Commit Graph

19 Commits

Author SHA1 Message Date
Matthew Meszaros 0a81fd361b feat: add safehttp dial-time SSRF guards and the whdomain subdomain-aware allowlist matcher used to harden outbound webhook delivery 2026-06-15 08:11:20 +02:00
Matthew Meszaros 1fa9c65ada fix: harden every user-supplied-URL outbound path against SSRF with a shared dial-time guard (resolves the host, blocks private/loopback/link-local/metadata IPs, pins the validated IP to defeat DNS rebinding, re-validates redirects) and log automation HTTP requests + blocked attempts with org attribution 2026-06-13 13:34:19 +02:00
Matthew Meszaros b2c5117eca feat: preview campaign templates
Adds the shared template helper function map, send-path spintax expansion, server-side template preview validation, and the campaign template preview endpoint.
2026-06-08 15:04:53 +02:00
Matthew Meszaros e92ec7c661 feat: add ai writing credit backend
Add an organization credit ledger with idempotent consumption, plan credit grants, Anthropic/OpenAI writing providers, and a gated generation endpoint for campaign writing assistance.
2026-06-05 06:03:32 +02:00
Matthew Meszaros b701e4efab feat: send campaign email attachments
Carry attachment references inside the stored email body blob, resolve bytes on workers, and encode attachments for Gmail API and SMTP sends without changing the Kafka send-email contract.
2026-06-05 06:03:21 +02:00
Matthew Meszaros 1afe453eb0 feat: add deliverability controls
Add seed inbox-placement testing with admin management, placement result polling, and seed mailbox persistence.

Add pre-send email verification, invalid-recipient skipping, warmup-health campaign gating, and RFC 8058 one-click unsubscribe headers/endpoints.
2026-06-03 16:47:53 +02:00
Matthew Meszaros f96bdfd2c1 feat: improve warmup content safeguards
Use subject-specific humanization so short warmup subjects are not mangled by body-level opener stripping.

Add rDNS verification logging after provisioning and remove the unused public campaign breaker interface method.
2026-06-03 11:32:19 +02:00
Matthew Meszaros 2009780beb feat: add warmup batch generation
Add OpenAI Batch API support for warmup content generation, including job metadata, polling, cancellation, and completed-batch ingestion.

Share the generation prompt between sync and batch modes and humanize/lint generated threads before storing them in the warmup content library.
2026-06-03 11:14:33 +02:00
Matthew Meszaros 24422ed427 feat: add campaign template scoring
Add an advisory content score endpoint that reuses warmup linting heuristics for campaign templates.

Surface the score in the sequence editor so users can check subject and body deliverability before sending.
2026-06-03 06:27:07 +02:00
Matthew Meszaros e81f6d54cf feat: add mailbox deliverability checks
Add an email auth-check endpoint and dashboard panel for SPF, DKIM, and DMARC validation.

Expose warmup content segment editing on mailboxes so segment-aware warmup content can be selected intentionally.
2026-06-03 06:26:23 +02:00
Matthew Meszaros 15ef9d4994 feat: add warmup content controls
Add warmup content generation and admin review surfaces, plus mailbox warmup appeal/status APIs.

Track warmup engagement and tampering signals so unsafe mailboxes can be handled by the warmup flow.
2026-06-03 05:05:53 +02:00
Matthew Meszaros 2430095197 feat: move infrastructure state off dynamodb
Remove DynamoDB-backed storage paths, add Postgres/HTTP repositories for mailbox state maps, wire the internal message-map API, and add provisioning runner/migration plumbing.
2026-06-02 15:54:12 +02:00
Matthew Meszaros d8d88c7f69 feat: add warmup health tracking, migrate repos to postgres, and overhaul web UI 2026-04-03 06:08:52 +00:00
Matthew Meszaros fbb55379c5 fix: propagate captcha errors and fix JWT signing
- Return actual captcha verification errors instead of generic
  internal errors in login, registration, and reset password flows
- Fix Sentry capturing wrong variable (err -> xerr) in
  RegistrationConfirm
- Pass AuthSecret as []byte to JWT SignedString/keyfunc
- Send form data in request body instead of PostForm for Turnstile
- Improve Turnstile non-200 error handling with response body logging

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-18 06:30:50 +01:00
Matthew Meszaros 6c6d26d8f0 Update auth and onboarding flow 2026-02-14 05:38:27 +01:00
Matthew Meszaros 141bc54974 Add sample auth UI theme 2026-02-10 19:30:47 +01:00
Máté Mészáros (Laptop) a8d13a6d53 Fix: Go Tests 2026-01-29 09:23:46 +01:00
Máté Mészáros (Laptop) 4a1c8cddeb AI integration & warmup task 2026-01-24 12:31:22 +01:00
Matthew Meszaros 772c19820d New Repository: Add Backend Code 2026-01-17 14:11:14 +00:00