Devin AI
b65cda5680
feat: make Avro block limit and Cowboy header rejection regressions fail on unrelated errors or stalled sockets
2026-10-10 04:10:49 +00:00
Matthew Meszaros
7cddfc869b
feat: patch security dependencies and bound Kafka Avro decoding while rejecting realtime response header injection
2026-10-10 03:54:07 +00:00
Matthew Meszaros
bb4156cc6a
feat: add resource-scoped member access that restricts a member to selected campaign folders, campaigns and mailboxes read-only, enforced in the API route gate, SQL filters, permission trigger, realtime channels and dashboard
2026-10-09 13:34:05 +02:00
Matthew Meszaros and Devin AI
b4ef37fe82
feat: restore existing self-host realtime connections through normalized legacy gateway URLs and an authenticated API-origin WebSocket proxy, preserve ticket-bound client IP limits and direct retry fallback, and remember workspace mailbox tag filters across navigation with deterministic default account grouping
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-08 06:57:48 +00:00
Matthew Meszaros
8cb5893e37
feat: keep accepting API keys and OAuth tokens in the realtime socket URL as a deprecated fallback for existing clients, preferring the x-warmbly-token header and keeping the value out of logs
2026-10-04 05:20:20 -07:00
Matthew Meszaros
3a2d80b8bf
feat: accept realtime API keys and OAuth tokens only in the x-warmbly-token handshake header with the ws ticket alone in the query string, filter token and key params from Phoenix connect logs, refuse realtime keys, OAuth tokens and pool link tokens held by a login-banned user or a suspended app with an uncached key check, and send the key as a header from warmbly events tail
2026-10-04 02:56:18 -07:00
Matthew Meszaros
33f99b97e5
feat: end every session on sign-out-everywhere through RevokeOtherSessions with cache eviction after commit, refuse refresh on a revoked session, close a user's realtime sockets on any session revocation via a SESSIONS_REVOKED event, and verify tokens without a purpose claim for no flow
2026-10-04 02:56:18 -07:00
Matthew Meszaros
1b45c630bb
feat: end a removed member's sessions and OAuth app grants through a removal hook detached from the request, refuse OAuth tokens whose holder is no longer a member, clear and detach a session selection that outlived its membership, gate subscription checkout, portal and cancel on manage_billing in the API and the dashboard, re-read org channel permissions live on member, role and ownership changes and withhold gated events while they cannot be read, drop the unrouted GitHub releases webhook handler, and correct v1 and release trigger paths in the docs
2026-09-26 22:07:54 -07:00
Matthew Meszaros
86c5a06893
feat: disconnect a removed member's realtime sockets from the event broadcaster so campaign and account channels end too, and keep invalidating the remaining cached sessions when one invalidation fails
2026-09-26 21:30:03 -07:00
Matthew Meszaros
2df8991db5
feat: scope every session request to a workspace its user is still a member of, deselect a removed member's workspace on all their sessions, disconnect their realtime sockets on removal, and correct the singular /organization paths in the API docs
2026-09-26 21:18:49 -07:00
Matthew Meszaros
26f4549f63
fix: redact the credential from the Redis URL the realtime service logs on every boot, keeping the address that makes the line useful ( #454 )
2026-09-12 00:52:18 -07:00
Matthew Meszaros
a4f503f620
fix: realtime cannot complete either of its TLS connections ( #452 )
...
* fix: let the realtime service actually establish its TLS connections, adding the wildcard hostname match fun Redix needs for every managed Redis and a CA bundle option for an RDS Postgres that the system trust store cannot verify
* feat: drop the redundant wget package from the realtime image since busybox already provides it, and fix a comment that read as literal interpolation
* fix: treat a blank DATABASE_SSL_CA_FILE as unset in the realtime config, because compose passes every optional variable through as empty and cacertfile with an empty path is no CA source at all rather than a fallback to the system store
2026-09-12 00:29:34 -07:00
Matthew Meszaros
42ddb78e60
feat: make the realtime service survive a client that spams channel joins, and stop both clients from being that client: ws_join is now spent per phx_join in a shared RealtimeWeb.ChannelGuard that every channel runs BEFORE its Auth lookup (it was only ever spent on the socket handshake, so an established socket could issue unlimited joins and each one cost a Postgres query), handshakes move to their own ws_connect bucket so a reconnect storm cannot eat the budget a client needs to rejoin with, the retry_after_ms hint now points at the next window instead of shrinking as overage grew, every channel's join rejection carries the numeric code the API reference already promised (plus 4005 for a malformed topic), BulkChannel only pushes an event to the user who owns the operation instead of to anyone who guesses the id, and the web and admin clients treat a rate_limited join as transient (wait out the hint, keep the socket) while backing off per-channel rejoins on a decaying schedule rather than reconnecting on the 120ms floor forever; adds an ExUnit suite for realtime and a vitest suite for admin, both wired into CI
2026-08-26 21:14:34 -07:00
Devin AI
Matthew Meszaros
Matthew Meszaros