Skip to content

Reversion of Donation Gate commits#1

Closed
manubhardwaj wants to merge 13 commits into
deepak4566:mainfrom
manubhardwaj:feat/remove-donation-gate
Closed

Reversion of Donation Gate commits#1
manubhardwaj wants to merge 13 commits into
deepak4566:mainfrom
manubhardwaj:feat/remove-donation-gate

Conversation

@manubhardwaj
Copy link
Copy Markdown

@manubhardwaj manubhardwaj commented Mar 1, 2026

User description

Reverts the following commits that introduced the donation gate component:

  • ff8fadf Add donation gate component to prompt users before app creation
  • 7a37e44 Add donation gate component to prompt users before app creation

CodeAnt-AI Description

Add India-focused troubleshooting guides and improve proxy reliability

What Changed

  • Proxy: preserve OAuth and external redirect query parameters by only rewriting the host in Location headers, preventing broken OAuth redirects and malformed redirects to external providers
  • Proxy: cache configuration lookups for 60 seconds to reduce KV reads and speed proxy routing; adjust WebSocket upgrade requests to use Cloudflare-compatible headers so Realtime connections proxy reliably
  • Content: add multiple India-focused blog posts and JSON-LD schema, update sitemap with new posts and include /terms and /privacy links
  • Legal: add full Terms of Service and Privacy Policy pages and surface them in footer and layouts
  • Project metadata: add AGPL-3.0-only license to package.json

Impact

✅ Fewer broken OAuth logins
✅ Lower KV reads during proxy requests
✅ More discoverable India troubleshooting content

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Summary by CodeRabbit

Release Notes

  • New Features

    • Added donation modal to support project development
    • Introduced Terms of Service and Privacy Policy pages
    • Added Web App Manifest for improved app installation support
    • Enhanced registration form with terms acceptance checkbox
    • Improved URL validation during app creation
  • Documentation

    • Expanded blog with comprehensive guides on DNS blocking, Supabase and Firebase access issues in India, and reverse proxy solutions
  • Performance

    • Optimized reverse proxy caching for improved response times
    • Enhanced redirect handling and WebSocket upstream requests
  • Chores

    • Updated license information across project configuration
    • Enhanced SEO metadata and structured data across pages
    • Updated footer navigation with policy links

sunithvs and others added 11 commits February 28, 2026 11:56
…emap updates

- Blog posts 10-16 covering timeline, emergency guide, developer tool blocking history,
  DNS poisoning technical deep dive, Supabase vs Firebase comparison, government
  blocking order news, and network connectivity troubleshooting
- JSON-LD structured data (Article, FAQPage, BreadcrumbList, Organization, WebSite,
  SoftwareApplication, TechArticle, WebApplication, HowTo, CollectionPage) on all pages
- Updated BlogSuggestions, blog index, and sitemap with all new entries

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add /terms page (18 sections, DPDP Act 2023, IT Act Section 79, CERT-In compliance)
- Add /privacy page (19 sections, data controller info, transit data disclaimer)
- Add non-affiliation disclaimer for Supabase, Cloudflare, Jio Platforms, Reliance
- Clarify JioBase is a project name/domain, not a registered trade name
- Consistent contact email: jiobase@sunithvs.com across all legal pages
- Enforce legal acceptance on registration (checkbox + disabled submit)
- Add AUP compliance notice on app creation page
- Add Terms/Privacy footer links across all 7 page layouts
- Update sitemap with /terms and /privacy paths

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…h-icon

- Add favicon.ico (32x32) for Google crawler fallback
- Add favicon-192.png, favicon-512.png for web manifest
- Add apple-touch-icon.png (180x180) for iOS/Safari
- Add favicon.svg to static for direct URL access
- Add site.webmanifest with proper icon references
- Update layout: use static paths instead of Vite-hashed import
- Fix JSON-LD logo across 15 pages: SVG -> PNG (Google doesn't support SVG in structured data)
- Add theme-color meta tag

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Not affiliated with Supabase Inc., Jio Platforms Ltd., Reliance Industries, or Cloudflare Inc.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…on form

Show inline Supabase URL validation error on blur and extract field-level
errors from API response instead of showing generic "Validation failed".

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@codeant-ai
Copy link
Copy Markdown

codeant-ai Bot commented Mar 1, 2026

CodeAnt AI is reviewing your PR.


Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Mar 1, 2026

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 2b49305 and 0326965.

⛔ Files ignored due to path filters (6)
  • apps/web/static/apple-touch-icon.png is excluded by !**/*.png
  • apps/web/static/favicon-192.png is excluded by !**/*.png
  • apps/web/static/favicon-32.png is excluded by !**/*.png
  • apps/web/static/favicon-512.png is excluded by !**/*.png
  • apps/web/static/favicon.ico is excluded by !**/*.ico
  • apps/web/static/favicon.svg is excluded by !**/*.svg
📒 Files selected for processing (47)
  • LICENSE
  • apps/api/package.json
  • apps/proxy/package.json
  • apps/proxy/src/config.ts
  • apps/proxy/src/handler.ts
  • apps/proxy/src/websocket.ts
  • apps/web/package.json
  • apps/web/src/lib/components/BlogSuggestions.svelte
  • apps/web/src/lib/components/DonationModal.svelte
  • apps/web/src/routes/+layout.svelte
  • apps/web/src/routes/+page.svelte
  • apps/web/src/routes/blog/+layout.svelte
  • apps/web/src/routes/blog/+page.svelte
  • apps/web/src/routes/blog/dns-poisoning-supabase-india-explained/+page.svelte
  • apps/web/src/routes/blog/firebase-supabase-blocked-india/+page.svelte
  • apps/web/src/routes/blog/fix-supabase-jio-5-minutes/+page.svelte
  • apps/web/src/routes/blog/india-blocking-developer-tools-history/+page.svelte
  • apps/web/src/routes/blog/india-disrupts-supabase-blocking-order/+page.svelte
  • apps/web/src/routes/blog/proxy-supabase-cloudflare-workers/+page.svelte
  • apps/web/src/routes/blog/supabase-alternatives-india/+page.svelte
  • apps/web/src/routes/blog/supabase-blocked-india-fix/+page.svelte
  • apps/web/src/routes/blog/supabase-err-connection-timed-out-india/+page.svelte
  • apps/web/src/routes/blog/supabase-india-block-timeline/+page.svelte
  • apps/web/src/routes/blog/supabase-network-connectivity-problems-india/+page.svelte
  • apps/web/src/routes/blog/supabase-production-app-broken-india/+page.svelte
  • apps/web/src/routes/blog/supabase-vs-firebase-both-blocked-india/+page.svelte
  • apps/web/src/routes/blog/test-if-backend-blocked-india/+page.svelte
  • apps/web/src/routes/blog/why-indian-developers-need-supabase-proxy/+page.svelte
  • apps/web/src/routes/blog/why-supabase-banned-india-section-69a/+page.svelte
  • apps/web/src/routes/dashboard/+layout.svelte
  • apps/web/src/routes/dashboard/apps/[id]/+page.svelte
  • apps/web/src/routes/dashboard/apps/new/+page.svelte
  • apps/web/src/routes/docs/+page.svelte
  • apps/web/src/routes/fix/+layout.svelte
  • apps/web/src/routes/fix/[slug]/+page.svelte
  • apps/web/src/routes/guides/+layout.svelte
  • apps/web/src/routes/guides/[framework]/+page.svelte
  • apps/web/src/routes/india-status/+layout.svelte
  • apps/web/src/routes/india-status/+page.svelte
  • apps/web/src/routes/privacy/+page.svelte
  • apps/web/src/routes/register/+page.svelte
  • apps/web/src/routes/sitemap.xml/+server.ts
  • apps/web/src/routes/terms/+page.svelte
  • apps/web/src/routes/tools/worker-generator/+page.svelte
  • apps/web/static/site.webmanifest
  • package.json
  • packages/shared/package.json

📝 Walkthrough

Walkthrough

This pull request adds comprehensive licensing (AGPL-3.0-only), introduces a donation flow with modal UI and periodic prompts, expands blog content with structured data and SEO metadata, creates Privacy and Terms of Service pages, improves proxy caching and request handling, adds form validation, and restructures footers across multiple routes.

Changes

Cohort / File(s) Summary
Licensing
LICENSE, package.json, apps/api/package.json, apps/proxy/package.json, apps/web/package.json, packages/shared/package.json
Added AGPL-3.0-only license text and license field to package manifests across the monorepo.
Proxy Service Infrastructure
apps/proxy/src/config.ts, apps/proxy/src/handler.ts, apps/proxy/src/websocket.ts
Implemented KV cache TTL for slug/domain lookups, improved Location header rewriting to safely swap only Supabase hosts, and enhanced WebSocket URL handling with sanitized upstream headers (removing Cloudflare metadata).
Donation & Fundraising UX
apps/web/src/lib/components/DonationModal.svelte, apps/web/src/routes/+page.svelte, apps/web/src/routes/dashboard/+layout.svelte, apps/web/src/routes/dashboard/apps/[id]/+page.svelte
Added DonationModal component with celebration and periodic variants, integrated periodic donation prompts in dashboard layout and homepage, and tied celebration modal to app creation flow with localStorage tracking.
Blog Content & Suggestions
apps/web/src/lib/components/BlogSuggestions.svelte, apps/web/src/routes/blog/+page.svelte
Extended blog suggestions with seven new entries and added seven new blog posts to the listing page.
New Blog Pages
apps/web/src/routes/blog/dns-poisoning-supabase-india-explained/+page.svelte, apps/web/src/routes/blog/india-blocking-developer-tools-history/+page.svelte, apps/web/src/routes/blog/india-disrupts-supabase-blocking-order/+page.svelte, apps/web/src/routes/blog/supabase-india-block-timeline/+page.svelte, apps/web/src/routes/blog/supabase-network-connectivity-problems-india/+page.svelte, apps/web/src/routes/blog/supabase-production-app-broken-india/+page.svelte, apps/web/src/routes/blog/supabase-vs-firebase-both-blocked-india/+page.svelte
Created seven comprehensive technical blog articles with detailed sections, FAQs, code examples, and reverse-proxy solutions for India-specific DNS blocking issues.
Existing Blog SEO Enhancement
apps/web/src/routes/blog/firebase-supabase-blocked-india/+page.svelte, apps/web/src/routes/blog/fix-supabase-jio-5-minutes/+page.svelte, apps/web/src/routes/blog/proxy-supabase-cloudflare-workers/+page.svelte, apps/web/src/routes/blog/supabase-alternatives-india/+page.svelte, apps/web/src/routes/blog/supabase-blocked-india-fix/+page.svelte, apps/web/src/routes/blog/supabase-err-connection-timed-out-india/+page.svelte, apps/web/src/routes/blog/test-if-backend-blocked-india/+page.svelte, apps/web/src/routes/blog/why-indian-developers-need-supabase-proxy/+page.svelte, apps/web/src/routes/blog/why-supabase-banned-india-section-69a/+page.svelte
Added JSON-LD structured data (Article, BreadcrumbList, FAQPage schemas) to existing blog posts for enhanced SEO and rich results.
Legal & Policy Pages
apps/web/src/routes/privacy/+page.svelte, apps/web/src/routes/terms/+page.svelte
Created comprehensive Privacy Policy and Terms of Service pages with full legal documentation, data handling disclosures, and compliance sections.
Footer & Navigation Restructuring
apps/web/src/routes/+layout.svelte, apps/web/src/routes/blog/+layout.svelte, apps/web/src/routes/fix/+layout.svelte, apps/web/src/routes/guides/+layout.svelte, apps/web/src/routes/india-status/+layout.svelte
Restructured footers from single-line copyright to two-part flex layout with Terms/Privacy links above copyright text across multiple route layouts.
Page SEO & Metadata
apps/web/src/routes/+page.svelte, apps/web/src/routes/docs/+page.svelte, apps/web/src/routes/fix/[slug]/+page.svelte, apps/web/src/routes/guides/[framework]/+page.svelte, apps/web/src/routes/india-status/+page.svelte, apps/web/src/routes/tools/worker-generator/+page.svelte
Added JSON-LD structured data, favicon updates, and site manifest links to pages for improved SEO and metadata completeness.
Registration & App Creation Forms
apps/web/src/routes/register/+page.svelte, apps/web/src/routes/dashboard/apps/new/+page.svelte
Added Terms of Service checkbox requirement for registration, implemented Supabase URL validation with error feedback, and integrated localStorage flag for post-creation celebration modal trigger.
Sitemap & Web Manifest
apps/web/src/routes/sitemap.xml/+server.ts, apps/web/static/site.webmanifest
Extended sitemap with nine new blog URLs and /terms and /privacy routes; added PWA manifest with JioBase branding and icon metadata.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Poem

🐰 Hops of joy through the code I go,
With licenses clear and features aglow,
New blogs and forms, donations too,
SEO sparkles and footers made new!
From DNS tales to privacy's grace,
A rabbit's delight—what a wonderful place!

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@codeant-ai codeant-ai Bot added the size:XXL This PR changes 1000+ lines, ignoring generated files label Mar 1, 2026
@manubhardwaj manubhardwaj force-pushed the feat/remove-donation-gate branch from 3b6b61b to 0326965 Compare March 1, 2026 16:05
Comment on lines +19 to +21
function handleKeydown(e: KeyboardEvent) {
if (e.key === 'Escape') dismiss();
}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: The global Escape key handler calls the dismiss function unconditionally, so pressing Escape when the modal is not open still triggers the close callback, which can cause parent state to update as if the modal were closed even though it wasn't visible. Guard on the open flag before dismissing so the handler only runs when the modal is actually shown. [logic error]

Severity Level: Major ⚠️
- ⚠️ DonationModal onclose fires when modal is already closed.
- ⚠️ Parent logic relying on onclose may mis-trigger.
Suggested change
function handleKeydown(e: KeyboardEvent) {
if (e.key === 'Escape') dismiss();
}
function handleKeydown(e: KeyboardEvent) {
if (open && e.key === 'Escape') dismiss();
}
Steps of Reproduction ✅
1. Mount `DonationModal` from `apps/web/src/lib/components/DonationModal.svelte` with
`open={false}` and a non‑no‑op `onclose` callback (lines 4–8 define these props).

2. When the component mounts, Svelte registers `<svelte:window onkeydown={handleKeydown}
/>` (lines 24–25), so `handleKeydown` is active regardless of `open`.

3. Ensure the modal is closed (`open === false` so the `{#if open}` block at lines 27–126
does not render any visible modal content).

4. Press the Escape key in the browser; `handleKeydown` (lines 19–21) runs, calls
`dismiss()` (lines 10–13), which invokes the parent's `onclose()` even though the modal
was not open, causing parent state or side effects to fire unexpectedly.
Prompt for AI Agent 🤖
This is a comment left during a code review.

**Path:** apps/web/src/lib/components/DonationModal.svelte
**Line:** 19:21
**Comment:**
	*Logic Error: The global Escape key handler calls the dismiss function unconditionally, so pressing Escape when the modal is not open still triggers the close callback, which can cause parent state to update as if the modal were closed even though it wasn't visible. Guard on the `open` flag before dismissing so the handler only runs when the modal is actually shown.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
👍 | 👎

@codeant-ai
Copy link
Copy Markdown

codeant-ai Bot commented Mar 1, 2026

Nitpicks 🔍

🔒 No security issues identified
⚡ Recommended areas for review

  • Script Injection
    The page injects a script tag using Svelte's {@html} with an inline JSON.stringify payload. Although the object is currently static, using raw HTML injection increases risk if any part of that content becomes dynamic or accepts external input. Consider moving JSON-LD generation into the module script and injecting a precomputed, sanitized string instead.

  • Possible XSS
    The file uses Svelte's {@html ...} to inject a <script type="application/ld+json"> block with JSON.stringify. If any of the injected values ever become non-static or derived from user input, this pattern can introduce XSS or break CSP. Prefer safer insertion patterns or ensure all values are strictly controlled and validated.

  • HTML injection
    The head contains an injected script tag built via {@html <script>...${JSON.stringify(...)}...</script>}. If any of that JSON-LD payload becomes dynamic/untrusted in future, it could open an XSS vector because raw HTML/script is inserted via {@html}. Validate that all injected values are static or properly escaped before insertion.

  • Intrusive UX
    A repeating setInterval shows the donation modal periodically (every 3 minutes). This approach can be intrusive: it waits for the first interval tick (no immediate check), may show repeatedly across sessions if storage is cleared, and runs an interval even when user navigates away. Consider improving cadence, immediate check behavior, and lifecycle handling to avoid a poor UX.

  • Maintainability
    The component contains a very large amount of static HTML content inside a Svelte page component. This makes updates, translations, or content reuse harder and increases the component's surface area. Consider moving content into a markdown/content file or splitting into smaller components.

  • Proxy example - unsafe header/body forwarding
    The worker example forwards request.headers and request.body directly to the upstream. This can result in forwarding hop-by-hop headers (Host, Connection, Content-Length) and may fail for streaming bodies or WebSocket upgrades. The example should show creating a new Request and filtering hop-by-hop headers and proper handling/cloning of the request body.

  • Raw HTML injection
    The page injects a large JSON-LD script using Svelte's {@html} directive. Using {@html} with serialized content increases XSS risk if the serialized object ever includes untrusted input. Prefer inserting JSON-LD as a script node with Svelte expression content to avoid innerHTML usage.

  • Legal Review
    The article names a public official directly in explanatory text. Have legal/communications validate the phrasing to reduce risk of inadvertent defamation or policy conflicts for the site.

  • Structured Data
    The page injects a JSON-LD blob into the head using raw HTML insertion. Verify the JSON-LD content is fully static (no user input or runtime interpolation) and that it cannot be used to inject malicious HTML/JS via {@html}.

  • Accessibility
    Decorative inline SVGs are used across the page without ARIA attributes (e.g., aria-hidden). Confirm SVGs are marked appropriately (aria-hidden or role/title) to avoid confusing assistive tech and to meet a11y guidelines.

  • JSON-LD injection
    The page injects a script tag via Svelte's {@html} with JSON.stringify(...) inside svelte:head. If any of the embedded values become dynamic in the future, this pattern can accidentally introduce XSS or unsafe HTML injection. Consider switching to a safer pattern that emits a script block content without raw HTML injection.

  • Example secrets look real
    Multiple code examples include placeholder anon keys that look like real JWTs (e.g. "eyJhbGciOi..."). Authors or readers may accidentally copy/paste these into production or misinterpret them as real tokens. Consider using an explicit placeholder label to avoid confusion.

@codeant-ai
Copy link
Copy Markdown

codeant-ai Bot commented Mar 1, 2026

CodeAnt AI finished reviewing your PR.

@manubhardwaj manubhardwaj reopened this Mar 1, 2026
@manubhardwaj
Copy link
Copy Markdown
Author

Closing this in favour of the PR on the main repo: sunithvs#1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size:XXL This PR changes 1000+ lines, ignoring generated files

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants