Merge pull request #206 from develop

chore: sync develop → main

Author: ayoub3bidi

.github/workflows/deploy-cloudflare.yml

@@ -16,6 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     if: >-
       github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.head_repository.full_name == github.repository &&
       (github.event.workflow_run.head_branch == 'main' ||
        github.event.workflow_run.head_branch == 'develop')
     permissions:

.github/workflows/deploy-supabase-functions.yml

@@ -51,3 +51,4 @@ jobs:
           supabase functions deploy platform-access
           supabase functions deploy delete-account
           supabase functions deploy waitlist-welcome --no-verify-jwt
+          supabase functions deploy sync-contacts

.github/workflows/ensure-pr-source-develop.yml

@@ -22,16 +22,15 @@ jobs:
 
       - name: Read inputs
         id: check
+        env:
+          ALLOWED: ${{ secrets.ALLOWED_MERGERS }}
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+          TARGET_BRANCH: ${{ github.event.pull_request.base.ref }}
         run: |
           # Allowed mergers come from a repo secret, comma-separated.
           # Set this secret in your repo settings: Settings -> Secrets -> Actions -> New repository secret
           # Example value: ayoub,my-org-release-bot
-          ALLOWED="${{ secrets.ALLOWED_MERGERS }}"
-
-          # PR metadata from github context
-          HEAD_REF="${{ github.event.pull_request.head.ref }}"
-          PR_AUTHOR="${{ github.event.pull_request.user.login }}"
-          TARGET_BRANCH="${{ github.event.pull_request.base.ref }}"
 
           echo "HEAD_REF=$HEAD_REF"
           echo "PR_AUTHOR=$PR_AUTHOR"
@@ -68,10 +67,11 @@ jobs:
 
       - name: Fail if not allowed
         if: steps.check.outputs.allowed != 'true'
+        env:
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
         run: |
-          head_ref="${{ github.event.pull_request.head.ref }}"
-          author="${{ github.event.pull_request.user.login }}"
-          echo "ERROR: PR targeting 'main' is not allowed. Head branch is '$head_ref' and PR author is '$author'."
+          echo "ERROR: PR targeting 'main' is not allowed. Head branch is '$HEAD_REF' and PR author is '$PR_AUTHOR'."
           echo "Only PRs whose head branch is 'develop' or PRs authored by an allowed merger (repo secret ALLOWED_MERGERS) may target 'main'."
           exit 1
 

.github/workflows/keep-supabase-alive.yml

@@ -5,12 +5,18 @@ on:
     - cron: "0 0 */3 * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   ping:
     runs-on: ubuntu-latest
     steps:
       - name: Ping Supabase REST API
+        env:
+          SUPABASE_URL: ${{ secrets.VITE_SUPABASE_URL }}
+          SUPABASE_ANON_KEY: ${{ secrets.VITE_SUPABASE_ANON_KEY }}
         run: |
-          curl -sf "${{ secrets.VITE_SUPABASE_URL }}/rest/v1/keepalive?select=id&limit=1" \
-            -H "apikey: ${{ secrets.VITE_SUPABASE_ANON_KEY }}" \
-            -H "Authorization: Bearer ${{ secrets.VITE_SUPABASE_ANON_KEY }}"
+          curl -sf "${SUPABASE_URL}/rest/v1/keepalive?select=id&limit=1" \
+            -H "apikey: ${SUPABASE_ANON_KEY}" \
+            -H "Authorization: Bearer ${SUPABASE_ANON_KEY}"

AGENTS.md

@@ -103,7 +103,10 @@ See reference doc for full checklists (JS, Python, pseudocode, sound, insight, t
 - **OAuth UX** — Google Identity Services (PKCE popup on `/auth/google/callback`); web uses `signInWithIdToken`, not `signInWithOAuth`; `googleIdentity.js` manages GIS script loading, nonce creation, and popup flow
 - **Service layer** — `src/services/authService.js`, `profileService.js`, `entitlementService.js`, `accessService.js`, `googleTokenExchange.js`; components use `AuthContext` / `useAuth`, never import Supabase directly
 - **Platform access** — signed-in users pass through `checkPlatformAccess()` → Supabase Edge Function `platform-access` (account ban gate); **fail-open** on transport/invoke errors, **fail-closed** only when `allowed: false` + `reason: account_banned`; signup path uses `before-signup` / `post-signup` hooks (ban logic fail-closed)
-- **Postgres-portable schema** — `profiles` keyed to `auth.users`; RLS on public tables; client-writable columns: `display_name`, `avatar_preference` only; `avatar_url` is OAuth/trigger-populated (not client-writable); `plan` and future `referral_*` / `pro_*` columns are service role / webhook only
+- **Postgres-portable schema** — `profiles` keyed to `auth.users`; RLS on public tables; client-writable columns: `display_name`, `avatar_preference` only; `avatar_url` is OAuth/trigger-populated (not client-writable); `plan` is service role only. Through 0.5.0: **no** LemonSqueezy, subscriptions, referrals, or `user_sessions` tables in tree
+- **Pro through 0.5.0** — waitlist demand only (`/pro` + `waitlist`); no checkout or Pro entitlements beyond waitlist capture
+- **Analytics (PostHog)** — `src/services/analytics.js` + `analyticsEvents.js`; SPA pageviews via `capture_pageview: 'history_change'`; `disable_surveys: true`; session replay sampled (`sampleRate: 0.2`). Growth events: `waitlist_joined`, `upgrade_limit_hit` (plus existing `sign_in_completed`). Anonymous viz limit stays hardcoded at `12` (no feature-flag A/B)
+- **Email (Resend)** — `waitlist-welcome` (one styled transactional email per waitlist join); `sync-contacts` on `SIGNED_IN` upserts the contact **and** sends a one-time Free-account welcome (`profiles.welcome_email_sent_at`). No broadcasts, digests, referral, or Pro-nudge sends in 0.5.0. Stay under Resend free daily cap (100/day)
 - **Profile settings** — private route `/settings/profile` (`RequireAuth`); `updateProfile()` in `profileService.js`; security boundary = RLS row scope + `REVOKE UPDATE` + `GRANT UPDATE (display_name, avatar_preference)`; tabbed UI with profile/notifications/connections tabs; DiceBear notionists avatar fallback
 - **Session** — `getSession()`, `onAuthStateChange()`; `AuthProvider` in `src/main.jsx`; request-dedup via `requestRef`
 - **Tiered access model** — Anonymous (no account) gets limited access to drive sign-in conversion; Free account (Google sign-in) unlocks the full platform

docs/AGENTS_REFERENCE.md

@@ -99,7 +99,11 @@
   - `supabase/functions/post-signup/` — post-signup side effects
   - `supabase/functions/platform-access/` — signed-in ban check (`accessService.checkPlatformAccess()`; fail-open on transport)
   - `supabase/functions/waitlist-welcome/` — Pro waitlist confirmation email via Resend (fail-open; invoked after client insert)
+  - `supabase/functions/sync-contacts/` — JWT-authenticated Resend contact upsert + one-time Free welcome email on sign-in (fail-open; identity from JWT only; atomic claim on `profiles.welcome_email_sent_at`; Resend segment via `RESEND_SEGMENT_ID` or legacy `RESEND_AUDIENCE_ID`)
   - `supabase/functions/delete-account/` — self-service account deletion
+- Shared email HTML: `supabase/functions/_shared/transactionalEmails.ts`
+- **Not in 0.5.0:** LemonSqueezy webhook, subscriptions / usage_events / referrals / user_sessions tables (dropped via `20260720180000_drop_premature_saas_scaffolding.sql`); no viz-limit email, weekly digest, Pro nudge, or referral invite sends (Pro nudge + referral templates may exist in Resend as parked drafts for later)
+- Analytics: `src/services/analytics.js`, `src/services/analyticsEvents.js` — PostHog SPA pageviews + growth events `waitlist_joined`, `upgrade_limit_hit`; surveys disabled in SDK
 - Context: `src/contexts/AuthProvider.jsx`, `src/hooks/useAuth.js`
 - Avatar resolution: `src/utils/resolveUserAvatar.js` (`resolveUserAvatar`, `resolveDisplayName`, DiceBear notionists style)
 - Components: `src/components/UserMenu.jsx`, `src/components/UserAvatar.jsx`, `src/components/RequireAuth.jsx`
@@ -117,8 +121,9 @@
 | `display_name` | yes | Editable on profile settings page |
 | `avatar_url` | no | OAuth / trigger-populated HTTPS URL |
 | `avatar_preference` | yes | `google` (default) \| `generated` |
+| `welcome_email_sent_at` | no | Set atomically by `sync-contacts` when claiming the one-time welcome send |
 
-Future (v0.6.0, not shipped): `username` (unique, set-once RLS), public `/u/:username` route; referral/billing columns (`referral_code`, `referred_by`, `referral_count`, `pro_months_earned`, `pro_expires_at`) — service role only.
+Future (post-0.5.0, not shipped): `username` (unique, set-once RLS), public `/u/:username` route; any referral/billing columns — new migrations then, not restore of dropped scaffolding. Through 0.5.0 Pro remains waitlist-only.
 
 ### Personal learning tables
 

index.html

@@ -211,6 +211,13 @@
         }
       })();
     </script>
+
+    <!-- Cloudflare Turnstile — invisible CAPTCHA for bot signup prevention -->
+    <script
+      src="https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit"
+      async
+      defer
+    ></script>
   </head>
   <body>
     <div id="root"></div>

src/contexts/AuthProvider.jsx

@@ -186,14 +186,24 @@ export function AuthProvider({ children }) {
         if (event === 'SIGNED_IN' && nextSession?.user != null) {
           resetAllSessionCounters();
           resetUser();
+
+          const fallbackDisplayName =
+            nextSession.user.user_metadata?.full_name ||
+            nextSession.user.user_metadata?.name;
+
           identifyUser(nextSession.user, {
             email: nextSession.user.email,
-            displayName:
-              nextSession.user.user_metadata?.full_name ||
-              nextSession.user.user_metadata?.name,
+            displayName: fallbackDisplayName,
             plan: null,
           });
           trackSignInCompleted();
+          setTimeout(() => {
+            authService
+              .syncContactToResend({
+                displayName: fallbackDisplayName,
+              })
+              .catch(() => {});
+          }, 0);
         }
 
         if (event === 'SIGNED_OUT') {

src/contexts/AuthProvider.test.jsx

@@ -7,6 +7,7 @@ import {
   resetSupabaseMocks,
   supabaseAuthMock,
   supabaseFromMock,
+  supabaseFunctionsInvokeMock,
   authStateChangeCallbackRef,
 } from '../test/supabaseMock.js';
 
@@ -339,6 +340,17 @@ describe('AuthProvider', () => {
     });
     expect(screen.getByTestId('display-name')).toHaveTextContent('New User');
     expect(resetAllSessionCounters).toHaveBeenCalledTimes(1);
+    await waitFor(() => {
+      expect(supabaseFunctionsInvokeMock).toHaveBeenCalledWith(
+        'sync-contacts',
+        expect.objectContaining({
+          method: 'POST',
+          body: expect.objectContaining({
+            displayName: 'New User',
+          }),
+        })
+      );
+    });
   });
 
   it('does not reset session counters on INITIAL_SESSION hydrate', async () => {

src/i18n/locales/ar/translation.json

@@ -52,9 +52,7 @@
     "dangerZoneTitle": "منطقة الخطر",
     "dangerZoneDescription": "يحذف حسابك نهائياً مع جميع المفضلات وملاحظات الدراسة. لا يمكن التراجع عن هذا الإجراء.",
     "deleteAccount": "حذف الحساب",
-    "deleteAccountConfirmLabel": "اكتب DELETE للتأكيد",
-    "deleteAccountConfirmPlaceholder": "DELETE",
-    "deleteAccountConfirmWord": "DELETE",
+    "deleteAccountConfirmLabel": "اكتب بريدك الإلكتروني للتأكيد",
     "deleteAccountInProgress": "جارٍ حذف الحساب…",
     "deleteAccountSuccess": "تم حذف حسابك.",
     "deleteAccountError": "تعذّر حذف حسابك. حاول مرة أخرى أو راسل contact@bayanflow.com."