Commit Graph

Select branches

Hide Pull Requests

feat/campaign-entry-delay

feature/bulk-select-all

fix/issue-380

fix/issue-381-user-experience

fix/issue-382-user-experience

main

#1

#10

#100

#11

#114

#115

#116

#117

#118

#119

#12

#120

#121

#122

#123

#124

#125

#126

#127

#128

#129

#13

#130

#131

#132

#133

#134

#135

#137

#14

#15

#159

#16

#160

#162

#163

#17

#170

#172

#174

#175

#176

#177

#178

#179

#18

#180

#182

#183

#188

#19

#190

#191

#192

#197

#198

#199

#2

#20

#201

#202

#203

#204

#205

#206

#208

#21

#212

#213

#214

#215

#216

#217

#218

#22

#222

#223

#224

#226

#227

#228

#229

#23

#230

#231

#232

#233

#234

#235

#236

#237

#238

#239

#24

#240

#246

#248

#249

#25

#251

#252

#253

#254

#256

#257

#259

#26

#260

#261

#262

#263

#269

#27

#270

#271

#278

#279

#28

#280

#281

#282

#284

#286

#287

#289

#29

#290

#297

#298

#299

#3

#30

#300

#301

#302

#303

#31

#311

#312

#313

#315

#32

#320

#321

#322

#323

#324

#325

#327

#329

#33

#330

#332

#333

#335

#338

#34

#342

#344

#35

#350

#354

#355

#358

#36

#364

#365

#366

#367

#368

#369

#37

#370

#372

#373

#374

#375

#376

#377

#378

#379

#38

#384

#386

#387

#388

#389

#39

#390

#391

#4

#40

#41

#42

#43

#44

#45

#46

#47

#48

#49

#5

#50

#51

#52

#53

#54

#55

#56

#57

#58

#59

#6

#60

#61

#62

#63

#64

#65

#66

#67

#68

#69

#7

#70

#71

#72

#73

#75

#76

#77

#78

#79

#8

#80

#81

#82

#83

#84

#85

#86

#87

#88

#9

#90

#91

#92

#93

#94

#95

#96

#97

#98

#99

v0.1.0

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.3.0

v0.3.1

v0.4.0

v0.4.1

Mono Color

• ec6d47b39e feat: register GET /v1/me in the combined-auth protected route group reachable by API keys, OAuth, and JWT Matthew Meszaros 2026-06-28 19:09:37 +02:00
• 5e94b945ff feat: add GetIdentity handler returning user, org, auth type, and granted scopes for GET /v1/me Matthew Meszaros 2026-06-28 19:09:37 +02:00
• 5377374816 feat: add Identity model for the GET /v1/me caller-identity response shape Matthew Meszaros 2026-06-28 19:09:37 +02:00
• 0baa48991b Publish development docs to docs.warmbly.com Matthew Meszaros 2026-06-28 13:25:08 +02:00
• 7813d173b1 Move development docs to docs/development/ Matthew Meszaros 2026-06-28 12:25:08 +02:00
• 8e3445e4b8 Refresh README with mailboxes screenshot and warmup focus Matthew Meszaros 2026-06-28 12:02:02 +02:00
• a1cb25fc1d Update README and assets with new banner and dashboard screenshots Matthew Meszaros 2026-06-28 11:43:47 +02:00
• 9dd37b0d62 Merge pull request #52 from warmbly/referral-credits Matthew Meszaros 2026-06-28 09:12:57 +02:00
• 92e1cf186b Merge pull request #50 from warmbly/trial-email-styling Matthew Meszaros 2026-06-28 08:38:51 +02:00
• af4fa7b1d2 Merge remote-tracking branch 'origin/main' into referral-credits Matthew Meszaros 2026-06-28 06:38:50 +00:00
• 2ab389af5a Merge pull request #51 from warmbly/chore/security-deps Matthew Meszaros 2026-06-28 08:37:08 +02:00
• 19260bf954 Add paseo.json worktree teardown configuration Matthew Meszaros 2026-06-28 06:36:04 +00:00
• 22b75c9165 feat: implement ListByOrganization on the discount service test's fake redemption repo so the package typechecks under golangci-lint in CI Matthew Meszaros 2026-06-28 06:35:42 +00:00
• 9b948e326c chore(security): sync admin package.json vite range to ^7.3.6 to match the security-patched lockfile Matthew Meszaros 2026-06-28 06:29:18 +00:00
• 21d30df72d ci: run Site CI on Node 22 since Astro 6 dropped Node 20 support Matthew Meszaros 2026-06-28 06:29:01 +00:00
• bcfbe6153d fix(security): bump golang.org/x/net to v0.55.0 to clear CVE-2026-25680/25681/27136/39821/42502/42506 in the HTML parser Matthew Meszaros 2026-06-28 06:29:01 +00:00
• 9eb633414f fix(security): bump admin vite to 7.3.6 and form-data to 4.0.6 to clear CVE-2026-53571 and CVE-2026-12143 Matthew Meszaros 2026-06-28 06:29:01 +00:00
• 2187af0470 fix(security): migrate site from Astro 5.18 to 6.4.8 (and @astrojs/mdx to 6, sitemap to 3.7.3) to clear CVE-2026-50146 and CVE-2026-54299; build verified, 35 pages Matthew Meszaros 2026-06-28 06:21:16 +00:00
• f9d5c85a32 fix(security): move realtime sentry onto a Finch HTTP client and drop the hackney dependency to clear CVE-2026-47071 Matthew Meszaros 2026-06-28 06:18:33 +00:00
• 315c25c158 chore(security): sync web package.json vite range to ^7.3.6 to match the security-patched lockfiles Matthew Meszaros 2026-06-28 06:10:03 +00:00
• ceb54c25c3 fix(security): bump site transitive vite to 6.4.3 to clear the vite server.fs.deny bypass CVE-2026-53571 Matthew Meszaros 2026-06-28 06:09:35 +00:00
• 3cb3616899 fix(security): bump web vite to 7.3.6, form-data to 4.0.6, and linkify-it to 5.0.1 in both lockfiles to clear CVE-2026-53571, CVE-2026-12143, and CVE-2026-48801 Matthew Meszaros 2026-06-28 06:09:35 +00:00
• b618a9d6d4 feat: widen the billing compare-plans grid to the full settings panel (sm two / xl four columns) so all four plan cards fit comfortably Matthew Meszaros 2026-06-28 05:58:31 +00:00
• bbc07be875 feat: default the settings Section primitive to a stacked full-width layout and keep the title-rail look as an opt-in split layout so wide content is no longer squeezed into a narrow column Matthew Meszaros 2026-06-28 05:58:31 +00:00
• 2f4e4f7ee6 feat: bound the settings layout to its container height so the left rail and content panes scroll internally instead of sliding under the sticky Settings topbar Matthew Meszaros 2026-06-28 05:58:31 +00:00
• 7e75394ab8 feat: decode the admin discount list and redemption cursors as opaque offset tokens, returning 400 on a malformed cursor instead of silently resetting to the first page Matthew Meszaros 2026-06-28 05:58:25 +00:00
• 0d22e546a9 feat: update the discount service test's fake redemption repo to the new offset-based ListByCode signature Matthew Meszaros 2026-06-28 05:58:25 +00:00
• 22bce66503 feat: thread an offset instead of a UUID cursor through the discount service ListRedemptions to match the offset-paged repository Matthew Meszaros 2026-06-28 05:58:25 +00:00
• c964e54317 feat: fix admin discount-code and redemption pagination by replacing the broken dc.id keyset (mismatched against ORDER BY, skipping/duplicating rows) with offset paging that emits opaque o1_ next cursors Matthew Meszaros 2026-06-28 05:58:25 +00:00
• 56fce77b0a feat: swap the admin discount search's query-bound UUID cursor for a handler-decoded Offset so the discount list's wire cursor stays opaque Matthew Meszaros 2026-06-28 05:58:25 +00:00
• 88266a797e feat: add migration 000052 indexing discount_codes on (created_at DESC, id DESC) so the admin discount list avoids a seqscan+sort once an org runs many promo codes Matthew Meszaros 2026-06-28 05:58:25 +00:00
• b71bef8e97 feat: drop the em dash from the welcome email copy to match the repo no-em-dash style rule Matthew Meszaros 2026-06-28 05:31:23 +00:00
• 6c2ea71955 feat: capture base-shell render failures to Sentry in renderEmail so every transactional email template's render errors are observable Matthew Meszaros 2026-06-28 05:31:23 +00:00
• 8373aebe99 feat: cover the refactored cancelled-deletion email shape with org and user template test cases Matthew Meszaros 2026-06-28 05:31:23 +00:00
• fe03275dbe feat: apply email-client review fixes to the danger-zone deletion templates (move the callout background to the td so Outlook renders it, switch the self-closing br to plain br, and interpolate cancelled-deletion names through html/template) Matthew Meszaros 2026-06-28 05:31:23 +00:00
• f0bdd72153 feat: add tests and previews covering the trial, invitation, notification, and deletion email generators including html-escaping and no-CTA cases Matthew Meszaros 2026-06-28 05:27:28 +00:00
• 233dee8766 feat: move danger-zone deletion emails onto the shared templates package and delete the off-brand standalone emails.go wrapper Matthew Meszaros 2026-06-28 05:27:28 +00:00
• a24b48b2f1 feat: add branded danger-zone deletion email templates (org/user scheduled, cancelled, reminder, completed) with semantic red/amber/green accents on the shared shell Matthew Meszaros 2026-06-28 05:27:28 +00:00
• 57adf4f9b2 feat: route notification.deliverEmail through GenerateNotificationHTML and drop the hand-rolled htmlEscape/inline-fragment email body Matthew Meszaros 2026-06-28 05:27:28 +00:00
• 18486ecfd4 feat: add a generic branded notification email template with an optional CTA button for the in-app notification email channel Matthew Meszaros 2026-06-28 05:27:28 +00:00
• 789da671d6 feat: send organization member invitations through GenerateInvitationHTML so they match the rest of the transactional mail Matthew Meszaros 2026-06-28 05:27:18 +00:00
• 6b2ee63593 feat: add a branded team-invitation email template with html/template-escaped org and inviter names and a slate CTA button Matthew Meszaros 2026-06-28 05:27:18 +00:00
• 7dcd5ac83f feat: render the trial-expiration job notice via GenerateTrialExpiredHTML instead of the raw unstyled h2/ul HTML fragment Matthew Meszaros 2026-06-28 05:27:18 +00:00
• f57f211d20 feat: add a branded trial-expired email template rendered through the shared transactional base shell in internal/notify/templates Matthew Meszaros 2026-06-28 05:27:18 +00:00
• 4187d15dd0 feat: document the referral program guide and the referral and applied-discounts API endpoints in docs Matthew Meszaros 2026-06-28 05:10:04 +00:00
• dce555689f feat: add the referral program marketing page and a Product footer link in site Matthew Meszaros 2026-06-28 05:10:04 +00:00
• db94ce0c47 feat: capture the ?ref= referral code in the web signup flow and thread it through registration Matthew Meszaros 2026-06-28 05:10:04 +00:00
• faad54b6a3 feat: add a redeemed promo codes table to the web billing settings page with its client, hook, and model Matthew Meszaros 2026-06-28 05:10:04 +00:00
• 8aec22ba71 feat: invalidate referral query keys on the referral and referral_credit realtime audit events in the web spine Matthew Meszaros 2026-06-28 05:10:04 +00:00
• ae09a1646c feat: build the dashboard referral settings page with its API clients, hooks, models, and route registration in web Matthew Meszaros 2026-06-28 05:10:04 +00:00
• f49816a7b1 feat: construct and bidirectionally wire the referral service into the backend bootstrap Matthew Meszaros 2026-06-28 05:09:50 +00:00
• 8bd3a1137e feat: expose the JWT referral and applied-discounts endpoints with handlers and manage_billing-gated routes Matthew Meszaros 2026-06-28 05:09:50 +00:00
• b1f26e24f9 feat: list an organization's promo redemption history through the discount service and repository for the billing page Matthew Meszaros 2026-06-28 05:09:50 +00:00
• a21f4d0d0e feat: capture the signup referral code through the auth registration flow and the WireReferral attributor hook Matthew Meszaros 2026-06-28 05:09:50 +00:00
• 234e624fdc feat: add the Stripe customer-balance applier and wire referral reward, qualify, and clawback hooks into the Stripe webhook handlers Matthew Meszaros 2026-06-28 05:09:50 +00:00
• 8b05f381f7 feat: add the referral service covering code minting, signup attribution, the reward and clawback lifecycle, and Stripe customer-balance sync in internal/app/referral Matthew Meszaros 2026-06-28 05:09:50 +00:00
• a6fae9f043 feat: add the referral repository with atomic idempotent reward and clawback ledger primitives plus code and attribution persistence in pg_referral.go Matthew Meszaros 2026-06-28 05:09:50 +00:00
• 4e7d82f8c0 feat: read the new plans.referral_reward_percent column through every plan repository scan Matthew Meszaros 2026-06-28 05:09:50 +00:00
• 6996588cb4 feat: add referral domain models, Plan month-equivalent and reward-cents helpers, and the referral and referral_credit audit entity types in internal/models Matthew Meszaros 2026-06-28 05:09:50 +00:00
• fd25383719 feat: add migration 000051 creating the referral_codes, referral_attributions, and referral earnings ledger and transactions tables plus a plans.referral_reward_percent column Matthew Meszaros 2026-06-28 05:09:50 +00:00
• d61f049f6c Merge pull request #49 from warmbly/feature/webhook-settings-onboarding Matthew Meszaros 2026-06-15 08:25:23 +02:00
• 38e9ca980f fix: correct the dashboard /auth/me avatar and password endpoints, guard self-row actions on the members page, align the steps-page permission gate with the server, harden realtime event handling, and remove the dead admin roles client Matthew Meszaros 2026-06-15 08:12:35 +02:00
• ce45ba02d9 docs: document the webhook platform and OAuth app webhooks, add the webhooks guide, and update the endpoint scope map Matthew Meszaros 2026-06-15 08:11:53 +02:00
• 2c910dcdeb feat: make a campaign step's Original a first-class weighted A/B arm driven by a single draggable traffic-split bar, persisting the control share as an is_control variant row Matthew Meszaros 2026-06-15 08:11:53 +02:00
• 03acdb87e3 fix: thread organization_id through contact, CRM, and unibox reads and writes so non-owner org members see and edit their workspace data, and backfill contacts.organization_id for single-membership users (migration 000049) Matthew Meszaros 2026-06-15 08:11:53 +02:00
• a72addabeb feat: add OAuth app webhook configuration with an event picker, signing-secret reveal and rotate, per-org installs, and a cross-org delivery log Matthew Meszaros 2026-06-15 08:11:35 +02:00
• d655ff4f59 feat: add the webhooks settings page with delivery observability, an onboarding setup step, and the webhook API client, hooks, and models Matthew Meszaros 2026-06-15 08:11:35 +02:00
• c5dfa5e4e7 feat: remove the HTTP-request action from campaign steps and automations in favor of signed webhooks, keep fire_event for custom payloads, and drop the now-unused outbound quota plumbing Matthew Meszaros 2026-06-15 08:11:35 +02:00
• 660d717456 feat: register the webhook and oauth-app-webhook routes and wire the delivery worker, audit-to-webhook bridge, and app domain resolver into the backend Matthew Meszaros 2026-06-15 08:11:20 +02:00
• 9d0c432be7 feat: let OAuth apps subscribe to webhooks by declaring a url/events/secret and materializing per-org endpoints gated by each grant's scopes, with secret rotation and delivery observability (migration 000050) Matthew Meszaros 2026-06-15 08:11:20 +02:00
• 173736a004 feat: add a Stripe-grade webhook platform with a typed event catalog, HMAC-signed delivery, retries with backoff, endpoint ownership verification, per-endpoint throttling, an audit-spine event bridge, and firehose emit sites (migration 000048) Matthew Meszaros 2026-06-15 08:11:20 +02:00
• 0a81fd361b feat: add safehttp dial-time SSRF guards and the whdomain subdomain-aware allowlist matcher used to harden outbound webhook delivery Matthew Meszaros 2026-06-15 08:11:20 +02:00
• 8209f2fbef Merge pull request #48 from warmbly/feature/realtime-tracking Matthew Meszaros 2026-06-14 12:13:33 +02:00
• ab7ed0571b ci: ignore esbuild GHSA-gv7w-rqvm-qjhr (Deno-installer RCE) since we install esbuild via pnpm/npm with integrity-pinned binaries and ship it in no runtime artifact Matthew Meszaros 2026-06-14 12:08:18 +02:00
• 899bdfb2f0 fix: stop the automation builder from showing 'Updated by a teammate' when the change was made by the same user elsewhere (e.g. toggling enabled from the automations list) by consulting the global self-mutation signal Matthew Meszaros 2026-06-14 11:12:07 +02:00
• c51946e4da fix: track the current user's own audited mutations from the realtime actor id so collaborative editors can tell a self-made change (list-row toggle, another tab) apart from a teammate's edit Matthew Meszaros 2026-06-14 11:12:07 +02:00
• c1bd391ceb docs: add a dependency-free realtime gateway reference client (connect, HELLO, heartbeat loop, seq resume, intents incl CUSTOM), a close-codes table, and OAuth-access-token auth Matthew Meszaros 2026-06-14 11:02:12 +02:00
• b83aa51921 feat: make CUSTOM_EVENT fire-event signals an explicit allow on the org channel and return structured {code, reason} errors on a failed channel join Matthew Meszaros 2026-06-14 11:02:12 +02:00
• 799e5f10ef feat: surface WebSocket connection-rejection reasons to the client as a structured {code, reason, retry_after_ms} payload (Discord-style 4003/4004/4007/4009/4010) instead of a bare 403, and fix the rate-limit 3-tuple match Matthew Meszaros 2026-06-14 11:02:12 +02:00
• 34e579fc0f feat: authenticate the realtime WebSocket with OAuth access tokens (wmat_ with the realtime scope), validated against oauth_access_grants alongside wmbly_ API keys and JWTs, and map not-a-member/forbidden rejections to close code 4010 Matthew Meszaros 2026-06-14 11:02:12 +02:00
• fcafac4195 refactor: remove the campaign 'notify (webhook)' step type now that the HTTP request step covers outbound calls and there is no webhook setup surface Matthew Meszaros 2026-06-14 10:48:06 +02:00
• 5cee0375f9 fix: let portaled pickers/menus nest inside capture-phase and popover containers via a shared data-floating marker, and migrate the last native date/time inputs (contact activity range, unibox snooze + send-later) to the themed pickers Matthew Meszaros 2026-06-14 10:48:06 +02:00
• ab24d8bbc8 feat: add a 'Fire event' action and campaign step that publish custom events to the realtime gateway (no public URL), an HTTP-request campaign step, a configurable automation dry-run test with per-step toggles, and fix the false 'updated by a teammate' toast on your own save Matthew Meszaros 2026-06-14 09:52:49 +02:00
• b94a053ac9 feat: replace native date/time inputs with the themed pickers across the dashboard (audit log, admin audit, CRM tasks/deals, contacts and unibox filters, new meeting, campaign schedule) Matthew Meszaros 2026-06-14 09:52:49 +02:00
• 736bb3d0c0 feat: add themed DatePicker, TimePicker, and DateTimePicker primitives so the dashboard never falls back to native browser date/time controls Matthew Meszaros 2026-06-14 09:52:49 +02:00
• e24c75a7db feat: render Pipedrive's real monogram in white on a Green Haze tile in integrations, via a full-bleed brand-logo option Matthew Meszaros 2026-06-14 09:52:49 +02:00
• 9cf56ee0af feat: match the analytics tab's range/metric controls to the deliverability tab (slate-100 track with a white active pill) instead of the dark slate-900 blocks Matthew Meszaros 2026-06-14 09:52:49 +02:00
• fc5e014766 fix: remove dead admin Roles/Users/Plans tabs, point the deliverability 'all mailboxes' link at /app/emails, and add the missing document titles so those dashboard tabs no longer read 'Page not found' Matthew Meszaros 2026-06-14 09:52:49 +02:00
• f598237348 feat: redesign the Settings tab into grouped sections with a framer-motion sliding active indicator and animated content transitions Matthew Meszaros 2026-06-14 09:52:49 +02:00
• e3c49fe571 feat: move the OAuth apps developer portal into Settings with a multi-step registration onboarding wizard (stepper, animated modal, logo upload) and an animated apps/authorized tab switch Matthew Meszaros 2026-06-14 09:52:49 +02:00
• fcdb31cda7 feat: OAuth apps always issue a client secret (drop the public/PKCE-only client type, secret required for the token exchange), add an app-logo upload endpoint, and align the docs to OAuth2 with optional PKCE Matthew Meszaros 2026-06-14 09:52:49 +02:00
• 0fe1401f8b feat: document the OAuth 2.1 authorization server (new api/oauth.mdx flow guide, authentication + permissions + endpoints scope-map updates, meta registration) Matthew Meszaros 2026-06-13 14:10:11 +02:00
• b06a11315f feat: add the OAuth 2.1 dashboard UI: an OAuth apps page (register apps with a scope picker, one-time client secret, rotate, delete, authorized-apps tab with revoke) and a standalone consent screen at /oauth/authorize, plus the API client, hooks, and sidebar entry Matthew Meszaros 2026-06-13 14:07:21 +02:00
• 8c175d4221 feat: add an OAuth 2.1 authorization server (migration 000047 apps/codes/grants, app registration CRUD, authorization-code-with-PKCE authorize+token+refresh-rotation+revoke endpoints, RFC 8414 discovery, bearer-token validation wired into the auth middleware reusing the API-permission gates, scopes mapped to API permission bits) Matthew Meszaros 2026-06-13 13:56:39 +02:00
• 20935ef061 feat: add a nil-safe per-org daily outbound-action quota (Redis daily counter, anti-abuse ceiling on the HTTP-request automation node, wired in both backend and consumer, fail-open) to bound webhook relay abuse Matthew Meszaros 2026-06-13 13:41:20 +02:00
• 1fa9c65ada fix: harden every user-supplied-URL outbound path against SSRF with a shared dial-time guard (resolves the host, blocks private/loopback/link-local/metadata IPs, pins the validated IP to defeat DNS rebinding, re-validates redirects) and log automation HTTP requests + blocked attempts with org attribution Matthew Meszaros 2026-06-13 13:34:19 +02:00
• c5226147ac fix: use Pipedrive's Green Haze (#08A742) for the provider glyph background instead of the darker favicon green Matthew Meszaros 2026-06-13 13:28:35 +02:00
• a7fc7263a8 fix: make HTTP request headers/body placeholders visible with normal input colors and fix the Set variables Add variable button (stop filtering the blank row on edit) Matthew Meszaros 2026-06-13 13:27:29 +02:00
• 501b5009b4 feat: add an on-error branch to automation action nodes (try/catch routing, rose on-error handle, executor follows the error edge and treats the failure as handled instead of failing the run) Matthew Meszaros 2026-06-13 13:15:41 +02:00
• 9aa3300f46 feat: capture per-action output in automation run history (HTTP status/ok, set-variables values, rendered channel/url/message) and render it under each action in the builder History panel Matthew Meszaros 2026-06-13 13:11:58 +02:00