Skip to main content

​
🔴 Release v2.503.0

⭐⭐⭐ Moderate Complexity • 25 commits • 267 files changed
Security and access-control hardening.

​
What’s New

  • Widget PKCE authentication – Shopify embeds now use cryptographic proof for OAuth token exchanges, eliminating token interception risks
  • AI image metadata detection – See which images in your asset library are AI-generated and manage that metadata directly in the admin panel
  • Multilingual admin content creation – Create and manage challenges, rewards, and achievements in multiple languages through admin chat
  • Secure session cookies for iframes – Widget iframe authentication now uses Partitioned cookies for cross-site privacy compliance
  • Better widget error messages – Users see clear, actionable errors when OAuth sign-in fails instead of generic failures
  • Action attribute data preservation – Partial updates to actions now merge with existing fields instead of replacing them, preventing data loss
  • Improved achievement visibility – Locked achievements are visually dimmed to help users see at a glance which ones they haven’t completed

​
Apps Updated

User App

✓ Updated – Widget security, auth improvements, achievement UX

API

✓ Updated – AI metadata, multilingual content, action merging

Admin

✓ Updated – Asset metadata UI, multilingual tools

MCP Server

✓ Updated – Multilingual entity support, test suites

Design System

✓ Updated – i18n strings for new features

Games

— No changes

​
Admin Highlights

  • AI Image Metadata Detection – View which images in the asset library are AI-generated and set or update the AI metadata flag directly in the asset detail panel
  • Secure Widget Deployment – Widget OAuth now uses PKCE for cryptographic protection, eliminating token interception risks in cross-site embeds
  • Multilingual Content Creation – Admin chat tools now support creating and updating challenges, rewards, actions, and achievements in multiple languages with automatic schema validation
  • Partitioned Session Cookies – Widget iframe authentication now uses Partitioned cookies, complying with privacy and third-party cookie regulations
  • Action Attribute Preservation – Partial updates to actions now merge with existing attributes instead of replacing them, preventing accidental data loss

​
User Highlights

  • Clearer OAuth Errors – When widget sign-in fails, you now see what went wrong (invalid token, expired session, etc.) instead of a generic failure message
  • Better Achievement Cards – Locked (uncompleted) achievements are now visually dimmed to 60% opacity, making it instantly obvious which ones you haven’t earned yet
  • Faster Widget Loading – Widget OAuth session handoff is more efficient and reliable, especially on slower connections

​
Shopify Highlights

  • PKCE-Secured Widget Authentication – Shopify app now uses Proof Key for Code Exchange (PKCE) for all widget OAuth flows, meeting OAuth 2.1 security standards
  • Partitioned Cookies for Cross-Site Embeds – Widget session cookies are now Partitioned, ensuring compatibility with browser privacy features (Storage Access API)
  • Robust OAuth Session Handoff – Improved handling of popup-to-iframe token delivery with better error reporting when handoffs fail
  • Stale Widget Recovery – If a widget is outdated and doesn’t support new security features, the system automatically recovers and reloads

​
Detailed Changes

  • Implement PKCE (Proof Key for Code Exchange) for widget OAuth flows
  • Set Partitioned session cookies for iframe auth
  • Bind identity claims to guest link tokens
  • Surface failed widget handoff errors with clear messaging
  • Implement stale widget recovery mechanism when PKCE not supported
  • Improve OAuth popup-to-iframe token delivery with better error reporting
  • Dim locked achievement cards to 60% opacity for better visual distinction
  • Improve swipe choice actions to feel like a card deck
  • Better error surfacing and user messaging for authentication failures
  • Improved mobile OAuth flow reliability
  • Asset detail drawer now displays AI metadata section
  • Allow admins to edit AI metadata (aiGenerated flag and description)
  • Implement image edit modal with AI metadata probe functionality
  • Add asset image metadata query UI
  • Enhanced asset library interface for metadata management
  • Support multilingual content in admin chat MCP tools
  • Add language-specific editors for challenge, reward, action, and achievement details
  • Improved chat stream handling for multilingual payloads
  • Automatic language schema validation and conversion
  • Add AI image metadata reading with XMP packet parsing
  • Implement IPTC DigitalSourceType detection for AI-generated images
  • Support JPEG, PNG, and WebP formats with smart heuristics
  • Add asset image metadata query endpoint
  • Store and retrieve AI metadata in image files
  • Support multilingual entity content in models and schemas
  • Fix action attribute merge on update (preserve existing fields)
  • Stop inactive leaderboard distribution crons
  • Enhanced tRPC router schemas for multilingual fields
  • Improved action update mutation with field preservation
  • Add multilingual content support to all entity creation/update tools
  • Implement language field exposure in tool schemas for inline editing
  • Language schema validation and contract enforcement
  • Update tool input/output schemas to support language arrays
  • Add comprehensive test suite for multilingual workflows
  • Update all language locale files (en, de, es, fr, nl, pt, zh)
  • Add translations for new AI metadata UI labels
  • Refine translation keys for error messages

​
Breaking Changes

  • Widget OAuth PKCE Required – Widget OAuth callback no longer supports legacy non-PKCE flows. All widget integrations must support browser WebCrypto for PKCE challenge generation. If your environment doesn’t support WebCrypto (plain HTTP, very old browsers), the widget will show an error requiring an iframe reload. Deploy an updated widget bundle to resolve.

​
Technical Notes

PKCE Implementation: Widget OAuth now requires browser WebCrypto (crypto.subtle) to generate PKCE verifiers and challenges. The flow is backward-compatible via a stale-widget recovery path that reloads the iframe if PKCE setup fails. AI Metadata Storage: Image AI metadata is read from and written to file XMP packets using standard IPTC DigitalSourceType declarations. The implementation handles JPEG, PNG, and WebP formats with smart fallback heuristics for providers that embed metadata in non-XMP container fields. Multilingual MCP Content: Payload DTOs for multilingual content use a language-keyed discriminated union pattern. The MCP tool layer automatically exposes language fields to the admin chat interface, enabling inline editing of all translations. Action Attributes Merge: The action update mutation now uses a merge strategy (patch) instead of replacement for attribute fields, preserving data from concurrent or partial updates. Fields explicitly set to null in the request still remove that attribute.

​
Usage Examples

​
Check Image AI Status in Asset Library

Admins can identify AI-generated images and update their metadata to ensure compliance with disclosure requirements.
  1. Open Admin → Asset Library
  2. Click on any image in the grid
  3. The detail drawer shows an ‘AI Metadata’ section
  4. View the ‘AI Generated’ flag and Description
  5. Edit the flag or description directly and save
  6. Changes are persisted to the image file’s XMP metadata

​
Create Multilingual Challenge via Admin Chat

Campaign managers can create challenges in multiple languages in a single chat turn using the updated MCP tools.
  1. Open Admin → Chat
  2. Ask: ‘Create a challenge with the name in English and Spanish’
  3. The chat shows inline editors for each language
  4. Fill in titles, descriptions, and requirements in both languages
  5. Submit to create a fully localized challenge

​
Widget OAuth Flow with PKCE

Widget authentication now uses PKCE for security. Most integrations work transparently; custom implementations need WebCrypto support. Security and access-control hardening.

​
Release Stats

​
Contributors

erek_d@erek_d11 commits • +15,269/-2,156 lines
dch@dch6 commits • +1,005/-146 lines
HienH@HienH2 commits • +1,039/-58 lines
zuhayrk00@zuhayrk002 commits • +5,887/-168 lines
jamescockayne@jamescockayne1 commit • +264/-7 lines
v2.503.0 deployed on August 26, 2026