 Matthew Meszaros
|
9be5c8a3c3
|
feat: give API refusals stable codes and actionable messages (attempt_check_unavailable and code_lookup_limited with Retry-After, account and workspace standing codes, session_ended, reset_link_invalid, sessions_not_ended, api_credentials_revoke_unsupported, invitation_expired, image_unreadable and the other image upload codes, own-domain redirects naming the allowed domains, Pipedrive reload guidance, duplicate parameters, structured forms service errors), and show them in the dashboard, admin panel and warmbly CLI
|
2026-10-23 19:53:03 +02:00 |
|
|
Matthew Meszaros
|
cc1dc2f64c
|
feat: answer refused realtime handshakes with a JSON code and reason, name a reused ws ticket or signed-out session, use the not_a_member slug on org joins, warn at boot when REALTIME_ALLOW_QUERY_CREDENTIALS is on, stop the admin socket reconnecting on admin_mfa_required, not_an_admin and jwt_required with a clear message, and have the seeder, updater, webhook and notification URL checks, instance health, fleet join and log mail transport say which setting applies and what to do
|
2026-10-23 19:53:03 +02:00 |
|
|
Matthew Meszaros
|
03fd30f9bc
|
feat: merge decoded-byte image validation with download-safe serving, own-domain form and domain redirects, TLS-only SMTP AUTH negotiation and pinned per-server certificate opt-outs, with MAIL_TLS_INSECURE honoured on self-hosted and development instances and resolved by the control plane for joining nodes
|
2026-10-23 16:20:30 +02:00 |
|
|
Matthew Meszaros
|
573e79ce8e
|
feat: store each SMTP/IMAP server's certificate opt-out and pinned SPKI SHA-256 on email_accounts_smtp_imap (migration 000326, expand-only), carry tls_unverified and tls_pin in ADD_EMAIL, Cloud enrolment and vendor reconnect, keep an opt-out only for a certificate that fails CA verification and pin it to what the connection test saw, keep it across a credential change for the same host, name the presented certificate in a TLS refusal, and add GET /emails/:id/certificates plus session-only check and confirm endpoints that pin the fingerprints the owner confirmed
|
2026-10-23 16:15:55 +02:00 |
|
|
Matthew Meszaros
|
dba87e8d74
|
feat: merge fail-closed ban and attempt-budget reads, 48-hour invitations and tester passwords with one-click resend, transactional invitation consumption, development-only seeding and redacted log mail links
|
2026-10-23 16:06:29 +02:00 |
|
|
Matthew Meszaros
|
68c87cb751
|
feat: merge resolved-peer address checks on every mail dial, strict bounded autoconfig XML, shell-free updater commands and refusal of repeated single-valued query parameters and credential headers
|
2026-10-23 16:04:08 +02:00 |
|
|
Matthew Meszaros
|
d7bacf6112
|
feat: check every mailbox SMTP and IMAP dial against its resolved peer address in netbind, refusing loopback, private, link-local, CGNAT, multicast and metadata addresses on hosted production and wherever MAIL_ALLOW_PRIVATE_HOSTS=false, render that resolved policy into each joining node's env, and honour WARMBLY_ALLOW_UNSAFE_WEBHOOK_URLS only on self-hosted or development instances
|
2026-10-23 16:02:52 +02:00 |
|
|
Matthew Meszaros
|
0d76f81a3f
|
feat: cap workspace invitations and reviewer tester passwords at 48 hours, quote each invitation's real remaining lifetime in its email, list recently expired invitations behind include_expired on GET /organization/invitations, and add a one-click Resend for expired invitations on the members settings page
|
2026-10-23 15:57:22 +02:00 |
|
|
Matthew Meszaros
|
123965fb81
|
feat: merge absolute session expiry, revoke-before-write password changes with optional API credential revocation, bounded Pipedrive tokens, always-Secure broker cookie, body-carried reset sessions and atomic Slack state
|
2026-10-23 15:52:51 +02:00 |
|
|
Matthew Meszaros
|
b4c7067174
|
feat: mark the brokered mailbox sign-in's browser-binding cookie Secure in every environment except plain-http development, and post the binding value from the consent page in a form body to POST /addresses/connect/continue while still accepting the query form from pages the previous release rendered
|
2026-10-23 15:50:13 +02:00 |
|
|
Matthew Meszaros
|
0c40e53e02
|
feat: bind each realtime ws ticket to the session that minted it and accept it once while that session is live, require a second-factor session to join admin:platform, confine API key and OAuth sockets to their own workspace with member permissions narrowed to their read scopes, and refuse those credentials in the socket URL unless REALTIME_ALLOW_QUERY_CREDENTIALS=true
|
2026-10-23 15:48:00 +02:00 |
|
|
Matthew Meszaros
|
a786d26fa3
|
feat: require every Pipedrive panel and modal token to carry an issued-at within 15 minutes or an expiry within 24 hours and refuse one with neither, and answer the Pipedrive app routes with Referrer-Policy no-referrer and no-store so the signed query token is never passed on
|
2026-10-23 15:47:31 +02:00 |
|
|
Matthew Meszaros
|
e0a97ef520
|
feat: end other sessions before a signed-in password change is stored and refuse the change when that fails, add an optional revoke_api_credentials to the change and reset that also revokes the user's OAuth grants and the API keys they created, exchange the emailed reset link for an opaque reset session through POST /auth/reset-password/session so the confirm step carries no token in its URL, and add the sign-out-apps checkbox to the dashboard's change-password dialog
|
2026-10-23 15:45:51 +02:00 |
|
|
Matthew Meszaros
|
3f13636a5b
|
feat: decide uploaded image formats from their decoded bytes through internal/pkg/imagetype for avatars, OAuth logos, form assets, email images and archive-restored public objects, store public objects with inline headers only for PNG/JPEG/GIF/WebP, sign every presigned attachment and node GET URL with forced download disposition and a safe response content type, and rasterize SVG previews to PNG in the dashboard image client
|
2026-10-23 15:43:42 +02:00 |
|
|
Matthew Meszaros
|
b14e1b1679
|
feat: refuse sign-in, emailed-code, two-factor, SSO-link and re-authentication checks with a retryable 503 when their attempt budget cannot be charged, and refuse password, passkey and two-factor sign-in and workspace creation when the account's ban or two-factor state cannot be read
|
2026-10-23 15:41:36 +02:00 |
|
|
Matthew Meszaros
|
494ed2c06f
|
feat: re-place parked warmup and campaign wakeups when mailbox behaviour, warmup hours, timezone, caps, tags, campaign pacing or the workspace timezone change, retire stranded warmup preparations with refunded charges or unsent tokens so they stop blocking mailboxes, spread window-opening reply-backs and deferred sends, and show the next queued warmup send in the mailbox list and drawer
|
2026-10-21 10:34:22 +02:00 |
|
 555aaditya
|
1ff9da55a5
|
feat: keep the shared unibox overview across read-only POSTs (contact, deal and task search and summary, segment and template previews, campaign estimate) and drop it when opening a message marks it read
|
2026-10-19 01:59:29 +05:30 |
|
|
Matthew Meszaros
|
de4328b4cf
|
feat: let Unibox forwards reach suppressed recipients by exempting forward tasks from the send-admission suppression check, refuse suppressed replies and direct sends before queueing with a recipient_suppressed 400 naming the address and matching entry, report admission refusals as RECIPIENT_SUPPRESSED with the address, show the server reason in the reply composer, and document it
|
2026-10-16 06:56:52 +02:00 |
|
|
Matthew Meszaros
|
0ca6e7e642
|
feat: let the confirm-it-is-you prompt offer only the methods an account has, adding passkey, Google/Apple/SSO popup and native iOS Apple/Google re-authentication bound to the session and linked identity, across backend, dashboard, admin, iOS and docs
|
2026-10-15 15:26:25 +02:00 |
|
  Matthew MeszarosandDevin AI
|
c59512d160
|
feat: batch IMAP message-map lookups and index normalized send identifiers and mailbox folder generations
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
|
2026-10-13 13:27:39 +00:00 |
|
|
Matthew Meszaros
|
8b667c2d29
|
feat: merge main into the mobile app redesign branch, keep both the apollo and appattest handler imports, and renumber the app_attest_keys migration to 000291 now that main holds 000290
|
2026-10-12 10:40:02 +02:00 |
|
|
Matthew Meszaros
|
8c06efc6e4
|
feat: ship the iOS app to TestFlight from GitHub Actions on merges touching ios/ (ios-release workflow with cloud-managed signing, shared Warmbly scheme, ExportOptions, iPhone-only 1.0.0, privacy manifest), add in-app account deletion and a read-only billing page, let admins exempt an existing account from the emailed login code for App Review, read Apple .p8 keys as PEM or base64 through one applekey parser for Sign in with Apple and APNs, and document the release flow and Apple web sign-in setup
|
2026-10-12 10:38:14 +02:00 |
|
|
Matthew Meszaros
|
ec46f57d22
|
feat: redesign the iOS app (inbox with inbox agent drafted replies edited in the full composer, Remie, home, analytics, CRM, contacts, settings hubs, mailbox connect flow covering every dashboard source) and replace Turnstile in the app with Apple App Attest (attested keys in app_attest_keys, challenge and key endpoints, verifyHuman gate on login, registration and password reset, auth config flag, docs and OpenAPI)
|
2026-10-11 19:00:50 +02:00 |
|
|
Matthew Meszaros
|
0c413e49bc
|
feat: prove archive overwrites retain protected dispatch evidence before preparing fresh local warmup work
|
2026-10-11 16:54:16 +00:00 |
|
|
devin-ai-integration[bot]
|
0dfdedba84
|
Merge pull request #949 from warmbly/devin/1791716603-fence-warmup-execution
feat: require current warmup dispatch identity for generic execution and cancellation
|
2026-10-11 15:55:44 +00:00 |
|
|
Matthew MeszarosandDevin AI
|
c60efed16d
|
feat: require matching unstarted warmup dispatch identity before generic execution and cancellation
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
|
2026-10-11 11:15:30 +00:00 |
|
|
Matthew Meszaros
|
f9a9163891
|
feat: record Apollo import outcomes with an uncancellable context, bound recurring runs and release interrupted ones so they rerun and sync on schedule, send the saved Clay auth token only to the connection's own table webhook, use typed routes for the Apollo, Clay and Salesforce page links, and document Clay HTTP API column retries
|
2026-10-11 12:59:05 +02:00 |
|
|
Matthew Meszaros
|
19d8d24fac
|
feat: add Apollo integration (API key connect, list imports with hourly sync, contact enrichment) and two-way Clay integration (inbound row URL creating contacts, outbound event rows, automation action) with dashboard pages, brand logos, Discover ranking, org transfer registration and docs
|
2026-10-11 12:41:56 +02:00 |
|
|
Matthew Meszaros
|
255c7172d4
|
Merge remote-tracking branch 'origin/main' into feature/dashboard-onboarding-tour
|
2026-10-10 19:13:35 +02:00 |
|
|
Matthew Meszaros
|
3ba5913569
|
feat: add a skippable chaptered dashboard product tour narrated by Remie with sample-data scenes, plan comparison and selection (hosted links and Warmbly Cloud on self-host), saved per account via PUT /auth/me/product-tour
|
2026-10-10 18:52:21 +02:00 |
|
|
Matthew MeszarosandDevin AI
|
c0e721f92e
|
feat: retain native warmup filing provider retry deadlines across workers and admission retries
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
|
2026-10-10 16:22:04 +00:00 |
|
|
Matthew Meszaros
|
9712ea5262
|
Merge pull request #926 from warmbly/devin/1791630200-combined-restricted-member-security
feat: close all restricted-member data leaks and resource-scope escapes
|
2026-10-10 12:07:57 +00:00 |
|
|
Devin AI
|
9a45259527
|
feat: release failed filing commands only after exact backend proof of pending durable recovery while preserving acknowledgements and legacy retries
|
2026-10-10 11:52:47 +00:00 |
|
|
Matthew Meszaros
|
a581225102
|
feat: restrict auth and unibox category registries and thread labels to mailbox grants and constrain email cursors by organization and allowed mailboxes
|
2026-10-10 10:54:59 +00:00 |
|
|
Devin AI
|
3eef4399c3
|
feat: redact campaign activity metadata and embedded mailbox details against caller grants and count dashboard campaigns after grant intersection
|
2026-10-10 10:54:59 +00:00 |
|
|
Matthew Meszaros
|
314223345e
|
feat: enforce grant-scoped organization summaries and account-wide workspace creation with target membership checks for limit requests
|
2026-10-10 10:54:59 +00:00 |
|
|
Matthew Meszaros
|
21b56fce08
|
Merge pull request #921 from warmbly/devin/1791619490-retire-stale-mailbox-sync
feat: retire stale mailbox generations on authoritative ownership loss without acknowledging arrivals
|
2026-10-10 08:30:04 +00:00 |
|
|
Matthew MeszarosandDevin AI
|
f2876f1fc9
|
feat: retire stale worker mailbox generations only on authenticated ownership-loss admission evidence while retaining failed arrival bodies and provider cursors
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
|
2026-10-10 08:17:59 +00:00 |
|
|
Matthew Meszaros
|
507c98e008
|
feat: preserve retry-safe locked fleet enrollment identities and trusted canonical CLI credential roots while disclosing unavailable generic runtime log sources
|
2026-10-10 07:55:46 +00:00 |
|
|
Matthew Meszaros
|
fb955f054b
|
feat: document authenticated UUID-preserving fleet evidence re-enrollment and regress the original node identity without broadening shared broker authority
|
2026-10-10 07:25:22 +00:00 |
|
|
Matthew Meszaros
|
d3455c5373
|
feat: integrate released recovery main with admission request identifiers and stored result replay migration while retaining separate administrator operations
|
2026-10-10 07:17:43 +00:00 |
|
|
Matthew Meszaros
|
582c1aaaa4
|
feat: preserve fail-closed fleet enrollment fixtures and independent broker deadlines while honoring bounded evidence upload rate limits
|
2026-10-10 06:57:13 +00:00 |
|
|
Matthew MeszarosandDevin AI
|
9efc162fb8
|
feat: preserve bounded non-UUID request tracing identifiers in admission diagnostics while rejecting unsafe or oversized values
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
|
2026-10-10 06:31:23 +00:00 |
|
|
Matthew MeszarosandDevin AI
|
48087b6a40
|
feat: categorize arrival admission failures with safe control-plane UUID diagnostics while retaining cursor and durable acknowledgement protections
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
|
2026-10-10 06:20:33 +00:00 |
|
|
Matthew Meszaros
|
23a81409ab
|
feat: omit unresolved administrator identity from pending device responses and retain approved-session auditing with a precise polling schema
|
2026-10-10 06:19:03 +00:00 |
|
|
Matthew Meszaros
|
9081b1bce0
|
feat: add proof-preserving one-use admin device sessions and bounded enrollment-authenticated worker evidence with scoped Kafka partition diagnostics
|
2026-10-10 06:14:52 +00:00 |
|
|
Devin AI
|
4758216dbf
|
feat: integrate current monitoring and member access changes with durable mailbox synchronization
|
2026-10-09 16:56:53 +00:00 |
|
|
Matthew Meszaros
|
1c325b7a87
|
Merge pull request #903 from warmbly/devin/1791559441-admin-monitoring-final
feat: show evidence-based admin monitoring and truthful mailbox refresh states
|
2026-10-09 16:38:53 +00:00 |
|
|
Matthew Meszaros
|
2cf19ebedf
|
feat: add permission-aware operational monitoring to admin Overview and health with evidence clocks, backlog signals, coverage docs and typed permission regressions
|
2026-10-09 15:34:18 +00:00 |
|
|
Matthew Meszaros
|
9a09740c84
|
feat: add permission-shaped operational monitoring snapshots with aggregate recovery evidence and read-only broker diagnostics
|
2026-10-09 15:12:54 +00:00 |
|