2190 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
joao-crm	83ba4b38b4	fix: re-check the addresses the built-in probe left unknown as soon as a workspace connects a paid verifier, and withdraw the connection's degraded state once that verifier answers again, since a verdict reached before the connection existed otherwise waited out the 30-day shelf life while the credits sat unused and the card kept reporting whatever the provider said on the very first pass	2026-09-08 15:48:12 +00:00
Matthew Meszaros	30f6cd5e2f	Merge pull request #373 from warmbly/fix/issue-371-public-images ... fix: publish images a stranger can actually pull, and fail the release when they cannot v0.4.1	2026-09-07 09:19:10 -07:00
Matthew Meszaros	de4b1e3aff	Merge remote-tracking branch 'origin/main' into fix/issue-371-public-images ... # Conflicts: # site/public/install.sh.sha256	2026-09-07 09:13:22 -07:00
Matthew Meszaros	cf78e394f7	Merge pull request #370 from warmbly/feat/issue-357-loopback-mail-relays ... Connect a mail server on the instance's own machine (Proton Bridge and other local relays)	2026-09-07 09:11:56 -07:00
Matthew Meszaros	6542047745	Merge remote-tracking branch 'origin/main' into fix/issue-371-public-images	2026-09-07 09:07:22 -07:00
Matthew Meszaros	25484f70ab	Merge remote-tracking branch 'origin/main' into feat/issue-357-loopback-mail-relays	2026-09-07 09:05:11 -07:00
Matthew Meszaros	398bd263bd	Merge pull request #372 from warmbly/fix/issue-356-imap-folder-identity ... Identify an IMAP folder by its name, not its UIDVALIDITY	2026-09-07 09:04:54 -07:00
Matthew Meszaros	c4bfbaf4a9	feat: address the review on the image publicity gate by passing build-push only the seven services that workflow actually publishes, since web, admin and cli have no :dev tag and would have warned falsely on every push to main, by taking the release tag through the step env instead of interpolating github.ref_name into the shell, and by no longer asserting the tag is fine when a pull is refused, because GHCR denies an unknown namespace exactly as it denies a private one, so a mistyped --registry now gets its own reading in the installer message, the troubleshooting table and the fork note, which also splits the personal and organization paths to the visibility setting	2026-09-07 09:02:23 -07:00
Matthew Meszaros	719a81866c	feat: gate the release on every published image being pullable with no credentials, because GHCR creates each package private and does not inherit the repository's visibility, so the authenticated imagetools inspect in create-release passed for four releases while ghcr.io/warmbly/warmbly/* returned unauthorized to everyone outside the org and no curl | sh self-host install could pull a byte (#371); adds scripts/check-images-public.sh as the anonymous pull test, makes it the gate before create-release and the source of the digests in images.json, warns from build-push on main where a new service image first appears, and teaches install.sh to report a registry refusal as one instead of as a missing tag	2026-09-07 08:51:57 -07:00
Matthew Meszaros	8b757985f3	feat: address the review on the folder identity change by retiring a deleted folder's backfill floor with it, since a name is reusable and an inherited floor silently skips the next folder's history, by claiming a rename only when a UIDVALIDITY has exactly one missing folder and one new one, because two missing folders and one arrival cannot say which was renamed and guessing moves the wrong folder's mail, by deduplicating names before the folder cap rather than after so a name listed twice cannot spend a real folder's slot, by deleting on a legacy UIDVALIDITY-only event only when that number still names exactly one folder, and by moving the folder row and its mail in one transaction so a refused rename cannot leave the messages in a folder nothing renamed	2026-09-07 08:49:23 -07:00
Matthew Meszaros	d48d57464b	feat: hand the SMTP auth negotiation the normalized host, because net/smtp records the name NewClient was given as the server name and PlainAuth refuses to authenticate when its own host does not match it, so a bracketed IPv6 literal failed on an address it was correct about, and stop the bulk CSV calling an unencrypted row invalid while the deployment config is still loading, where a self-hosted instance would have accepted it	2026-09-07 08:44:32 -07:00
Matthew Meszaros	63070fb833	feat: address the review on the loopback mailbox mode by building every mail address with net.JoinHostPort, so an IPv6 literal keeps the brackets a host:port string needs and "::1" on 1143 stops dialling a host called "::1:1143" with no port, by moving the self-hosted half of the rule into the dialers as well as the connect form, because an organization archive exported from a self-hosted instance carries its mailboxes and an import must not hand a hosted worker one that dials its own loopback in the clear, by refusing an unencrypted CSV row on a hosted instance where the API would only reject it a moment later, and by saying in the docs that the port never selects the mode and that the whole 127.0.0.0/8 range counts	2026-09-07 08:27:54 -07:00
Matthew Meszaros	769a05aa90	feat: identify an IMAP folder by its name rather than by its UIDVALIDITY, which RFC 3501 never promised was unique across folders, so a mailbox on a server that stamps that number with the folder's creation time no longer loses the entire sync of every folder in a tree created in the same second, with the folder row keyed on (email_id, mailbox), each stored message stamped with its folder's name alongside the UIDVALIDITY generation its uid belongs to, a rename followed as a move that carries the mail and the cursor instead of orphaning both, and a changed UIDVALIDITY treated as what it is, the cursor going void	2026-09-07 08:21:17 -07:00
Matthew Meszaros	766bd3ae6a	feat: let a self-hosted instance connect a mail server on its own machine by adding a third mailbox security mode, "none", accepted only for a loopback literal and only where the worker shares a host with the relay, so Proton Bridge on 127.0.0.1:1143/1025 and a local Dovecot or Mailpit can be connected at all, with the rule enforced in onboarding and reauth validation, again by the worker against the peer it actually dialled rather than the name it was given, and hidden from the connect form on the hosted product where the worker is never the customer's machine	2026-09-07 08:07:40 -07:00
Matthew Meszaros	b6089b3bf3	Merge pull request #369 from warmbly/fix/issue-341-behavior ... feat: give a hand-placed unsubscribe link a real anchor instead of the bare API URL	2026-09-07 06:40:11 -07:00
Matthew Meszaros	a5802b53cf	feat: address the review on the unsubscribe-link change by closing the tag scanner over quoted attributes in both the send path and the editor, so a > inside an attribute can no longer split a tag and rewrite the href that follows it into a dead link, and by scanning only the copy a plain-text step actually ships, resolving the campaign's inherited opt-out mode before warning, checking the subject too, and reporting an unreadable step list as a failed check rather than an empty scan	2026-09-07 06:34:45 -07:00
Matthew Meszaros	b25897fe67	feat: render a hand-placed {{.UnsubscribeLink}} as a real anchor labelled with the workspace's unsubscribe link text instead of shipping the bare signed API URL in the body, let the composer turn a text selection into that link so the wording stays the author's, and warn in the step editor and at preflight when a plain-text-only campaign carries a body opt-out link that has nowhere to hide its address	2026-09-07 06:34:45 -07:00
Matthew Meszaros	aa740ee4ed	Merge pull request #364 from warmbly/feat/cookieless-posthog-analytics ... Cookieless PostHog analytics for the hosted properties, with first-party signup attribution	2026-09-07 06:05:58 -07:00
Matthew Meszaros	f826cf0803	feat: state at the acquisition filter itself that it selects on the presence of a record rather than of a UTM tag, so the query, the search model and the admin panel's labels and Channel column all carry the same definition of a direct signup	2026-09-07 06:02:10 -07:00
Matthew Meszaros	26c88d2426	feat: address the CodeRabbit review on the PostHog PR by dropping a referrer that is not a hostname instead of storing its query string or fragment, redacting email-shaped values out of every acquisition field before they reach the database or an analytics property, counting an invited signup which returned before the count was taken, hanging subscription_started off the persisted trial-to-paid transition so a redelivered webhook cannot report a second start, capturing the validated provider in both OAuth mailbox paths including Warmbly Cloud, making the two acquisition toggles mutually exclusive and naming them after what they actually select, and replacing the unsupported CNIL consent-exemption claim with what the guidance says and an explicit note that qualifying is a deployment-specific assessment this document does not make	2026-09-07 05:45:11 -07:00
Matthew Meszaros	ab62f24009	Merge main into the PostHog branch after the Sentry work landed	2026-09-07 05:25:47 -07:00
Matthew Meszaros	91a7ec516e	Merge pull request #367 from warmbly/feat/sentry-everywhere ... Complete Sentry coverage across every service, optional everywhere, behind one Go wrapper	2026-09-07 05:25:31 -07:00
Matthew Meszaros	103fa00b55	feat: state in the configuration reference and the troubleshooting guide that a hosted form page takes its error-reporting environment from the forms service's APP_ENV, stamped into the page, rather than from WARMBLY_SENTRY_ENVIRONMENT like the dashboard and the admin panel do	2026-09-07 05:19:24 -07:00
Matthew Meszaros	8843e23138	feat: cover the acquisition record with live repository tests against a real schema, so the LEFT JOIN, the four columns added to the admin projection and the three channel filters are exercised rather than assumed, including that a second signup link cannot rewrite where a workspace came from and that the join does not fan out a row	2026-09-07 05:08:35 -07:00
Matthew Meszaros	7bd812d568	feat: warn once rather than silently when the analytics host is unreachable or rejects the key, so a wrong POSTHOG_KEY does not look like a quiet week, and cover the client with tests that assert the cookieless ingestion contract against a stub capture host: the sentinel distinct id, the mode flag, the three hash inputs, and that no event property names a person	2026-09-07 05:06:13 -07:00
Matthew Meszaros	b204737a05	Merge the Sentry branch (with main) into the PostHog branch	2026-09-07 05:01:38 -07:00
Matthew Meszaros	1239f1d191	Merge main into the Sentry branch, routing the new smtp reporting through the errs wrapper instead of the SDK import main added	2026-09-07 05:00:43 -07:00
Matthew Meszaros	bc4fcefc74	Merge pull request #368 from warmbly/fix/issue-343-behaviour ... feat: fix hosted form creation failing with a not-null violation on allowed_domains	2026-09-07 04:59:26 -07:00
Matthew Meszaros	8f604921ab	Merge branch 'main' into fix/issue-343-behaviour	2026-09-07 04:49:48 -07:00
Matthew Meszaros	2cfb7fdd76	Merge pull request #366 from warmbly/feat/sync-error-lifecycle ... feat(worker): let a fixed mailbox problem stop showing as an error	2026-09-07 04:49:22 -07:00
Matthew Meszaros	04dc83da38	Merge the Sentry review fixes into the PostHog branch, keeping the new JavaScript escaping for the PostHog runtime-config values too	2026-09-07 04:48:30 -07:00
Matthew Meszaros	f043bfc761	feat: address the CodeRabbit review on the Sentry PR by escaping every runtime-config value the web and admin entrypoints write into a JavaScript string literal so a quote or newline in a DSN cannot inject or discard the whole config, reporting only the count and types of a failed query's parameters instead of their values now that the db scope actually applies, cloning the fallback hub in errs.Hub so scope cannot leak between requests, flushing the tracking service before every fatal exit since process::exit skips the guard's drop, treating a blank WARMBLY_RELEASE or APP_ENV as unset in realtime, stamping the environment and a service tag into the forms page, and correcting the docs claim that an unset DSN means the SDK is never initialised	2026-09-07 04:47:51 -07:00
Matthew Meszaros	372df39eaa	feat: decide the hosted form URL scheme from the host rather than the port, so an install that terminates TLS on a non-default port (forms.example.com:8443) keeps https in its share links, embeds and base_url instead of being downgraded to http by the port check, with a private-network host now treated as the LAN install it is, one scheme helper shared by FormsBaseURL and FormURLOn so the builder's base_url and a form's share_url can never disagree, and a table test covering every install shape	2026-09-07 04:45:21 -07:00
Matthew Meszaros	4582896f54	merge	2026-09-07 04:43:45 -07:00
Matthew Meszaros	908b0b6f1e	Merge pull request #365 from warmbly/feat/smtp-every-server ... feat(worker): send through every kind of SMTP server	2026-09-07 04:41:44 -07:00
Matthew Meszaros	cebcd2cc83	merge	2026-09-07 04:37:07 -07:00
Matthew Meszaros	f1b6345337	feat: address the CodeRabbit review on the mailbox error lifecycle PR by bounding the transient-error resolution to failures raised before the sync pass ran, because JetStream is configured with MaxDeliver and no MaxAckPending so a redelivered older success could otherwise clear a newer outage and leave the mailbox looking healthy until the next distinct one, naming the archive folder in the drawer's folder note alongside the others the cap always keeps, and giving the duplicate-folder note a singular verb	2026-09-07 04:36:50 -07:00
Matthew Meszaros	d51501bef1	Merge branch 'main' into fix/issue-343-behaviour	2026-09-07 04:36:42 -07:00
Matthew Meszaros	87a7e3e1ed	feat: make a hosted form creatable again by binding an unset embed allowlist and field list as empty arrays instead of NULL in the forms repository writes, which is what made every New form fail with a not-null violation on forms.allowed_domains since the feature shipped (issue #343), and while proving the flow end to end keep the port on the shared forms host so share links and embeds resolve on a ported install, build the embed snippet on the form's own origin so an organization on a verified custom forms domain does not embed from the shared one, and apply the same empty-array fix to webhook endpoints created without event_types, which answered the raw Postgres error instead of the documented subscribe-to-everything	2026-09-07 04:35:56 -07:00
Matthew Meszaros	a2c5cd8047	Merge feat/sentry-everywhere (with main) into the PostHog branch	2026-09-07 04:31:44 -07:00
Matthew Meszaros	b4486efbf8	Merge main into the Sentry branch after the dashboard DSN fix landed	2026-09-07 04:30:44 -07:00
Matthew Meszaros	d763e6e783	Merge pull request #354 from warmbly/fix/web-sentry-dsn-runtime-config ... Read the dashboard's Sentry DSN from runtime config, so a self-host reports nowhere by default	2026-09-07 04:30:21 -07:00
Matthew Meszaros	6bfba363d3	feat: address the CodeRabbit review on the SMTP compatibility PR by carrying the server's own refusal in a rejected-recipient error so an address that no longer exists is distinguishable from one a policy blocked, classifying our own refusal to authenticate over an unencrypted link as the configuration problem it is rather than retrying it four times as an outage against a server that is answering fine, and fixing the fake server's canned refusal at construction so the session goroutine and the test no longer race on it under go test -race	2026-09-07 04:30:04 -07:00
Matthew Meszaros	6f230a3e17	feat: renumber the organization_acquisition migration from 000132 to 000133 after main landed its own 000132 for unibox mailbox uid_next, since two branches that each took the next number are green alone and collide once both merge	2026-09-07 04:27:02 -07:00
Matthew Meszaros	d00960ad59	Merge feat/sentry-everywhere (with main) into the PostHog branch	2026-09-07 04:26:17 -07:00
Matthew Meszaros	be16f77f5d	Merge main into the Sentry branch	2026-09-07 04:25:41 -07:00
Matthew Meszaros	9c63cbe0b6	Merge branch 'main' into fix/web-sentry-dsn-runtime-config	2026-09-07 04:25:16 -07:00
Matthew Meszaros	b61a3588b6	Merge feat/sentry-everywhere into the PostHog branch to keep the stack current	2026-09-07 04:24:31 -07:00
Matthew Meszaros	b1a1941574	feat: flush the SDK before exiting on a captured boot failure via a new errs.CaptureFatal, because the previous capture-then-log.Fatal pattern in the backend and consumer mains killed the background sender before it had sent anything, making a failure to boot the one error that never reached Sentry	2026-09-07 04:24:30 -07:00
Matthew Meszaros	1af5ac1ea6	feat: let a fixed mailbox problem stop showing as a permanent error (issues #362, #363): resolve a mailbox's connection errors on the first sync pass that reaches the server again, because nothing but a credential reconnect ever resolved an error row, so a five-minute outage left a red needs-attention on the mailbox for good and held its health at warning; carry what the folder listing had to skip as sync state shown in the drawer's Sync card instead of raising an error row nobody can withdraw, so the note disappears once the mailbox is back under the folder limit or the duplicate folder id is renamed; and keep only a fingerprint per message in the IMAP flag scan rather than the whole flag set and Message-ID, which held 74 MB per mailbox at the window and folder limits against 14 MB for the digests, on a worker whose base capacity is 16 mailboxes	2026-09-07 04:24:09 -07:00