Taiyabah Masjid
The masjid's own prayer times, notices, Qur'an and services — in one app,offline, in four languages.
Bolton Central Islamic Society · Registered charity 1041569
31a Draycott Street, Bolton BL1 8HD
Open the app →
[!NOTE]
Reading this without a technical background? Start at The problem, What
the app is and One Friday, end to end. Those three explain what this is and
what it does for the congregation. Everything after How the pieces actually
fit is for whoever maintains it.
How to read the diagrams
Every picture in this file uses the same four colours, and they always mean the
same thing. The connectors animate, so you can see which way the information
actually travels.
| Means |
|---|
| ⬛ Deep plum, gold border | This repository — our code, the masjid's own data |
| 🟩 Pale green | Live, in the congregation's hands today |
| 🟨 Sand, dashed border | In development — not built, and not described as built |
| ⬜ Stone | A person, or something outside the app |
The problem, in one picture
Somebody wants to know when Jumuʿah is. Before this app there were four places
to look and no way to tell which one the masjid had actually said.
The point is not that an app is nicer. It is that the times are the masjid's
own published timetable and nothing else. There is no calculation engine in
this repository. A third-party app can be excellent and still be wrong here,
because it is answering a different question: what the astronomy says, rather
than what this masjid prints on its board.
What the app is
Four tabs, and a menu that opens in place rather than taking you somewhere else.
[!IMPORTANT]
Two things carry the "in development" tag, and they stay tagged until they
are real. Membership status publishes what membership is and when the fee
falls due, but is not wired to the committee's members list, so it cannot tell
an individual whether they have paid. Recordings — past bayaans inside
the app's own player — waits on written permission from eMasjid Live, whose
infrastructure holds the archive. The live stream itself works today.
Nothing else is tagged. Before adding or removing a tag anywhere, check what
the code does rather than what this file says.
It installs to the home screen, works with no signal, and is also on Google
Play as a Trusted Web Activity over the same URL — one codebase, not two.
One Friday, end to end
The clearest way to explain the app is to follow a single Friday: a reminder
sent at nine, a timetable that rearranges itself, and two automatic alerts
before the jamāʿah.
[!TIP]
The cross-check in the middle is the part worth knowing. The app shows
times embedded in index.html; the reminder scheduler reads
data/timetable-2026.json. Both are generated from the same source, but a
refresh that updated one and not the other would announce a time nobody can
see. So every scheduled run compares the two before sending — and halts with a
logged discrepancy rather than guessing.
How the pieces actually fit
Three things are deliberately kept apart: the files the phone runs, the database
that holds requests, and the one place a secret is allowed to exist.
[!CAUTION]
The Supabase service_role key must never appear in this repository, in
index.html, or anywhere else a browser can reach it. It bypasses Row Level
Security entirely. It exists in exactly one place — Cloudflare's secret store —
where the Worker uses it to write a notice. The OneSignal REST key can message
the entire congregation and lives in the same one place: never in the
repository, never in admin.html, never in a browser.
If GitHub's secret scanning ever blocks a push, do not click "Allow
secret." Cancel, remove the key, rotate it.
The publishable key is in the app, and that is fine: Row Level Security is
the real access control. With it the app can write a hall booking, a nikāḥ
request or a request for the imam's advice, and read the notices view,
availability and term dates. It cannot read any of those requests back, and it
cannot write a notice. That was verified by querying as the anon role, not
inferred from the grants.
Hall bookings, nikāḥ requests, advice requests and notices all live in the same
Supabase project the masjid's website uses, so a request made in the app
lands in the same queue the office already works from. db/001_notices.sql is
this repository's own migration, applied by hand to the shared project.
Everything else in that schema belongs to the website repository.
The prayer timetable
Generated, never hand-entered, and never calculated.
Current dataset: 1 January – 31 December 2026 (1447–1448 AH).
This is the beginning of the README. Read the rest at the original. Read the full README ↗
