Changelog

All notable changes to this store, one entry per merged pull request.

  • fix #32

    adapt prescription and order UI to hardened web-raku APIs

    • preview prescription files with a local object URL instead of following the stored CDN URL
    • keep the permanent upload URL only in the hidden cart property for authenticated/admin processing
    • remove the obsolete type query override; web-raku now derives content type from the uploaded file's allowlisted MIME
    • pass customer_id from the legacy order-list flow to the hardened order-detail endpoint
    @diyesh
  • chore #31

    untrack remaining Playwright scratch files

    Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013wiFPum1YpEUQpcvMi8Xfy

    @wilthung
  • chore #30

    untrack Playwright scratch folder and ignore it

    Accidentally committed in #29.

    Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013wiFPum1YpEUQpcvMi8Xfy

    @wilthung
  • fix #29

    free-shipping amount text, re-sync product templates, cart heading

    Follow-ups from QC of PR #28 on the live store.

    • Free-shipping bar rendered "Rp 0": filter precedence bug (money applied to the translated string). Fixed.
    • The product-promise block and both product templates from #28 never reached the live theme (section-rendering API confirms the old template). Removed the url default values from the block schema, the only unusual feature in it, and touched both templates so the GitHub sync re-pushes them.
    • Cart page title "Cart" -> "Keranjang"…
    @wilthung
  • fix #28

    cart free-shipping bar, product promise lines, sold-out filtering, cleanups

    Round two of obvious, low-risk fixes, found while verifying PR #27 on the live store.

    @wilthung
  • feat #27

    entity schema, product specs+FAQ, article reviewer, full obat index, related products

    Tier 1 (items 2–6) of the SEO/GEO plan. Item 1 (review app metafield sync) is a Stamped admin toggle, not code; the theme is ready for it.

    @wilthung
  • fix #26

    unblock mobile buy bar, trim page weight, tighten SEO tags

    Quick wins from the 12 Sep 2026 storefront audit. Theme-only; no merchant JSON touched.

    @wilthung
  • fix #25

    add spam guard to prescription form, crypto-random record id

    • blocks/prescription-request-form.liquid + assets/prescription-request-form.js submit straight to app.asmaraku.com via fetch(), bypassing Shopify's native form handling — client-side validateForm() was the only gate, trivially bypassed by scripting a direct POST.
    • Adds the same honeypot + minimum-fill-time spam guard already used on Horizon OB's corporate-partner forms (sections/corporate-partner-contact.liquid): a hidden hp_field only a bot would fill, plus a 3s minimum…
    @diyesh
  • fix #24

    escape user-submitted values before re-rendering into forms (XSS)

    • form.email/form.name/form.phone/form.body/form.author/form.message/form.send_on were re-populated into value="..." attributes and <textarea> content after a failed validation, without | escape. A submission containing "><script> breaks out of the attribute/tag on the re-rendered error page.
    • Fixes snippets/contact-form.liquid, snippets/blog-comment-form.liquid, snippets/gift-card-recipient-form.liquid (11 output points total).
    • Found during a theme security audit covering XSS,…
    @diyesh
  • #23

    Add Compare Chat Button block to product Details

    • New theme block (blocks/bitchat-compare-button.liquid) that opens the bitChat Live Chat Widget and auto-sends "Bandingkan {product} dengan produk lainnya" so shoppers can quickly ask for a comparison
    • Full settings: label, prompt template, icon (+ new "compare" icon option), position (left/center/right, default center), style, and optional custom colors
    • Wired into the Details block on both templates/product.json and templates/product.one-condoms.json
    @diyesh
  • feat d10f22f

    Changelog page: table-style ledger with type filters and full-text toggle

    Redesigns this page from a stacked list into an aligned Date / Type / PR / Change / By ledger, with colour-coded type tags, filter chips, and a full-text toggle — all CSS, no JavaScript. Also keeps CHANGELOG.md as the canonical auto-generated ledger and moves the longer engineering notes to docs/.

    @wilthung
  • feat 447eea9

    SEO/AEO/GEO & trust: social-image fix, medicine structured data, prescription privacy note

    Serves the Open Graph share image over HTTPS so link previews render on WhatsApp / Facebook. Adds structured data to the medicine (obat) content — an ItemList for the A–Z directory and MedicalWebPage + Drug schema on articles — for search, AI Overviews, and answer engines. Adds a configurable privacy reassurance before prescription upload.

    @wilthung
  • fix 0fcaebb

    Prescription form: show validation messages, enable autofill, announce errors

    The form's styled Indonesian validation messages never appeared for empty fields (native browser validation intercepted first) — fixed with novalidate. Adds autocomplete so mobile shoppers can autofill name / email / phone / address, and aria-live so validation and file-status are announced to screen readers.

    @wilthung
  • fix 6d24cdb

    Account page: harden attribute escaping, cap tracking prefetch, live status on Load More

    Escapes quotes in account-card markup, caps the courier-status prefetch at 4 concurrent requests (was up to 25 per page load), and re-runs it after “Load More” so newly loaded orders show live status instead of a stale badge.

    @wilthung
  • #20

    Lint: use route objects in main-account.liquid (+ fix forgot-password link)

    Small cleanup for sections/main-account.liquid. Two one-line changes. The second is a likely bug fix, not just lint.

    @wilthung
  • #19

    Security mitigation: server-render addresses, stop exposing customer.id (BBB2-6013)

    Theme-side mitigation for a confirmed security issue: renders account addresses from Shopify's authenticated customer object and stops emitting the numeric customer id into the page markup.

    @wilthung
  • #18

    QC: harden custom account/prescription layer (remove dead XSS code · add fetch timeouts · fix self-XSS)

    Touches only the custom code added on top of the Horizon theme (customer account, order tracking, prescription upload): removes dead code, adds fetch timeouts, and fixes a self-XSS. No backend, checkout, or customer-visible behaviour changes.

    @wilthung
  • feat #21

    feat: add changelog page, agent guide (CLAUDE.md), and CI workflows from Horizon v1

    Ports three things from the Horizon v1 reference into this repo: the storefront Changelog page (sections/changelog.liquid, snippets/changelog-entries.liquid, templates/page.changelog.json), the CLAUDE.md agent guide, and the CI workflows.

    @diyesh
  • init

    Initial changelog setup — Horizon theme for FAVO with custom order tracking

Open items

Work identified but not yet shipped, tracked here for visibility. Not a commitment or timeline.

Performance

  • planned Complete the A–Z medicine directory beyond the current page limit so every product page is listed and internally linked.
  • planned Faster courier-tracking status on the account page via a batched lookup.

Reliability & cart

  • needs review Gentler B2B cart handling when a session expires, so items aren't cleared without explanation.
  • needs review Keep prescription products purchasable and recoverable if the upload service is slow or briefly unavailable.

Security & backend

  • external Ongoing hardening of account and upload services — authentication, rate-limiting, and private storage — coordinated with the backend team.

Content & merchant

  • merchant Licensed-pharmacist review and attribution on medicine (obat) articles, for trust and search credibility.
  • merchant Keep prescription-privacy wording aligned with actual data handling.
  • planned Replace the prescription-form error pop-up with an inline, accessible message.