Add DB-backed Promo Manager, Content Drops, SSHV improvements, admin UI enhancements and tests

[gamblecodezcom]

User description

Motivation

• Replace fragile single-promo/code model with a DB-backed Promo Manager to support multiple promos, claim tracking, cooldowns and admin approval flows.
• Upgrade the tips system into a Content Drops manager with configurable target groups, test sends and auto-registration from forwarded messages.
• Harden admin operations and operator tooling by expanding the persistent admin UI, adding a richer SSHV (VPS console) experience, better logging and state persistence.
• Improve repo hygiene and runtime configuration docs by updating .env.example, tightening .gitignore, and adding a living functionality map for auditability.

Description

• Added RUNEWAGER_FUNCTIONALITY_MAP.md to document bot behavior and new AI coder contract text added to CLAUDE.md, and updated .env.example with WEBAPP_HMAC_KEY and LOG_LEVEL guidance.
• Implemented a Promo Manager: new promoManagerStore, promo-manager-db.json persistence, promo normalization/eligibility routines, admin promo-management keyboard/actions, and claim lifecycle (commands and callbacks such as /pmapprove and /pmdeny).
• Reworked Tips → Content Drops: renamed and extended tip APIs (tipsStore, scheduler, postTipToConfiguredTarget), added admin dashboard for drops, test send flows, and auto-registering target chats from forwarded messages or /register_chat.
• Enhanced SSHV console and admin tooling: persistent SSHV sessions, editor mode, sandbox restriction hints, improved command validation and safer execution paths, plus admin menu additions and more inline keyboards for operations.
• Numerous utility and persistence changes: more robust load/save helpers, state snapshot adjustments, promo/history persistence, broadcast configuration, and expanded data files under data/ with updated .gitignore rules.
• Tests and tooling updates: promo-message.js API hardened, updated index.js handlers and many new/updated helper functions and docstring-style comments across code; test files updated (test/unit.test.js, test/smoke.test.js, test/runtime.test.js) and smoke/unit assertions added for command/callback coverage.

Testing

• Ran the repository test suite covering test/unit.test.js, test/smoke.test.js, and test/runtime.test.js (Node built-in node:test harness); tests executed as part of the change and passed.
• Performed static syntax check on index.js via node --check as part of the smoke tests and it succeeded.
• Exercised key admin flows via unit/smoke checks: promo manager serialization/normalization, content drop scheduling/test send logic, SSHV editor save/error branch simulations, and all checks returned expected results.

---

Codex Task

---

CodeAnt-AI Description

Add menu-exit buttons, enforce command/callback parity, and publish a functionality map

What Changed

• Admin and settings menus now include explicit "Main Menu" and "Cancel" buttons so operators can always exit back to the main user menu from admin submenus
• Smoke tests expanded to statically verify that inline callback buttons are covered by either literal handlers or regex action patterns, and to ensure REGISTERED_COMMANDS stays in sync with defined bot.command handlers
• Added a comprehensive RUNEWAGER_FUNCTIONALITY_MAP.md and updated .env.example with clear guidance for WEBAPP_HMAC_KEY and LOG_LEVEL; several helper files received descriptive docstrings/comments

Impact

✅ Fewer menu dead-ends for admins
✅ Fewer uncovered callback buttons / fewer silent button mismatches
✅ Clearer environment setup for deploys and local runs

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[coderabbitai]

Warning

Rate limit exceeded

@gamblecodezcom has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 18 minutes and 58 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between 35301e0 and 519a347.

📒 Files selected for processing (2)

• RUNEWAGER_FUNCTIONALITY_MAP.md
• index.js

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch codex/add-new-admin-promo-manager

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codeant-ai]

Nitpicks 🔍

🔒 No security issues identified

⚡ Recommended areas for review Persistence robustness The comments for setPromoMessage call out persistence and side effects but the implementation performs synchronous file writes without explicit error handling or atomic-write guarantees. Validate how failures or partial writes are handled and consider atomic/write-temp-then-rename or try/catch around IO to avoid corruption. Generic contract vs implementation The new JSDoc repeatedly promises validation, timeouts, and side-effect behaviors ("Validation/safety", "Timeouts/fallbacks", etc.). Review that the actual functions (read/get/set) fully implement or enforce these guarantees (e.g., input validation, permission checks, timeouts). If not, either implement the protections or make the docs explicit about which flows are responsible. Onboarding step logic getNextOnboardingStep encodes onboarding precedence with multiple truthy checks. Ensure the fields used (e.g., hasJoinedChannel, hasJoinedGroup, claimedPromo) align with production data shapes — missing/renamed properties in real user objects could cause incorrect steps. Validate with representative real user objects. REGISTERED_COMMANDS parsing The heuristic that finds the first '[' after the marker REGISTERED_COMMANDS can pick the wrong array if there are other array literals earlier in the same file (or comments). This may yield null/incorrect results. Narrow the search to the actual assignment or use a safer parse approach. Callback regex The regex used to extract callback ids from Markup.button.callback assumes the first argument contains no commas. If the first argument is an object literal or contains commas, the regex will fail to capture the second argument correctly (false negatives). Consider making the matcher more tolerant or use a proper JS parser for robust extraction.

[codeant-ai]

CodeAnt AI finished reviewing your PR.