15 Commits

Include renames

Author	SHA1	Message	Date
Matthew Meszaros	75f764dc67	feat: require a verified Cloud Tasks token with a pinned audience on task webhooks, manage_settings on integration OAuth and a fresh membership check at every mailbox and integration OAuth finish, user verification for passkey sign-in, ended sessions before a password reset or ban reports success, and a revoked session when a rotated refresh token is replayed; remove the internal DEK delete route, log credential path parameters by name, hold remote images in received mail until the reader loads them, add Calendly and Cal.com signing keys with inbound URL rotation, keep automation signing secrets out of connection responses, and apply the password rules to the bootstrap password	2026-09-30 06:46:24 -07:00
Matthew Meszaros	cc244e5159	feat: make every admin panel list page past the first and filter by id: bind query-string ids through models.ParamUUID since gin cannot set a uuid.UUID, page the explorers and secondary lists by an opaque offset cursor with an id tiebreak instead of an id keyset that disagreed with the sort, page the audit log on (created_at, id) with an inclusive YYYY-MM-DD end day and read next_cursor on its page, cast every before-date bound to timestamptz, coalesce nullable audit ip and user agent, and report failed admin queries and 5xx mutations to PostHog or Sentry with method, path, status, code and request id	2026-09-21 02:11:38 -07:00
Matthew Meszaros	03f59d4d6f	docs: state the tenant and key-shape invariants in these comments as the constraints they are, rather than as an account of what each check replaced, since this repository is public and every self-hosted instance that has not updated yet reads the same text	2026-09-19 08:28:41 +02:00
Matthew Meszaros	e668a2a36b	feat: complete the ADA CASA v2.1.1 AL1 control set across authentication, sessions, access control, cryptography, input validation and configuration, adding a breached-password denylist and per-account login throttling, enforced multi-factor authentication on the admin panel, step-up confirmation before an action that mints a lasting credential, purpose-scoped session tokens, single-use TOTP steps, tenant verification on every cross-referenced identifier, security headers on every surface, encrypted webhook signing secrets, per-organization idempotency, PKCE and a minimal two-scope Gmail consent on the mailbox OAuth flow, bounded spreadsheet and archive decoding, a patched Go toolchain with govulncheck in CI, and the evidence pack under compliance/casa	2026-09-19 08:18:35 +02:00
Matthew Meszaros	d6025ea4c0	feat: address worker capacity review findings with safe migrations and recovery reporting	2026-09-17 06:24:14 -07:00
Matthew Meszaros	c26300ae5e	feat: backend half of the admin panel upgrade: delete the unrouted provisioning, releases, plan, discount and enterprise-inquiry admin handlers with their service and repository methods, retire the six admin permission bits nothing gated as reserved placeholders so live bit positions and existing masks are unchanged and IsSuperAdmin checks the live set, add forty admin endpoints for mailbox sync governor state with clear-throttle and restart-backfill, in-flight send reservations, cross-workspace dead letters with replay, task failures, webhook delivery health with reclaim, fleet capacity, the control loops decision log, dedicated bindings with release and the routed convert-to-dedicated, operator-driven workspace export and import, per-organization API keys and webhooks, warmup invalid-token abuse and action history, and signups by acquisition channel, and add a scheduled_job_runs table (migration 000135) with a jobrun package that every backend and consumer loop now records through and a run-now request the owning process picks up within fifteen seconds	2026-09-07 21:40:38 -07:00
Matthew Meszaros	51dedc90ee	feat: put every runtime behind one optional error-reporting story: a single internal/observability/errs wrapper that is now the only package importing sentry-go, InitSentry for cmd/forms, release and environment tags on every service from the existing build stamp, optional Sentry in the admin panel and the public forms app, the sentry crate in the Rust tracking service, release tagging in realtime, CI source-map upload that only runs when a Sentry token is configured, and docs covering the DSN for each service	2026-09-07 03:51:06 -07:00
Matthew Meszaros	0f715da88e	feat: close the force-stop race and trim the comments the review flagged: the eligibility test moved out of the admin service and into the UPDATE's WHERE clause, so a campaign that completes between the status read and the write can no longer be dragged back to paused and recorded as force-stopped, StopCampaign reports whether it actually stopped anything and the service turns a refusal into the same 400 it used to raise from the pre-check, a new live test parks the campaign at completed and at draft and fails if either is overwritten, and the explanatory comment blocks added across pg_admin.go, the admin service, the admin models and the rate-limit dialog are cut back to the one-line form CLAUDE.md asks for	2026-08-27 03:21:25 -07:00
Matthew Meszaros	1c4fcff558	feat: make the admin panel's broken queries run: seven statements referenced schema that does not exist and failed 100% of the time, so a force-stop wrote status = 'stopped' and stopped_at to a campaign_status enum and a campaigns table that have neither, the plan writes named a duration column that became duration_id long ago, the user rate-limit read and write named a daily_email_limit column that user_rate_limits has never had, and the user preview compared email_accounts.user_id (uuid) against a text parameter and then swallowed the error so every operator saw an empty mailbox list; the same uuid = text defect in GetUserEmails, which the prepare sweep cannot see because that WHERE clause is assembled at runtime, was a live 500 on GET /admin/users/:id/emails; a stop now parks the campaign at 'paused' like the owner-facing stop and records the reason the UI has always sent and the backend has always dropped into both the audit log and the owner's campaign feed, the plan writes resolve durations.title to duration_id and answer 400 rather than a constraint violation on an unknown period, the rate-limit editor now covers the seven real limit columns instead of one that never existed and patches insert-then-update in a transaction because every column is NOT NULL, AdminWorkerEmail.LastSyncedAt is a pointer so a never-synced mailbox stops being silently dropped from every admin list, and TestLiveEveryQueryPrepares now fails on undefined columns, tables, operators and enum values instead of only reporting them	2026-08-27 03:09:40 -07:00
Matthew Meszaros	bc435747ea	feat: expand admin management queries ... Add richer backend models, handlers, services, and repository queries for admin campaigns, discounts, outreach, organizations, limit requests, and provisioning surfaces.	2026-06-02 15:54:29 +02:00
Matt	3ffa416e40	feat(admin): mailboxes admin (cross-org triage) ... Adds GET /admin/mailboxes — paginated platform-wide mailbox list that joins email_accounts → users → organizations so the table answers "whose mailbox is this and where does it live" without N+1 fetches. Search covers mailbox email / owner email / org name; status filter defaults to active so the active surface shows first ("inactive" / "all" both available). Provider filter speeds up "show me every Gmail mailbox" investigations. Cursor pagination matches the rest of the admin lists. Frontend page surfaces warmup-on/off, send budget, and last-sync time with red-when-never / amber-when-stale-over-24h tone so an investigator can spot dead mailboxes fast. Mailbox email links into the owning user's detail page; org name links into the workspace admin so the pivot path stays one click in either direction. Gated on AdminPermViewUsers since mailbox triage is tightly coupled to user/org context today; a dedicated bit can be carved later if mailbox-specific actions land.	2026-05-28 12:38:08 +02:00
Matt	7de29b0fb0	feat(admin): ban scope bitmask (schema + UI; enforcement is staged) ... Add users.ban_scope INT NOT NULL DEFAULT 0 in migration 000045 so admins can describe what a ban concretely stops (login / workspace creation / outbound send) instead of relying on a single boolean banned_at flag that meant "everything". Wire flags in the BanScope enum (kept in sync with the migration) plus a CHECK constraint guaranteeing non-negative values. Existing bans backfill to BanScopeLogin so the historical "you can't log in" semantics is preserved exactly — no behaviour changes silently at deployment. BanUserRequest gains an optional scope field, BanUser threads it through the service to the repo write, and the UserBanDialog grows a checkbox group with one option per flag. Reason still required; at least one scope must be picked. Audit details now include the scope bitmask. Runtime enforcement (refusing login when BanScopeLogin is set, etc.) is intentionally separate from this commit — the existing codebase doesn't yet have an active ban check anywhere, so wiring that lives across the auth middleware, org-create handler, and emailsend service. This slice ships the schema, the audit story, and the UI vocabulary so the enforcement PR can land without database churn.	2026-05-28 10:00:29 +02:00
Matthew Meszaros	950965fe90	fix(audit): route new admin actions to admin_audit_log ... The audit calls added in the last commit went to AuditService.LogAction, which writes to the general user-facing audit log (Cassandra). The admin audit-log viewer at /admin/audit-logs queries the admin_audit_log table in Postgres, so worker / credentials / release actions never showed up. Add a public AdminService.LogAdminAction that wraps the existing private logAction (writes to admin_audit_log with the same shape as ban_user / update_worker / etc.). Repoint h.audit() at it. Actions now visible in the audit viewer: test, install, restart, upgrade, uninstall, rotate_keys, apply, assign, system_update, reboot, check_releases (plus the existing create/update/delete across workers, AWS creds, and profiles).	2026-05-19 05:21:18 +00:00
Matthew Meszaros	19d20e72b4	feat: add warmup health throttled state, complaint/bounce metrics, A/B analysis, and rate limiting	2026-04-09 12:51:30 +00:00
Máté Mészáros (Laptop)	41624a6f79	Analytics & Tracking	2026-01-29 05:59:04 +01:00