 Matthew Meszaros
|
57adf4f9b2
|
feat: route notification.deliverEmail through GenerateNotificationHTML and drop the hand-rolled htmlEscape/inline-fragment email body
|
2026-06-28 05:27:28 +00:00 |
|
|
Matthew Meszaros
|
18486ecfd4
|
feat: add a generic branded notification email template with an optional CTA button for the in-app notification email channel
|
2026-06-28 05:27:28 +00:00 |
|
|
Matthew Meszaros
|
789da671d6
|
feat: send organization member invitations through GenerateInvitationHTML so they match the rest of the transactional mail
|
2026-06-28 05:27:18 +00:00 |
|
|
Matthew Meszaros
|
6b2ee63593
|
feat: add a branded team-invitation email template with html/template-escaped org and inviter names and a slate CTA button
|
2026-06-28 05:27:18 +00:00 |
|
|
Matthew Meszaros
|
7dcd5ac83f
|
feat: render the trial-expiration job notice via GenerateTrialExpiredHTML instead of the raw unstyled h2/ul HTML fragment
|
2026-06-28 05:27:18 +00:00 |
|
|
Matthew Meszaros
|
f57f211d20
|
feat: add a branded trial-expired email template rendered through the shared transactional base shell in internal/notify/templates
|
2026-06-28 05:27:18 +00:00 |
|
|
Matthew Meszaros
|
d61f049f6c
|
Merge pull request #49 from warmbly/feature/webhook-settings-onboarding
|
2026-06-15 08:25:23 +02:00 |
|
|
Matthew Meszaros
|
38e9ca980f
|
fix: correct the dashboard /auth/me avatar and password endpoints, guard self-row actions on the members page, align the steps-page permission gate with the server, harden realtime event handling, and remove the dead admin roles client
|
2026-06-15 08:12:35 +02:00 |
|
|
Matthew Meszaros
|
ce45ba02d9
|
docs: document the webhook platform and OAuth app webhooks, add the webhooks guide, and update the endpoint scope map
|
2026-06-15 08:11:53 +02:00 |
|
|
Matthew Meszaros
|
2c910dcdeb
|
feat: make a campaign step's Original a first-class weighted A/B arm driven by a single draggable traffic-split bar, persisting the control share as an is_control variant row
|
2026-06-15 08:11:53 +02:00 |
|
|
Matthew Meszaros
|
03acdb87e3
|
fix: thread organization_id through contact, CRM, and unibox reads and writes so non-owner org members see and edit their workspace data, and backfill contacts.organization_id for single-membership users (migration 000049)
|
2026-06-15 08:11:53 +02:00 |
|
|
Matthew Meszaros
|
a72addabeb
|
feat: add OAuth app webhook configuration with an event picker, signing-secret reveal and rotate, per-org installs, and a cross-org delivery log
|
2026-06-15 08:11:35 +02:00 |
|
|
Matthew Meszaros
|
d655ff4f59
|
feat: add the webhooks settings page with delivery observability, an onboarding setup step, and the webhook API client, hooks, and models
|
2026-06-15 08:11:35 +02:00 |
|
|
Matthew Meszaros
|
c5dfa5e4e7
|
feat: remove the HTTP-request action from campaign steps and automations in favor of signed webhooks, keep fire_event for custom payloads, and drop the now-unused outbound quota plumbing
|
2026-06-15 08:11:35 +02:00 |
|
|
Matthew Meszaros
|
660d717456
|
feat: register the webhook and oauth-app-webhook routes and wire the delivery worker, audit-to-webhook bridge, and app domain resolver into the backend
|
2026-06-15 08:11:20 +02:00 |
|
|
Matthew Meszaros
|
9d0c432be7
|
feat: let OAuth apps subscribe to webhooks by declaring a url/events/secret and materializing per-org endpoints gated by each grant's scopes, with secret rotation and delivery observability (migration 000050)
|
2026-06-15 08:11:20 +02:00 |
|
|
Matthew Meszaros
|
173736a004
|
feat: add a Stripe-grade webhook platform with a typed event catalog, HMAC-signed delivery, retries with backoff, endpoint ownership verification, per-endpoint throttling, an audit-spine event bridge, and firehose emit sites (migration 000048)
|
2026-06-15 08:11:20 +02:00 |
|
|
Matthew Meszaros
|
0a81fd361b
|
feat: add safehttp dial-time SSRF guards and the whdomain subdomain-aware allowlist matcher used to harden outbound webhook delivery
|
2026-06-15 08:11:20 +02:00 |
|
|
Matthew Meszaros
|
8209f2fbef
|
Merge pull request #48 from warmbly/feature/realtime-tracking
Realtime collaboration + presence privacy, the steps/automations flow overhaul, and the label-email action
|
2026-06-14 12:13:33 +02:00 |
|
|
Matthew Meszaros
|
ab7ed0571b
|
ci: ignore esbuild GHSA-gv7w-rqvm-qjhr (Deno-installer RCE) since we install esbuild via pnpm/npm with integrity-pinned binaries and ship it in no runtime artifact
|
2026-06-14 12:08:18 +02:00 |
|
|
Matthew Meszaros
|
899bdfb2f0
|
fix: stop the automation builder from showing 'Updated by a teammate' when the change was made by the same user elsewhere (e.g. toggling enabled from the automations list) by consulting the global self-mutation signal
|
2026-06-14 11:12:07 +02:00 |
|
|
Matthew Meszaros
|
c51946e4da
|
fix: track the current user's own audited mutations from the realtime actor id so collaborative editors can tell a self-made change (list-row toggle, another tab) apart from a teammate's edit
|
2026-06-14 11:12:07 +02:00 |
|
|
Matthew Meszaros
|
c1bd391ceb
|
docs: add a dependency-free realtime gateway reference client (connect, HELLO, heartbeat loop, seq resume, intents incl CUSTOM), a close-codes table, and OAuth-access-token auth
|
2026-06-14 11:02:12 +02:00 |
|
|
Matthew Meszaros
|
b83aa51921
|
feat: make CUSTOM_EVENT fire-event signals an explicit allow on the org channel and return structured {code, reason} errors on a failed channel join
|
2026-06-14 11:02:12 +02:00 |
|
|
Matthew Meszaros
|
799e5f10ef
|
feat: surface WebSocket connection-rejection reasons to the client as a structured {code, reason, retry_after_ms} payload (Discord-style 4003/4004/4007/4009/4010) instead of a bare 403, and fix the rate-limit 3-tuple match
|
2026-06-14 11:02:12 +02:00 |
|
|
Matthew Meszaros
|
34e579fc0f
|
feat: authenticate the realtime WebSocket with OAuth access tokens (wmat_ with the realtime scope), validated against oauth_access_grants alongside wmbly_ API keys and JWTs, and map not-a-member/forbidden rejections to close code 4010
|
2026-06-14 11:02:12 +02:00 |
|
|
Matthew Meszaros
|
fcafac4195
|
refactor: remove the campaign 'notify (webhook)' step type now that the HTTP request step covers outbound calls and there is no webhook setup surface
|
2026-06-14 10:48:06 +02:00 |
|
|
Matthew Meszaros
|
5cee0375f9
|
fix: let portaled pickers/menus nest inside capture-phase and popover containers via a shared data-floating marker, and migrate the last native date/time inputs (contact activity range, unibox snooze + send-later) to the themed pickers
|
2026-06-14 10:48:06 +02:00 |
|
|
Matthew Meszaros
|
ab24d8bbc8
|
feat: add a 'Fire event' action and campaign step that publish custom events to the realtime gateway (no public URL), an HTTP-request campaign step, a configurable automation dry-run test with per-step toggles, and fix the false 'updated by a teammate' toast on your own save
|
2026-06-14 09:52:49 +02:00 |
|
|
Matthew Meszaros
|
b94a053ac9
|
feat: replace native date/time inputs with the themed pickers across the dashboard (audit log, admin audit, CRM tasks/deals, contacts and unibox filters, new meeting, campaign schedule)
|
2026-06-14 09:52:49 +02:00 |
|
|
Matthew Meszaros
|
736bb3d0c0
|
feat: add themed DatePicker, TimePicker, and DateTimePicker primitives so the dashboard never falls back to native browser date/time controls
|
2026-06-14 09:52:49 +02:00 |
|
|
Matthew Meszaros
|
e24c75a7db
|
feat: render Pipedrive's real monogram in white on a Green Haze tile in integrations, via a full-bleed brand-logo option
|
2026-06-14 09:52:49 +02:00 |
|
|
Matthew Meszaros
|
9cf56ee0af
|
feat: match the analytics tab's range/metric controls to the deliverability tab (slate-100 track with a white active pill) instead of the dark slate-900 blocks
|
2026-06-14 09:52:49 +02:00 |
|
|
Matthew Meszaros
|
fc5e014766
|
fix: remove dead admin Roles/Users/Plans tabs, point the deliverability 'all mailboxes' link at /app/emails, and add the missing document titles so those dashboard tabs no longer read 'Page not found'
|
2026-06-14 09:52:49 +02:00 |
|
|
Matthew Meszaros
|
f598237348
|
feat: redesign the Settings tab into grouped sections with a framer-motion sliding active indicator and animated content transitions
|
2026-06-14 09:52:49 +02:00 |
|
|
Matthew Meszaros
|
e3c49fe571
|
feat: move the OAuth apps developer portal into Settings with a multi-step registration onboarding wizard (stepper, animated modal, logo upload) and an animated apps/authorized tab switch
|
2026-06-14 09:52:49 +02:00 |
|
|
Matthew Meszaros
|
fcdb31cda7
|
feat: OAuth apps always issue a client secret (drop the public/PKCE-only client type, secret required for the token exchange), add an app-logo upload endpoint, and align the docs to OAuth2 with optional PKCE
|
2026-06-14 09:52:49 +02:00 |
|
|
Matthew Meszaros
|
0fe1401f8b
|
feat: document the OAuth 2.1 authorization server (new api/oauth.mdx flow guide, authentication + permissions + endpoints scope-map updates, meta registration)
|
2026-06-13 14:10:11 +02:00 |
|
|
Matthew Meszaros
|
b06a11315f
|
feat: add the OAuth 2.1 dashboard UI: an OAuth apps page (register apps with a scope picker, one-time client secret, rotate, delete, authorized-apps tab with revoke) and a standalone consent screen at /oauth/authorize, plus the API client, hooks, and sidebar entry
|
2026-06-13 14:07:21 +02:00 |
|
|
Matthew Meszaros
|
8c175d4221
|
feat: add an OAuth 2.1 authorization server (migration 000047 apps/codes/grants, app registration CRUD, authorization-code-with-PKCE authorize+token+refresh-rotation+revoke endpoints, RFC 8414 discovery, bearer-token validation wired into the auth middleware reusing the API-permission gates, scopes mapped to API permission bits)
|
2026-06-13 13:56:39 +02:00 |
|
|
Matthew Meszaros
|
20935ef061
|
feat: add a nil-safe per-org daily outbound-action quota (Redis daily counter, anti-abuse ceiling on the HTTP-request automation node, wired in both backend and consumer, fail-open) to bound webhook relay abuse
|
2026-06-13 13:41:20 +02:00 |
|
|
Matthew Meszaros
|
1fa9c65ada
|
fix: harden every user-supplied-URL outbound path against SSRF with a shared dial-time guard (resolves the host, blocks private/loopback/link-local/metadata IPs, pins the validated IP to defeat DNS rebinding, re-validates redirects) and log automation HTTP requests + blocked attempts with org attribution
|
2026-06-13 13:34:19 +02:00 |
|
|
Matthew Meszaros
|
c5226147ac
|
fix: use Pipedrive's Green Haze (#08A742) for the provider glyph background instead of the darker favicon green
|
2026-06-13 13:28:35 +02:00 |
|
|
Matthew Meszaros
|
a7fc7263a8
|
fix: make HTTP request headers/body placeholders visible with normal input colors and fix the Set variables Add variable button (stop filtering the blank row on edit)
|
2026-06-13 13:27:29 +02:00 |
|
|
Matthew Meszaros
|
501b5009b4
|
feat: add an on-error branch to automation action nodes (try/catch routing, rose on-error handle, executor follows the error edge and treats the failure as handled instead of failing the run)
|
2026-06-13 13:15:41 +02:00 |
|
|
Matthew Meszaros
|
9aa3300f46
|
feat: capture per-action output in automation run history (HTTP status/ok, set-variables values, rendered channel/url/message) and render it under each action in the builder History panel
|
2026-06-13 13:11:58 +02:00 |
|
|
Matthew Meszaros
|
6f5f05c5a2
|
feat: document the inbound webhook automation trigger (unique per-automation URL, JSON body as event payload, token security and limits) in the automations guide
|
2026-06-13 13:08:37 +02:00 |
|
|
Matthew Meszaros
|
977daf8a01
|
feat: surface the inbound webhook trigger in the automations builder with a copyable per-automation webhook URL and caller-defined payload conditions
|
2026-06-13 13:08:04 +02:00 |
|
|
Matthew Meszaros
|
331745ecc5
|
feat: add a generic per-automation inbound webhook trigger (inbound.webhook event, token-gated POST /api/v1/integrations/inbound/automation/:token, migration 000046 inbound_token, background graph run with the JSON body as event payload)
|
2026-06-13 13:04:10 +02:00 |
|
|
Matthew Meszaros
|
9904919ae3
|
feat: replace the Pipedrive provider glyph with its real mark, a Green Haze circle and white blocky lowercase p, instead of a generic letter tile
|
2026-06-13 12:55:57 +02:00 |
|