Matthew Meszaros 1387541bf0 feat: make self-hosted auth work without a mail relay by rewriting the platform SMTP transport with real AUTH and TLS (it did neither, so SMTP_USERNAME/SMTP_PASSWORD were dead and every documented relay was unreachable), adding MAIL_TRANSPORT=smtp|log|ses with a log transport that prints codes so a fresh install can sign in with no relay, demoting the emailed login code to AUTH_LOGIN_CODE=always|new_device|off (off on self-host, per NIST SP 800-63B and OWASP ASVS), claiming the first owner through a single-use setup link or WARMBLY_BOOTSTRAP_* instead of register-then-psql, deriving every emailed URL from APP_URL rather than a hardcoded app.warmbly.com that leaked live reset tokens to the vendor, fixing the confirm hooks that read path params against paramless routes and broke login, register and reset confirmation in the dashboard everywhere, adding generic OIDC with PKCE, one-time state, verified nonce and (issuer,subject) identity binding, enforcing 2FA on the social paths that skipped it, adding a per-IP limiter and trusted-proxy handling to the unthrottled auth group, refusing boot on the published default secrets, and dropping mailpit from the default stack

2026-08-14 10:37:14 +02:00

..

argon2

Fix: Go Tests

2026-01-29 09:23:46 +01:00

captcha

feat: make google, apple and turnstile optional at boot

2026-07-20 09:56:17 +02:00

climit

New Repository: Add Backend Code

2026-01-17 14:11:14 +00:00

crypt

Update auth and onboarding flow

2026-02-14 05:38:27 +01:00

dnsauth

feat: add dnsauth unit tests covering Result.State() classification (unknown on empty/transient-error, passing on SPF+DMARC, DKIM advisory) and DMARC policy parsing

2026-07-17 03:22:48 +00:00

dsn

feat: add a conservative DSN bounce parser that extracts permanence, failed recipient, and original message id from delivery-status reports, treating only 5.x.x/failed as permanent so transient 4.x.x failures never over-suppress

2026-07-04 11:36:47 +02:00

emailverify

feat: add deliverability controls

2026-06-03 16:47:53 +02:00

emsg

feat: send campaign email attachments

2026-06-05 06:03:21 +02:00

encrypt

feat: seal SMTP/IMAP credentials at rest with a CREDENTIALS_ENCRYPTION_KEY-backed encrypter - the email repository Encrypt field was never wired anywhere, so smtp_imap accounts could never load onto workers (plaintext rows failed decode; hex-looking rows would nil-panic); adds encrypt.FromEnv and nil-guards that fail with a captured error instead

2026-07-11 17:30:49 +02:00

generation

Merge pull request #83 from warmbly/ai-content-blocks

2026-07-22 17:59:36 +02:00

geo

feat: move infrastructure state off dynamodb

2026-06-02 15:54:12 +02:00

humanlint

feat: improve warmup content safeguards

2026-06-03 11:32:19 +02:00

idtoken

feat: make self-hosted auth work without a mail relay by rewriting the platform SMTP transport with real AUTH and TLS (it did neither, so SMTP_USERNAME/SMTP_PASSWORD were dead and every documented relay was unreachable), adding MAIL_TRANSPORT=smtp|log|ses with a log transport that prints codes so a fresh install can sign in with no relay, demoting the emailed login code to AUTH_LOGIN_CODE=always|new_device|off (off on self-host, per NIST SP 800-63B and OWASP ASVS), claiming the first owner through a single-use setup link or WARMBLY_BOOTSTRAP_* instead of register-then-psql, deriving every emailed URL from APP_URL rather than a hardcoded app.warmbly.com that leaked live reset tokens to the vendor, fixing the confirm hooks that read path params against paramless routes and broke login, register and reset confirmation in the dashboard everywhere, adding generic OIDC with PKCE, one-time state, verified nonce and (issuer,subject) identity binding, enforcing 2FA on the social paths that skipped it, adding a per-IP limiter and trusted-proxy handling to the unthrottled auth group, refusing boot on the published default secrets, and dropping mailpit from the default stack

2026-08-14 10:37:14 +02:00

mcp

feat: connect external MCP servers whose tools the AI assistant can use - ai_mcp_servers table with bearer tokens sealed by the org DEK cipher (never returned) and SSRF-validated https urls, a dependency-free streamable-HTTP JSON-RPC client (initialize/tools/list/tools/call over safehttp dial-time IP blocking with SSE+JSON handling and body caps), an mcp service that discovers tools on connect and contributes only enabled servers' tools to the dashboard agent as namespaced mcp_<server>_<tool> defs that are always write-class and never auto-allowed, a registry DynamicToolSource hook so per-org tools join the agent's tool set and resume executes them through ToolDefs, /ai/connections CRUD gated on manage_settings with an mcp_server audit entity and spine, a Connections settings page to add servers and review/enable discovered tools, and docs

2026-07-13 20:05:24 +02:00

safehttp

feat: add safehttp dial-time SSRF guards and the whdomain subdomain-aware allowlist matcher used to harden outbound webhook delivery

2026-06-15 08:11:20 +02:00

stoken

New Repository: Add Backend Code

2026-01-17 14:11:14 +00:00

tmplfuncs

feat: preview campaign templates

2026-06-08 15:04:53 +02:00

warmlint

feat: add campaign template scoring

2026-06-03 06:27:07 +02:00

warmpersona

feat: add warmup content controls

2026-06-03 05:05:53 +02:00

whdomain

feat: add safehttp dial-time SSRF guards and the whdomain subdomain-aware allowlist matcher used to harden outbound webhook delivery

2026-06-15 08:11:20 +02:00