 Matthew Meszaros
|
34e579fc0f
|
feat: authenticate the realtime WebSocket with OAuth access tokens (wmat_ with the realtime scope), validated against oauth_access_grants alongside wmbly_ API keys and JWTs, and map not-a-member/forbidden rejections to close code 4010
|
2026-06-14 11:02:12 +02:00 |
|
|
Matthew Meszaros
|
fcafac4195
|
refactor: remove the campaign 'notify (webhook)' step type now that the HTTP request step covers outbound calls and there is no webhook setup surface
|
2026-06-14 10:48:06 +02:00 |
|
|
Matthew Meszaros
|
5cee0375f9
|
fix: let portaled pickers/menus nest inside capture-phase and popover containers via a shared data-floating marker, and migrate the last native date/time inputs (contact activity range, unibox snooze + send-later) to the themed pickers
|
2026-06-14 10:48:06 +02:00 |
|
|
Matthew Meszaros
|
ab24d8bbc8
|
feat: add a 'Fire event' action and campaign step that publish custom events to the realtime gateway (no public URL), an HTTP-request campaign step, a configurable automation dry-run test with per-step toggles, and fix the false 'updated by a teammate' toast on your own save
|
2026-06-14 09:52:49 +02:00 |
|
|
Matthew Meszaros
|
b94a053ac9
|
feat: replace native date/time inputs with the themed pickers across the dashboard (audit log, admin audit, CRM tasks/deals, contacts and unibox filters, new meeting, campaign schedule)
|
2026-06-14 09:52:49 +02:00 |
|
|
Matthew Meszaros
|
736bb3d0c0
|
feat: add themed DatePicker, TimePicker, and DateTimePicker primitives so the dashboard never falls back to native browser date/time controls
|
2026-06-14 09:52:49 +02:00 |
|
|
Matthew Meszaros
|
e24c75a7db
|
feat: render Pipedrive's real monogram in white on a Green Haze tile in integrations, via a full-bleed brand-logo option
|
2026-06-14 09:52:49 +02:00 |
|
|
Matthew Meszaros
|
9cf56ee0af
|
feat: match the analytics tab's range/metric controls to the deliverability tab (slate-100 track with a white active pill) instead of the dark slate-900 blocks
|
2026-06-14 09:52:49 +02:00 |
|
|
Matthew Meszaros
|
fc5e014766
|
fix: remove dead admin Roles/Users/Plans tabs, point the deliverability 'all mailboxes' link at /app/emails, and add the missing document titles so those dashboard tabs no longer read 'Page not found'
|
2026-06-14 09:52:49 +02:00 |
|
|
Matthew Meszaros
|
f598237348
|
feat: redesign the Settings tab into grouped sections with a framer-motion sliding active indicator and animated content transitions
|
2026-06-14 09:52:49 +02:00 |
|
|
Matthew Meszaros
|
e3c49fe571
|
feat: move the OAuth apps developer portal into Settings with a multi-step registration onboarding wizard (stepper, animated modal, logo upload) and an animated apps/authorized tab switch
|
2026-06-14 09:52:49 +02:00 |
|
|
Matthew Meszaros
|
fcdb31cda7
|
feat: OAuth apps always issue a client secret (drop the public/PKCE-only client type, secret required for the token exchange), add an app-logo upload endpoint, and align the docs to OAuth2 with optional PKCE
|
2026-06-14 09:52:49 +02:00 |
|
|
Matthew Meszaros
|
0fe1401f8b
|
feat: document the OAuth 2.1 authorization server (new api/oauth.mdx flow guide, authentication + permissions + endpoints scope-map updates, meta registration)
|
2026-06-13 14:10:11 +02:00 |
|
|
Matthew Meszaros
|
b06a11315f
|
feat: add the OAuth 2.1 dashboard UI: an OAuth apps page (register apps with a scope picker, one-time client secret, rotate, delete, authorized-apps tab with revoke) and a standalone consent screen at /oauth/authorize, plus the API client, hooks, and sidebar entry
|
2026-06-13 14:07:21 +02:00 |
|
|
Matthew Meszaros
|
8c175d4221
|
feat: add an OAuth 2.1 authorization server (migration 000047 apps/codes/grants, app registration CRUD, authorization-code-with-PKCE authorize+token+refresh-rotation+revoke endpoints, RFC 8414 discovery, bearer-token validation wired into the auth middleware reusing the API-permission gates, scopes mapped to API permission bits)
|
2026-06-13 13:56:39 +02:00 |
|
|
Matthew Meszaros
|
20935ef061
|
feat: add a nil-safe per-org daily outbound-action quota (Redis daily counter, anti-abuse ceiling on the HTTP-request automation node, wired in both backend and consumer, fail-open) to bound webhook relay abuse
|
2026-06-13 13:41:20 +02:00 |
|
|
Matthew Meszaros
|
1fa9c65ada
|
fix: harden every user-supplied-URL outbound path against SSRF with a shared dial-time guard (resolves the host, blocks private/loopback/link-local/metadata IPs, pins the validated IP to defeat DNS rebinding, re-validates redirects) and log automation HTTP requests + blocked attempts with org attribution
|
2026-06-13 13:34:19 +02:00 |
|
|
Matthew Meszaros
|
c5226147ac
|
fix: use Pipedrive's Green Haze (#08A742) for the provider glyph background instead of the darker favicon green
|
2026-06-13 13:28:35 +02:00 |
|
|
Matthew Meszaros
|
a7fc7263a8
|
fix: make HTTP request headers/body placeholders visible with normal input colors and fix the Set variables Add variable button (stop filtering the blank row on edit)
|
2026-06-13 13:27:29 +02:00 |
|
|
Matthew Meszaros
|
501b5009b4
|
feat: add an on-error branch to automation action nodes (try/catch routing, rose on-error handle, executor follows the error edge and treats the failure as handled instead of failing the run)
|
2026-06-13 13:15:41 +02:00 |
|
|
Matthew Meszaros
|
9aa3300f46
|
feat: capture per-action output in automation run history (HTTP status/ok, set-variables values, rendered channel/url/message) and render it under each action in the builder History panel
|
2026-06-13 13:11:58 +02:00 |
|
|
Matthew Meszaros
|
6f5f05c5a2
|
feat: document the inbound webhook automation trigger (unique per-automation URL, JSON body as event payload, token security and limits) in the automations guide
|
2026-06-13 13:08:37 +02:00 |
|
|
Matthew Meszaros
|
977daf8a01
|
feat: surface the inbound webhook trigger in the automations builder with a copyable per-automation webhook URL and caller-defined payload conditions
|
2026-06-13 13:08:04 +02:00 |
|
|
Matthew Meszaros
|
331745ecc5
|
feat: add a generic per-automation inbound webhook trigger (inbound.webhook event, token-gated POST /api/v1/integrations/inbound/automation/:token, migration 000046 inbound_token, background graph run with the JSON body as event payload)
|
2026-06-13 13:04:10 +02:00 |
|
|
Matthew Meszaros
|
9904919ae3
|
feat: replace the Pipedrive provider glyph with its real mark, a Green Haze circle and white blocky lowercase p, instead of a generic letter tile
|
2026-06-13 12:55:57 +02:00 |
|
|
Matthew Meszaros
|
f1cf470121
|
feat: render Discord notifications as sky-themed rich embeds and Slack notifications as sky-accented attachment cards with contact and subject fields instead of plain text lines
|
2026-06-13 12:41:26 +02:00 |
|
|
Matthew Meszaros
|
2d41cb541e
|
feat: use Slack's real four-color hash and Close's colored orb mark, fix Calendly, and give Pipedrive a branded Green Haze tile in the integrations provider glyph
|
2026-06-13 12:37:49 +02:00 |
|
|
Matthew Meszaros
|
96f19919ac
|
feat: document the HTTP request / webhook and Set variables automation actions in the automations guide
|
2026-06-13 12:20:20 +02:00 |
|
|
Matthew Meszaros
|
534928cfdd
|
feat: add a safe Set-variables (transform) automation node — computes named values from Go templates against the event + prior step output and writes them back for later steps to reuse, running the same sandboxed text/template engine as every other action value (no I/O, no arbitrary code execution)
|
2026-06-13 12:18:45 +02:00 |
|
|
Matthew Meszaros
|
5118033389
|
feat: render real brand logos in the integrations tab — ProviderGlyph now draws the official simple-icons (CC0) SVG marks for Slack, Discord, HubSpot, Salesforce, Zapier, n8n, Calendly, Make, and Cal.com in each brand's color on a neutral tile, falling back to a tinted initial for providers without a bundled mark
|
2026-06-13 12:15:06 +02:00 |
|
|
Matthew Meszaros
|
dfdb304033
|
feat: add the HTTP request / webhook node to the automation builder — method/url/headers/body/output-key editor, registered in the action picker with a globe glyph, surfacing how to read the response in later steps and branch on {{.response.ok}}
|
2026-06-13 12:07:04 +02:00 |
|
|
Matthew Meszaros
|
f4a2b87c50
|
feat: add a configurable warmbly.http_request automation action (the generic send-a-webhook/call-any-API node) — templated method/url/headers/query/body, SSRF-guarded + bounded retry, captures the response back into the event data under an output key so downstream nodes use {{.response.body...}} and conditions branch on {{.response.ok}}
|
2026-06-13 12:02:11 +02:00 |
|
|
Matthew Meszaros
|
f2fa0d756c
|
feat: guarantee in-order gateway delivery via a per-org sequencer pool — serialize each org's events (partitioned by org id) so seq order always equals broadcast order even under concurrent ingest, closing the resume race where a higher seq could arrive first and a disconnect would skip the lower one
|
2026-06-13 11:31:07 +02:00 |
|
|
Matthew Meszaros
|
4e2fdec482
|
feat: document the resumable gateway (resume/replay, seq, resume_failed) in realtime.mdx and publish a machine-readable AsyncAPI 3.1 spec at docs/asyncapi.json describing the org channel, join/resume, HELLO, events, intents, and presence
|
2026-06-13 11:29:12 +02:00 |
|
|
Matthew Meszaros
|
4552ab4e31
|
feat: make the org realtime channel a resumable gateway — assign a monotonic per-org sequence + buffer each event in a capped Redis stream (Realtime.EventLog) before broadcast, advertise the current seq in the HELLO and stamp it on every event, and replay the missed gap (re-filtered) on reconnect via resume.last_seq or signal a full resync when the buffer no longer covers the client
|
2026-06-13 11:23:07 +02:00 |
|
|
Matthew Meszaros
|
3c7c0b6411
|
fix: finish the opaque-cursor doc sweep — change the offset query params to cursor on the CRM search operations in the OpenAPI spec, and drop the dead SearchContacts.Offset field and its docs (clamped but never used in SQL)
|
2026-06-13 11:00:59 +02:00 |
|
|
Matthew Meszaros
|
aed4a06190
|
feat: unify pagination by making the offset-based CRM deals/tasks search and meetings endpoints expose the same opaque next_cursor and {total, next_cursor, has_more} envelope as every keyset list (offset hidden inside the token), updating web clients, the OpenAPI spec, and the reference docs
|
2026-06-13 10:47:17 +02:00 |
|
|
Matthew Meszaros
|
3b987f38d0
|
feat: replace the fabricated SDK code samples and First-class SDKs claims on the developers page with honest plain-HTTP examples and an accurate OpenAPI-and-generate-your-own-client story
|
2026-06-13 07:29:17 +02:00 |
|
|
Matthew Meszaros
|
013a73b9be
|
feat: publish a machine-readable OpenAPI 3.1 spec at docs/openapi.json covering 204 operations across the public API, with an OpenAPI docs page describing how to generate clients from it
|
2026-06-13 07:29:17 +02:00 |
|
|
Matthew Meszaros
|
57e8705a82
|
feat: make public API list cursors opaque base64 tokens (internal/utils/paging) instead of raw record UUIDs, decoding on input with a 400 on a bad cursor; admin endpoints keep transparent UUID cursors
|
2026-06-13 07:18:23 +02:00 |
|
|
Matthew Meszaros
|
587eae774e
|
feat: serve the entire customer API (auth + resources) only under /v1 with no unversioned alias, and repoint the web and admin clients to the versioned base accordingly
|
2026-06-13 07:18:23 +02:00 |
|
|
Matthew Meszaros
|
7901e9a92c
|
feat: wire the Pub/Sub realtime provisioning, the instant-branch automation runner, and the campaign-chain reconciler into the backend and consumer binaries
|
2026-06-13 06:27:06 +02:00 |
|
|
Matthew Meszaros
|
49b01c6b67
|
feat: version the public API under /v1 by mounting the customer surface under both /v1 and the bare paths, adding an API-Version response header and Deprecation/Sunset headers nudging API-key callers off the unversioned aliases
|
2026-06-13 06:27:01 +02:00 |
|
|
Matthew Meszaros
|
71abb12a38
|
feat: stop campaigns silently stalling on a transient scheduler error by retrying instead of completing the task, end past-end-date campaigns cleanly, record scheduler failures to the campaign log, add a campaign-chain reconciler, and surface failures live in the dashboard activity panel
|
2026-06-13 06:27:01 +02:00 |
|
|
Matthew Meszaros
|
919af47d29
|
feat: select the realtime transport by PUBSUB_ENABLED in backend/consumer and auto-provision the Pub/Sub topics and per-topic subscriptions on boot so prod never publishes to a subscription the Elixir fanout never created
|
2026-06-13 06:26:48 +02:00 |
|
|
Matthew Meszaros
|
c5911fe37a
|
feat: fire run_automation on campaign instant branches (reply/open/click) through a wired AutomationRunner instead of stamping the action node sent without ever running the flow
|
2026-06-13 06:26:48 +02:00 |
|
|
Matthew Meszaros
|
969d53af6d
|
feat: animate the top-left Add-step dropdown the same as the drag-create menu (AnimatePresence scale + fade growing from the top-left) instead of appearing instantly
|
2026-06-12 17:47:05 +02:00 |
|
|
Matthew Meszaros
|
cc52878966
|
fix: apply cargo fmt to the tracking service (line wrapping in abuse.rs, config.rs, links.rs) so the Rust CI format check passes
|
2026-06-12 17:45:32 +02:00 |
|
|
Matthew Meszaros
|
c5ced50868
|
fix: apply mix format to the realtime service (supervisor child-list indentation in application.ex + org_channel.ex) so the Elixir CI format check passes
|
2026-06-12 17:45:32 +02:00 |
|
|
Matthew Meszaros
|
e321d582dc
|
feat: smoother campaign steps canvas — position-preserving layout (no jump on connect/disconnect), an animated drag-create dropdown, Condition adds the if-branch directly instead of a router you drag from, an open then dot instead of an auto-STOP, then-targets placed to the right for clean branch lanes, and the label-email action
|
2026-06-12 16:44:29 +02:00 |
|