starred/warmbly
1
0
Fork 0
mirror of https://github.com/warmbly/warmbly.git synced 2026-09-06 08:01:24 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,935 Commits 1 Branch 8 Tags
55307b0ad9f4f9cbeef4aedabb793dcee69e2bd4
Commit Graph
21 Commits
Author SHA1 Message Date
Matthew Meszaros 2e376bcd4a feat: make the tracking publisher honor user:pass@ or token@ credentials in NATS_URL by lifting them into async-nats ConnectOptions, since async-nats ignores URL userinfo unlike the Go client, and redact the userinfo from the connect log line 2026-08-30 00:21:16 -07:00
Matthew Meszaros 580109987d feat: copy tracking/static into the Rust image build context so the tracking service compiles again: handlers.rs serves the website tracker through include_str!("../static/tracking.js"), which is read at compile time, but the Dockerfile only copied Cargo.toml and src, so every Build and Push run since the website-visitor-tracking merge failed on both architectures with "couldn't read src/../static/tracking.js" while the CI cargo job stayed green because it builds from the full checkout 2026-08-29 06:16:33 -07:00
Matthew Meszaros e84d47c492 feat: drop a page hit instead of storing it under the wrong contact when tying a browser to a ticket fails after a lost identification race (attach now fails closed and the edge retries), and make the edge dedupe an atomic request-owned claim so a failed concurrent forward can only release its own entry and never a successful request's 2026-08-29 05:20:26 -07:00
Matthew Meszaros 111a5a4034 feat: read the forwarded client address from exactly one operator-named header (TRACKING_CLIENT_IP_HEADER, default x-forwarded-for with the proxy-appended last entry, cf-connecting-ip only when configured) so a client-supplied CF-Connecting-IP passed through a generic trusted proxy can no longer choose the rate-limit bucket or the stored page-hit location, with tests and the configuration, env example and compose entries 2026-08-29 05:11:22 -07:00
Matthew Meszaros 8daefbe8c4 feat: address the Greptile review on website tracking by believing forwarded-IP headers only from TRACKING_TRUSTED_PROXIES (socket peer otherwise, proxy-appended last X-Forwarded-For entry, applied to pixel, click and page-hit paths), making IdentifyVisitor report whether it claimed the row so a lost identification race re-reads the visitor and splits onto a fresh record instead of attributing the hit to the wrong contact, forgetting the edge dedupe entry when a forward to the backend fails so the retry is counted, and trimming the new Go and Rust comments to the one-line style 2026-08-29 04:16:28 -07:00
Matthew Meszaros 27630eec0a feat: add website visitor tracking for issue #255 with migration 000106 (website_tracking_settings, website_visitors, website_page_hits, all registered in the orgtransfer spec), a consent-gated dependency-free tracking.js served by the Rust tracking service with a rate-limited, size-capped, prefetch-filtered POST /p ingest that forwards to a new backend internal page-hits endpoint for server-side user-agent and GeoIP enrichment, contact identification only through the click ticket the redirect appends to registered hosts, a per-workspace retention job, page_hit events with an expandable detail view in the contact Activity timeline, a Settings > Website tracking page for the snippet and consent, location and retention configuration, realtime PAGE_HIT fanout, and a website tracking guide plus endpoint, export and configuration docs 2026-08-29 03:25:50 -07:00
Matthew Meszaros f0846eb034 feat: stop a freshly connected mailbox being silently excluded from every campaign send, by making an unset mailbox timezone representable as the empty string the campaign scheduler already checks for, since email_accounts.timezone defaulted to 'UTC' while campaigns.timezone defaults to 'Europe/London' and nothing in the OAuth or SMTP onboarding paths ever set either, so a brand new mailbox looked deliberately placed in UTC, was compared against the differing campaign zone and dropped by the hardcoded 8am-8pm business-hours gate whenever the current UTC hour fell outside it, emptying the candidate pool and failing the campaign start, adding a migration that changes the column default and converts existing 'UTC' rows because until now no API field, dashboard control or onboarding path could set that column at all so every such row is the old default rather than a choice, adding the missing Timezone field to UpdateEmail with IANA validation so the setting the sending-behaviour UI already tells people to change is finally reachable and an unloadable zone is rejected instead of being silently coerced to UTC by the scheduler, and replacing the misleading 'no active email accounts found for campaign's email tags' response for a pool that exists but is entirely gated out with a distinct message naming the real cause, via an ErrNoEligibleMailbox that wraps ErrNoEmailAccounts so the three callers that pause a campaign on it are unaffected (#126) (#125) 2026-08-16 07:54:45 +02:00
Matthew Meszaros bebc09289d build: cross compile the go images and fix realtime and the healthchecks 2026-07-21 17:34:59 +02:00
Matthew Meszaros a419bde824 build: make the docker images cgo-free and cache-mounted so builds are fast 2026-07-20 09:56:47 +02:00
Matthew Meszaros 3922333930 feat: run the tracking service on nats by default, kafka behind a cargo feature 2026-07-20 09:56:29 +02:00
Matthew Meszaros cc52878966 fix: apply cargo fmt to the tracking service (line wrapping in abuse.rs, config.rs, links.rs) so the Rust CI format check passes 2026-06-12 17:45:32 +02:00
Matthew Meszaros 8732805934 feat: replace signed click redirects with server-side link tickets (tracked_links store, internal resolver API, opaque /c/<id> URLs, layered anti-probe caches with miss budget and circuit breaker) removing TRACKING_LINK_SECRET entirely 2026-06-11 09:30:21 +02:00
Matthew Meszaros 2c5e8b2cbd feat: make TRACKING_LINK_SECRET a required boot-time secret on backend and tracking service with no unsigned mode and no rotation grace, so rotating the key revokes old links immediately 2026-06-11 09:00:04 +02:00
Matthew Meszaros 515efce991 feat: support TRACKING_LINK_SECRET_PREVIOUS rotation grace on the tracking service so rotating the click-signing key never breaks links in already-delivered emails 2026-06-11 08:53:29 +02:00
Matthew Meszaros 8b9277dabf feat: harden tracking service against abuse with per-IP rate limiting, prefetch/scanner filtering, URL length caps, and HMAC-signed click redirects (TRACKING_LINK_SECRET) closing the open-redirect hole 2026-06-11 08:11:05 +02:00
Matthew Meszaros d57febd1e3 ci: relax golangci-lint to real-bug rules, silence dead-code in tracking 
Go:
- Drop errcheck, unparam, prealloc, gosec, exportloopref from the
  enabled set. The legacy codebase has thousands of unchecked
  `tx.Rollback()` calls (idiomatic — Rollback after Commit is a
  no-op), prealloc suggestions the author chose not to follow, and
  gosec rules that don't apply to our control-plane code.
  Real-bug linters (govet, staticcheck, ineffassign, gosimple,
  unused, bodyclose, noctx, sqlclosecheck, typecheck) stay enabled.

Rust:
- Add #[allow(dead_code)] to `Config::from_aws` — legacy
  AWS-only loader kept as fallback while we migrate fully to the
  unified loader. Clippy's `-D warnings` was failing the build on
  the unused warning.
 2026-05-23 16:44:00 +00:00
Matthew Meszaros d8bb10bf8f ci: fix Bad-credentials + bump deps to clear Trivy CVEs 
Workflow:
- Add explicit `permissions: contents: read, pull-requests: read`
  so dorny/paths-filter can list PR files via the GitHub API. Without
  it the "Detect Changes" job dies with "Bad credentials" on PRs and
  every downstream language CI gets skipped.

Go:
- google.golang.org/grpc v1.78.0 → v1.79.3 (CVE-2026-33186 — HTTP/2
  path validation authorization bypass).

Elixir (realtime):
- cowboy 2.14.2 → 2.15.0 (CVE-2026-8466)
- cowlib 2.16.0 → 2.16.1 (CVE-2026-43970, CVE-2026-7790)
- phoenix 1.8.3 → 1.8.7 (CVE-2026-32689 — long-poll memory blow-up)
- plug 1.19.1 → 1.19.2 (CVE-2026-8468 — multipart header overflow)
- plug_cowboy 2.7.5 → 2.8.1 (CVE-2026-32688 — unauth DoS)
- postgrex 0.22.0 → 0.22.2 (CVE-2026-32687 — channel-name SQLi)

Rust (tracking):
- aws-lc-rs 1.15.4 → 1.17.0 (pulls aws-lc-sys to 0.41.0 — fixes
  GHSA-394x-vwmw-crm3, GHSA-65p9-r9h6-22vj, GHSA-9f94-5g5w-gf6r,
  GHSA-hfpc-8r3f-gw53, GHSA-vw5v-4f2q-w9xf)
- openssl 0.10.75 → 0.10.80 (CVE-2026-41676/8/81/898, -42327)
- rustls-webpki 0.103.9 → 0.103.13

- Add .trivyignore for GHSA-82j2-j2ch-gfr8 on the old rustls-webpki
  0.101.7 path that aws-smithy-http-client / hyper-rustls 0.24 still
  pulls in. AWS SDK hasn't migrated to rustls 0.23+ yet; the CRL
  parsing path the advisory covers isn't reachable from our usage
  (SSM + Secrets Manager at startup over the public CA chain).
 2026-05-23 16:13:39 +00:00
Matthew Meszaros c12fd93def Add local Sentry logging 2026-02-14 05:49:49 +01:00
Matthew Meszaros 141bc54974 Add sample auth UI theme 2026-02-10 19:30:47 +01:00
Máté Mészáros (Laptop) 7ed5719c15 Config & Deploy 2026-01-29 08:50:38 +01:00
Máté Mészáros (Laptop) 41624a6f79 Analytics & Tracking 2026-01-29 05:59:04 +01:00