Matthew Meszaros e668a2a36b feat: complete the ADA CASA v2.1.1 AL1 control set across authentication, sessions, access control, cryptography, input validation and configuration, adding a breached-password denylist and per-account login throttling, enforced multi-factor authentication on the admin panel, step-up confirmation before an action that mints a lasting credential, purpose-scoped session tokens, single-use TOTP steps, tenant verification on every cross-referenced identifier, security headers on every surface, encrypted webhook signing secrets, per-organization idempotency, PKCE and a minimal two-scope Gmail consent on the mailbox OAuth flow, bounded spreadsheet and archive decoding, a patched Go toolchain with govulncheck in CI, and the evidence pack under compliance/casa

2026-09-19 08:18:35 +02:00

..

backdrops

feat: add discount code support for checkout and plan changes

2026-05-29 05:49:19 +00:00

_headers

feat: complete the ADA CASA v2.1.1 AL1 control set across authentication, sessions, access control, cryptography, input validation and configuration, adding a breached-password denylist and per-account login throttling, enforced multi-factor authentication on the admin panel, step-up confirmation before an action that mints a lasting credential, purpose-scoped session tokens, single-use TOTP steps, tenant verification on every cross-referenced identifier, security headers on every surface, encrypted webhook signing secrets, per-organization idempotency, PKCE and a minimal two-scope Gmail consent on the mailbox OAuth flow, bounded spreadsheet and archive decoding, a patched Go toolchain with govulncheck in CI, and the evidence pack under compliance/casa

2026-09-19 08:18:35 +02:00

_redirects

feat: let web and admin be served from a static host by teaching each app's own entrypoint to render config.js wherever WARMBLY_CONFIG_OUT points, so one definition of the runtime key set serves both the container that renders it at start and a build:pages script that renders it into dist, ship a _redirects in each so a deep link stops 404ing without nginx try_files, and add scripts/check-pages-build.sh to make lint because a malformed config.js reads fine in a diff and leaves the app blank at runtime

2026-09-10 18:03:00 +02:00

apple-touch-icon.png

feat: refresh app favicon assets

2026-06-04 08:55:31 +02:00

config.js

feat: add a runtime config shim to the dashboard so a single built image reads its API url, app url, tracking domain, and turnstile key from container env via /config.js

2026-07-22 18:40:06 +02:00

favicon-16x16.png

feat: refresh app favicon assets

2026-06-04 08:55:31 +02:00

favicon-32x32.png

feat: refresh app favicon assets

2026-06-04 08:55:31 +02:00

favicon-48x48.png

feat: refresh app favicon assets

2026-06-04 08:55:31 +02:00

favicon-96x96.png

feat: refresh app favicon assets

2026-06-04 08:55:31 +02:00

favicon.ico

feat: refresh app favicon assets

2026-06-04 08:55:31 +02:00

site.webmanifest

feat: add discount code support for checkout and plan changes

2026-05-29 05:49:19 +00:00

web-app-manifest-192x192.png

feat: refresh app favicon assets

2026-06-04 08:55:31 +02:00

web-app-manifest-512x512.png

feat: refresh app favicon assets

2026-06-04 08:55:31 +02:00