12 Commits

Include renames

Author	SHA1	Message	Date
Matthew Meszaros	6cadcc725d	feat: answer every public request-body bind failure with a 400 that names the problem (empty body, JSON syntax error with its byte offset, wrong JSON type for the body or a named field, missing or out-of-range fields by json key) instead of a blanket malformed-JSON message or a 500, accept a single contact object on POST /v1/contacts as the CLIs send it, and drop the API-key lookup cache whose 300ns TTL made it a Redis round trip that saved nothing	2026-09-22 20:21:41 -07:00
Matthew Meszaros	cc244e5159	feat: make every admin panel list page past the first and filter by id: bind query-string ids through models.ParamUUID since gin cannot set a uuid.UUID, page the explorers and secondary lists by an opaque offset cursor with an id tiebreak instead of an id keyset that disagreed with the sort, page the audit log on (created_at, id) with an inclusive YYYY-MM-DD end day and read next_cursor on its page, cast every before-date bound to timestamptz, coalesce nullable audit ip and user agent, and report failed admin queries and 5xx mutations to PostHog or Sentry with method, path, status, code and request id	2026-09-21 02:11:38 -07:00
Matthew Meszaros	e668a2a36b	feat: complete the ADA CASA v2.1.1 AL1 control set across authentication, sessions, access control, cryptography, input validation and configuration, adding a breached-password denylist and per-account login throttling, enforced multi-factor authentication on the admin panel, step-up confirmation before an action that mints a lasting credential, purpose-scoped session tokens, single-use TOTP steps, tenant verification on every cross-referenced identifier, security headers on every surface, encrypted webhook signing secrets, per-organization idempotency, PKCE and a minimal two-scope Gmail consent on the mailbox OAuth flow, bounded spreadsheet and archive decoding, a patched Go toolchain with govulncheck in CI, and the evidence pack under compliance/casa	2026-09-19 08:18:35 +02:00
Matthew Meszaros	49acd51b64	feat: stop one recurring fault burying error tracking by reporting it once per five minutes with the count it stands for, keep a cache outage from answering every signed-in request with a 500 and from taking realtime down by treating an unreachable Redis as a miss and the websocket handshake nonce nothing reads as best-effort, answer a 5xx with a sentence the reader can act on while the call site's own words go to the log against the same request id, prefer the API's own message over the HTTP class in the admin and dashboard clients, and name the fix on a schema registry refusal, an SES sandbox rejection and a mailbox check that could not be run	2026-09-19 07:39:40 +02:00
Matthew Meszaros	d6025ea4c0	feat: address worker capacity review findings with safe migrations and recovery reporting	2026-09-17 06:24:14 -07:00
Matthew Meszaros	c26300ae5e	feat: backend half of the admin panel upgrade: delete the unrouted provisioning, releases, plan, discount and enterprise-inquiry admin handlers with their service and repository methods, retire the six admin permission bits nothing gated as reserved placeholders so live bit positions and existing masks are unchanged and IsSuperAdmin checks the live set, add forty admin endpoints for mailbox sync governor state with clear-throttle and restart-backfill, in-flight send reservations, cross-workspace dead letters with replay, task failures, webhook delivery health with reclaim, fleet capacity, the control loops decision log, dedicated bindings with release and the routed convert-to-dedicated, operator-driven workspace export and import, per-organization API keys and webhooks, warmup invalid-token abuse and action history, and signups by acquisition channel, and add a scheduled_job_runs table (migration 000135) with a jobrun package that every backend and consumer loop now records through and a run-now request the owning process picks up within fifteen seconds	2026-09-07 21:40:38 -07:00
Matthew Meszaros	1c4fcff558	feat: make the admin panel's broken queries run: seven statements referenced schema that does not exist and failed 100% of the time, so a force-stop wrote status = 'stopped' and stopped_at to a campaign_status enum and a campaigns table that have neither, the plan writes named a duration column that became duration_id long ago, the user rate-limit read and write named a daily_email_limit column that user_rate_limits has never had, and the user preview compared email_accounts.user_id (uuid) against a text parameter and then swallowed the error so every operator saw an empty mailbox list; the same uuid = text defect in GetUserEmails, which the prepare sweep cannot see because that WHERE clause is assembled at runtime, was a live 500 on GET /admin/users/:id/emails; a stop now parks the campaign at 'paused' like the owner-facing stop and records the reason the UI has always sent and the backend has always dropped into both the audit log and the owner's campaign feed, the plan writes resolve durations.title to duration_id and answer 400 rather than a constraint violation on an unknown period, the rate-limit editor now covers the seven real limit columns instead of one that never existed and patches insert-then-update in a transaction because every column is NOT NULL, AdminWorkerEmail.LastSyncedAt is a pointer so a never-synced mailbox stops being silently dropped from every admin list, and TestLiveEveryQueryPrepares now fails on undefined columns, tables, operators and enum values instead of only reporting them	2026-08-27 03:09:40 -07:00
Matthew Meszaros	bc435747ea	feat: expand admin management queries ... Add richer backend models, handlers, services, and repository queries for admin campaigns, discounts, outreach, organizations, limit requests, and provisioning surfaces.	2026-06-02 15:54:29 +02:00
Matt	7de29b0fb0	feat(admin): ban scope bitmask (schema + UI; enforcement is staged) ... Add users.ban_scope INT NOT NULL DEFAULT 0 in migration 000045 so admins can describe what a ban concretely stops (login / workspace creation / outbound send) instead of relying on a single boolean banned_at flag that meant "everything". Wire flags in the BanScope enum (kept in sync with the migration) plus a CHECK constraint guaranteeing non-negative values. Existing bans backfill to BanScopeLogin so the historical "you can't log in" semantics is preserved exactly — no behaviour changes silently at deployment. BanUserRequest gains an optional scope field, BanUser threads it through the service to the repo write, and the UserBanDialog grows a checkbox group with one option per flag. Reason still required; at least one scope must be picked. Audit details now include the scope bitmask. Runtime enforcement (refusing login when BanScopeLogin is set, etc.) is intentionally separate from this commit — the existing codebase doesn't yet have an active ban check anywhere, so wiring that lives across the auth middleware, org-create handler, and emailsend service. This slice ships the schema, the audit story, and the UI vocabulary so the enforcement PR can land without database churn.	2026-05-28 10:00:29 +02:00
Matthew Meszaros	23b5c925e4	feat: add scheduled warmup health sweep, pool health summary endpoint, and admin overview	2026-04-09 15:57:04 +00:00
Matthew Meszaros	0799020dac	feat: add metrics, warmup content variety, tz-aware scheduling, org budget, admin stubs, and bug fixes	2026-04-09 14:33:45 +00:00
Máté Mészáros (Laptop)	41624a6f79	Analytics & Tracking	2026-01-29 05:59:04 +01:00