  Matthew MeszarosandDevin AI
|
d93cf3c138
|
feat: preserve isolated email preview headers on the canonical Cloudflare Pages path while retaining dashboard frame protection
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
|
2026-10-07 15:47:00 +00:00 |
|
|
Matthew MeszarosandDevin AI
|
dfed1e1593
|
feat: validate API UUIDs, recover expired Gmail history and guard consumer startup and stale frontend assets
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
|
2026-10-07 07:19:15 +00:00 |
|
|
Matthew MeszarosandDevin AI
|
416c4feee3
|
feat: prevent private API response storage and remove wildcard CORS from the static Pages dashboard
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
|
2026-10-06 12:05:54 +00:00 |
|
|
Matthew MeszarosandDevin AI
|
0f12b3b250
|
feat: preserve static CSP preview and runtime configuration cache rules with current main
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
|
2026-10-06 06:05:17 +00:00 |
|
|
Matthew MeszarosandDevin AI
|
589bc823ed
|
feat: generate static dashboard CSP hashes and isolate email preview styling across Vite nginx and Pages
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
|
2026-10-06 05:46:52 +00:00 |
|
 Matthew Meszaros
|
0731a8c788
|
feat: refuse an HTML page as an API response in the dashboard client (api_url_not_api) so a missing or wrong API_URL falls back to the unreachable login state instead of crashing, and serve config.js with Cache-Control no-store from the dashboard and admin Pages _headers to match the nginx images
|
2026-10-05 17:04:05 +02:00 |
|
|
Matthew Meszaros
|
7980079f3e
|
feat: move the dashboard to TanStack Router with lazy route chunks, hover preloading, route loaders that prefetch each page's data, a parallel session boot behind an app-frame skeleton, self-hosted preloaded Inter to end the load flash, and optimistic updates for frequent mailbox, campaign, CRM, label and template actions
|
2026-10-04 10:38:14 -07:00 |
|
|
Matthew Meszaros
|
e668a2a36b
|
feat: complete the ADA CASA v2.1.1 AL1 control set across authentication, sessions, access control, cryptography, input validation and configuration, adding a breached-password denylist and per-account login throttling, enforced multi-factor authentication on the admin panel, step-up confirmation before an action that mints a lasting credential, purpose-scoped session tokens, single-use TOTP steps, tenant verification on every cross-referenced identifier, security headers on every surface, encrypted webhook signing secrets, per-organization idempotency, PKCE and a minimal two-scope Gmail consent on the mailbox OAuth flow, bounded spreadsheet and archive decoding, a patched Go toolchain with govulncheck in CI, and the evidence pack under compliance/casa
|
2026-09-19 08:18:35 +02:00 |
|