# Work Job BD — free-tier PWA starter

Bilingual (Bangla/English) installable web app starter with Supabase Auth, task listings, submissions, admin review, ledger-based balances, and withdrawal requests.

## Included
- Responsive PWA UI and service worker
- Email/password signup and login via Supabase Auth
- Active task listing and one submission per task/user
- Admin-only review RPC that credits approved task rewards once
- Ledger-backed balance and withdrawal holds/refunds
- Row Level Security (RLS) starter policies and SQL schema
- No payment gateway integration; withdrawal requests are reviewed/paid manually by the operator

## Important limitations
This is a starter project, not a fully audited production financial platform. It has not been deployed or tested against your Supabase project because you have not supplied project credentials. Never promise earnings or collect money from members without a transparent business model, terms, privacy policy, support process, and fraud controls. Do not offer rewards for artificial YouTube/Facebook likes, subscriptions, follows, comments, or shares. Use legitimate work such as content review, translation, transcription, surveys with consent, and original content creation. Follow each platform's current policies.

## Free setup
1. Create a Supabase project at https://supabase.com (free tier availability/limits can change).
2. Open SQL Editor, paste and run `supabase/schema.sql`.
3. In Authentication settings, configure Site URL and allowed redirect URLs to your eventual HTTPS site. For local testing use a local web server URL.
4. In Project Settings → API, copy the Project URL and publishable/anon key. Put these in `app.js`:
   - `SUPABASE_URL`
   - `SUPABASE_ANON_KEY`
   The browser key is public by design; RLS protects the data. **Never put a service_role/secret key in app.js.**
5. Create an account through the site. In Supabase SQL Editor, promote your email to admin:
   `update public.profiles set role='admin' where email='YOUR-ADMIN-EMAIL';`
6. Host the folder on an HTTPS static host. Options may offer free tiers (for example GitHub Pages, Cloudflare Pages, or Netlify); check current limits and terms. A service worker/PWA needs HTTPS except on localhost.
7. Open the HTTPS URL in Android Chrome → browser menu → Install app / Add to Home screen. The app shell can cache, but authentication/data require internet.

## Local preview
From this folder, run a static web server, e.g. `python -m http.server 8000`, then visit `http://localhost:8000`. Supabase still must be configured for login and data.

## Admin workflow
- Admin adds/edits tasks in Supabase Table Editor (`tasks`); only active tasks show.
- Review submitted work in the app's Admin tab and approve/reject.
- To mark withdrawals paid/rejected, call the `review_withdrawal` RPC from a trusted admin-only tool. This starter UI does not yet include withdrawal review controls; do not mark a request paid without actually sending the payment.
- Verify identity/payment destination only as necessary, and avoid storing more personal data than needed.

## Security notes before public launch
- Review RLS and SQL with a qualified developer; run tests using two regular accounts and one admin account.
- Configure email verification, password recovery, rate limits, bot protection/CAPTCHA, privacy policy, terms, task dispute handling, audit logs, and abuse reporting.
- The current browser UI intentionally never writes wallet balances directly. Rewards are inserted only by the `review_submission` database function; withdrawal amounts are held in the ledger transactionally.
- Keep `service_role` key secret. Do not trust screenshots or user-entered proof without review.
- Do not collect national ID, passwords, or payment PINs. Payment destination should only be a number/reference needed for the payout.
- For production, use a dedicated backend/payment provider and independent security review before handling significant funds.

## Project files
- `index.html`, `styles.css`, `app.js`
- `manifest.webmanifest`, `sw.js`, `icons/icon.svg`
- `supabase/schema.sql`


## Clickable task links (Facebook / YouTube / other websites)
1. In Supabase SQL Editor, run `supabase/add_task_url.sql` once.
2. In Table Editor > `tasks`, fill the `task_url` column with the full URL beginning with `https://` (for example, the public video/page URL).
3. Deploy the updated site files to Cloudflare Pages. Active tasks will show an **Open task link** link/button for logged-in members.
4. The link opens in a new tab. Members return to Work Job BD to submit their proof.
Never add private keys or service_role keys to browser code.

## Admin dashboard refresh (October 2026)

This update adds a polished admin task-creation form, task URL field, target participant slots, completed-slot progress, and a customer-facing task progress indicator.

### Required database migration
1. Open Supabase Dashboard → SQL Editor.
2. Open `supabase/add_task_management.sql` from this ZIP and run it once.
3. This migration adds `task_url`, `target_count`, and `completed_count` if missing, then updates the completed count when a submission is approved. A task automatically becomes inactive when its target count is reached.
4. Deploy the full site files in this ZIP to Cloudflare Pages. Before deployment, copy your existing Supabase Project URL and publishable/anon key into `app.js`. Never use a `service_role` or secret key in browser code.

### Admin task creation
Log in with an account whose `profiles.role` is `admin`, open the Admin tab, and use **নতুন কাজ তৈরি করুন**. Fill in both language titles/instructions, reward, optional HTTPS task URL, target participant count, and active status. The number is a participant/task-slot target, not a target for buying subscribers/followers. Paid or incentivized YouTube/Facebook subscriptions/follows can violate those platforms' fake-engagement rules; use legitimate tasks such as content reviews, surveys, data entry, or summaries instead.

### Important
This front end is not deployed automatically by generating the ZIP. Test with a non-admin customer account after deployment. The task URL opens in a new tab; users return to Work Job BD to submit their proof. Payouts are manual; the website does not send mobile-money payments automatically.


## Brand logo update
The header now uses `images/work-job-bd-logo.png`; the app icon was updated in `icons/icon.svg`. Keep the folder structure when deploying.


## কাজের প্রমাণের ছবি আপলোড চালু করা
1. Supabase Dashboard খুলে SQL Editor-এ যান।
2. এই প্যাকেজের `supabase/add_submission_proof.sql` ফাইলের সম্পূর্ণ লেখা কপি করে SQL Editor-এ চালান। এটি private `submission-proofs` bucket এবং `submissions.proof_image_path` কলাম তৈরি করবে।
3. এই আপডেটের ফাইলগুলো Cloudflare Pages-এ deploy করুন। ZIP extract করে `wjbd_pro` ফোল্ডারের ভেতরের সব ফাইল/ফোল্ডার আপলোড করবেন—`wjbd_pro` নামের বাইরের ফোল্ডারটি নয়।
4. লগইন করে একটি পরীক্ষামূলক কাজ জমা দিন; JPG/PNG/WebP ছবি সর্বোচ্চ 5 MB। অ্যাডমিন প্যানেলে pending জমার ছবিটি দেখা যাবে।

ছবির bucket private; signed link এক ঘণ্টা কার্যকর থাকে। কখনো `service_role` key ব্রাউজারের `app.js`-এ রাখবেন না।


## Customer support inbox
1. Run `supabase/add_customer_support.sql` in Supabase SQL Editor.
2. Deploy the updated `wjbd_pro` folder to Cloudflare Pages.
3. Logged-in customers can use “যোগাযোগ / মেসেজ”; admin can reply from the Admin workspace.

## Disable email confirmation (optional)
In Supabase Dashboard, open Authentication settings / Sign In Providers / Email and turn off “Confirm email” (the exact menu label may vary). Save the setting. This applies to new signups; existing accounts may still need the verification status handled separately. Disabling verification makes fake email accounts easier, so keep strong passwords, rate limits/CAPTCHA if available, and never allow unverified users to access admin privileges.

### Admin customer-message reply fix
The admin message list now loads support messages first and fetches profile emails separately, avoiding a PostgREST relationship join between `support_messages` and `profiles` that may not exist. If messages still do not appear, run `supabase/add_customer_support.sql` in the Supabase SQL Editor and verify the logged-in admin user has the `admin` role in `public.profiles`.


## Community, automatic cleanup, and 72-hour message expiry

1. In Supabase Dashboard → SQL Editor, run `supabase/add_community_cleanup.sql`. This assumes the earlier `add_submission_proof.sql` and `add_customer_support.sql` migrations have already been run. Then run `supabase/add_message_cleanup_cron.sql` separately to enable the hourly 72-hour message cleanup.
2. It adds member comments, private member-to-member messages, a member count and approved-task statistics. The counter “আয় করা সদস্য” means a member has at least one approved submission; it does not claim a cash withdrawal was paid.
3. When a submission changes to `approved`, the associated `submission-proofs` Storage object is deleted and the path is cleared. Rejected or pending submissions keep their image until manually removed or otherwise handled.
4. The separate `add_message_cleanup_cron.sql` file schedules Supabase `pg_cron` to run every hour and delete `support_messages` and `direct_messages` older than 72 hours. Confirm the job appears in Supabase Dashboard → Cron (menu wording may vary). If `pg_cron` is unavailable or that second migration reports an error, automatic 72-hour deletion is not active until the schedule is fixed.
5. Extract this ZIP and deploy the contents of the `wjbd_pro` folder to Cloudflare Pages. Then reload the site; if an older PWA version appears, close/reopen the installed app or refresh the browser.

Community comments are user-written opinions, not proof or a guarantee of payment. Members are shown with anonymous labels instead of exposing their email addresses.

## Member names and navigation update (2026-10-25)
- Run `supabase/add_member_names.sql` in Supabase SQL Editor to add `profiles.full_name` and update the member-list RPC.
- New sign-ups now ask for a display name and store it in Supabase Auth user metadata. The member picker shows that name when available, without exposing email addresses; older accounts fall back to a safe member label until they update their name.
- Navigation is a top horizontal menu on desktop and a left slide-out drawer on mobile. The login/sign-up panel and dashboard counters have a more colorful responsive design.
- After running the SQL, deploy the contents of `wjbd_pro` to Cloudflare Pages. Existing accounts may still show a generated member label until a name is added to their Auth user metadata or `profiles.full_name`.