c229431b8c
chore(deploy): drop kubernetes manifests
...
Workers need IP diversity, but k8s nodes typically NAT all pods through a
small set of egress IPs — defeating the point of a DaemonSet for cold mail.
Plus, the control plane is moving to Railway and workers will be managed
per-VPS, so the kustomize tree no longer reflects how anything actually
ships.
2026-05-18 13:08:06 +00:00
1ad8e7e995
feat: implement dead worker detection with heartbeat TTL and auto-reassignment
2026-04-12 11:14:24 +00:00
2f2ccb41dd
feat: add exponential backoff retry for transient email send failures
2026-04-12 11:10:28 +00:00
3e556825d8
fix: add org scoping to contact notes and activities to prevent IDOR
2026-04-12 11:09:40 +00:00
562752d20e
feat: skip bounced and suppressed contacts in campaign scheduling
2026-04-12 11:06:04 +00:00
0f883e38ac
fix: record bounces in campaign progress so analytics and auto-pause work
2026-04-12 11:05:10 +00:00
e7933ab6c5
feat: publish auth error events on critical mail errors and register token update handler
2026-04-10 07:05:39 +00:00
f9d9ed6dc0
feat: implement IMAP sync worker and unified mail sync loop for all providers
2026-04-10 07:02:25 +00:00
00dac953ae
fix: add nil checks on SmtpImapData and avoid slice modification during iteration
2026-04-10 06:58:41 +00:00
6766696ac4
fix: add 2-minute timeout context to task handlers to prevent hangs
2026-04-10 06:57:17 +00:00
a741b4939a
feat: implement worker HandleAddEmail and HandleRemoveEmail handlers
2026-04-10 06:56:35 +00:00
fbd62ea20c
fix: invert nil checks in dynamo email message Del so non-nil keys are added
2026-04-10 06:54:58 +00:00
58d41f3668
fix: store correct email account ID and message ID in dynamo email map
2026-04-10 06:54:31 +00:00
b9797e9e7b
chore: ignore seed binary build artifact
2026-04-10 06:32:52 +00:00
7f90323d55
chore: remove metrics endpoint, prometheus instrumentation, and IP rate limiter
2026-04-10 06:32:30 +00:00
7e123a2dac
fix: remove deep health endpoint and add IP rate limiting to public endpoints
2026-04-09 16:03:37 +00:00
80358168ae
test: add unit tests for warmup health evaluation, campaign state machine, and templates
2026-04-09 15:59:27 +00:00
23b5c925e4
feat: add scheduled warmup health sweep, pool health summary endpoint, and admin overview
2026-04-09 15:57:04 +00:00
65641ec1f2
feat: add send test email endpoint for campaign preview before launch
2026-04-09 15:52:59 +00:00
33092fa56e
fix: add 10MB request body size limit to prevent OOM from large payloads
2026-04-09 15:50:08 +00:00
816c432e71
feat: add deep health check endpoint with PostgreSQL connectivity check
2026-04-09 15:49:28 +00:00
dd1fc3d41d
feat: generate List-Unsubscribe URL for campaign emails when unsubscribe header is enabled
2026-04-09 15:17:39 +00:00
ffe6bd31ca
fix: sanitize Stripe error messages to prevent leaking internal details to clients
2026-04-09 15:15:18 +00:00
3699774f7d
fix: use timeout context for Stripe webhook migration goroutines to prevent leaks
2026-04-09 15:13:47 +00:00
9c4b6d21fd
fix: add contact email deduplication with unique index and upsert on conflict
2026-04-09 15:12:41 +00:00
41aa183be2
fix: add campaign state machine to prevent invalid status transitions
2026-04-09 15:11:58 +00:00
36f4a94814
fix: prevent race condition in dedicated worker assignment with atomic insert
2026-04-09 14:54:22 +00:00
306690db0a
feat: add explicit position column to sequences for deterministic ordering
2026-04-09 14:52:17 +00:00
421a3fb3dc
fix: add campaign ownership validation to prevent IDOR in bulk campaign operations
2026-04-09 14:48:29 +00:00
c2948d464b
fix: add hard limit to pipeline list query to prevent unbounded results
2026-04-09 14:47:14 +00:00
d903c26255
fix: add hard limit of 500 to template list query to prevent unbounded results
2026-04-09 14:46:20 +00:00
4f16944ff8
fix: add size limits to bulk contact operations to prevent resource exhaustion
2026-04-09 14:45:10 +00:00
d417b1f0a4
perf: add missing index on campaign_leads(contact_id) for reverse lookups
2026-04-09 14:43:40 +00:00
4b8ff94201
fix: use correct column names contact_id and campaign_id in campaign_leads queries
2026-04-09 14:43:10 +00:00
0799020dac
feat: add metrics, warmup content variety, tz-aware scheduling, org budget, admin stubs, and bug fixes
2026-04-09 14:33:45 +00:00
19d20e72b4
feat: add warmup health throttled state, complaint/bounce metrics, A/B analysis, and rate limiting
2026-04-09 12:51:30 +00:00
ba9e3c096a
fix: replace context.TODO with proper context in cipher and Google client
...
- cipher: use the already-available ctx parameter for DynamoDB Put
- goog: use context.Background for OAuth token refresh callback since
it runs asynchronously outside any request lifecycle
2026-04-09 12:10:42 +00:00
91ec703093
fix: increment verification code tries on failed attempts
...
The Tries counter on login and registration sessions was checked but
never incremented, making the brute-force protection dead code. An
attacker could retry verification codes indefinitely within the session
TTL. Now each failed attempt increments and persists the counter.
2026-04-09 12:10:26 +00:00
4ec7e65896
fix: prevent nil deref on Stripe Customer and use background ctx for goroutines
...
- Guard checkoutSession.Customer access with nil checks to prevent panic
when Stripe sends incomplete checkout session data
- Switch worker migration goroutines from request ctx to context.Background()
since these operations outlive the webhook HTTP request and would be
cancelled prematurely when the response completes
2026-04-09 12:09:07 +00:00
7fe8e663d5
fix: propagate parent context instead of context.TODO in cipher service
...
The ctx parameter was already available from the Cipher method but
wasn't being passed to the DynamoDB Put call for new DEK storage.
2026-04-09 12:06:54 +00:00
6517b06893
feat: expand warmup subject lines and conversation templates
...
Increase warmup subjects from 5 to 20 and conversations from 3 to 12
to reduce repetition patterns that spam filters can detect. New themes
cover industry, tools, networking, feedback, planning, reading, travel,
wellness, and events.
2026-04-09 12:06:30 +00:00
3edf6b1d22
refactor: remove redundant min/max helpers shadowing Go builtins
...
Go 1.21+ provides builtin min/max for all ordered types. Remove the
custom int helpers and replace math.Max with builtin max for floats.
2026-04-09 12:06:25 +00:00
57644d752d
refactor: replace fmt.Printf with structured zerolog logging and fix weak URL hash
...
- Replace all fmt.Printf calls in Kafka consumer/producer, tracking consumer,
and user email task with structured zerolog (log.Warn/Error/Info)
- Fix hashURL using SHA-256 instead of naive first-8-chars+length approach
which was collision-prone for deduplication
2026-04-09 12:06:20 +00:00
9dbd25b24b
feat: delete S3 email body after successful send
2026-04-03 06:25:44 +00:00
308f72b874
feat: add CORS origin config, encrypt email bodies in S3, replace printfs with structured logging
2026-04-03 06:24:20 +00:00
d8d88c7f69
feat: add warmup health tracking, migrate repos to postgres, and overhaul web UI
2026-04-03 06:08:52 +00:00
21ffb6a748
feat: add advanced outreach controls with A/B testing, deliverability dashboard, and DLQ
2026-02-20 08:59:17 +00:00
c564b3ac95
feat: implement unibox replies, warmup conversations, and daily email limits
2026-02-20 04:54:46 +00:00
ae0a8f16a2
feat: add web dev container and use unique host ports
2026-02-19 03:07:06 +00:00
fbb55379c5
fix: propagate captcha errors and fix JWT signing
...
- Return actual captcha verification errors instead of generic
internal errors in login, registration, and reset password flows
- Fix Sentry capturing wrong variable (err -> xerr) in
RegistrationConfirm
- Pass AuthSecret as []byte to JWT SignedString/keyfunc
- Send form data in request body instead of PostForm for Turnstile
- Improve Turnstile non-200 error handling with response body logging
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-18 06:30:50 +01:00
Matthew Meszaros