Skip to content

(feat):welfie referral fork - #60

Open
Ramyabindu wants to merge 3 commits into
amicalhq:mainfrom
Ramyabindu:feat/welfie-referral-fork
Open

Ramyabindu wants to merge 3 commits into
amicalhq:mainfrom
Ramyabindu:feat/welfie-referral-fork

Conversation

@Ramyabindu

Copy link
Copy Markdown

This pull request implements the Welfie referral fork, adding major new capabilities to the refrefhq/refref codebase. The key additions are support for referee capture via a public form, outbound webhook delivery, a secure hand-off token flow, email-based reconciliation for late signups, and comprehensive abuse controls. All changes are additive and maintain upstream compatibility. Below are the most important changes grouped by theme:

Referral Lead Capture, Hand-off, and Reconciliation:

  • Added a referee lead form and secure hand-off token flow, allowing the system to capture referees before account creation and later reconcile them via token or email. This includes new endpoints, token validation, and reconciliation logic to mark leads as qualified and link them to actual signups. [1] [2] [3] [4]

Outbound Webhook Infrastructure:

  • Introduced a robust outbound webhook dispatcher, including new tables for endpoints and deliveries, HMAC-SHA256 signing with support for secret rotation, and a worker that can run inside the API process or standalone. Webhooks are enqueued on key events (like referral qualification) and delivered with retries, backoff, and dead-lettering. [1] [2] [3] [4] [5]

Schema and Configuration:

  • Added new database tables (referral_lead, handoff_token, webhook_endpoint, webhook_delivery) and associated migration. Updated .env.example and documentation to cover new configuration options for the webhook worker and attribution window. [1] [2]

Documentation and Testing:

  • Provided detailed implementation notes in WELFIE_FORK_IMPLEMENTATION.md, outlining the fork’s architecture, flows, and testing coverage. End-to-end and unit tests were added or extended to cover all major new flows and abuse scenarios.

API and Integration:

  • Extended the signup tracking endpoint to reconcile pending leads and emit referral.qualified webhooks. Added a new /v1/handoff/exchange endpoint for secure token exchange, intended for internal use only. [1] [2]

These changes collectively enable robust, secure, and auditable referral flows with cross-device attribution and downstream integration for the Welfie product.

Ramyabindu and others added 3 commits August 13, 2026 03:11
Add the two fork-owned capabilities (referee form + outbound webhook) plus
supporting schema, single-use hand-off tokens, qualified-signup reconciliation
(hand-off token or email within the attribution window), and abuse controls.

- coredb: referral_lead, handoff_token, webhook_endpoint, webhook_delivery
  (migration 0003) + entity-id prefixes.
- @refref/webhooks (new): HMAC signing w/ rotation-overlap verify, DB-backed
  queue, worker with exponential backoff + dead-letter + replay.
- apps/refer: public /refer/invite/:code page + form, consent capture, honeypot,
  disposable-domain + self-referral checks, hand-off token, redirect to signup.
- apps/api: internal /v1/handoff/exchange (single-use), /v1/track/signup emits
  referral.qualified, optional in-process webhook worker + standalone worker.
- Tests: signing (8), abuse (9), plus a real-Postgres e2e script (38 checks).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0195CXEbCdxXHrUk27QYZQHP

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant