 Matthew Meszaros
|
ec6d47b39e
|
feat: register GET /v1/me in the combined-auth protected route group reachable by API keys, OAuth, and JWT
|
2026-06-28 19:09:37 +02:00 |
|
|
Matthew Meszaros
|
5e94b945ff
|
feat: add GetIdentity handler returning user, org, auth type, and granted scopes for GET /v1/me
|
2026-06-28 19:09:37 +02:00 |
|
|
Matthew Meszaros
|
5377374816
|
feat: add Identity model for the GET /v1/me caller-identity response shape
|
2026-06-28 19:09:37 +02:00 |
|
|
Matthew Meszaros
|
9dd37b0d62
|
Merge pull request #52 from warmbly/referral-credits
feat: implement referral program with credit-based rewards
|
2026-06-28 09:12:57 +02:00 |
|
|
Matthew Meszaros
|
22b75c9165
|
feat: implement ListByOrganization on the discount service test's fake redemption repo so the package typechecks under golangci-lint in CI
|
2026-06-28 06:35:42 +00:00 |
|
|
Matthew Meszaros
|
7e75394ab8
|
feat: decode the admin discount list and redemption cursors as opaque offset tokens, returning 400 on a malformed cursor instead of silently resetting to the first page
|
2026-06-28 05:58:25 +00:00 |
|
|
Matthew Meszaros
|
0d22e546a9
|
feat: update the discount service test's fake redemption repo to the new offset-based ListByCode signature
|
2026-06-28 05:58:25 +00:00 |
|
|
Matthew Meszaros
|
22bce66503
|
feat: thread an offset instead of a UUID cursor through the discount service ListRedemptions to match the offset-paged repository
|
2026-06-28 05:58:25 +00:00 |
|
|
Matthew Meszaros
|
c964e54317
|
feat: fix admin discount-code and redemption pagination by replacing the broken dc.id keyset (mismatched against ORDER BY, skipping/duplicating rows) with offset paging that emits opaque o1_ next cursors
|
2026-06-28 05:58:25 +00:00 |
|
|
Matthew Meszaros
|
56fce77b0a
|
feat: swap the admin discount search's query-bound UUID cursor for a handler-decoded Offset so the discount list's wire cursor stays opaque
|
2026-06-28 05:58:25 +00:00 |
|
|
Matthew Meszaros
|
88266a797e
|
feat: add migration 000052 indexing discount_codes on (created_at DESC, id DESC) so the admin discount list avoids a seqscan+sort once an org runs many promo codes
|
2026-06-28 05:58:25 +00:00 |
|
|
Matthew Meszaros
|
b71bef8e97
|
feat: drop the em dash from the welcome email copy to match the repo no-em-dash style rule
|
2026-06-28 05:31:23 +00:00 |
|
|
Matthew Meszaros
|
6c2ea71955
|
feat: capture base-shell render failures to Sentry in renderEmail so every transactional email template's render errors are observable
|
2026-06-28 05:31:23 +00:00 |
|
|
Matthew Meszaros
|
8373aebe99
|
feat: cover the refactored cancelled-deletion email shape with org and user template test cases
|
2026-06-28 05:31:23 +00:00 |
|
|
Matthew Meszaros
|
fe03275dbe
|
feat: apply email-client review fixes to the danger-zone deletion templates (move the callout background to the td so Outlook renders it, switch the self-closing br to plain br, and interpolate cancelled-deletion names through html/template)
|
2026-06-28 05:31:23 +00:00 |
|
|
Matthew Meszaros
|
f0bdd72153
|
feat: add tests and previews covering the trial, invitation, notification, and deletion email generators including html-escaping and no-CTA cases
|
2026-06-28 05:27:28 +00:00 |
|
|
Matthew Meszaros
|
233dee8766
|
feat: move danger-zone deletion emails onto the shared templates package and delete the off-brand standalone emails.go wrapper
|
2026-06-28 05:27:28 +00:00 |
|
|
Matthew Meszaros
|
a24b48b2f1
|
feat: add branded danger-zone deletion email templates (org/user scheduled, cancelled, reminder, completed) with semantic red/amber/green accents on the shared shell
|
2026-06-28 05:27:28 +00:00 |
|
|
Matthew Meszaros
|
57adf4f9b2
|
feat: route notification.deliverEmail through GenerateNotificationHTML and drop the hand-rolled htmlEscape/inline-fragment email body
|
2026-06-28 05:27:28 +00:00 |
|
|
Matthew Meszaros
|
18486ecfd4
|
feat: add a generic branded notification email template with an optional CTA button for the in-app notification email channel
|
2026-06-28 05:27:28 +00:00 |
|
|
Matthew Meszaros
|
789da671d6
|
feat: send organization member invitations through GenerateInvitationHTML so they match the rest of the transactional mail
|
2026-06-28 05:27:18 +00:00 |
|
|
Matthew Meszaros
|
6b2ee63593
|
feat: add a branded team-invitation email template with html/template-escaped org and inviter names and a slate CTA button
|
2026-06-28 05:27:18 +00:00 |
|
|
Matthew Meszaros
|
7dcd5ac83f
|
feat: render the trial-expiration job notice via GenerateTrialExpiredHTML instead of the raw unstyled h2/ul HTML fragment
|
2026-06-28 05:27:18 +00:00 |
|
|
Matthew Meszaros
|
f57f211d20
|
feat: add a branded trial-expired email template rendered through the shared transactional base shell in internal/notify/templates
|
2026-06-28 05:27:18 +00:00 |
|
|
Matthew Meszaros
|
8bd3a1137e
|
feat: expose the JWT referral and applied-discounts endpoints with handlers and manage_billing-gated routes
|
2026-06-28 05:09:50 +00:00 |
|
|
Matthew Meszaros
|
b1f26e24f9
|
feat: list an organization's promo redemption history through the discount service and repository for the billing page
|
2026-06-28 05:09:50 +00:00 |
|
|
Matthew Meszaros
|
a21f4d0d0e
|
feat: capture the signup referral code through the auth registration flow and the WireReferral attributor hook
|
2026-06-28 05:09:50 +00:00 |
|
|
Matthew Meszaros
|
234e624fdc
|
feat: add the Stripe customer-balance applier and wire referral reward, qualify, and clawback hooks into the Stripe webhook handlers
|
2026-06-28 05:09:50 +00:00 |
|
|
Matthew Meszaros
|
8b05f381f7
|
feat: add the referral service covering code minting, signup attribution, the reward and clawback lifecycle, and Stripe customer-balance sync in internal/app/referral
|
2026-06-28 05:09:50 +00:00 |
|
|
Matthew Meszaros
|
a6fae9f043
|
feat: add the referral repository with atomic idempotent reward and clawback ledger primitives plus code and attribution persistence in pg_referral.go
|
2026-06-28 05:09:50 +00:00 |
|
|
Matthew Meszaros
|
4e7d82f8c0
|
feat: read the new plans.referral_reward_percent column through every plan repository scan
|
2026-06-28 05:09:50 +00:00 |
|
|
Matthew Meszaros
|
6996588cb4
|
feat: add referral domain models, Plan month-equivalent and reward-cents helpers, and the referral and referral_credit audit entity types in internal/models
|
2026-06-28 05:09:50 +00:00 |
|
|
Matthew Meszaros
|
fd25383719
|
feat: add migration 000051 creating the referral_codes, referral_attributions, and referral earnings ledger and transactions tables plus a plans.referral_reward_percent column
|
2026-06-28 05:09:50 +00:00 |
|
|
Matthew Meszaros
|
2c910dcdeb
|
feat: make a campaign step's Original a first-class weighted A/B arm driven by a single draggable traffic-split bar, persisting the control share as an is_control variant row
|
2026-06-15 08:11:53 +02:00 |
|
|
Matthew Meszaros
|
03acdb87e3
|
fix: thread organization_id through contact, CRM, and unibox reads and writes so non-owner org members see and edit their workspace data, and backfill contacts.organization_id for single-membership users (migration 000049)
|
2026-06-15 08:11:53 +02:00 |
|
|
Matthew Meszaros
|
c5dfa5e4e7
|
feat: remove the HTTP-request action from campaign steps and automations in favor of signed webhooks, keep fire_event for custom payloads, and drop the now-unused outbound quota plumbing
|
2026-06-15 08:11:35 +02:00 |
|
|
Matthew Meszaros
|
660d717456
|
feat: register the webhook and oauth-app-webhook routes and wire the delivery worker, audit-to-webhook bridge, and app domain resolver into the backend
|
2026-06-15 08:11:20 +02:00 |
|
|
Matthew Meszaros
|
9d0c432be7
|
feat: let OAuth apps subscribe to webhooks by declaring a url/events/secret and materializing per-org endpoints gated by each grant's scopes, with secret rotation and delivery observability (migration 000050)
|
2026-06-15 08:11:20 +02:00 |
|
|
Matthew Meszaros
|
173736a004
|
feat: add a Stripe-grade webhook platform with a typed event catalog, HMAC-signed delivery, retries with backoff, endpoint ownership verification, per-endpoint throttling, an audit-spine event bridge, and firehose emit sites (migration 000048)
|
2026-06-15 08:11:20 +02:00 |
|
|
Matthew Meszaros
|
0a81fd361b
|
feat: add safehttp dial-time SSRF guards and the whdomain subdomain-aware allowlist matcher used to harden outbound webhook delivery
|
2026-06-15 08:11:20 +02:00 |
|
|
Matthew Meszaros
|
fcafac4195
|
refactor: remove the campaign 'notify (webhook)' step type now that the HTTP request step covers outbound calls and there is no webhook setup surface
|
2026-06-14 10:48:06 +02:00 |
|
|
Matthew Meszaros
|
ab24d8bbc8
|
feat: add a 'Fire event' action and campaign step that publish custom events to the realtime gateway (no public URL), an HTTP-request campaign step, a configurable automation dry-run test with per-step toggles, and fix the false 'updated by a teammate' toast on your own save
|
2026-06-14 09:52:49 +02:00 |
|
|
Matthew Meszaros
|
fcdb31cda7
|
feat: OAuth apps always issue a client secret (drop the public/PKCE-only client type, secret required for the token exchange), add an app-logo upload endpoint, and align the docs to OAuth2 with optional PKCE
|
2026-06-14 09:52:49 +02:00 |
|
|
Matthew Meszaros
|
8c175d4221
|
feat: add an OAuth 2.1 authorization server (migration 000047 apps/codes/grants, app registration CRUD, authorization-code-with-PKCE authorize+token+refresh-rotation+revoke endpoints, RFC 8414 discovery, bearer-token validation wired into the auth middleware reusing the API-permission gates, scopes mapped to API permission bits)
|
2026-06-13 13:56:39 +02:00 |
|
|
Matthew Meszaros
|
20935ef061
|
feat: add a nil-safe per-org daily outbound-action quota (Redis daily counter, anti-abuse ceiling on the HTTP-request automation node, wired in both backend and consumer, fail-open) to bound webhook relay abuse
|
2026-06-13 13:41:20 +02:00 |
|
|
Matthew Meszaros
|
1fa9c65ada
|
fix: harden every user-supplied-URL outbound path against SSRF with a shared dial-time guard (resolves the host, blocks private/loopback/link-local/metadata IPs, pins the validated IP to defeat DNS rebinding, re-validates redirects) and log automation HTTP requests + blocked attempts with org attribution
|
2026-06-13 13:34:19 +02:00 |
|
|
Matthew Meszaros
|
501b5009b4
|
feat: add an on-error branch to automation action nodes (try/catch routing, rose on-error handle, executor follows the error edge and treats the failure as handled instead of failing the run)
|
2026-06-13 13:15:41 +02:00 |
|
|
Matthew Meszaros
|
9aa3300f46
|
feat: capture per-action output in automation run history (HTTP status/ok, set-variables values, rendered channel/url/message) and render it under each action in the builder History panel
|
2026-06-13 13:11:58 +02:00 |
|
|
Matthew Meszaros
|
331745ecc5
|
feat: add a generic per-automation inbound webhook trigger (inbound.webhook event, token-gated POST /api/v1/integrations/inbound/automation/:token, migration 000046 inbound_token, background graph run with the JSON body as event payload)
|
2026-06-13 13:04:10 +02:00 |
|
|
Matthew Meszaros
|
f1cf470121
|
feat: render Discord notifications as sky-themed rich embeds and Slack notifications as sky-accented attachment cards with contact and subject fields instead of plain text lines
|
2026-06-13 12:41:26 +02:00 |
|