5 Commits

Include renames

Author	SHA1	Message	Date
Matthew Meszaros	6cadcc725d	feat: answer every public request-body bind failure with a 400 that names the problem (empty body, JSON syntax error with its byte offset, wrong JSON type for the body or a named field, missing or out-of-range fields by json key) instead of a blanket malformed-JSON message or a 500, accept a single contact object on POST /v1/contacts as the CLIs send it, and drop the API-key lookup cache whose 300ns TTL made it a Redis round trip that saved nothing	2026-09-22 20:21:41 -07:00
Matthew Meszaros	cc244e5159	feat: make every admin panel list page past the first and filter by id: bind query-string ids through models.ParamUUID since gin cannot set a uuid.UUID, page the explorers and secondary lists by an opaque offset cursor with an id tiebreak instead of an id keyset that disagreed with the sort, page the audit log on (created_at, id) with an inclusive YYYY-MM-DD end day and read next_cursor on its page, cast every before-date bound to timestamptz, coalesce nullable audit ip and user agent, and report failed admin queries and 5xx mutations to PostHog or Sentry with method, path, status, code and request id	2026-09-21 02:11:38 -07:00
Matthew Meszaros	03f813dd43	feat: let an admin create a tester account that joins an existing workspace with an explicitly chosen role instead of always minting an empty one, so an OAuth reviewer signing in lands in a workspace that shows the app doing real work	2026-09-16 19:37:32 +02:00
Matt	0f3552b1bf	feat(admin): per-org limit overrides + product hard caps ... Wire the write path for the override table from the previous migration: GET /admin/organizations/:id/overrides view_organizations PUT /admin/organizations/:id/overrides manage_organizations PUT is a partial upsert — nil fields leave existing values untouched, and 0 explicitly removes that column's override (back to plan default or the product hard cap). Every write stamps granted_by/granted_at and fires an admin audit log with the diff the admin asked for. Introduce product-level hard caps in config/constants.go so plans that advertise "unlimited" still have a real backstop: 200 mailboxes, 500 total campaigns, 100 active campaigns, 100 team members, 1M contacts, 1k daily campaign sends. GetEffectiveLimits resolves per-field as override > 0 ?: plan ?: hard_cap and now never returns nil pointers, so downstream limit checks compare against a concrete ceiling on every plan tier. CanAddMember / CanAddCampaign / CanAddEmailAccount now call GetEffectiveLimits instead of GetOrganizationLimits, so admin overrides and the product hard cap both bite at runtime. AdminOrgDetail surfaces three limit blocks side-by-side — plan, raw override row (0 = inherit), and effective limits — so the UI can show exactly where each enforced number came from. Slice 2 UI lands in the next commit. Daily creation throttles ("no 1000 new campaigns in one day even on an unlimited plan") are explicitly out of scope; they need a per-day counter, tracked as a TODO on the hard-cap block.	2026-05-28 08:54:07 +02:00
Matt	4b7a0be93d	feat(admin): read-only organization endpoints ... Wire three GET endpoints behind the existing admin middleware so the admin app can browse workspaces alongside users: GET /admin/organizations list with q/cursor/limit/sort GET /admin/organizations/:id detail + plan/sub + limits + counts GET /admin/organizations/:id/members full member list with joined users The list query inlines member/email-account/campaign/active-campaign counts via subqueries so the table can render usage without an extra fetch per row. Detail layers GetOrganizationLimits + GetOrganizationCounts on top of the list shape, ensuring admin sees the same numbers the in-app limit checks enforce. Gated on AdminPermViewUsers for now since orgs are tightly coupled to user admin context today; a dedicated ViewOrganizations/ManageOrganizations pair will land alongside the write paths (per-org overrides, ban scope) in the next slice.	2026-05-28 08:39:13 +02:00