Repository navigation
feat: add order-notifier example app (Telegram alerts and webhooks) - #6
Merged
Merged
Conversation
…der API
The app subscribed to `orders.create`, which the store and the emulator
refuse with a 422, and built the endpoint from an unset APP_URL. The
failure was caught and logged, so no store was ever subscribed; the tests
passed because they injected a webhook secret and hand-signed deliveries.
- Subscribe to `order.created` (APP_URL now required) and re-subscribe on
save when a store has no secret.
- A delivery carries the stored record with no customer or currency, so
read the order from /api/v1/orders/{id}?include=orderGroup as the app.
- Escape store values for Telegram's HTML mode; a name with & or < made
Telegram refuse the whole alert.
- Never return the bot token to the page: GET answers botTokenSet, and a
blank token on save keeps the saved one. Seal the webhook secret too.
- Report a Telegram refusal as delivered: false instead of true; pass the
Telegram URL through createApp instead of process.env; time out at 10 s.
- Settings page: @flycommerce/ui Switch, Checkbox and FieldError.
- dev: grant webhooks.manage, set APP_URL, press Enter to place an order.
- Tests drive install and delivery through the emulator.
.env.example named FLYCOMMERCE_APP_ID and FLYCOMMERCE_APP_SECRET, which the SDK doesn't read, and shipped a usable ENCRYPTION_KEY. Use the SDK's variable names with an empty key and how to generate one, and rewrite the README and AGENTS.md in order-export's form, with what the app doesn't do.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
order-notifier, a second example app: it subscribes to theorder.createdwebhook on install and sends a Telegram alert for each new order.What it shows
readWebhook()(HMAC-SHA256 of the raw body,X-Webhook-Signature)./api/v1/orders/{id}?include=orderGroup) instead of trusting the delivery body.botTokenSetinstead).@flycommerce/ui, authenticated with the session token, per store.Running it
.env.examplelists the variables (APP_ID,APP_SECRET,HUB_API_URL,APP_URL,ENCRYPTION_KEY).npm run devruns it in the emulator; pressing Enter places an order and deliversorder.createdto the app.Tests
15 tests (
npm test), offline: install subscribes toorder.created, a delivery reads the order and sends an escaped alert, the bot token is kept sealed and never returned, saving settings re-subscribes a store with no secret, Telegram refusals reportdelivered: false.Not covered
The repo's CI checks the PR title only; tests were run locally.