Đang tải...
Theo dõi toàn bộ tính năng mới, cải tiến hiệu năng và bản vá bảo mật của B1sTeam
Bản cập nhật mới nhất của hệ thống B1sTeam được biên dịch và triển khai tự động.
fix(vercel): remove all cron jobs from main branch (crons handled by Render and Supabase)
feat(render): configure full backend hosting for all 112 API routes on Render
feat(infra): add Render blueprint, Dockerfile, and Vercel proxy rewrites for backend decoupling
perf(version): optimize CPU and network with visibility pausing, reload current page and show post-update notification
feat(ui): redesign app update notification with modern floating glassmorphism island, non-blocking flow, and smart reload
feat(products): add service_type option to distinguish standard vs locket_gold products and prevent false triggers
feat(locket): auto-add account to /quantri/locket and auto-activate gold upon product order
fix(sql): add DROP FUNCTION and fix cron.schedule quote escaping in master migration
fix(domain): update default domain to https://b1s.id.vn across crons and notifications
feat(supabase): consolidate all crons into Supabase master migration
feat(locket): default to 100% full auto mode with persistent loop
perf(locket): optimize CPU and network with in-memory caching, memoized rows, and throttled background jobs
feat(locket): implement zero-cron dynamic expiration check and lazy auto-renew
feat(supabase): add pg_cron and edge function for locket auto-renew
feat(locket): auto check, expiration tracking, auto renew gold and retry loop
fix: stats grid null safety - display 0 instead of crashing when stats data is missing
Update token and diff files
fix: update locket payload and synchronize subscription
fix: increase entitlement propagate wait times (5s/5s/5s + 3 checks)
feat: embed payloads with fetch_token + app_transaction (thanhdo1110/Locket-Gold approach)
feat: rewrite using thanhdo1110/Locket-Gold approach (fetch_token + app_transaction)
fix: use LOCKET_REVENUECAT_BEARER env var with fallback
fix: remove EventSource, use polling only to avoid MIME type error
feat: embed payload directly in code, remove file/URL dependency
Add files via upload
feat: use LOCKET_GIST_TOKEN_URL only, remove local token.json from git
feat: fallback to local token.json + gitignore sensitive file
feat: dynamic payload rotation for Locket Gold inject (sandbox mode) - Rewrite injectGold() to fetch receipts from LOCKET_GIST_TOKEN_URL env var - Random payload rotation per request (prevents detection from repeated payloads) - X-Is-Sandbox: true for restore purchase flow - Inject app_user_id + fresh timestamp into each payload before sending - Cache payloads in memory with 60s TTL - Remove hardcoded RevenueCat headers (now minimal: auth + sandbox) - Remove bot_config dependency for inject act
fix+redesign: locket admin - bug fixes & responsive UI overhaul Bug fixes: - Fix FK violation in POST/DELETE: create proper locket_actions before inserting locket_logs - Move hardcoded RevenueCat API key to REVENUECAT_API_KEY env var - Remove incorrect manual Content-Length header - Fix duplicate useEffect causing double API load on mount - Parallel bulk actions with Promise.allSettled Redesign (mobile + desktop): - Refined status badge with dot indicators & semantic colors - Stats grid with g
fix: remove conflicting middleware.ts - proxy.ts already handles auth redirects
fix: add middleware to redirect logged-in users away from /login, /register, /forgot-password
fix: enforce 1 session per device - rewrite to not depend on JWT jti, add to confirm flow
fix: session/auth bugs - clearTokens prefix leak, encryption rotation, token TTL, plaintext fallback, session ownership check
revert: back to hardcoded appl_ key for RevenueCat
fix(locket): remove hardcoded secret key, read from env at runtime - Split REVENUECAT_HEADERS into base headers + getRevenueCatHeaders() function that reads LOCKET_REVENUECAT_BEARER at call time - Removed hardcoded appl_... fallback from source code - Secret key now only exists in .env.local (gitignored)
fix(locket): use LOCKET_REVENUECAT_BEARER env var instead of hardcoded key RevenueCat receipts API requires secret key (sk_), not public key (appl_). Updated to read from LOCKET_REVENUECAT_BEARER env variable.
fix(locket): JSONB parsing bug causing empty tokens Supabase returns JSONB columns as already-parsed JS objects, not strings. JSON.parse() on an object throws, catch silently swallowed it, tokens stayed empty, triggering 'Thieu token' error. Fix: check typeof before parsing. Also add error logging.
fix(locket): receipt validation + missing token fields + retry logic - Add early validation: if fetch_token/app_transaction are empty, fail immediately with clear error message instead of sending bad request - Read hash_params and hash_headers from bot_config (required for proper receipt validation per RevenueCat API) - Replace single-retry logic with 5-attempt loop with backoff - Break early on 400/401/403 (permanent failures) to avoid wasted retries - Better error messages in Vietnamese f
fix(locket): UID extraction failing on new Locket page format The Locket invite page changed its HTML structure. The old regex '/invites/([A-Za-z0-9]{28})' no longer works because: 1. /invites/ is URL-encoded as %2F in the redirect URL 2. UID is now 48 chars (was 28), appended with a hex hash New extraction sources (in priority order): - Firebase storage URL: users%2F<UID>%2F (most reliable) - Decoded /invites/ path in HTML or redirect - URL-encoded link= parameter (decodeURIComponent first) -
fix(locket): normalizeUsername now strips locket.cam domain prefix normalizeUsername was not removing the 'locket.cam/' domain prefix from URLs. Input like 'https://locket.cam/bch.nguyn01' would incorrectly normalize to 'locket.cam' instead of 'bch.nguyn01'. Added: domain prefix removal + fallback to last path segment for any URL format.
refactor(locket-admin): redesign + modularize page into components - Break 718-line monolithic page into 7 focused components - Redesign desktop table with better visual hierarchy and hover states - Redesign mobile card layout with improved info density and touch targets - Add timeline-style LogsDialog with vertical line connector - Fix search debounce bug (proper cleanup with useRef timer) - Add BulkActionsBar component with responsive mobile layout - Extract StatsGrid, AccountTable, AccountCa
fix: them dau tieng viet cho tat ca text locket admin
fix: chuyen tat ca text sang tieng viet cho locket admin
add ATV badge next to locket username for active/success accounts
rebuild locket gold admin - full web-based, auto-check, no telegram
fix: revert jimp import to CJS require with ESLint disable for Turbopack build compatibility
'locket type fixes'
fix sql comments
Fix TypeScript errors: Jimp import compatibility for Turbopack
Fix invalid regex patterns in next.config.ts headers
Mọi đóng góp phản hồi từ cộng đồng giúp B1sTeam ngày càng hoàn thiện hơn.
