Merge pull request #12 from thribhuvan003/codex/trayy-production-hardening

fix: harden production ordering and portal flows

Author: thribhuvan003

.env.example

@@ -11,8 +11,9 @@ NEXT_PUBLIC_RAZORPAY_LIVE=
 
 # Resend — transactional email (invites, admin recap). Optional; no-ops if blank.
 RESEND_API_KEY=
+RESEND_FROM_EMAIL="Tray <orders@your-verified-domain.example>"
 
-# Upstash Redis — rate-limit. Optional; in-memory fallback if blank.
+# Upstash Redis — required in production; local development has an in-memory fallback.
 UPSTASH_REDIS_REST_URL=
 UPSTASH_REDIS_REST_TOKEN=
 

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: false
 contact_links:
   - name: Security vulnerability
-    url: https://github.com/thribhuvan003/tray/security/advisories/new
+    url: https://github.com/thribhuvan003/trayy/security/advisories/new
     about: Please report security issues privately via GitHub Security Advisories.

.github/workflows/ci.yml

@@ -28,6 +28,10 @@ jobs:
           NEXT_PUBLIC_SUPABASE_ANON_KEY: ${{ secrets.NEXT_PUBLIC_SUPABASE_ANON_KEY || 'sb_publishable_e0_d-CRp71kmQbDbQmO1BQ_dGxGgNKz' }}
           SUPABASE_SERVICE_ROLE_KEY: ${{ secrets.SUPABASE_SERVICE_ROLE_KEY }}
           RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}
+          # Build-time placeholders only. Production must provide real Upstash
+          # credentials in its deployment environment.
+          UPSTASH_REDIS_REST_URL: https://ci-placeholder.invalid
+          UPSTASH_REDIS_REST_TOKEN: ci-build-placeholder
           QSTASH_TOKEN: ${{ secrets.QSTASH_TOKEN }}
           QSTASH_CURRENT_SIGNING_KEY: ${{ secrets.QSTASH_CURRENT_SIGNING_KEY }}
           QSTASH_NEXT_SIGNING_KEY: ${{ secrets.QSTASH_NEXT_SIGNING_KEY }}

.mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "supabase": {
+      "type": "http",
+      "url": "https://mcp.supabase.com/mcp?project_ref=mepowrsrbjddaqfvzvtc&features=docs%2Caccount%2Cdatabase%2Cdebugging%2Cdevelopment%2Cfunctions%2Cbranching"
+    }
+  }
+}

README.md

@@ -6,7 +6,7 @@ Tray handles real money (UPI payments) and PII (student emails, order history).
 
 **Please do not open a public GitHub issue for security problems.**
 
-Report privately via [GitHub Security Advisories](https://github.com/thribhuvan003/tray/security/advisories/new). Include:
+Report privately via [GitHub Security Advisories](https://github.com/thribhuvan003/trayy/security/advisories/new). Include:
 
 - A description of the issue and its impact
 - Steps to reproduce (or a proof of concept)
@@ -19,7 +19,7 @@ You should receive an acknowledgement within **72 hours**. We aim to triage and
 
 In scope:
 
-- The deployed Tray application (`*.tray.app` and preview URLs)
+- The deployed Tray application (`trayy.vercel.app` and its Vercel preview URLs)
 - This repository's source code, CI configuration, and infrastructure as code
 - Supabase RLS policies and database functions in `supabase/migrations/`
 - Razorpay webhook handling and order capture flow

SECURITY.md

@@ -1,7 +1,13 @@
 # 0004 — Per-tenant payment_mode; direct-UPI as the default rail
 
 ## Status
-Accepted
+Accepted; implementation updated through migration `0031`
+
+This record preserves the production failure and decision that introduced
+per-tenant payment modes. The current Razorpay path now loads Razorpay Checkout
+and verifies capture on the server. The direct-UPI path is confirmed atomically
+by staff through `safe_confirm_direct_upi_and_start`. Migration `0031` is the
+current deployment prerequisite for these payment and inventory guarantees.
 
 ## Context
 Production symptom: a student paid (money debited) but the order never reached the
@@ -56,7 +62,6 @@ The canteen repays manually from their UPI app.
   payment at the counter (the UNVERIFIED badge already exists in the kitchen
   board). A dishonest student could tap-without-paying; the counter check is the
   guard, exactly like every small UPI shop in India.
-- Direct UPI refunds are manual (admin "refunds owed" payout — UI to follow).
-- **Deploy ordering:** migration `0024` MUST be applied to the database BEFORE the
-  new code is deployed. The combined `select(is_open, paused_until, payment_mode)`
-  errors out if the column is missing, which silently skips the open/paused guard.
+- Direct UPI refunds are manual and are tracked as refunds owed to the customer.
+- **Deploy ordering:** migrations must be applied in filename order before the
+  matching application code. The current implementation requires migration `0031`.