- Click-drag: grab cursor, drag left/right to scroll
- Mouse wheel: vertical scroll converts to horizontal pan
- Arrow buttons (< >) appear at edges when more pills are off-screen,
hide when scrolled to the end
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- pay-form: overflow:hidden -> overflow:visible so it no longer blocks
horizontal touch events on the pkg-scroll child
- pay-form-header: gets its own top border-radius to maintain visual
corner clipping without relying on parent overflow:hidden
- pkg-scroll: added touch-action:pan-x so browser hands horizontal
swipe gestures to this element rather than the page scroll
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Platform cards: replaced inline onclick with data attributes + event
listeners to avoid JSON double-quote quoting bug that broke clicks
- Onboarding: reverted to original yes/no -> request accounts flow,
removed alias-entry step that didn't work
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
After saving aliases, flow continues to account request step so players
can also request logins for platforms they don't have yet.
'Done' button on alias step still allows early exit.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Removed Play Now (▶) button from profile aliases tab — Play Now section
on home page is the one place to launch platforms
- Onboarding: "Yes I have existing logins" now leads to a new alias-entry
step where the player enters their username per active platform; saved
on submit, dismisses onboarding
- "No, I want new logins" still goes to the account-request step
- Back arrow on each step returns to the opening question
- obHideAll/obGoBack helpers keep step transitions clean
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- platforms table gets url_alias_param column (configurable per platform)
- Admin game form has new "Username URL Param" field — leave blank if platform
doesn't support it, or set to e.g. "username" if it does
- Platform cards now use onclick openPlatform() instead of plain href:
copies player's saved alias to clipboard on every click, and if
url_alias_param is set appends ?param=alias to the launch URL
- Toast notification confirms "Alias copied — paste into login"
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- payout_methods list now includes admin_enabled flag via JOIN on admin_payout_settings
- Disabled methods appear at 45% opacity with UNAVAILABLE/DISABLED BY ADMIN badge
in both the cashout radio list and profile payout tab; radio is disabled so they
can't be selected, but the delete button remains
- Set Default button hidden on disabled methods
- cashout.php server-side guard rejects submissions using a disabled method type
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Rocket Loader defers our main script, causing DOMContentLoaded to fire
before our listener is registered — so buildPlatforms(), buildPaymentMethods()
etc. never run. Adding Cache-Control: no-transform tells Cloudflare not to
rewrite the response, disabling Rocket Loader for this page.
Also adds buildPaymentMethods() to showApp() alongside buildPlatforms() so
payment methods are guaranteed to render when the user logs in, regardless
of fetch timing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Two issues:
1. Race condition: me.php resolves before the platforms fetch, so
showApp() runs with an empty CFG.platforms and the grid stays
blank until the Promise.all resolves. Fixed by calling
buildPlatforms() inside showApp() when platforms are already
loaded, guaranteeing the grid renders when the app becomes visible.
2. Stale placeholder: 'links' platform (is_active=1) was polluting
the grid with a "Platform Links coming..." card. Disabled in DB
(is_active=0).
Also hardened buildPlatforms/buildCashoutPlatforms: null-guard on
selects, early return when CFG.platforms is empty, and clear select
options before re-populating to prevent duplicates on re-call.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Players now paste the URL of their post instead of just clicking a
platform button. The server fetches the URL and looks for the player's
referral code in the page content. If found, the share is auto-approved
and tokens are awarded immediately. If not (login wall, private page,
code missing), it falls into the pending queue with a reason so admins
can click the link directly for manual review.
- api/referrals.php: replace submit_share with URL-accepting version;
add scrapeForReferralCode() (SSRF-guarded cURL, 8s timeout, 512KB cap)
and inferPlatformFromUrl() helpers
- db/schema.sql: add share_url, auto_verified, verify_result columns
- index.php: replace platform buttons with URL input form; show auto-
verify result inline; shares list shows URL and auto-verify badge
- admin/index.php: share cards show clickable URL, auto-check result
label, and auto-verified tag
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
myron