 Matthew Meszaros
|
babde3397c
|
feat: apply the explicit no-access message to campaigns, contacts, analytics, and API keys pages too, so every permission-gated tab says which permission is missing instead of showing nothing
|
2026-06-11 13:21:34 +02:00 |
|
|
Matthew Meszaros
|
72d2af2c3d
|
feat: inbox and email-accounts pages now show an explicit 'you don't have access' message (with the missing permission) instead of a blank or misleading-empty screen when the member lacks unibox/campaign-view access
|
2026-06-11 13:19:25 +02:00 |
|
|
Matthew Meszaros
|
b07d21b907
|
feat: add usePermission hook + a NoAccess surface that explains which permission a member is missing instead of rendering a blank page
|
2026-06-11 13:19:24 +02:00 |
|
|
Matthew Meszaros
|
3654ca0809
|
feat: profile and workspace name fields auto-save ~700ms after typing stops (empty names stay unsaved), replacing manual Discard/Save with the live status indicator
|
2026-06-11 13:00:27 +02:00 |
|
|
Matthew Meszaros
|
01e23c7596
|
feat: notifications settings auto-save instantly on toggle with a Saving/Saved header indicator, replacing the manual Discard/Save buttons
|
2026-06-11 13:00:27 +02:00 |
|
|
Matthew Meszaros
|
14837ed959
|
feat: guard settings tab switches — block in-app navigation (and warn on reload) when a tab has unsaved or failed auto-save changes, with a Stay/Discard/Save-changes dialog
|
2026-06-11 13:00:27 +02:00 |
|
|
Matthew Meszaros
|
aa9273fe06
|
feat: add autosave primitives — useAutosave hook (instant for toggles, debounced for text, with dirty/flush/retry status), an unsaved-changes registry context, and a Saving/Saved/retry header indicator
|
2026-06-11 13:00:18 +02:00 |
|
|
Matthew Meszaros
|
709b77cdc6
|
fix: notification email links use the configured APP_URL instead of a hardcoded app.warmbly.com, so dev and self-hosted deployments link to the right host
|
2026-06-11 12:43:17 +02:00 |
|
|
Matthew Meszaros
|
4f6837b395
|
fix: refresh the active-sessions list and confirm other devices were signed out after a password change, so revoked sessions disappear live
|
2026-06-11 12:42:44 +02:00 |
|
|
Matthew Meszaros
|
3c6de16321
|
fix: forgotten-password reset now revokes all existing sessions, so a reset done because access was lost or compromised fully cuts off prior devices
|
2026-06-11 12:41:55 +02:00 |
|
|
Matthew Meszaros
|
f209eca9ad
|
fix: Slack notification delivery now resolves a real channel (connection config, then the org's configured Slack automation channel) instead of an always-empty connect-time field that silently dropped every message; docs and UI corrected to match
|
2026-06-11 12:40:31 +02:00 |
|
|
Matthew Meszaros
|
3c040649c0
|
fix: changing your password now revokes every other session (keeping the current device), matching the security promise in the sign-in alert and docs
|
2026-06-11 12:39:24 +02:00 |
|
|
Matthew Meszaros
|
2d53f4f819
|
fix: rate-limit POST /me/password so a hijacked session can't brute-force the current password unthrottled
|
2026-06-11 12:38:07 +02:00 |
|
|
Matthew Meszaros
|
5bcc2baaa8
|
feat: implement the coming-soon security features — logged-in change-password (verify current, policy-checked, POST /me/password) with a real dialog, and new-device sign-in alerts (security notification category fired from the token service on an unrecognized OS+browser, delivered in-app and by email), removing the comingSoon stub helper and updating docs
|
2026-06-11 12:30:44 +02:00 |
|
|
Matthew Meszaros
|
160dc0bc76
|
feat: implement the coming-soon notification delivery channels — Email (SES/SMTP to the account email) and Slack (posts to the org's connected workspace via a new integration NotifySlack), wired in both backend and consumer with per-channel gating, real toggles replacing the coming-soon labels, and updated docs
|
2026-06-11 12:21:48 +02:00 |
|
|
Matthew Meszaros
|
39a9752d63
|
feat: real tokenized invite-accept link — public /invite landing page with safe preview (org, inviter, roles), accept-by-token plus the previously-broken accept-by-invitation-id, public preview + admin copy-link endpoints, login next-param redirect, and a Copy button that yields a working /invite?token link
|
2026-06-11 11:57:45 +02:00 |
|
|
Matthew Meszaros
|
19f66507b4
|
feat: fix multi-role review findings — atomic member+roles insert on invite accept (no partial-failure stranding), gate role deletion on the actor holding the role's permissions (blocks team-managers de-privileging admins), and hydrate+chip pending-invitation role sets
|
2026-06-11 11:32:57 +02:00 |
|
|
Matthew Meszaros
|
8540f7db15
|
feat: members can hold multiple roles — join tables for member/invitation role sets (migration 000044) with effective permissions as the bitwise OR recomputed on every assignment and role edit/delete, role_ids in invite/update APIs, multi-select checkbox role picker with colored chips in roster and invite flow, freely deletable roles
|
2026-06-11 11:24:19 +02:00 |
|
|
Matthew Meszaros
|
80d080b982
|
feat: fix realtime UUID param encoding crashing org-channel joins, remove the permission matrix from Roles & access, compact the role dropdown, and drop the redundant Integrations tab from settings nav
|
2026-06-11 11:16:13 +02:00 |
|
|
Matthew Meszaros
|
3473d09bcc
|
feat: fix review findings in the roles redesign — GetMembers role_id column (members endpoint 500), TransferOwnership role_id hygiene, accept-time role re-resolution, race-free in-use delete guard covering invitations, assignment anti-escalation with self-role-change block, canManage-gated members UI, colored RolePills, fresh currentOrganization on refetch, dev JWT_SECRET wiring for make realtime, docs corrections
|
2026-06-11 10:45:21 +02:00 |
|
|
Matthew Meszaros
|
2badeb7f50
|
feat: align team-roles docs with data-driven roles (seeded editable defaults, owner as status, color in the role editor) and drop dead accent maps from the members page
|
2026-06-11 10:20:41 +02:00 |
|
|
Matthew Meszaros
|
091b39f34e
|
feat: roles become workspace data — seed editable Admin/Manager/Viewer rows per org (migration 000043 with member backfill), require role_id for invites and role changes, add role colors with a shared colored RoleSelect dropdown in the roster and invite flow, and rebuild Roles & access around real roles with an Owner reference column
|
2026-06-11 10:18:45 +02:00 |
|
|
Matthew Meszaros
|
0b253337fc
|
feat: integrate custom roles across Roles & access settings (manager replaces the coming-soon placeholder, custom roles join the permission matrix and summary cards, permission-aware canManage gating via the org context bitmask)
|
2026-06-11 10:08:46 +02:00 |
|
|
Matthew Meszaros
|
9992eb65c4
|
feat: document custom roles in the team-roles guide (creation flow, start-from presets, propagation and anti-escalation rules, limits)
|
2026-06-11 09:46:15 +02:00 |
|
|
Matthew Meszaros
|
63b2b046f9
|
feat: custom roles dashboard UI (roles manager with built-in reference rows, permission-checkbox editor with start-from presets, custom roles in member role picker and invite flow, realtime spine refresh)
|
2026-06-11 09:45:23 +02:00 |
|
|
Matthew Meszaros
|
edd4524007
|
feat: custom organization roles backend (organization_roles table with write-through member propagation, CRUD endpoints with anti-escalation and in-use guards, custom-role invites and assignment via role_id, audited as role entity)
|
2026-06-11 09:39:52 +02:00 |
|
|
Matthew Meszaros
|
8732805934
|
feat: replace signed click redirects with server-side link tickets (tracked_links store, internal resolver API, opaque /c/<id> URLs, layered anti-probe caches with miss budget and circuit breaker) removing TRACKING_LINK_SECRET entirely
|
2026-06-11 09:30:21 +02:00 |
|
|
Matthew Meszaros
|
2c5e8b2cbd
|
feat: make TRACKING_LINK_SECRET a required boot-time secret on backend and tracking service with no unsigned mode and no rotation grace, so rotating the key revokes old links immediately
|
2026-06-11 09:00:04 +02:00 |
|
|
Matthew Meszaros
|
515efce991
|
feat: support TRACKING_LINK_SECRET_PREVIOUS rotation grace on the tracking service so rotating the click-signing key never breaks links in already-delivered emails
|
2026-06-11 08:53:29 +02:00 |
|
|
Matthew Meszaros
|
014cbe79fa
|
feat: label machine opens (Apple MPP prefetch, UA-less fetchers) with human-open upgrade semantics, exclude them from open-triggered automations, and surface the auto-open count in workspace and campaign analytics (migration 000040)
|
2026-06-11 08:33:09 +02:00 |
|
|
Matthew Meszaros
|
8af2950d0b
|
feat: reconcile missed realtime events by invalidating all queries when the websocket reconnects after a gap
|
2026-06-11 08:25:00 +02:00 |
|
|
Matthew Meszaros
|
a365aa1605
|
feat: document realtime collaboration architecture (audit spine, presence conventions, org event gating) and tracking anti-abuse layer in agent notes
|
2026-06-11 08:17:04 +02:00 |
|
|
Matthew Meszaros
|
9cc9240dd5
|
feat: document TRACKING_LINK_SECRET and TRACKING_RATE_LIMIT_PER_MIN rollout knobs in the deploy env example
|
2026-06-11 08:15:00 +02:00 |
|
|
Matthew Meszaros
|
7079efe21a
|
feat: document the developer realtime WebSocket (channels, presence, limits, close codes), add the live collaboration guide, and note bot filtering in analytics docs
|
2026-06-11 08:13:56 +02:00 |
|
|
Matthew Meszaros
|
8b9277dabf
|
feat: harden tracking service against abuse with per-IP rate limiting, prefetch/scanner filtering, URL length caps, and HMAC-signed click redirects (TRACKING_LINK_SECRET) closing the open-redirect hole
|
2026-06-11 08:11:05 +02:00 |
|
|
Matthew Meszaros
|
a06a525cf9
|
feat: live team presence across the dashboard (online avatar stack in header, viewing/replying indicators on unibox threads and rows, editing collaborators in the automation builder, campaign and contact viewers) plus audit-spine query invalidation
|
2026-06-11 08:04:11 +02:00 |
|
|
Matthew Meszaros
|
371fe0c0a3
|
feat: add Phoenix.Presence org collaboration layer (online members, viewing/editing/replying activity) with permission-gated org event fanout in the realtime service
|
2026-06-11 07:51:34 +02:00 |
|
|
Matthew Meszaros
|
fe96eff7b4
|
feat: audit-log coverage for teams, automations (typed entity), lead-sync sources, and manual meetings so the org activity trail and its realtime spine see every mutation
|
2026-06-11 07:47:29 +02:00 |
|
|
Matthew Meszaros
|
abdfd05c34
|
feat: org-scope realtime events (inbox, campaign, tracking, account health) and emit EMAIL_SENT/EMAIL_REPLIED/EMAIL_DELETED pulses so the whole team's dashboard updates live
|
2026-06-11 07:43:57 +02:00 |
|
|
Matthew Meszaros
|
fa83e55763
|
Merge pull request #47 from warmbly/feature/redesign-developers-page
feat: redesign developers page
|
2026-06-11 07:18:26 +02:00 |
|
|
Matthew Meszaros
|
65455b907d
|
feat: redesign developer page content
|
2026-06-11 05:15:56 +00:00 |
|
|
Matthew Meszaros
|
78b8a73fa8
|
feat: refactor developer page data model
|
2026-06-11 05:15:34 +00:00 |
|
|
Matthew Meszaros
|
5a2d62b030
|
Merge pull request #46 from warmbly/feature/marketing-automation
feat: add automations marketing experience
|
2026-06-11 06:28:44 +02:00 |
|
|
Matthew Meszaros
|
dcc68f6eb4
|
feat: add automations navigation and featured product entry
|
2026-06-11 06:11:42 +02:00 |
|
|
Matthew Meszaros
|
79935060ef
|
feat: add automations landing page and homepage showcase
|
2026-06-11 06:11:33 +02:00 |
|
|
Matthew Meszaros
|
d540f2227d
|
Merge pull request #45 from warmbly/feature/integrations-3
feat: key envelope-encryption DEKs by organization
|
2026-06-10 19:02:45 +02:00 |
|
|
Matthew Meszaros
|
15cf150f9e
|
feat: remove the stale worker assignment operator doc from docs/, matching the earlier operator markdown cleanup
|
2026-06-10 18:56:59 +02:00 |
|
|
Matthew Meszaros
|
bd7db069ba
|
Merge origin/main into feature/integrations-3, resolving doc conflicts by accepting the docs-restructure deletions
|
2026-06-10 18:56:47 +02:00 |
|
|
Matthew Meszaros
|
cc0c9a84ea
|
Merge pull request #44 from warmbly/chore/update-docs
Docs overhaul: branded static docs site with guides/learn/api tabs
|
2026-06-10 18:46:21 +02:00 |
|
|
Matthew Meszaros
|
49a4e1e8ec
|
feat: shorten verbose code comments in the docs app and add a one-line comment rule to the agent notes
|
2026-06-10 18:36:29 +02:00 |
|