Tassyir Hosting

​

What a hosted app is

name        = "Review Requests"
handle      = "review-requests"
api_version = "2026-10"

[access]
scopes = ["read_orders"]

[access.scope_reasons]
read_orders = "Find delivered orders to ask for a review"

[hosting]
mode          = "tassyir"
allowed_hosts = ["graph.facebook.com"]

[admin]
page = "/"

[[webhooks]]
topics = ["orders/delivered", "app/uninstalled"]
uri    = "/webhooks"

• Its address is https://{handle}.tassyir-apps.com, and admin.page and each webhook uri are paths on it. A hosted app has no hosting.url, no auth.callback_url and no absolute webhook uri.
• It answers only inside the dashboard. The dashboard opens your page in its frame with a session it started for that member and that installation. A visit to the address in a browser tab, a frame on another site, or a request from another app gets a short refusal, never your page.
• /.tassyir/ is Tassyir’s. On a hosted app’s origin, /.tassyir and every path below it are answered by Tassyir itself (that is where the dashboard’s session starts). The manifest refuses admin.page or a webhook uri there (MANIFEST_PATH_RESERVED), and a link of yours to it leads nowhere.
• Each installation runs the version its merchant accepted, the same as for an app on your server: a new version is offered to each installation as an update (Scopes and consent). Only a version that passed its scan and was released runs, on a merchant’s business and on a dev store alike.

​

The code

interface HostedProps {
  installation: {
    id: string;
    businessId: string;
    appId: string;
    handle: string;
    version: number;
    scopes: string[];
    storeAccess: 'all' | 'selected';
    storeIds: string[];
    devStore: boolean;
  };
  /** The dashboard member looking at your page; null for a webhook. */
  viewer: { userId: string; sessionId: string } | null;
  STORAGE: {
    sql(
      query: string,
      ...bindings: unknown[]
    ): Promise<{ rows: Record<string, unknown>[] }>;
  };
  TASSYIR: { fetch(url: string, init?: RequestInit): Promise<Response> };
}

export default {
  async fetch(
    request: Request,
    env: unknown,
    ctx: { props: HostedProps },
  ): Promise<Response> {
    const { installation, TASSYIR } = ctx.props;
    if (new URL(request.url).pathname !== '/') {
      return new Response('Not found', { status: 404 });
    }
    const res = await TASSYIR.fetch(
      'https://api.tassyir.io/apps/2026-10/orders?limit=5',
    );
    const page = (await res.json()) as { data: { id: string }[] };
    return new Response(
      `${installation.handle}: ${String(page.data.length)} recent orders`,
    );
  },
};

​

Deploy with the CLI

tassyir deploy

1. Build. It bundles your Worker’s entry (--entry <file>, else the first of src/worker.ts, src/worker.js, src/index.ts, src/index.js) into one ES module, worker.js. .html and .css files import as text (import page from './page.html' is a string).
2. Check, before anything is sent. The bundle rules below and the scan’s checks that need nothing of Tassyir’s: every problem at once, each at its place in your source (src/worker.ts:12), exit code 4. Nothing is uploaded until they pass.
3. Upload the manifest and the bundle, with your lockfile (package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock or bun.lock), which is scanned and never deployed.
4. Follow the scan until the version is released or refused, then exit by the verdict.

tassyir app version 3 --follow --app review-requests

​

The bundle rules

​

The scan

​

Where a version stands

​

Call the Admin API

async function confirm(
  TASSYIR: { fetch(url: string, init?: RequestInit): Promise<Response> },
  orderId: string,
): Promise<void> {
  const res = await TASSYIR.fetch(
    `https://api.tassyir.io/apps/2026-10/orders/${orderId}/confirm`,
    {
      method: 'POST',
      headers: {
        'content-type': 'application/json',
        'idempotency-key': `confirm-${orderId}`,
      },
      body: JSON.stringify({}),
    },
  );
  if (!res.ok) {
    const problem = (await res.json()) as { code: string; fix?: string };
    throw new Error(`${problem.code}: ${problem.fix ?? ''}`);
  }
}

• Only Admin API paths: /apps/<version>/ and segments of letters, digits, _ and -; no other path, no //, trailing /, % or ;. The URL’s host does not matter: the call always goes to Tassyir’s API.
• Only GET, POST, PUT, PATCH and DELETE, and only a JSON body of at most 100 KB. It is re-serialised before it is sent, so send ids as strings: a number past 2^53 would be rounded (the Admin API’s ids always are strings).
• Only three of your headers pass: Accept, Content-Type and Idempotency-Key (1 to 255 printable ASCII characters). Retrying a write with the same key is safe, as for any app.
• The answer is the API’s, at most 8 MiB, with Content-Type, the RateLimit-* headers, Retry-After, Idempotent-Replayed and X-Request-Id. Ask for less with limit or ?fields=.
• The installation acts, never the viewer: the activity log names your app. Rate limits are the installation’s, as for any app.

​

Storage

async function remember(
  STORAGE: {
    sql(query: string, ...bindings: unknown[]): Promise<unknown>;
  },
  orderId: string,
  stars: number,
): Promise<void> {
  await STORAGE.sql(
    'CREATE TABLE IF NOT EXISTS reviews (order_id TEXT PRIMARY KEY, stars INTEGER)',
  );
  await STORAGE.sql(
    'INSERT OR REPLACE INTO reviews (order_id, stars) VALUES (?, ?)',
    orderId,
    stars,
  );
}

• Limits: 50 MiB per installation; a query of at most 100,000 characters; at most 100 bound values, 1 MiB together; a batch of at most 50 statements; at most 5,000 rows and about 4 MiB in an answer (page with LIMIT).
• Each call is one transaction: a statement that fails, an answer too large or a database grown past its size rolls back everything the call wrote. Reads and deletes always run, so a full database can be emptied. BEGIN, COMMIT and most PRAGMAs are refused.
• Errors are thrown with a message that starts with STORAGE_FULL, STORAGE_LIMIT, STORAGE_INVALID or STORAGE_UNAVAILABLE, or SQLite’s own message.
• It is deleted 48 hours after the app is uninstalled, with the installation’s app data (Compliance and uninstall).

​

Call other services

​

Webhooks

import { WebhookKeys, verifyWebhook } from '@tassyir/app';

// The whpk_… keys of GET https://api.tassyir.io/apps/webhook-keys.
const keys = WebhookKeys.fromPublicKeys([
  'whpk_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=',
]);

async function onWebhook(
  request: Request,
  installation: { id: string; appId: string },
): Promise<Response> {
  const body = await request.text();
  const delivery = await verifyWebhook(
    { headers: request.headers, body },
    { keys, appId: installation.appId, installationId: installation.id },
  );
  console.log(delivery.event.type);
  return new Response(null, { status: 200 });
}

​

Checklist

• Every host the code calls is in allowed_hosts; nothing calls Tassyir but ctx.props.TASSYIR.
• No node: import, and the entry exports a fetch handler.
• No page, webhook or link under /.tassyir/.
• No merchant data in module-level variables.
• Nothing changes on a GET.
• Ids are strings in every body.
• tassyir deploy passes its checks before it uploads; the scan’s findings are fixed, not silenced.