Extract the raw_url() template from install.sh and compare the parsed
hostname to raw.githubusercontent.com. Resolves the CodeQL "incomplete
URL substring sanitization" alert on the old substring assertion.
Stamp official Docker builds with a low-cardinality provenance marker and report build_provenance/image_modified in anonymous telemetry. Local and fork builds default to custom, while official GitHub/GitLab release paths mark images as official.
Emoji logos were removed long ago; the only remaining trace was a
purge of stale data/webapp-emoji cache files on theme save. Remove
the purge, the WEBAPP_EMOJI_CACHE_DIR constant and the emoji part of
the prune test.
Add GET /api/admin/health powered by a config health service that
detects common deployment mistakes: missing or read-only data volume,
broken tariffs/locale-override/guides JSON files, payment providers
enabled without credentials, webhook providers without
WEBHOOK_BASE_URL, no enabled payment methods, missing or non-https
mini app URL, missing Redis, partially configured SMTP, untrusted
reverse proxy, invalid bot token, missing/mismatched/failing Telegram
webhook and unreachable Remnawave panel. Network checks (Telegram,
panel) are cached for two minutes; ?refresh=1 forces a re-check.
The admin UI shows the alerts as a banner on the dashboard with
per-section navigation chips and a manual re-check button, and as a
filtered banner inside each affected section. Alerts are localized
via admin_health_* keys with built-in Russian fallbacks.
PAYMENT_REQUEST_TIMEOUT_SECONDS was read once in each provider's
__init__ and baked into the aiohttp session, so admin overrides
(applied in-process) only took effect after a container restart.
Providers now hand HttpClientMixin a timeout source callable; the
mixin builds the session with the current value and swaps in a fresh
session when the value changes, closing the replaced one only after
any in-flight request on it is bound by its own total timeout.
Also:
- check the Heleket payment-info success flag before reading the
payload so a non-dict provider response cannot raise in the
pending-payment reuse path
- add PAYMENT_REQUEST_TIMEOUT_SECONDS to the FreeKassa settings stub
in test_security.py (fixes three tests broken by the new field)
The lazy-loaded admin CSS/JS resolved to bare runtime names served
no-store, the same scheme that left the main bundle vulnerable to stale
CSS in iOS WebViews after a deploy. The original reason for keeping them
bare (hashed admin files could 404 when nginx fronts aiohttp) no longer
holds: the backend image now carries the same deterministically hashed
assets nginx serves, and the App.svelte loader already falls back to the
bare name if a hashed asset ever 404s.
Resolve the admin assets through the same hashed/version-stable path as
the main bundle so they are emitted as immutable, cache-busting URLs.
Also drop the inert <meta http-equiv="Cache-Control/Pragma/Expires">
tags from the shell: browsers ignore http-equiv caching directives for
the document and use the real HTTP headers, which are already set.
The backend renders the Mini App shell and rewrites the stylesheet and
script tags to content-hashed names (subscription_webapp.<hash>.css).
Those hashed files are gitignored build artifacts, so a clean checkout
has none of them and the backend image was built without any webapp
assets. The resolver therefore stat()-ed a missing file and fell back to
the bare /subscription_webapp.css URL.
That bare URL never changes between deploys and is served no-store. Most
clients re-fetch it, but iOS WebViews (WKWebView) ignore no-store for
subresources and keep serving a stale cached copy, so after every deploy
the CSS no longer matched the markup and the Mini App looked broken on
iOS only. The earlier no-store / ?v= / Clear-Site-Data attempts could not
help because none of them gave iOS a new URL to fetch.
Copy the freshly built assets from the frontend-builder stage into the
backend image (frontend-builder is reordered ahead of the backend stage
so the copy resolves). The build is deterministic, so the hash matches
the one the nginx image serves; the shell now emits immutable, hashed
URLs that change on every asset change and force iOS to fetch fresh CSS.
The once-per-version Clear-Site-Data: "cache" header on the index
navigation raced the page's own CSS/JS subresource loads in the
Telegram WebView, intermittently evicting or aborting the main
stylesheet so the mini app rendered half-styled on mobile.
It also could not fix stale HTML: it only fires when the document
actually reaches the backend, never when the WebView serves a cached
page. The no-store HTML plus immutable content-hashed asset filenames
already guarantee freshness without clearing the cache, so remove the
reset header, its helpers, constants, and tests.
Keep privacy policy and user agreement links as the supported legal documents.
Refresh the admin settings manifest, demo dataset, locales, docs, and bot menu tests.
Keep one-off device top-ups scoped to the active subscription term and move device renewal into subscription checkout.
Carry HWID renewal metadata through provider callbacks and webhooks, including YooKassa saved-card flows.
Add admin extension controls, docs, demo data, and regression coverage.
Drop the emoji-logo feature (and its font picker) from the Web App. Only
an uploaded/linked image logo and favicon remain; when no logo is set,
the default project logo is shown. Existing emoji-logo overrides are
ignored — the keys are gone from the manifest, so the override service
skips them and the app falls back to the default logo.
- Remove WEBAPP_LOGO_USE_EMOJI / WEBAPP_LOGO_EMOJI / WEBAPP_LOGO_EMOJI_FONT
settings, validators, manifest entries and override/runtime plumbing.
- Strip the animated-emoji fetch/cache subsystem, the /webapp-emoji route
and emoji branches from logo/favicon resolution; leftover emoji cache
files are now purged on appearance save.
- Simplify BrandMark to an image-only component and drop the emoji UI
from the admin Appearance section.
- Regenerate the demo settings manifest and clean docs, locales, nginx
and demo data of emoji-logo references.
The order of enabled_periods (period tariffs) and traffic_packages
(traffic tariffs) is now the storefront order everywhere — both the
Telegram keyboard and the web app. Only new tariffs-config tariffs are
affected; legacy subscription/traffic options are untouched.
- Stop sorting periods and traffic packages in the web app plans
serializer so it follows the configured order, matching the bot
keyboards that already iterate the lists as-is.
- Preserve the row order through the admin draft (load and save) instead
of sorting by months.
- Add a reusable Sortable component to the UI library (native HTML5
drag & drop with a grip handle; bits-ui/shadcn have no such primitive)
and use it to reorder period rows and traffic package rows in the
tariff editor.
Localized promo errors carry Telegram-style <code> markup, which the
web app rendered as literal text. Strip tags and unescape entities
before returning the message in the JSON error.
certifi==2026.5.20 conflicts with aiocryptopay 0.4.8, which hard-caps
certifi<2024.0.0, so pip could not resolve and the Docker image build
failed. Revert to the transitive certifi; PYSEC-2024-230 stays unfixable
until aiocryptopay relaxes its cap. Keeps the PyJWT 2.13.0 bump.
pip-audit flagged 6 advisories: PyJWT 2.12.1 (PYSEC-2026-175/177/178/179,
fixed in 2.13.0) and transitive certifi 2023.11.17 (PYSEC-2024-230, fixed
in 2024.7.4). Bump PyJWT and pin certifi to its latest release to enforce
the resolved version.
Trial and registration/referral-bonus subscriptions usually last only a
few days, so the multi-day ending-soon reminders fired almost the moment
they were granted and needlessly alarmed newcomers.
Track this with a new subscription flag (suppress_early_expiry_notifications,
migration 0035): trial activation, referral welcome bonus and inviter bonus
grants set it, while a real paid purchase clears it on upsert. While set, the
notification worker skips the day-before stages but still sends the
hours-before reminder and the expiry/after-expiry notices, so users are
warned shortly before access ends. Once they pay for a full subscription the
complete reminder spectrum resumes.
The migrations/remnashop guide existed in docs/ but was missing from the
docs-site navigation. Add its sidebar entry after remnawave-tg-shop and a
curated sync description so it renders with the rest of the migrations.
Add a PR job that installs the backend deps and runs the
settings-manifest drift guard, so a change to admin_settings_manifest.py
without regenerating settingsManifest.generated.json fails CI instead of
silently leaving the docs demo Settings screen stale.
The demo Settings screen was fed by a frozen snapshot baked into the
externally generated demoDataset.js, so it drifted from the real
manifest: the Remnawave Panel (plus System and Migrations) sections
were missing and trial/checkout/common still showed as top-level
sections instead of subsections.
Generate frontend/src/lib/webapp/settingsManifest.generated.json from
manifest_payload() (the same source the live /admin/settings endpoint
uses) via scripts/export_settings_manifest.py, and build the demo
section structure from it, overlaying realistic demo values per field
key. A pytest drift guard fails if the Python manifest changes without
regenerating the snapshot, so the demo stays in sync going forward.
Bring the ASCII, Windows 95 and light themes up to date with the
webapp changes since the last theme refresh:
- Flatten/bevel the new Telegram notifications banner icon badge.
- Square off the premium-server and referral-tariff dropdown help
pills and bevel the standalone referral surfaces (win95).
- Fix the selected-language check vanishing on the highlighted row
(black on ASCII, inverted bitmap on win95).
- Square the login-screen language trigger and render flag emoji
monochrome in the ASCII console palette.
- Add a soft drop shadow to the banner on the light theme.
Bump assets_version for all three CSS themes and update the theme
config tests accordingly.
3252a8
