325 Commits

Include renames

Author	SHA1	Message	Date
Matthew Meszaros	579b0ac04c	feat: merge main into the unsubscribe branch again, carrying the UTM campaign columns alongside unsubscribe_mode in every campaign scanner, keeping unsubscribe links out of the moved link tracker and its UTM tagging, and renumbering the opt-out migration to 000124 because main released 000123 for link clicks	2026-09-03 03:43:47 -07:00
Matthew Meszaros	78c4021053	Merge remote-tracking branch 'origin/main' into feat/link-click-attribution ... # Conflicts: # docs/content/docs/api/reference/campaigns.mdx # docs/content/docs/guides/campaigns.mdx # internal/repository/pg_campaign.go # internal/repository/pg_campaign_lifecycle.go # web/src/components/app/campaigns/NewCampaignDialog.tsx	2026-09-03 03:14:19 -07:00
Matthew Meszaros	64f2d1637b	feat: address the review on the unsubscribe PR: register the suppression family in warmblyctl, require the confirm field on the browser unsubscribe POST and cap its body, render a chosen A/B variant through the template engine so its merge fields and unsubscribe link resolve, fold curly apostrophes before opt-out phrase matching, write pasted suppression lists in one transaction, clamp copy by runes instead of bytes, add the constraints NOT VALID plus a lower(email) index in migration 000123, scope the unsubscribe link type-ahead to email bodies, and document DELETE /suppressions/:id	2026-09-03 02:20:47 -07:00
Matthew Meszaros	9485503e03	feat: merge main into the unsubscribe branch, keeping the new campaigns.kind column alongside unsubscribe_mode in every campaign scanner and renumbering the opt-out migration to 000123 because main took 000122 for campaign kind	2026-09-03 01:56:38 -07:00
Matthew Meszaros	5eb92c601c	feat: give every campaign email a working opt-out: a reply-to-opt-out line by default or an unsubscribe link (workspace setting under Settings > Sending with a per-campaign override and a {{.UnsubscribeLink}} variable), signed per-recipient unsubscribe links served on the API origin so the List-Unsubscribe header no longer points at a dead warmbly.com page, a confirm page on GET with RFC 8058 one-click on POST and a resubscribe button, reply opt-out detection through the whole-word compliance lexicon with quoted history stripped, a first-class suppression list (Contacts tab, GET/POST/DELETE /suppressions with address and domain entries, audited removal, contact drawer action), the contact Subscribed flag enforced in campaign routing, migration 000122 with a shared recipient_suppressed() predicate, and docs for all of it	2026-09-03 01:52:40 -07:00
Matthew Meszaros	1cb2b65cd7	Merge remote-tracking branch 'origin/main' into feat/link-click-attribution	2026-09-03 01:42:44 -07:00
Matthew Meszaros	24b7e26fbb	feat: add the one-time email campaign preset from #288: campaigns.kind column with sequence and one_time values and a kind field on POST /campaigns, GET /campaigns?kind= and an one_time count on /campaigns-overview, a POST /campaigns-estimate endpoint projecting deduplicated segment recipients against the mailbox pool's per-day capacity and finish date, a wizard type picker whose one-time flow runs Basics, Email, Audience, Sending and Send with send-now or scheduled start and the estimate panel and then creates, links segments and starts the campaign, a guard refusing a second email step on a one-time campaign, draft/scheduled/sending/sent wording with a One-time badge and Type filter in the campaigns list, kind on the AI create_campaign_draft tool, honouring text_only in the send and test-email paths so plain-text campaigns ship no HTML part or tracking, and the campaigns, segments, API reference and endpoint docs	2026-09-03 01:42:00 -07:00
Matthew Meszaros	e8393eaeb8	feat: identify links by ticket in the click burst check so two tickets sharing a destination still count as a scanner walking the email, re-read a deferred human click's classification with retries and skip its effects entirely when the read keeps failing instead of assuming it was a person, and document the burst window plus one second wait	2026-09-03 01:36:37 -07:00
Matthew Meszaros	8096ca047c	feat: hold a human click's side effects (evidence, instant actions, webhook, live event) until the click burst window has passed and re-read its classification first, so the first click of a security scanner's burst can no longer fire a clicked automation or webhook before the second click reveals the burst; the stamp, log row and dedupe mark are still written immediately and walked back as before	2026-09-03 01:29:54 -07:00
Matthew Meszaros	b785d3b86b	feat: address review on per-link click attribution: read bare href values and ignore data-href when tracking anchors, compare the destination host instead of substring-matching the tracking domain, tag bare URLs in plain-text bodies when UTM tagging is on, count UTM limits in characters, expose the UTM overrides in the AI campaign tool, dedupe clicks by ticket so two links sharing a destination are two clicks, count machine_clicks only for steps with machine and no human clicks, never withdraw a click stamp that predates per-link logging, keep the coarse timeline click unless a logged click stands for it, resolve the link once per event, give auto-clicks their own tooltip and make the wizard's discard guard notice toggled settings	2026-09-03 01:20:48 -07:00
Matthew Meszaros	117affbb09	Merge remote-tracking branch 'origin/main' into fix/profile-avatar-persistence	2026-09-03 01:20:48 -07:00
Matthew Meszaros	3601147c7c	feat: address review on the avatar persistence fix: avatar object keys carry a random nonce next to the millisecond epoch so two uploads in the same millisecond cannot share an immutably cached URL, the org avatar hooks capture the target workspace id when the mutation starts and patch the org pointer, list and current-org caches only for that id so a mid-flight workspace switch cannot stamp the avatar onto the wrong org, and the API docs describe the stored file deletion on remove as best effort	2026-09-03 01:15:10 -07:00
Matthew Meszaros	f579497c81	feat: make profile and workspace avatar changes survive a refresh: user avatar upload and remove go through the user service so the cached /auth/me copy is dropped instead of serving the old avatar for 30 minutes, the org list mapper carries avatar_url into the persisted workspace pointer it previously discarded, the avatar mutation hooks patch the cached user, org pointer and org queries with the server's answer before invalidating, all four handlers delete the replaced or removed object under our own avatars/ prefix with millisecond keys so quick replacements cannot collide on an immutable URL, the org avatar removal is audited, the uploader copy stops promising WebP and GIF, and the API docs note that remove deletes the stored file (fixes #295)	2026-09-03 01:06:36 -07:00
Matthew Meszaros	99be92f159	feat: attribute every campaign click to the exact link with a per-link click log (email_link_clicks) behind the contact activity timeline, campaign live feed, recent activity and the email_clicked webhook, add per-campaign automatic UTM tagging (utm_tracking with source, medium and campaign overrides, utm_content from the link text) applied at send time to the stored ticket destination, and classify opens and clicks as machine when they arrive within ten seconds of dispatch or when several links of one email are followed within five seconds, so scanner clicks are logged but never count as engagement, fire automations or send webhooks	2026-09-03 01:05:34 -07:00
Matthew Meszaros	16eed14501	feat: keep every frontend node_modules and build output out of the root Docker build context so a host forms/node_modules from a native make forms or make dev no longer overwrites the forms image's own pnpm install and aborts the build with ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY, set CI=true in the forms, web and admin app build stages so pnpm reinstalls instead of prompting in a build with no TTY, and document the symptom on the troubleshooting page (#292)	2026-09-03 01:04:27 -07:00
Matthew Meszaros	53b932292b	fix: address review findings on forms v2: the list aggregates query passed a Go int into a text concatenation so pgx could not encode it and starts, identified and the trend sparkline were always empty behind a silent degrade; the forms tables sat above campaigns in the org transfer order despite carrying a campaign_id foreign key, which would fail a full import; an imported forms domain inherited the destination workspace's stale verified flag; a form whose creator was offboarded stopped creating contacts because created_by is ON DELETE SET NULL, now falling back to the workspace owner; the forms mirror check never ran when only the web-side copy changed; and the bare metal guide asked for five DNS names while certbot requested a sixth	2026-09-01 09:49:06 -07:00
Matthew Meszaros	290f1f00aa	Merge remote-tracking branch 'origin/main' into feature/public-forms ... # Conflicts: # cmd/backend/main.go # docs/content/docs/guides/workspace-export-import.mdx	2026-09-01 09:29:53 -07:00
Matthew Meszaros	05d74dbe9f	feat: forms v2, a full redesign of the hosted form and its builder: eight one-click themes, card/wide/split layouts with a brand cover panel, classic paged and Typeform-style focus modes split on a new page_break block, logo/cover/background uploads with size, fit and veil controls, an optional header bar that can span the page or sit with the form, a real HSV colour picker and font preview, per-contact personalized links that prefill and attribute without email verification, a render-token gate so the form JSON cannot be scraped without loading the page, funnel analytics with per-page drop-off and identified visitors, a leads-style forms list and responses table, and an organization custom forms domain verified by CNAME with hourly re-checks	2026-09-01 09:27:28 -07:00
Matthew Meszaros	128e314103	Merge remote-tracking branch 'origin/main' into fix/issue-277	2026-09-01 04:03:37 -07:00
Matthew Meszaros	33011468fb	feat: rebuild the contacts bulk edit panel: a Will apply strip above the footer lists every queued change as a chip you can take back one at a time so a bulk write is never applied blind, the header names the segment or campaign the selection came from, add and remove pickers sit side by side under one heading behind small tinted glyphs instead of shouting green and red labels, the locally duplicated campaign picker is replaced by the shared CampaignMultiPicker so chips match the rest of the app, custom-field rows put key and value on one line with the type hint inline and mark a half-filled operation as skipped instead of sending it, and Escape now closes an open picker or the confirm before the drawer (with data-floating added to CategoryPicker)	2026-09-01 03:55:10 -07:00
Matthew Meszaros	d6ddf1f170	feat: fix implicit-TLS SMTP on 465 and IMAP STARTTLS on 143 behind a stored per-mailbox security mode that accepts any port, stop worker ID churn orphaning mailbox assignments via flock-claimed persistent worker ids, give the unibox a standard mail-folder sidebar (inbox/sent/drafts/archive/spam/trash) backed by a provider-derived folder column, and expose the AI tool registry over REST for non-MCP function-calling agents (#283)	2026-09-01 03:53:19 -07:00
Matthew Meszaros	103145e970	feat: address the CodeRabbit review on the segment pin and campaign selection bar: the include override for a contact created inside a segment is now written inside the contact repository's own transaction (parsed and deduped alongside campaigns and categories, org-scoped, ON CONFLICT upsert) so a failed override write rolls the contact back instead of answering 200 with a membership that never happened, the service keeps only the pre-write existence check that turns an unknown segment into a 400, and the leads selection bar drops its bulk Delete inside a campaign so the destructive bulk action matches the row action and cannot delete workspace contacts from a Leads tab	2026-09-01 03:07:39 -07:00
Matthew Meszaros	55307b0ad9	feat: fix the segment dialog UI and make a contact created inside a segment join it (issue #285): the add-to-campaign picker now shows a humanised, colour-toned campaign status instead of the raw PAUSED_NO_ACCOUNTS enum, its footer wraps instead of clipping the hint mid-sentence and the Add leads button no longer breaks across two lines, campaign status labels move to a shared components/app/campaigns/status module, the Segments, Categories and Segment pages plus every unmapped settings and onboarding route get a document title so they stop reading Page not found, and POST /contacts takes a segments array that pins the new contacts in as include overrides (validated before the write, best-effort after it) which the New contact dialog sends when opened from a segment page	2026-09-01 02:57:30 -07:00
Matthew Meszaros	7b6830daa5	feat: say segments out loud in the API scope catalog: the READ_CONTACTS and WRITE_CONTACTS descriptions served to the API key dialog (and the docs permission table) now name segments, since segment CRUD, previews, member overrides and enrolment ride on the contact scopes and the picker never said so	2026-09-01 01:32:56 -07:00
Matthew Meszaros	5e87b1bbbf	Merge remote-tracking branch 'origin/main' into feature/public-forms	2026-09-01 01:17:54 -07:00
Matthew Meszaros	60c9e316d9	feat: hosted lead-capture forms end to end: drag-and-drop builder with field settings, design panel, embed/share and submissions tabs in the dashboard, a public TanStack form app (forms/) served by the new standalone forms service (cmd/forms + internal/formserver) on FORMS_DOMAIN with per-form frame-ancestors CSP, honeypot/fill-time/Turnstile/per-IP submit protection and a same-origin JSON API proxying the backend internal API, form submissions creating contacts with categories and campaign enrollment plus realtime, audit, webhook and org-transfer coverage, migration 000114, seed forms, CI jobs, Dockerfile, systemd/nginx/compose manifests and docs	2026-09-01 01:17:51 -07:00
Matthew Meszaros	8db032a656	feat: address review on segment-campaign linking: a campaign_lead_removals table (migration 000115, orgtransfer-registered) records hand-removed leads so the automatic segment sync never re-adds them while a manual add or the one-shot enrol clears the record, PUT /campaigns/:id/segments rejects an omitted segment_ids so {} cannot detach everything, rows.Err checks on the four new link queries so a truncated read cannot commit as success, write-path enrolment syncs detached from the request goroutine with a per-org in-flight dedupe, per-campaign 30s deadlines in the sweep instead of one shared budget, and an error-with-retry state in the linked-segments dialog	2026-09-01 00:33:42 -07:00
Matthew Meszaros	66a105fb9f	feat: make segments a live campaign audience and round out lead management (issue #277): a campaign_segments link table with GET/PUT /campaigns/:id/segments (max 20, replace semantics), immediate enrolment of linked-segment members as leads plus targeted re-syncs on contact writes, segment edits, pin-ins and imports and a 2-minute backend sweep for drift, waking active campaigns and restarting completed ones through the full launch checks; a Segments manager dialog and toolbar button on the campaign Leads tab; Remove from campaign as the row action and a selection-bar bulk action so leads can leave a campaign without deleting the contact; campaign and segment pickers in the CSV import wizard backed by a new segment_ids import option that pins imported rows as include overrides; a delete guard naming linked campaigns; orgtransfer registration, live repo tests and docs for all of it	2026-08-31 08:45:27 -07:00
Matthew Meszaros	773a3ecaf2	Merge remote-tracking branch 'origin/main' into fix/account-reverification-button-missing	2026-08-31 06:26:40 -07:00
Matthew Meszaros	9d9c126b76	feat: hyphenate the 24-hour window compound in the mailboxes guide gap-throughput note	2026-08-31 05:39:53 -07:00
Matthew Meszaros	a657da3a1d	Merge remote-tracking branch 'origin/main' into fix/cold-email-sending-defaults	2026-08-31 05:39:46 -07:00
Matthew Meszaros	c28179e61f	feat: raise the campaigns ramp_start/ramp_ceiling DB CHECK constraints to 5000 (migration 000113) so raised API bounds cannot 500 on the constraint, validate the effective ramp pair against stored values on partial updates, and fix the campaign/mailbox guides on the effective cap and the 600s gap throughput bound	2026-08-31 05:31:13 -07:00
Matthew Meszaros	896fc60f4d	feat: add the missing mailbox re-verification flow (issue #274): POST /emails/onboarding/oauth/reauth/:id re-runs the provider consent for an existing Gmail/Outlook mailbox (login_hint preselect, same-address check, token rewrite keeping the stored refresh token) and PUT /emails/onboarding/smtp-imap/:id replaces SMTP/IMAP credentials after live validation; both resolve the credential-class error rows and reactivate the mailbox onto its worker, the drawer's Needs attention banner gains Re-authorize and Update credentials buttons, and the mailboxes guide documents reconnecting	2026-08-31 05:29:35 -07:00
Matthew Meszaros	f35d7e5037	feat: address CodeRabbit review on the segment ID chip: narrow the API reference sentence to endpoints that operate on an existing segment, add an aria-label and a polite sr-only status to the copy button so the copied state reaches assistive technology	2026-08-31 04:19:20 -07:00
Matthew Meszaros	d7a17a0149	feat: make the per-mailbox daily campaign cap configurable up to 5000 (issue #276): raise campaign_limit, campaign daily_limit and ramp start/ceiling validation to config.LimitMax, warn in the dashboard above 100/day, and update aitools, zapier and docs copy to match	2026-08-31 03:50:36 -07:00
Matthew Meszaros	55156a8964	feat: surface the segment ID for API integrators: a click-to-copy ID chip in the segment page header, a Copy segment ID entry in the segments list row menu, a Segments in the API section in the segments guide pointing at the CRUD, members and enrolment endpoints, and a note in the API reference on where the dashboard shows the ID	2026-08-31 03:47:12 -07:00
Matthew Meszaros	7a7c6051bc	Merge remote-tracking branch 'origin/main' into feature/contact-segments	2026-08-30 02:07:56 -07:00
Matthew Meszaros	b99e77c389	feat: replace the contact filter side sheet with an inline interactive filter bar: always-visible Category, Segment, Status and Campaign pills that apply on the spot, an Add filter menu for custom fields, date added, last updated, campaign count and (on Leads) lead status and engagement, editable pills with remove, a live matching count, Clear and Save as segment, half-filled custom-field pills kept out of the request, and docs for filtering the list	2026-08-30 01:57:38 -07:00
Matthew Meszaros	7dc6a9a26c	feat: fold segments into the contacts area instead of a separate nav item: a Contacts layout with All contacts, Segments and Categories tabs, segment pages moved to /app/contacts/segments, a new Categories tab with live counts, rename, color, create and delete, a Save as segment button in the contact filter panel that opens the editor with the filters mapped to conditions, and ?category= pre-filtering of the contact list	2026-08-30 01:50:57 -07:00
Matthew Meszaros	072ff1a39c	Merge branch 'main' into fix/issue-265	2026-08-30 01:05:03 -07:00
Matthew Meszaros	802c0913b0	feat: address review on the bare-metal guide: bind NATS to loopback through /etc/nats.conf and document token plus TLS auth before opening it to remote workers, clone and build as the unprivileged user with sudo install into /opt/warmbly/bin, and issue certificates with certbot certonly --standalone before enabling the nginx site	2026-08-30 00:21:16 -07:00
Matthew Meszaros	2e376bcd4a	feat: make the tracking publisher honor user:pass@ or token@ credentials in NATS_URL by lifting them into async-nats ConnectOptions, since async-nats ignores URL userinfo unlike the Go client, and redact the userinfo from the connect log line	2026-08-30 00:21:16 -07:00
Matthew Meszaros	52916ab60d	feat: verification evidence engine and Greptile fixes for #264: contact_verification_evidence ledger (migration 000111) fed by clean deliveries, human opens, clicks, replies and recipient-naming bounces from the send, tracking, reply and bounce paths, a decaying score that lets real mail outrank a probe and a newer bounce outrank older engagement, verification_confidence on every contact with a reasons list and animated Deliverability card in the contact drawer, per-organization probe breakers, undeliverable counts that ignore finished leads, tighter wiring comments, and docs	2026-08-29 23:49:33 -07:00
Matthew Meszaros	50663ef652	feat: document the segments endpoints, condition format, segment_ids search filter and the add/remove-segment sequence actions in the API reference, and note that segments travel in workspace archives	2026-08-29 23:45:06 -07:00
Matthew Meszaros	abd2ebca97	feat: document segments in a new guide (building, overrides, sequence actions, using, limits), register it in the guides index and link it from the contacts guide	2026-08-29 23:45:06 -07:00
Matthew Meszaros	393caf6b3a	feat: link the Compose self-hosting guide's Beyond compose section to the new Deploying without Docker page and the deploy/systemd and deploy/nginx assets	2026-08-29 23:37:22 -07:00
Matthew Meszaros	e1599f6dc0	feat: register the bare-metal page in the Self-hosting docs section directly after the Compose deployment guide	2026-08-29 23:37:22 -07:00
Matthew Meszaros	cc6783cb0a	feat: add docs page Deploying without Docker covering backing services, building the Go, Rust, Elixir and Vite artifacts from source, hand-written config.js, warmbly.env and worker.env, systemd, nginx, claiming, native remote workers, upgrades, backups and troubleshooting	2026-08-29 23:37:22 -07:00
Matthew Meszaros	a02ff7c936	feat: address verification overhaul for #264: MillionVerifier as a pay-as-you-go integration plugin with org-sealed key and automatic fallback to the built-in check, built-in prober gains domain cache, Microsoft/Yahoo fingerprinting, MX fallback, disposable/role sub-statuses and a self-check breaker, imports and POST /contacts accept verification results in any known provider vocabulary with auto-detected columns, verdict provenance and expiry columns (migration 000110), campaigns park at paused_undeliverable with re-verify/send-anyway instead of finishing, POST/GET /contacts/verification bulk actions and overview, launch gate override via acknowledge_list_risk, animated verification marks, banner and settings card in the dashboard, and docs	2026-08-29 23:11:22 -07:00
Matthew Meszaros	2a831e9783	feat: let a linked self-hosted instance sign Google and Microsoft mailboxes in through Warmbly Cloud's own OAuth apps and send with cloud-brokered access tokens: the cloud runs the consent (pool_link_mailboxes.managed, brokered state in Redis, the existing /addresses/*/callback completes it and redirects to the instance's /cloud-oauth/done), keeps the refresh grant, mints short-lived tokens at /pool-link/instance/mailboxes/:id/token and refuses them for revoked links, removed, inactive or blocked mailboxes; the instance mirrors such mailboxes without a credential (cloud_link_mailboxes.managed), ships them to the worker as brokered so goog/msgraph init on a token source that pulls from /api/v1/internal/cloud-link/token/:id, lets the consumer ignore cloud warmup tokens for enrolled mailboxes, and can adopt mailboxes connected directly on the workspace; Add account shows the cloud path and the adoptable list, and the Warmbly Cloud guide documents the model	2026-08-29 09:50:52 -07:00