Release 1.1.0-rc.11

2026-09-12 · release-candidate

Secure administrator login credential changes

Changes

• Added self-service administrator login email and password changes under Security, requiring the current password and CSRF verification.
• Made credential changes transactional, rejected duplicate emails and weak or mismatched passwords, and revoked old web sessions, API tokens and password-reset links.
• Added isolated account database and responsive browser checks for email-only, password-only and combined changes, old-login rejection and customer access denial.
• Added validated internal B2B procurement with vendor maintenance, colour/size purchase lines, serialized PO numbering and duplicate-submission guards.
• Made complete purchase receipts and reversals transactional, updating product and variant stock together and rejecting unsafe reversals or reopening cancelled purchases.
• Added supplier invoice references, duplicate-bill checks, guarded part/full payment recording and supplier payables separate from customer receivables.
• Added encrypted Google OAuth credential entry in Integrations with explicit live enablement, legacy fallback only when no managed profile exists, and interactive-verification status.
• Added isolated database and real-admin browser coverage for procurement, payment retries, archived vendors, draft-product isolation and responsive procurement/key-entry screens.
• Added per-variation selling price and MRP overrides with parent-price fallback in admin, product selection, cart, checkout, API and social catalogue feeds.
• Added structured Variant Prices sheet import/export, price-only updates, validation and stock-only price retention.
• Kept matching variation IDs stable and made product and variation saves transactional.
• Added database and responsive browser checks for price imports, admin saves, selected-size pricing, COD totals and no-JavaScript product links.
• Added a dedicated read-only Meesho setup view under Integrations, with supplier onboarding requirements and links to existing reports and listing sheets.
• Included the supplied third-party API profile and authentication notes as documentation, not executable connector configuration.
• Added route and responsive browser checks covering admin access, rejected write requests, provider navigation and no-JavaScript access.
• Fixed squeezed mobile headers across Settings, Catalogue Import, Product Sheet and Marketplaces.
• Contained the Add/Edit Product form, stacked photo-assistant sections and made variation and size/color controls fit mobile screens.
• Connected the shared header search to inventory search, including drafts, instead of a nonfunctional placeholder.
• Made both id and edit product links open the selected record and added responsive form/search/variation regression checks.
• Rebuilt Social Shopping with product previews, channel metrics and settings, separate catalogue/attention/sharing views, search and pagination.
• Added copy-link actions with feedback, empty states, mobile channel shortcuts and self-hosted Lucide icons.
• Removed the clipped mobile menu region and nested desktop menu scrolling; all items and Logout remain reachable.
• Added responsive visual and interaction checks for social views, images, long names, clipboard behavior, feed saves and menu boundaries.
• Removed duplicate Razorpay and social-contact editors, with direct links to each setting's canonical screen.
• Added explicit encrypted import of legacy Razorpay settings without changing checkout switches or exposing secrets.
• Restored sidebar and group icons, visible tablet/mobile labels, a shared collapsible menu and active order-detail navigation.
• Preserved saved profiles after validation errors and separated provider enablement from prepaid checkout activation.
• Batched repeated checkout schema metadata queries after an admin-route test exposed request timeouts.
• Extended browser gates across admin menu destinations, settings tabs, responsive and no-JavaScript navigation, migration and credential preservation.
• Added opt-in cron-backed Amazon merchant-order synchronization with persistent pagination checkpoints, single-worker locking and profile-change pauses.
• Added a seller-bound review queue and explicit retry controls for orders with mapping, totals, stock or fulfilment conflicts.
• Prevented stale Amazon status updates from erasing shipment history or restoring dispatched stock.
• Fixed provider settings overwriting the application base URL on the integrations page.
• Encrypted administrator-managed sandbox/live profiles for Razorpay, iThink, Amazon SP-API, WhatsApp Cloud API and Instagram/Meta.
• Sandbox Razorpay checkout verification, iThink serviceability/rates/labels/cancellation controls and durable provider action history.
• Explicit Amazon order import, mapped inventory preview/publication, standard self-ship confirmation and guarded fulfilment/cancellation reconciliation.
• Meta catalogue feed scheduling, opted-in WhatsApp website order confirmations and signed delivery/opt-out webhook handling.
• Customer account navigation and opt-in Google sign-in, supplier import validation and distributor photo uploads.
• Mocked provider, encrypted database and isolated browser checks covering sandbox isolation, secrets, webhook replay and marketplace stock transitions.
• Rebuilt the customer header and footer with consistent gutters, readable branding, essential links and a persistent cart.
• Added About, Contact, FAQs, Shipping, Returns, Cancellations, Privacy, Terms, Payments, Cookies and a policy index.
• Made cart and add-to-cart available independently of checkout activation and removed setup/coming-soon messages.
• Separated payment-method previews from explicit order placement and added native cart removal.
• Added isolated browser purchase tests and an explicit activation workflow for COD plus configured live Razorpay.
• Constrain the public header logo to prevent its original image dimensions from pushing the homepage below the screen.
• Restore compact navigation and visible homepage content on desktop and mobile.
• Customer registration, sign-in, password recovery, saved delivery address and private order history.
• Administrator access checks, session revocation, transactional stock updates and captured-payment validation.
• Instagram and WhatsApp shopping links, referral attribution and an opt-in Meta catalogue feed.
• Opt-in iThink shipment booking, existing-AWB reconciliation and scheduled tracking updates.
• Mobile source updates for registration, order history and browser-based purchasing; new app binaries are not included in this website deployment.
• Automated commerce checks now gate website deployment.

Known limitations

• Credential changes require an existing administrator login and the current password. This deployment does not reset production credentials or add administrator account recovery.
• The agreed B2B scope is internal admin procurement with complete-PO receipts and unbilled full reversals. Supplier logins, partial deliveries, supplier returns/credit notes and mobile app-store releases are outside this release.
• The product list and opening supplier balances still require merchant review and entry; this deployment does not import or publish catalogue records, enter provider keys, send payments or activate external integrations.
• This is a release candidate for testing, not a completed omnichannel platform.
• Commerce-provider sandbox and live acceptance tests remain pending credentials; this admin UI release does not activate providers or create production transactions.
• Amazon order scheduling is off by default and requires a connection-tested live profile plus a running cron schedule. Inventory publication remains manual; restricted buyer data and marketplace fulfilment programmes are not handled.
• Meesho setup is informational: no live connector or automatic sync is installed. Implementation and provider testing require an approved API contract, signing specification and access; seller reports and listing sheets remain available.
• WhatsApp requires Cloud API onboarding and approved templates; Instagram shopping requires eligible Meta assets and permissions.
• Conversational chat checkout, refunds/returns, settlements, NDR automation and automatic recovery of uncertain provider requests remain unfinished.
• Provider credentials, Google OAuth configuration and account approvals must be configured by the merchant. Deployment alone does not activate live integrations.

Build 612bda30011b4f22932658bd48087ef8eaae710c
Built 2026-10-01T08:19:59+00:00