Production: premium website + admin panel + backend + slim mobile#4
Open
KSultonboy wants to merge 81 commits into
Open
Production: premium website + admin panel + backend + slim mobile#4KSultonboy wants to merge 81 commits into
KSultonboy wants to merge 81 commits into
Conversation
- Rewrite palette.ts: Deep Navy base, Sky Blue primary, Aqua Mint AI accent - Add AI/gradient tokens (aiAccent, gradientPrimary, gradientHero, blurTint, sand) - Default theme preference to dark (dark-first brand) - Switch heading font Plus Jakarta -> Space Grotesk (Inter body unchanged) - Add RADIUS.button/card, CONTROL_HEIGHT, and effects.ts glow helpers - Install expo-linear-gradient, expo-blur, space-grotesk; drop plus-jakarta Co-Authored-By: Claude Opus 4.8 <[email protected]>
- Button: gradient primary + new 'ai' variant with aqua glow + spark icon, 56px CTA height - Add GlassCard (expo-blur frosted panel) for use over photos/maps - Card: 20px radius, hairline border, shared cardShadow - Badge: new 'ai' variant with sparkle + aqua glow - Add AiSpark (animated SVG sparkle, reduce-motion aware) - Add AiThinking (rotating AI loading phrases) replacing LoadingDots - AnimatedBrand: aqua glow + aqua 'AI' accent - Remove dead decorative components (FabricWave, FallingPetals, LoadingDots) Co-Authored-By: Claude Opus 4.8 <[email protected]>
- Splash (index): hero gradient + animated brand + tagline - Onboarding: gradient bg, aqua glow icon, aqua dots, gradient CTA - Tab bar: frosted glass (BlurView) + aqua active glow pill - Home: AI planner gradient CTA card with spark + glow; aqua accents - Planner: gradient generate button, aqua progress bar, AiSpark loading - Planner result: gradient save button, brand-colored confetti - Trip map loading: hero gradient + AiSpark - Budget chart: brand aqua/sky/sand segment palette Co-Authored-By: Claude Opus 4.8 <[email protected]>
- StitchButton: gradient primary variant (powers auth/list screens) - StitchMobile: aqua section actions, theme-aware dark button - Replace legacy near-black (#050814) surfaces with primaryDark (visible on navy) - Trip setup featured option row -> sky-blue branded CTA with dark text - Map markers + achievement accents -> brand aqua/sky/sand palette - Notification accent -> sky blue; remove dead legacy colors.ts Co-Authored-By: Claude Opus 4.8 <[email protected]>
- Add AuroraBackground (Skia animated mesh/aurora, reduce-motion aware) - Add Globe3D (SVG + Reanimated pseudo-3D rotating globe, UI-thread) - Add LottieAnim wrapper + hand-authored ai-loading & success Lottie JSON - Splash: aurora background + rotating 3D globe + forced-light brand text - Trip map loading: aurora + Lottie ai-loading - Planner loading overlay: Lottie ai-loading - Planner result: Lottie success overlay on trip save - Install @shopify/react-native-skia + lottie-react-native (SDK 54) Co-Authored-By: Claude Opus 4.8 <[email protected]>
Policy-based runtimeVersion is unsupported when a native android/ dir exists. Co-Authored-By: Claude Opus 4.8 <[email protected]>
Backend:
- Add TourAgency.telegram field (+ migration); make TourBooking.customerEmail optional
- Expose agency contact (phone/telegram/website) in tour/agency/booking payloads
- Booking accepts a free lead with phone OR email (no payment required)
Mobile (Tour Details):
- "Agentlik bilan bog'lanish" card: Telegram / WhatsApp / Call / Website buttons
- Prefill name/email from logged-in user; email now optional
- Reworded as free request ("So'rov qoldiring / yuborish")
Co-Authored-By: Claude Opus 4.8 <[email protected]>
- publicAgency exposes telegram; updateAgencyProfile allows editing telegram - Admin approval copies application.telegram -> TourAgency.telegram - Email the agency owner on every new free booking lead (sendBookingLeadEmail) Co-Authored-By: Claude Opus 4.8 <[email protected]>
…odel Combine codex/travelorai-platform-updates (team web/agency/auth/booking-deadline work) with the navy/aqua mobile redesign + free user↔agency lead model. - backend: keep team's expanded controllers/auth/migrations; port telegram field (TourAgency + public/admin/agency outputs), free-lead flow (optional customerEmail, phone-or-email), and agency new-lead email notification onto team's booking flow (responseDeadlineAt preserved) - website: take team's version wholesale (AccountPortal, AgencyPortal, landing v2, GoogleContinueButton, LandingTours) - mobile: keep redesign; port team's wishlist toggle on home cards, bookings screen route, planner response-time UI + "Bookinglarim" CTA, resolveMediaUrl - schema: TourAgency.telegram + TourBooking.customerEmail optional; migration history linear Verified: prisma generate OK, mobile tsc clean, website next build OK. Co-Authored-By: Claude Opus 4.8 <[email protected]>
Agency (agency.travelorai.com): - Monolit 1400-qator AgencyPortal.tsx -> sahifa-routing arxitektura - lib/agency: types + api helper + session context (yagona holat manbasi) - /agency dashboard (lead-first ish stoli), /leads (inbox: yangi/qabul/arxiv), /tours + /tours/new + /tours/[id] (editor), /profile (email-change countdown) - Sidebar: yangi lead badge, sahifalararo real URL navigatsiya Admin (admin.travelorai.com): - /admin dashboard: tasdiqlash navbatlari (ariza/tour/lead) + platforma stats - /admin/moderation: agentlik arizalari + tour review (approve/reject + izoh) - /admin/leads: barcha leadlar nazorati + admin override - /admin/agencies: faollik boshqaruvi - Mavjud /admin/content va /admin/hero saqlanadi, yagona AdminShell nav Baza prod jonli manbasi bilan sinxronlandi (cookie-auth proxylar, email-change).
- Nav links light-on-dark, mint active state with glow, username chip - Aside rounded card look; stats read flat totalUsers/totalTrips/totalPlaces/totalFeedback
- Admin/agency sidebar: flush to edge, collapse/expand toggle (localStorage) - Agency auth: full-viewport split layout (image left, form right), no page scroll - Onboarding application: 4-step wizard (kompaniya/aloqa/onlayn/tavsif) - Tour editor: 3-step wizard (asosiy/narx/kontent) with step validation
- Agency auth left panel: faqat brand + sarlavha (ortiqcha matnlar olib tashlandi) - Admin login: yangilangan matn (boshqaruv paneli), ixcham karta, scrollsiz, /admin'ga redirect
…ression, approval celebration - Wizard bosqichlari yo'nalishli slide+fade bilan o'tadi (reduced-motion hurmat qilinadi) - Sana: '11-iyun, 2026-yil' formatida (Intl uz-UZ 'M06' muammosi o'rniga qo'lda oy nomlari) - Rasm yuklash: client-side siqish (max 1280px JPEG) — reviewga yuborish sezilarli tezlashadi - Ariza tasdiqlanganda: ikki burchakdan konfeti + 'Xush kelibsiz!' kartasi, so'ng kabinet ochiladi
Email almashtirish yakunlanganda ikkala manzilga 'muvaffaqiyatli o'zgartirildi' xabarnomasi (fire-and-forget).
Prod container'da SMTP/Google sozlamalarini recreate'siz .env orqali almashtirish imkonini beradi.
Email almashtirilganda eski Google identifikatori uziladi — aks holda eski Gmail bilan 'Continue with Google' hisobga kiraverardi. Xabarnomaga eslatma qo'shildi.
…eports - /admin/places: POI CRUD (landing ko'rsatish/featured toggle) - /admin/stories: sayohatchi fikrlari CRUD - /admin/reports: umumiy hisobotlar — tizim holati, platforma, turlar, leadlar, POI sifat (oddiy kartalar) - /admin/content monolit (Platform overview) -> /admin redirect - AdminShell nav + dashboard quick links yangilandi
- Boshqaruv sahifasi endi navbatlar + to'liq monitoring (tizim/platforma/turlar/leadlar/POI) - /admin/reports -> /admin redirect, Hisobotlar nav olib tashlandi - /admin/hero: eski /admin/content redirect o'rniga HeroSlidesAdmin AdminShell ichida - HeroSlidesAdmin: o'z monolit sidebar'i olib tashlandi (yagona shell)
- Booking forma: 'ro'yxatdan o'tish shart emas' tushuntiruvi (agentlik fikri asosida) - Bookinglarim: mehmonga do'stona ekran (jim bo'sh o'rniga kirish tushuntirishi + tugmalar) - eas.json: production-apk profili (production channel, adb sideload uchun)
- Backend: schema +21 paket maydonlari, 3 migration, tourImage util, controllers/schemas (Codex) + mening patchlarim saqlangan (email notice, googleId detach) — 3-way merge - Website v2: TourEditor 4 bosqich (Asosiy / Mehmonxona va ovqat / Narx va mavjudlik / Kontent), meal-plan select + hint, checkbox-row stillar, admin moderation paket ko'rinishi, 16mb proxy - Mobile: tur detail paket kartasi (Codex) + guest-booking izohi saqlangan
….md rules - POST /agency/auth/google route + googleAuth controller + googleAuthSchema - AgencyAccount.googleId (idempotent migration — prod DB da ustun bor edi) - AGENTS.md: agentlar uchun majburiy qoidalar (git baza, podman deploy, port-war oldini olish)
…eens, package badges on catalog - Bookinglarim: status endi uzbekcha + rangli (Javob kutilmoqda/Qabul qilingan/...) - O'lik checkout.tsx + payment-methods.tsx olib tashlandi (free-model, hech qayerdan chaqirilmaydi) - Katalog kartasida hotel kategoriya + meal-plan badge (codex paket maydonlari)
…pool register() awaited the Gmail SMTP send, so responses took 2-13s (one prod request measured 12585ms) and often exceeded the mobile 15s axios timeout — the spinner hung and the code sometimes never arrived. Now issueAuthCode fires the email send fire-and-forget after persisting the code, returning immediately (prod register 12585ms -> 241ms). Also added SMTP connection/greeting/socket timeouts + connection pooling so a slow SMTP server can never hang a request. Affects register, forgot-password, resend-verification, email-change and account-delete flows. Co-Authored-By: Claude Opus 4.8 <[email protected]>
issueAgencyCode awaited the Gmail SMTP send (2-13s), so agency register / email-change risked the website agency-proxy 15s timeout (504) and hung the UI. Now the email is sent fire-and-forget after the code row is persisted, returning immediately (prod agency register 361ms). Same fix as the mobile user flow in issueAuthCode. Co-Authored-By: Claude Opus 4.8 <[email protected]>
- Translate landing (Navbar, Hero, HowItWorks, Footer, Destinations,
AppPreview) + page/layout metadata to Uzbek; nav "Turlar" now links to a
real /tours page instead of an anchor.
- Add /tours: server-rendered browse page showing agency tours + popular
places (mobile-app-like), open to all. Booking ("Bron qilish") routes to
/account which gates auth, so active actions require login.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
- /tours: client ToursBrowser with "Qayerga" country chips (same 12-country set + keyword matching as the mobile app) + search box. Filters on title/city/destinationCountry/subtitle/agency, so the agency form's DESTINATION_OPTIONS (already aligned) drive correct filtering. Added destinationCountry to LandingTour type; tours fetch bumped to 60, places 24. - Admin: translate remaining English (Boshqaruv, Tasdiqlash/Rad etish/Yakunlash, section eyebrows, placeholders) to Uzbek for portal consistency. Co-Authored-By: Claude Opus 4.8 <[email protected]>
…ner on web User web account now mirrors mobile actions (same backend, already synced): - Edit profile (name/lastName/bio) via PUT /auth/profile. - Edit travel style + interests via PUT /auth/preferences. - Remove wishlist items (DELETE /wishlist/:id). - Generate a new AI itinerary (POST /planner/generate) and save it (POST /trips) — appears under "Mening safarlarim", synced to mobile. Co-Authored-By: Claude Opus 4.8 <[email protected]>
New native build for Play upload: travelorai.com base + all current OTA JS. runtimeVersion stays 1.0.7 for OTA continuity. EAS production env now also carries the Yandex MapKit key so cloud builds bake maps correctly. Co-Authored-By: Claude Opus 4.8 <[email protected]>
- Design system (styles/marketing.scss): green+gold premium tokens, Reveal animations, header/footer/hero/card/buttons/forms/stats. - Shared components (components/marketing): Logo, Reveal (IO + 2.5s fallback), SiteHeader (sticky, transparent-over-hero, auth-aware), SiteFooter, PageHero, TourCard, HeroSearch, CountUp, MarketingShell, useAuth. - next/font Plus Jakarta Sans; single-source regions→cities (lib/travelData). - New premium HOME: hero + search, featured tours, popular destinations, value props, count-up stats, CTA — real backend data, Uzbek copy. WIP: catalog/detail/auth/partners/about/contact/legal/my-trips + SEO pending; not deployed until those pages exist (header links them). Co-Authored-By: Claude Opus 4.8 <[email protected]>
Sticky filter bar: search + sort (rating / price asc / price desc) + dependent Region→City dropdowns (region narrows city list) + live client-side filtering, "N natija" counter, empty state. Premium TourCard grid. Hero search routes here with ?region=. Replaces the old ToursBrowser. Co-Authored-By: Claude Opus 4.8 <[email protected]>
- /about: mission, count-up stats, values, 3-tourism roadmap (outbound now → domestic next → inbound future). - /contact: channel cards (phone/email/telegram/address) + message form with Suggestion/Complaint toggle → POST /feedback (graceful 401 → use channels). - /privacy + /terms: shared LegalDoc layout, realistic Uzbek prose. Co-Authored-By: Claude Opus 4.8 <[email protected]>
…s, destinations, SEO - /tours/[id]: gallery, inclusions chips, package card, sticky BookingPanel (date + travelers stepper + price breakdown + service fee → total; "Kirib bron qiling" when logged out, POST /bookings when in), reviews, Product JSON-LD, dynamic metadata/OG. - /signin: split-screen premium auth — role choice (Sayohatchi/Hamkor), back arrow, login↔register toggle (name for traveler register), Google (traveler), 6-digit verify step; routes Partner→/agency, Traveler→/my-trips (or ?next). - /partners: benefits + 4-step + application form → agency register (pending). - /my-trips: auth-gated (redirect to /signin), bookings with status badges, skeleton + empty state. - /destinations: region tiles with tour counts → /tours?region=. - SEO: sitemap (static + dynamic tour URLs), robots (disallow admin/auth routes). Co-Authored-By: Claude Opus 4.8 <[email protected]>
…t + dark fallback Co-Authored-By: Claude Opus 4.8 <[email protected]>
- User.role (traveler|partner|admin) + migration. - POST /auth/admin/login (password → 2FA email code), /auth/admin/login/verify (code → JWT signed with role=admin). buildPublicUser exposes role. - adminAuthMiddleware now accepts x-admin-key (legacy proxy) OR Bearer admin JWT, so existing /admin proxy keeps working while the new panel uses JWT. WIP: admin endpoints (vendors/listings-delete/reports/reviews/feedback-status) + premium admin frontend pending. Co-Authored-By: Claude Opus 4.8 <[email protected]>
…us, tour delete, add partner) - Feedback.status (new|resolved) + migration; PATCH /admin/feedback/:id/status. - GET /admin/reports (revenue, 5% commission, paid/last-30 bookings, by-status, top tours) from TourBooking. - GET /admin/reviews + DELETE /admin/reviews/:id (TripReview). - DELETE /admin/tours/:id. - POST /admin/business (create approved AgencyAccount partner). Existing stats/users/bookings/feedback/agency-applications reused by the panel. Co-Authored-By: Claude Opus 4.8 <[email protected]>
Replaces old /admin. Green+gold premium design (admin.scss), JWT-in-localStorage api() client via /api/backend (forwards Bearer), 2FA email login, AdminGate (role=admin), AdminShell (sidebar+topbar, mobile drawer). Sections: Dashboard, Partners(+add), Listings(delete), Bookings, Reports (revenue/commission/bar chart/top tours), Users (search), Reviews (delete), Feedback (tabs + resolve). Reusable StatCard/StatusBadge/EmptyState/ConfirmButton/Spinner/Toast; optimistic status updates; consistent badge colors; Uzbek. Co-Authored-By: Claude Opus 4.8 <[email protected]>
- backend adminLogin: username+password -> JWT(role=admin), no email/2FA - add GET /admin/me (AdminGate session check via admin JWT) - adminAuth middleware carries username - website: single-step login screen (Login + Parol), adminApi uses /admin/me Co-Authored-By: Claude Opus 4.8 <[email protected]>
Replace mobile/ with the deployed slim app (OTA truth): remove map/AI-planner/achievements, green+gold light theme, tour-details fix. Website + backend + admin already match prod on this branch. fcm service-account secret intentionally excluded. Co-Authored-By: Claude Opus 4.8 <[email protected]>
KSultonboy
changed the title
* Auth hardening + Google fix + console cleanup (on production line) Security: - Escalating login lockout (5 fails -> 5/20/60 min -> support) for user + agency logins - Block-check on password AND Google login (blocked users were still getting in) - Forgot-password / resend-verification rate limit (max 3 / 15 min) - Admin "send password reset" endpoint + Users page action (code goes to user's email) Google Sign-In: - Add missing @react-native-google-signin config plugin in app.config.js (fixes DEVELOPER_ERROR) Console cleanup: - Public GET /auth/session (200 {user:null} for guests) -> website header no longer logs 401 - prefetch={false} on marketing nav/footer links -> stop preloading unused hero images Co-Authored-By: Claude Opus 4.8 <[email protected]> * fix(web): suppressHydrationWarning on <html>/<body> to avoid React #418 The site uses data-theme on <html> for dark mode; setting it before hydration (plus browser-extension attribute injection on <body>) triggers a hydration mismatch. This is the standard next-themes-style mitigation. Note: the live header shows a theme toggle that is NOT committed in any repo branch — the definitive #418 fix needs that deployed-but-uncommitted code. Co-Authored-By: Claude Opus 4.8 <[email protected]> --------- Co-authored-by: Claude Opus 4.8 <[email protected]>
The frontend was switched to /auth/session (200 for guests, removes console 401), but that backend endpoint is not deployed yet -> live my-trips redirected everyone to signin and the header showed logged-in users as guests. Revert to /auth/me (live backend endpoint) so login state works; flip back once backend ships. Co-Authored-By: Claude Opus 4.8 <[email protected]>
…ript used forbidden prisma migrate)
…st 401 console noise)
…n' note on partner login
…set page -> /signin. Agents unchanged (admin-only).
…ssword (unblocks login when Google isn't configured)
… save/autofill, clearer Google-account login message
…ockerfile (was missing -> Google button never got the client id)
…d display:block, width, and gradient fallback bg
…s Next prefetch link-preload warnings across all marketing pages
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings
mainup to the current production state (travelorai.com + mobile OTA).Website (Next.js)
Admin panel (/admin)
Backend (Node/Express/Prisma)
Mobile (Expo/RN) — slim, tour-booking focus
Note: mobile/fcm-service-account.json (a secret committed on the mobile branch) is intentionally NOT included here.