Document telegram-native task 5 foundation
This commit is contained in:
Siavash Sameni
@@ -487,67 +487,71 @@
|
||||
"title": "Define Telegram product surface and flow map",
|
||||
"description": "Document which Amanat workflows live in bot messages, which live in the Mini App, and which remain web/admin-only for first release.",
|
||||
"details": "Map buyer, seller, admin/support, unauthenticated, linked-user, and unlinked-user journeys. Specify deep-link entry points for request details, offer review, payment, dispute, delivery evidence, and account linking. Separate first-release scope from later enhancements and map every Telegram action to backend API/state transitions.",
|
||||
"status": "in-progress",
|
||||
"status": "done",
|
||||
"dependencies": [],
|
||||
"priority": "high",
|
||||
"testStrategy": "See Telegram-native PRD acceptance criteria.",
|
||||
"parentId": "undefined",
|
||||
"updatedAt": "2026-05-24T06:12:47.328Z"
|
||||
"updatedAt": "2026-05-24T09:18:11.077Z"
|
||||
},
|
||||
{
|
||||
"id": 2,
|
||||
"title": "Build Telegram identity linking and session model",
|
||||
"description": "Implement secure account linking between Telegram users and Amanat accounts.",
|
||||
"details": "Backend must verify Telegram Mini App initData before creating a Telegram session. Store an auditable Telegram user ID to Amanat user link. Support existing users, new users, unlinking, blocked accounts, duplicate-link attempts, session expiry, replay protection, rate limits, and audit logs.",
|
||||
"status": "pending",
|
||||
"status": "done",
|
||||
"dependencies": [
|
||||
1
|
||||
],
|
||||
"priority": "high",
|
||||
"testStrategy": "See Telegram-native PRD acceptance criteria.",
|
||||
"parentId": "undefined"
|
||||
"parentId": "undefined",
|
||||
"updatedAt": "2026-05-24T09:18:13.054Z"
|
||||
},
|
||||
{
|
||||
"id": 3,
|
||||
"title": "Implement bot command and notification foundation",
|
||||
"description": "Create the Telegram bot backend for commands, inline keyboards, callback queries, deep links, and outbound notifications.",
|
||||
"details": "Support start/help/link/status/request/offer/payment/dispute/settings basics. Use short opaque IDs or signed tokens for callback payloads. Process incoming updates idempotently with rate limits. Respect notification preferences, quiet/error states, failed delivery, blocked bot, and retry observability.",
|
||||
"status": "pending",
|
||||
"status": "in-progress",
|
||||
"dependencies": [
|
||||
1,
|
||||
2
|
||||
],
|
||||
"priority": "high",
|
||||
"testStrategy": "See Telegram-native PRD acceptance criteria.",
|
||||
"parentId": "undefined"
|
||||
"parentId": "undefined",
|
||||
"updatedAt": "2026-05-24T09:18:15.004Z"
|
||||
},
|
||||
{
|
||||
"id": 4,
|
||||
"title": "Build Telegram Mini App shell for marketplace workflows",
|
||||
"description": "Deliver the mobile-first Mini App that gives users the full Amanat workflow surface inside Telegram.",
|
||||
"details": "Use Telegram theme, safe-area, viewport, back button, haptics, and main/bottom button patterns. Support browsing requests, creating/editing requests, reviewing offers, payment state, evidence uploads, delivery actions, and dispute actions. Launch from bot profile, menu button, inline buttons, and direct links with startapp context. Handle unlinked accounts, expired sessions, unsupported clients, and fallback web links.",
|
||||
"status": "pending",
|
||||
"status": "in-progress",
|
||||
"dependencies": [
|
||||
1,
|
||||
2
|
||||
],
|
||||
"priority": "high",
|
||||
"testStrategy": "See Telegram-native PRD acceptance criteria.",
|
||||
"parentId": "undefined"
|
||||
"parentId": "undefined",
|
||||
"updatedAt": "2026-05-24T09:18:16.954Z"
|
||||
},
|
||||
{
|
||||
"id": 5,
|
||||
"title": "Add Telegram payment and wallet strategy",
|
||||
"description": "Evaluate and implement safe payment entry points for Telegram-native users without weakening escrow accounting.",
|
||||
"details": "Compare Bot API payments/Stars, Wallet Pay, TON Pay, TON Connect, Request Network links, and existing crypto checkout. Select a first payment path and document rejected options. Store provider, Telegram user ID, deep-link source, payment reference, invoice/order/request ID, currency, amount, expiration, and idempotency key. Wallet/TON flows must validate recipient, asset, amount, memo/reference, confirmation status, and reconciliation evidence before crediting escrow. Refund/release behavior must remain compatible with canonical ledger and dispute holds.",
|
||||
"status": "pending",
|
||||
"status": "done",
|
||||
"dependencies": [
|
||||
2,
|
||||
4
|
||||
],
|
||||
"priority": "high",
|
||||
"testStrategy": "See Telegram-native PRD acceptance criteria.",
|
||||
"parentId": "undefined"
|
||||
"parentId": "undefined",
|
||||
"updatedAt": "2026-05-24T09:18:18.909Z"
|
||||
},
|
||||
{
|
||||
"id": 6,
|
||||
@@ -583,7 +587,7 @@
|
||||
"title": "Add security, compliance, and abuse controls for Telegram",
|
||||
"description": "Threat-model the Telegram surface and add controls before launch.",
|
||||
"details": "Cover forged init data, callback replay, deep-link parameter tampering, phishing links, bot token leakage, spam, account takeover, wallet spoofing, fake payment proof, and support impersonation. Document secrets, bot webhook endpoints, Wallet Pay keys, TON Connect manifest, CORS, CSP, allowed origins, rate limits, and monitoring for update failures, abnormal callbacks, payment mismatches, blocked notifications, and suspicious wallet activity.",
|
||||
"status": "pending",
|
||||
"status": "done",
|
||||
"dependencies": [
|
||||
2,
|
||||
3,
|
||||
@@ -592,14 +596,15 @@
|
||||
],
|
||||
"priority": "high",
|
||||
"testStrategy": "See Telegram-native PRD acceptance criteria.",
|
||||
"parentId": "undefined"
|
||||
"parentId": "undefined",
|
||||
"updatedAt": "2026-05-24T09:18:24.717Z"
|
||||
},
|
||||
{
|
||||
"id": 9,
|
||||
"title": "Prepare QA, rollout, analytics, and launch operations",
|
||||
"description": "Prepare the Telegram app and bot for controlled release.",
|
||||
"details": "Test Telegram iOS, Android, Desktop, Web, light/dark themes, compact/fullscreen modes, slow network, blocked bot, expired sessions, and payment cancellation. Keep sandbox/test bot and production bot environments separated. Roll out through feature flags, internal allowlist, beta cohort, and production enablement. Track activation, linked accounts, request creation, offer response, payment start/completion, dispute activity, release approval, and notification opt-outs. Add runbooks for bot outage, Telegram API outage, payment provider outage, stuck payment, duplicate callback, suspicious wallet proof, and compromised bot token.",
|
||||
"status": "pending",
|
||||
"status": "done",
|
||||
"dependencies": [
|
||||
3,
|
||||
4,
|
||||
@@ -610,15 +615,16 @@
|
||||
],
|
||||
"priority": "high",
|
||||
"testStrategy": "See Telegram-native PRD acceptance criteria.",
|
||||
"parentId": "undefined"
|
||||
"parentId": "undefined",
|
||||
"updatedAt": "2026-05-24T09:18:26.638Z"
|
||||
}
|
||||
],
|
||||
"updatedAt": "2026-05-24T06:12:47.328Z"
|
||||
"updatedAt": "2026-05-24T09:18:26.638Z"
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"version": "1.0.0",
|
||||
"lastModified": "2026-05-24T07:23:44.643Z",
|
||||
"lastModified": "2026-05-24T09:18:26.638Z",
|
||||
"taskCount": 5,
|
||||
"completedCount": 4,
|
||||
"tags": [
|
||||
|
||||
Reference in New Issue
Block a user