-account, telegram - 7 seller dashboard pages with shared sidebar layout - 22 API route proxies to existing Supabase Edge Functions - Suspense boundaries for useSearchParams pages - Standalone output build for Docker deployment - Dockerfile (multi-stage Node 20 alpine, port 7860) - README with HF Space YAML frontmatter - .hfignore for lean Docker context Backend unchanged: 27 Supabase Edge Functions, Render bot, OpenWA, PalmPay payment verifier — all remain in place.94c9882 -
fix: Rewrite videos.html — broken by aggressive regex, now clean with navbar
Z Userf8e9acc -
fix: Remove old topbar from videos.html + clean up categories.html old nav JS
Z Uservideos.html: - Removed the old .topbar div (Back to home bar) that was overlapping with the shared navbar - Removed the .topbar CSS - The shared navbar already provides navigation (logo links to home, mobile bottom nav has Home/Category/Discover/Cart/Account) categories.html: - Replaced old checkAuthState() that referenced removed elements (accountBtn, mobileAccountBtn, loggedInCheck, mobileLoggedInCheck) - These elements were part of the old inline nav which was removed - Auth state is now handled by the shared navbar's initNavbar() function456ed3d -
fix: Remove duplicate inline mobile navs from ai-chat.html and search-result.html
Z UserBoth pages had their OWN inline mobile bottom nav IN ADDITION to the shared navbar. This caused them to show the OLD nav (Home/Shops/Cart/Account with 'AI Shop' center button) instead of the NEW shared nav (Home/Category/Discover/Cart/Account). Now ALL pages with the navbar use ONLY the shared navbar.html — no duplicates. The mobile bottom nav is identical across index.html, ai-chat.html, categories.html, videos.html, and all other pages: Home | Category | Discover (centered) | Cart | Accountcbd6709 -
fix: Mobile bottom nav — Home | Category | Discover (centered) | Cart | Account
Z User- Changed 'Shops' to 'Category' in both desktop nav and mobile bottom nav - Added 'Discover' as the CENTER item in mobile bottom nav - Links to videos.html (social ecommerce discovery page) - Prominent cyan circle icon with compass icon - Slightly larger (scale 1.15) to stand out - Cyan glow shadow - Order: Home | Category | Discover | Cart | Account - Discover is centered between the other 4 items - Same navbar used on all pages (index, ai-chat, categories, videos, etc.)ee268fe -
fix: Remove navbar from utility pages, fix categories nav, AI chat colors, seller profile tabs
Z User1. Removed top navbar from utility pages: - cart.html, checkout.html, wishlist.html, orders.html, profile.html, settings.html, order-confirmation.html - These pages don't need the category bar (AI Mode, Explore, etc.) - They're transactional pages, not browsing pages 2. Categories page: removed old duplicate inline header - Now uses only the universal navbar (same as index.html) - No more extra buttons or different nav items 3. AI chat page: fixed all old orange/amber colors → cyan - Brand palette in tailwind config updated - All orange gradients, icons, buttons → cyan - Removed old inline header (now uses universal navbar) 4. Seller profile tabs: changed from Shop/Reviews/About to All/Videos/Products - All tab: mixed grid of products AND videos (sorted by date) - Videos tab: shows seller's product videos with video thumbnails - Products tab: shows only products - Video cards show view count and '▶ Video' badge - Product prices now show ₦ …09e8793 -
fix: Universal cyan/white theme + smaller fonts + ₦ currency + navbar everywhere
Z UserCOLOR FIXES (30 files updated): - Replaced ALL orange/amber/red/gold/purple/violet/teal/rose/indigo/pink colors with cyan (#00d4ff / #0891b2) across every HTML, CSS, and JS file - All gradients now use cyan - All badges, buttons, text accents → cyan - All borders, focus rings, backgrounds → cyan - No more yellow/orange/amber anywhere FONT SIZES (Temu/AliExpress/Amazon style): - Base font: 14px (was 16px) - Body text: 13px - H1: 20px (was 40px), H2: 18px, H3: 16px - Meta/badges: 10px - Mobile: base 13px (even denser) - Added !important overrides for Tailwind text-xs/sm/base/lg/xl/2xl/3xl CURRENCY: - All prices now show ₦ instead of $ (cart, checkout, product, orders, etc.) - All 'USD' → 'NGN' - All locale 'en-US' → 'en-NG' NAVBAR: - Added universal navbar to 18 pages that were missing it: cart, categories, checkout, product, profile, orders, wishlist, settings, search-result, ai-chat, order-confirmation, videos, live-watch, whatsapp, telegram - All pages now have the same nav…00611f0 -
feat: Background payment verifier thread on HF Space
Z UserInstead of an on-demand HTTP endpoint (which times out due to IMAP latency), the payment verifier now runs as a daemon thread inside the HF Space web server. It checks Gmail every 30 seconds for PalmPay emails matching awaiting_verification orders. Flow: 1. Buyer clicks 'I've sent it' → order status set to 'awaiting_verification' 2. Background thread (running every 30s) detects the order 3. Thread connects to Gmail via IMAP (Python imaplib — proven to work) 4. Fetches 10 most recent unread PalmPay emails 5. Parses amounts + matches against pending orders 6. On match: updates order to 'matched', marks email as read 7. Frontend polls check_status every 5s → detects 'matched' → shows success The thread uses Python's imaplib (not Deno's raw TLS) which we verified works from both our environment AND the HF Space. Also updated /api/verify-payments to use run_in_executor (for on-demand checks from the frontend, in case the background thread hasn't run yet).29663cc -
fix: run Gmail IMAP check in thread pool (was blocking async event loop)
Z Userimaplib is synchronous — calling it directly in an async FastAPI handler blocks the entire event loop, causing the /api/verify-payments endpoint to time out. Fixed by wrapping the IMAP check in a synchronous function and running it via loop.run_in_executor(None, do_gmail_check).fd035cb -
feat: On-demand payment verifier on HF Space + 3-role bot welcome
Z User1. Payment verifier hosted on HF Space (/api/verify-payments): - Triggered when buyer clicks 'I've sent it' (not a cron job) - Also triggered on each status poll (every 5 seconds) - Uses Python imaplib (proven, fast) — connects to Gmail, fetches 10 most recent unread PalmPay emails, parses amounts, matches against awaiting_verification orders - Updates matched orders in Supabase DB directly - Marks matched emails as read (prevents reuse) 2. Payment flow: - Buyer clicks 'I've sent it' → confirm_sent (edge function) - Frontend immediately calls /api/verify-payments (Gmail IMAP check) - Frontend polls check_status every 5s, each poll also calls /api/verify-payments → instant match detection 3. Bot welcome: 3-role selection (from handwritten notes): When user sends /start or first message: 1️⃣ Registered Buyer — browse, cart, checkout, track orders 2️⃣ Registered Seller — add products, upload videos, manage store 3️⃣ Guest Buyer — browse…87fd9d2 -
feat: PalmPay payment option in checkout + delivery info flow
Z User1. Added PalmPay bank transfer option to checkout.html payment methods - Cyan gradient icon, 'Auto-verified via AI' label - When selected, redirects to payment.html after order placement - Skips card/wallet validation for PalmPay orders 2. Checkout flow: shipping info (name, email, phone, address, city, state, zip) → payment method selection → place order → payment.html (for PalmPay) → auto-verification via AI + Gmail IMAP → order confirmation 3. Payment page receives order details via URL params: ?orderId=X&total=Y&items=Z&count=N 4. PalmPay account details set in Supabase secrets: - Account name: Abdlrazaq Bidemi Awofolaji - Account number: 8088561764 - Bank: PalmPay 5. Gmail credentials set: - Email: fuhandinho@gmail.com - App password: wttdauhasjdpqrem3f0a091 -
fix: remove duplicate searchGmailForPayment function (syntax error)
Z User351fd2b -
feat: AI-powered payment verification (Qwen2.5-72B) + bank name collection
Z UserUPGRADES: 1. Added buyer_bank_name field to payment_orders table + create_order endpoint 2. Frontend now collects buyer's bank name (required field) 3. Gmail IMAP polling now fetches full email content (headers + body) 4. AI matching uses Qwen2.5-72B to verify ALL THREE fields: - Buyer name (fuzzy match — handles variations like 'John Doe' vs 'JOHN D.') - Bank name (exact or close match) - Amount (must match exactly, including decimal suffix) 5. AI returns structured JSON: {match, email_index, sender_name, amount} 6. Fallback: if AI fails, falls back to simple amount matching 7. After match: marks Gmail email as read (prevents reuse) FLOW (matches the original plan): 1. User enters: full name, email, bank name 2. System generates unique amount (base + decimal suffix) 3. User transfers to PalmPay → clicks 'I've sent it' 4. AI checks Gmail for PalmPay emails matching name + bank + amount 5. On match → order confirmed, redirect to order confirmation page 6. On timeout → WhatsApp…cb3d98c -
feat: Payment gateway — PalmPay manual transfer + Gmail IMAP verification
Z UserDATABASE: - payment_orders table: order_id, buyer info, expected_amount (with unique decimal suffix), status (pending → awaiting_verification → matched/expired), matched_email_id (prevents reuse) - payment_rate_limits table: 1 confirm per order, 3 per IP per 10 min EDGE FUNCTION (payment): - create_order: generates unique order_id + unique expected_amount (base + 0.01-0.99 suffix) - confirm_sent: validates + rate-limits, then triggers background Gmail IMAP polling that runs every 30s for up to 10 minutes, searching for PalmPay alert emails that match the exact amount - check_status: returns only status + message (no email/transaction details) GMAIL IMAP: - Connects to imap.gmail.com:993 via TLS - Searches INBOX for unread emails FROM 'palmpay' in last 24h - Parses amount from email body (₦5,000.23 format) - Matches against expected_amount (exact match including decimal suffix) - Marks matched email as read (SEEN flag) - Checks matched_email_id to prevent reusing the same emai…6b807b3 -
fix: navbar scripts not executing — innerHTML doesn't run <script> tags
Z UserROOT CAUSE: When HTML is injected via element.innerHTML = htmlString, the browser does NOT execute any <script> tags inside it. This is a security feature. The navbar was loaded via: fetch('shared/navbar.html').then(r => r.text()).then(h => { document.getElementById('nav-mount').innerHTML = h; }); The navbar HTML contains a <script> that calls EdgeFunctions.auth.checkSession() and EdgeFunctions.cart.count() to update the auth state and cart count. Since the script never executed, the navbar never knew if the user was logged in, and the cart count was always 0. FIX: Created js/load-navbar.js which: 1. Fetches shared/navbar.html 2. Sets innerHTML (which injects the HTML but doesn't run scripts) 3. Extracts all <script> tags from the injected HTML 4. Creates new <script> elements and replaces the old ones (this DOES execute them) Updated all pages that load the navbar to use <script src='js/load-navbar.js'> instead of the inline fetch+innerHTML pattern.2b4bf9b -
fix: revert seller cards to always show all + stories bar filters by followed sellers
Z User1. Seller cards: REVERTED to always show ALL sellers (both logged in and logged out) - The user said 'leave the sellers card let them appear' — always show all 2. Stories bar (seller status): NOW filters by login state - Logged out: shows ALL sellers' stories - Logged in: shows only stories from FOLLOWED sellers - If logged in but not following any sellers with stories: section is hidden 3. Deleted test screenshots and test-errors.log 4. Also updated stories ring color from amber to cyan (matches theme)8fad92c -
Production fixes: seller-profile redesign, cart count, auth recognition, seller filtering
Z User1. Redesigned seller-profile.html to match Depop-style layout (Image 2): - Circular avatar (80px) on the left - Seller name + meta (category, location, type) to the right - Stats row: Followers, Products, Rating (with star count) - Cyan Follow button + Message icon button - Brief bio/description below header - Three tabs: Shop (product grid), Reviews, About - Product grid: 2 cols mobile, 3 tablet, 4 desktop — clean white cards - Reviews tab: shows buyer reviews with avatars, ratings, product links - About tab: store name, category, location, member since, description - Clean white background, black text, gray subtext, cyan accents 2. Fixed cart count not updating when logged in: - Root cause: navbar script ran before EdgeFunctions was ready (fetch injects HTML async) - Fix: added initNavbar() with polling — waits for window.EdgeFunctions to exist - Also: cart count is now only fetched when logged in (not when logged out) - When logged out: car…130c944
-
fix: const→let for gridItems variable (Assignment to constant variable error)
Z Userd8d9780 -
Production fixes: Depop-style sellers, AI Mode, products loading, cart count, account page
Z User1. Redesigned 'Discover Sellers' section on home page to Depop style: - Each seller shown as a card with 2x2 product grid (4 product images) - Circular avatar + seller name + follower count - Black 'Shop' button (hover: cyan) - Products are fetched and filtered by seller_id 2. Added 'AI Mode' to category bar BEFORE Explore (as requested) - Cyan gradient pill with sparkle icon - Links to ai-chat.html 3. Fixed products not loading on home page: - Root cause: handleHome() used discount_percentage column (doesn't exist) and sellers!inner join (FK relationship issue) — both returned empty - Fixed: fetch all products once, categorize client-side - Flash deals: products with units_sold > 0 (fallback: first 5) - Farm products: filter by category containing 'farm'/'food' (fallback: next 5) - Trending: newest 10, New arrivals: newest 5 4. Deleted test screenshots that were appearing on screen 5. Fixed cart count in navbar: - Badge now hides when count…c743329 -
fix: remove old auth UI code that referenced non-existent header elements
Z UserThe old updateAuthUI() function in index.html tried to manipulate header elements (authButtons, userMenu, mobileAccountBtn) that no longer exist since we replaced the header with the new shared/navbar.html. Simplified to just set window.currentUser.df9d635 -
Production refactoring: move buying folder to root, separate seller login, new navbar
Z UserMAJOR CHANGES: 1. Moved all files from 'Eesha buying folder/' to root directory - login.html, signup.html, cart.html, wishlist.html, profile.html, orders.html, categories.html, product.html, checkout.html, order-confirmation.html, settings.html, auth.html - Fixed all path references (../js/ → js/, ../css/ → css/, etc.) - Updated all references from 'Eesha buying folder/' to '' in all files 2. Created separate seller login page at /seller/login.html - Dark theme to distinguish from buyer login - Redirects to seller dashboard after login - Links back to buyer login 3. New universal navbar (shared/navbar.html) - Clean: Home, Shops, Cart, Account only - Category bar below search: Explore, Flash Deals, Farm Fresh, Phones, Electronics, Fashion, Home, Beauty, Sports, Books, Videos, Live - Mobile bottom nav: Home, Shops, Cart, Account - User dropdown with links to profile, orders, wishlist, seller dashboard, link-account, telegram - Cyan +…44d212f -
fix: product page 404 — FK constraint + column name fix
Z UserRoot cause: products.seller_id had a FK pointing to auth.users instead of public.sellers. PostgREST couldn't infer the relationship, so the by_id query with sellers(...) join returned 'Product not found' for every product. Fixes: 1. Dropped the wrong FK (products → auth.users) 2. Added correct FK (products → sellers) 3. Fixed column name in edge function: sellers(name,...) → sellers(business_name,...) 4. Also fixed the category query which had the same sellers(name,...) issue 5. Pulled the products edge function source into the repo for trackingbf04856 -
fix: 3 page errors found during testing
Z User1. Categories page 400 error: when no category selected, was calling products.category('') which returned 400. Now falls back to products.all(50) when no category is selected. 2. QR page CORS error: qr.html was making direct browser fetches to eesha-search.onrender.com which blocks cross-origin requests. Added /api/openwa/* proxy route in web-server that injects the X-API-Key header server-side. Updated qr.html to use the proxy. 3. Product page 404: was testing with product id=20 which was cleaned up. Not a code bug — just stale test data. The page correctly shows 'Product not found' for non-existent IDs.057c18f -
design: white + cyan single-color theme with futuristic animations
Z User- Replaced all orange/amber/gold/red/green/purple gradients with single cyan (#00d4ff) - Updated Tailwind brand palette to cyan scale (50-900) - Updated all CSS gradients: grad-flame, grad-gold, grad-mint, grad-flash → cyan - Updated seller dashboard CSS from amber to cyan - Updated common.css primary color to cyan - Added futuristic animations: - glow-pulse: CTA buttons breathe with cyan glow - scanline: scanning line effect for live elements - neon-border: hover border glows cyan - holo-card: holographic shimmer sweep on hover - neon-text: cyan text with glow shadow - reveal-up: smooth scroll-triggered fade-in - lift: enhanced hover with cyan shadow - Star ratings, progress bars, flash badges, seller badges → all cyan - Search focus ring → cyan glow - Tab active underline → cyan with glow184676a -
fix(phase4): edge functions now broadcast via Render bot /internal/broadcast
Z UserEdge functions (seller-products, live, group-buy) now call the Render bot's /internal/broadcast endpoint instead of the Supabase telegram edge function. This uses the bot's TELEGRAM_BOT_TOKEN (which never leaves Render) to send actual Telegram messages to subscribers. Auth: X-Internal-Key header (BOT_INTERNAL_KEY env var on both sides).6910d77 -
fix(phase4): forward X-Bot-Api-Key and X-Internal-Call headers through proxy
Z UserThe web-server proxy was stripping the X-Bot-Api-Key header, so all bot_* ops on cross-platform were returning 401. Now we explicitly forward: - X-Bot-Api-Key (so the Render WhatsApp bot can authenticate) - X-Internal-Call (so edge functions can call each other for telegram broadcasts)4dda966 -
Phase 4 — Cross-platform integration
Z User4 new feature areas built on existing HTTP-only cookie auth + EdgeFunctions client. EDGE FUNCTIONS (2 new, 3 modified): - cross-platform (NEW): 12 ops Web-side (cookie auth): generate_link_code, my_phone_links, unlink_phone Bot-side (X-Bot-Api-Key auth): bot_link_account, bot_get_cart, bot_add_to_cart, bot_remove_from_cart, bot_clear_cart, bot_checkout, bot_join_group_buy, bot_get_product, bot_search, bot_get_active_group_buys, bot_get_live_sessions, bot_get_seller_products - telegram (NEW): broadcast (internal-only), webhook (Telegram updates), set_webhook, channel_info, subscribe, unsubscribe, recent - seller-products (MODIFIED): auto-broadcasts new products to Telegram channel + subs - live (MODIFIED): auto-broadcasts live session starts to Telegram - group-buy (MODIFIED): auto-broadcasts new group buys to Telegram DATABASE (3 new tables): - user_phone_links (phone ↔ user_id, link_code, confirmed_at) — WhatsApp linking - telegram_subscribers (chat_id,…f90569c -
fix(phase3): video upload via /api/video-upload proxy (presigned URL endpoint had bucket bug)
Z User- The Supabase Storage 'create-signed-upload-url' endpoint returns 'Bucket not found' for our product-videos bucket even though the bucket exists (likely a TUS/resumable upload issue). - Replaced presigned URL approach with a direct PUT to /api/video-upload/{seller_id}/{product_id}/{filename} which the web-server proxies to Supabase Storage using the service role key. - Added SUPABASE_SERVICE_ROLE_KEY env var to HF Space. - The browser never sees the service key — it goes through the auth-verifying proxy. - Fixed videos feed bug: PostgREST couldn't infer FK between product_videos and sellers (no FK declared in migration), so sellers are now fetched separately and merged. - Updated seller/videos.html to use the new upload endpoint with XHR progress bar. - Updated test_phase3_live.py to match.f7b3b45 -
Phase 3 — Content & Discovery
Z User4 new feature areas, all using existing HTTP-only cookie auth + EdgeFunctions client. EDGE FUNCTIONS (4 new, all deployed): - videos: feed (algorithmic with personalized scoring), by_product, by_seller, get (increments views), upload_url (presigned PUT to Supabase Storage), create, delete, like, unlike, mine - trending: list (computes views + shares*3 + purchases*5 over last N hours, falls back to row-level aggregation if RPCs are missing), log_view, log_share - stories: active_bar (grouped by seller with has_unseen flag), by_seller, get (increments views + marks seen), mark_seen, create (auto-posts to activity_feed), mine, delete — 24-hour expiry - discover: recommend (rule-based + optional AI enrichment via Qwen2.5-72B), log_view — uses purchases, cart, wishlist, follows, recent views as signals DATABASE (5 new tables + 1 trigger + 1 storage bucket): - product_videos (status, views_count, likes_count) + product_video_likes with trigger maintaining likes_count - produc…f1d4890 -
Phase 2 — Community Engagement
Z User4 new feature areas, all using existing HTTP-only cookie auth + EdgeFunctions client. EDGE FUNCTIONS (4 new, all deployed): - reviews: by_product, by_seller, create (verifies purchase), helpful, delete - group-buy: create, join, status, active, mine, cancel (Pinduoduo model) - wishlist-share: share (snapshot), get_shared, my_shares, revoke - live: list, get, messages, start, end, join, leave, message, mynext, whatsapp_buy DATABASE (7 new tables + triggers): - product_ratings (avg + count cache, trigger-maintained from buyers_reviews) - group_buys + group_buy_members (status auto-flips to 'completed' at target) - shared_wishlists (token-based, snapshot JSON, view_count) - shop_live_sessions + shop_live_messages + shop_live_viewers (renamed from live_sessions to avoid clash with academy table) FRONTEND (all using EdgeFunctions, zero Supabase SDK): - Product page: WhatsApp/Telegram/copy share buttons, 'Start group buy' button, active group buys list, full reviews section + write-re…b0f33c8 -
chore: ignore supabase CLI linked-project artifacts
Z Userf2a57e4 -
Phase 1 — Social ecommerce: seller dashboard migrated to Edge Functions + follow/feed/discover
Z UserEdge Functions (5 new, all deployed): - seller-dashboard: stats (products, orders, revenue, followers, posts) - seller-products: full CRUD for seller catalog - seller-orders: list orders containing seller's items, with details - seller-profile: get/update seller's own profile - social: public_profile, follow/unfollow, feed, seller_feed, discover Database (migration applied): - seller_follows (follower_id, seller_id) with trigger-maintained counters - activity_feed (seller_id, activity_type, entity_id, title, body, image) - seller_social_stats (followers_count, posts_count) denormalized - Trigger: new product INSERT auto-posts to activity_feed Frontend (all using EdgeFunctions, zero Supabase SDK, zero localStorage tokens): - /seller/{index,products,orders,profile,academy,settings}.html — clean Cellex-branded seller center - /seller-profile.html — public storefront with follow button, tabs (products/about/activity) - index.html: added 'Discover Sellers' carousel + 'From Sellers You Fol…d4abe71
-
fix: simplify color theme — clean, flat, futuristic (like Temu/Alibaba)
Based on analysis of Temu, AliExpress, and Alibaba: - All 3 competitors use FLAT solid colors (zero gradients on body/cards) - Temu: #FB7701 orange, white bg, black text - AliExpress: near-black + #FF373A red accent, light gray bg - Alibaba: #FF6600 orange with 2 subtle gradients max Changes: 1. Simplified brand palette: #f97316 (cleaner orange, matches industry standard) 2. Simplified ink palette: slate-based grays (#0f172a, #1e293b, #334155 etc.) 3. Removed dark: color group (merged into ink:) 4. Removed multi-color gradients (grad-sunset, grad-royal) 5. Kept only 2-stop subtle gradients (grad-flame: #f97316→#ea580c) 6. Changed body background from #f4f4f7 to pure white 7. Simplified box shadows (less glow, more subtle card shadows) 8. Simplified nav-active glow (solid tint instead of gradient) 9. Simplified search focus ring (2px instead of 3px) 10. Replaced 20+ hex values throughout for consistency Result: Cleaner, simpler, more professional — still futuristic with subtle gradien…c3e7329
-
fix: update QR page for OpenWA API (X-API-Key header, session name with hyphen)
9fcb93e -
feat: keep Render services alive with 4-minute ping from HF Space
The HF Space (cellex-web) runs 24/7 and never sleeps. It now pings both Render services every 4 minutes: - Gateway: https://eesha-search.onrender.com/ - Bot: https://eesha-shop-buying-and-selling.onrender.com/health This prevents Render free tier from sleeping either service, which means: - WhatsApp connection stays alive (no more 'close' state) - Bot stays responsive to webhooks - No more rescanning QR codes after sleep The ping runs as a background asyncio task alongside uvicorn.19df4e5
-
Add dynamic WhatsApp QR code page (auto-fetches fresh QR from Evolution API)
644acd8 -
Add WhatsApp QR code display page
12867c4
-
fix: remove splash screen
Removed the splash screen div, its CSS, and the JS logic that hides it. The page now loads directly without the loading animation.ef876b6 -
feat: complete UI/UX overhaul based on NEXA reference + AliExpress/Temu/Jumia
Major redesign combining the best elements from all reference designs: - Based on the NEXA index (9).html reference (1103 lines) - Adapted for Cellex branding (replaced NEXA → Cellex) - Made FULLY RESPONSIVE (mobile, tablet, desktop) — not just phone shell - Preserved ALL existing JS logic, IDs, and edge function calls New design features: - Sticky header with logo, search bar, auth, cart, notifications - Category tab nav (Explore, Flash Deals, Farm Fresh, Phones, etc.) - AI Mode badge (Alibaba inspired) linking to ai-chat.html - 3-slide hero carousel (Choice Day, Beauty Monday, Brand Day) with: - Auto-rotate every 4.5s - Snap scrolling - Dot indicators - Live countdown timer - Trust banner (Temu): Free Shipping, Free Returns, Secure Privacy - Quick features strip (AliExpress): Coins, Flash, Brand+, Clearance, Hot Sale, Vouchers, Track - Flash Sales section (Jumia): red gradient header, countdown timer, stock progress bars - 6-tile category grid (Jumia): Awoof, ₦5000 Store, Ki…9433fb8 -
feat: redesign index.html combining best elements from AliExpress, Temu, Jumia
New design features: - Orange gradient hero banner with countdown timer (AliExpress style) - Trust bar: Free Shipping, Secure Checkout, 7-Day Returns (Temu style) - Circular discount badges on flash deals (Jumia style) - Stock progress bars on flash deals ('Selling fast!' - Jumia style) - 8-tile category grid with colored icons (Jumia/Alibaba style) - Dark 'Why Choose Us' section with trust badges - Peach sign-in CTA banner (Alibaba style) - Sora display font for headings + Plus Jakarta Sans for body - Updated color palette: brand orange, urgency red, trust green, peach - All existing JS logic, IDs, and edge function calls preserved Borrowed patterns: - AliExpress: countdown hero, feature icon strip, bundle deal cards - Temu: green trust checkmark row, secure privacy badges - Jumia: circular discount badges, stock progress bars, 5-tile categories - Alibaba: peach sign-in CTA, rounded trust badges19594fb -
feat: HTTP-only cookie auth (production standard — same as AliExpress, Amazon, Gmail)
Switched to HTTP-only cookies for session management. This is the industry standard used by every major website. How it works: - Login: edge function creates session in Supabase web_sessions table → returns { session_id, user } → web-server sets session_id as HTTP-only cookie → strips session_id from response body - All requests: browser AUTOMATICALLY sends the HTTP-only cookie → web-server reads it → forwards as Authorization: Bearer <session_id> - Edge function looks up session_id in web_sessions → gets JWT tokens → verifies → identifies user - Logout: web-server clears cookie + edge function deletes session Security: - HTTP-only: JavaScript CANNOT read the cookie (document.cookie returns nothing) - Secure: only sent over HTTPS - SameSite=Lax: CSRF protection - Max-Age=7 days: persists across tabs, browser restarts, and 7 days - The cookie only contains a random UUID (session_id), NOT a JWT token - The actual JWT tokens live in Supabase web_sessions table - NO localStorage.…f892a0d -
fix: use sessionStorage for session_id so login persists across page navigation
Problem: session_id was in JS memory only, so navigating to another page lost the session and the user appeared logged out. Fix: Store session_id in sessionStorage. This: - Survives page refreshes and navigations within the same tab - Is automatically cleared when the tab closes (more secure than localStorage) - Only stores a random UUID (not a JWT token, not a Supabase key) - The UUID is useless without the Supabase web_sessions table NO localStorage. NO cookies. NO tokens in JavaScript. The actual JWT tokens remain in the Supabase web_sessions table.2ed5a2e -
fix: add missing proxy routes (orders, profile, wishlist, checkout)
91a4275 -
fix: proxy now reads X-Session-Id header (was reading Authorization)
dbe4f6f -
fix: remove old cookie-based auth proxy (was causing 500 errors)
The old proxy_auth function was still referencing COOKIE_ACCESS_NAME which no longer exists. Replaced with simple proxy that uses _proxy_to_edge_function (reads X-Session-Id header, forwards as Bearer token).1258e79 -
feat: session-based auth stored in Supabase (NO cookies, NO localStorage)
Completely redesigned auth: - Auth tokens (JWT access_token + refresh_token) are stored IN SUPABASE in a new web_sessions table - Frontend receives ONLY a session_id (random UUID) — stored in JS memory - No cookies, no localStorage, no sessionStorage - Even if session_id is stolen via XSS, attacker can't get the JWT tokens (they're in the Supabase database, protected by service role key) Flow: 1. Login → edge function authenticates via Supabase Auth → stores tokens in web_sessions table → returns { session_id, user } 2. Frontend stores session_id in a JS variable (memory only) 3. Each request: frontend sends X-Session-Id header 4. Web-server reads X-Session-Id → forwards as Authorization: Bearer <session_id> 5. Edge function looks up session_id in web_sessions → gets access_token → verifies with Supabase Auth → identifies user 6. Logout → deletes session from web_sessions Files changed: - supabase/functions/auth/index.ts: creates/deletes/checks sessions in web_sessions - su…a02b951 -
fix: auth proxy now sets HTTP-only cookies correctly
Rewrote proxy_auth to make a DIRECT HTTP call to the auth edge function instead of going through _proxy_to_edge_function. This allows us to: 1. Intercept the response before it's sent to the client 2. Extract access_token + refresh_token from the edge function response 3. Set them as HTTP-only cookies (JavaScript cannot read them) 4. Strip the tokens from the JSON body before sending to the frontend 5. The frontend only receives {success, user} — no tokens in JS Also fixed: cookies are now set BEFORE stripping tokens from the data (the previous version had a bug where tokens were popped before being used for cookies).66fbcc2 -
feat: refactor all 10 pages to use edge functions (no Supabase, no localStorage)
All pages now use: - Cookie-based auth (HTTP-only cookies, no tokens in JS) - Edge functions for all DB operations - In-memory user state (no localStorage) Pages refactored: - cart.html: uses window.Cart.* for all cart operations - checkout.html: uses EdgeFunctions.checkout.prepare() + placeOrder() - profile.html: uses EdgeFunctions.profile.get() + update() - orders.html: uses EdgeFunctions.orders.list() - categories.html: uses EdgeFunctions.products.category() + search() - product.html: uses EdgeFunctions.products.byId() - wishlist.html: uses EdgeFunctions.wishlist.* - settings.html: uses EdgeFunctions.auth.logout() - order-confirmation.html: uses EdgeFunctions.orders.details() - search-result.html: uses EdgeFunctions.products.search() Also: - Removed localStorage from ai-buyer-assistant.js (session ID now in memory) - Deleted unused products-loader.js (still had Supabase calls) - Deleted junk files (gfcx.html, test.html)8559869