Matthew Meszaros
32da32a0a8
feat: mask every revealed secret in session replay by tagging API key, client and signing secrets, inbound webhook URLs, join commands, tester passwords, pairing codes and the TOTP QR, block inputs holding credentials, mask token, session and code URL parameters in dashboard analytics, give the admin panel the same masking with console recording off, and update the privacy page to match
2026-10-04 02:57:17 -07:00
..
feat: frontend half of the admin panel upgrade: drop ten unused dependencies, the dead worker-load and plan requests, the stub pages and the retired permission names, fix the analytics client that sent the wrong query parameters and the mail test toasts that used an unmounted toaster, add a Cmd-K command palette with live user, organization, mailbox and worker search, a mobile nav drawer, document titles, a Sentry-wired route error boundary and permission gates on every route, replace polling with the realtime spine wherever an event exists, fold Analytics into Overview with a signups-by-channel card, merge System Status into Setup and health and Settings, Notifications and Effective limits into Configuration as tabs with redirects from every old path, add the Sync, Sends, Jobs, Fleet, Admins and Transfers pages plus API-key, webhook and transfer tabs on the organization page, mailbox reassignment on the worker page and abuse and action-history tabs on Warmup, and add the admin-panel docs page with every nav reference updated
2026-09-07 21:40:38 -07:00
feat: mask every revealed secret in session replay by tagging API key, client and signing secrets, inbound webhook URLs, join commands, tester passwords, pairing codes and the TOTP QR, block inputs holding credentials, mask token, session and code URL parameters in dashboard analytics, give the admin panel the same masking with console recording off, and update the privacy page to match
2026-10-04 02:57:17 -07:00
2026-09-16 04:04:09 -07:00
2026-09-17 04:15:05 -07:00
feat: address the CodeRabbit review on the admin frontend PR by warning about the last admin who can grant access only when the whole admin list is on screen, resetting the convert-to-dedicated form on Cancel, following a changed ?q= on the mailboxes page instead of only its first value, treating the all sentinel as the sync state default and not as a search term, naming the lease window in the webhook reclaim confirmation only once it is loaded, walking transfer group dependents transitively so unticking a group drops everything that needs it, labelling the shown-page scope of the worker bulk move, closing the mobile drawer when the viewport reaches the desktop breakpoint, dropping the stale plan mention from the users page description, and completing the accessibility contract of the status segments, passphrase fields, icon-only delete button and search combobox
2026-09-07 23:08:56 -07:00
feat: frontend half of the admin panel upgrade: drop ten unused dependencies, the dead worker-load and plan requests, the stub pages and the retired permission names, fix the analytics client that sent the wrong query parameters and the mail test toasts that used an unmounted toaster, add a Cmd-K command palette with live user, organization, mailbox and worker search, a mobile nav drawer, document titles, a Sentry-wired route error boundary and permission gates on every route, replace polling with the realtime spine wherever an event exists, fold Analytics into Overview with a signups-by-channel card, merge System Status into Setup and health and Settings, Notifications and Effective limits into Configuration as tabs with redirects from every old path, add the Sync, Sends, Jobs, Fleet, Admins and Transfers pages plus API-key, webhook and transfer tabs on the organization page, mailbox reassignment on the worker page and abuse and action-history tabs on Warmup, and add the admin-panel docs page with every nav reference updated
2026-09-07 21:40:38 -07:00
feat: run one inbox placement test across many sending mailboxes as a placement batch (issue #736): server-side sender scopes (a campaign's senders or the whole workspace, filtered by provider, domain, tag and untested days) and sampling (random, percent stratified by provider or domain, per domain, per provider) snapshotted at creation, a runner that starts senders under per-workspace and instance-wide concurrency and a start rate with defer or skip for unavailable mailboxes, aggregate placement by sending domain, sending provider and recipient provider, fleet coverage, cancel, credits agreed per batch, org transfer, operator settings in the admin panel, dashboard pages and dialog, CLI commands, agent tools, OpenAPI and docs
2026-09-29 10:19:46 -07:00
feat: address the CodeRabbit review on the admin frontend PR by warning about the last admin who can grant access only when the whole admin list is on screen, resetting the convert-to-dedicated form on Cancel, following a changed ?q= on the mailboxes page instead of only its first value, treating the all sentinel as the sync state default and not as a search term, naming the lease window in the webhook reclaim confirmation only once it is loaded, walking transfer group dependents transitively so unticking a group drops everything that needs it, labelling the shown-page scope of the worker bulk move, closing the mobile drawer when the viewport reaches the desktop breakpoint, dropping the stale plan mention from the users page description, and completing the accessibility contract of the status segments, passphrase fields, icon-only delete button and search combobox
2026-09-07 23:08:56 -07:00
feat: address the CodeRabbit review on the admin frontend PR by warning about the last admin who can grant access only when the whole admin list is on screen, resetting the convert-to-dedicated form on Cancel, following a changed ?q= on the mailboxes page instead of only its first value, treating the all sentinel as the sync state default and not as a search term, naming the lease window in the webhook reclaim confirmation only once it is loaded, walking transfer group dependents transitively so unticking a group drops everything that needs it, labelling the shown-page scope of the worker bulk move, closing the mobile drawer when the viewport reaches the desktop breakpoint, dropping the stale plan mention from the users page description, and completing the accessibility contract of the status segments, passphrase fields, icon-only delete button and search combobox
2026-09-07 23:08:56 -07:00
2026-07-22 12:11:19 +02:00
feat: address the CodeRabbit review on the admin frontend PR by warning about the last admin who can grant access only when the whole admin list is on screen, resetting the convert-to-dedicated form on Cancel, following a changed ?q= on the mailboxes page instead of only its first value, treating the all sentinel as the sync state default and not as a search term, naming the lease window in the webhook reclaim confirmation only once it is loaded, walking transfer group dependents transitively so unticking a group drops everything that needs it, labelling the shown-page scope of the worker bulk move, closing the mobile drawer when the viewport reaches the desktop breakpoint, dropping the stale plan mention from the users page description, and completing the accessibility contract of the status segments, passphrase fields, icon-only delete button and search combobox
2026-09-07 23:08:56 -07:00
2026-10-04 00:31:52 -07:00
2026-09-21 02:11:38 -07:00
feat: address verification overhaul for #264: MillionVerifier as a pay-as-you-go integration plugin with org-sealed key and automatic fallback to the built-in check, built-in prober gains domain cache, Microsoft/Yahoo fingerprinting, MX fallback, disposable/role sub-statuses and a self-check breaker, imports and POST /contacts accept verification results in any known provider vocabulary with auto-detected columns, verdict provenance and expiry columns (migration 000110), campaigns park at paused_undeliverable with re-verify/send-anyway instead of finishing, POST/GET /contacts/verification bulk actions and overview, launch gate override via acknowledge_list_risk, animated verification marks, banner and settings card in the dashboard, and docs
2026-08-29 23:11:22 -07:00
feat: frontend half of the admin panel upgrade: drop ten unused dependencies, the dead worker-load and plan requests, the stub pages and the retired permission names, fix the analytics client that sent the wrong query parameters and the mail test toasts that used an unmounted toaster, add a Cmd-K command palette with live user, organization, mailbox and worker search, a mobile nav drawer, document titles, a Sentry-wired route error boundary and permission gates on every route, replace polling with the realtime spine wherever an event exists, fold Analytics into Overview with a signups-by-channel card, merge System Status into Setup and health and Settings, Notifications and Effective limits into Configuration as tabs with redirects from every old path, add the Sync, Sends, Jobs, Fleet, Admins and Transfers pages plus API-key, webhook and transfer tabs on the organization page, mailbox reassignment on the worker page and abuse and action-history tabs on Warmup, and add the admin-panel docs page with every nav reference updated
2026-09-07 21:40:38 -07:00
2026-10-04 01:20:28 -07:00
2026-09-16 04:04:09 -07:00
2026-07-12 09:00:10 +02:00
2026-09-09 04:54:01 -07:00
feat: frontend half of the admin panel upgrade: drop ten unused dependencies, the dead worker-load and plan requests, the stub pages and the retired permission names, fix the analytics client that sent the wrong query parameters and the mail test toasts that used an unmounted toaster, add a Cmd-K command palette with live user, organization, mailbox and worker search, a mobile nav drawer, document titles, a Sentry-wired route error boundary and permission gates on every route, replace polling with the realtime spine wherever an event exists, fold Analytics into Overview with a signups-by-channel card, merge System Status into Setup and health and Settings, Notifications and Effective limits into Configuration as tabs with redirects from every old path, add the Sync, Sends, Jobs, Fleet, Admins and Transfers pages plus API-key, webhook and transfer tabs on the organization page, mailbox reassignment on the worker page and abuse and action-history tabs on Warmup, and add the admin-panel docs page with every nav reference updated
2026-09-07 21:40:38 -07:00
feat: make self-hosted onboarding survivable by fixing invite_only, which could not onboard anyone (the accept route is JWT-only, so redeeming the invitation that would create your account required already having one, making the self-host default silently identical to fully closed), threading the invitation token through registration so an invited person lands in the inviting organization instead of a stray workspace, gating SSO just-in-time provisioning behind DISABLE_REGISTRATION (it bypassed the gate entirely, so an instance set to true was still open to anyone the IdP would assert) with SSO_AUTO_PROVISION as the opt-out, correcting the OIDC redirect URL that pointed at /api/v1 against a route at /v1 and 404'd every SSO login, scoping the first-launch exemption so it no longer overrides an explicit lockdown, preserving the remaining TTL when restoring a losing setup token so a public endpoint cannot hold the claim window open forever, replacing a generic 403 with typed registration_invite_only, registration_closed, invitation_invalid, setup_token_invalid and setup_already_complete codes that name the next step, logging why no claim link was issued on an already-claimed instance instead of staying silent, adding a warmblyctl operator CLI (status with health checks and a non-zero exit, reissuable setup-link, user create/list/reset-password/grant-admin/revoke-admin/disable-2fa, hash-password) so a locked-out operator no longer needs hand-written psql, adding read-only instance configuration over 104 environment variables with structural secret redaction and fingerprints, 35 health checks, a database-backed settings tier for the three keys no environment variable owns, hiding the signup form when the config already says invite_only rather than failing the whole form with a toast, and documenting first run, accounts and access, configuration, instance health and troubleshooting alongside the root .env.example the README told operators to write but never shipped (#114)
2026-08-16 05:58:11 +02:00
feat: frontend half of the admin panel upgrade: drop ten unused dependencies, the dead worker-load and plan requests, the stub pages and the retired permission names, fix the analytics client that sent the wrong query parameters and the mail test toasts that used an unmounted toaster, add a Cmd-K command palette with live user, organization, mailbox and worker search, a mobile nav drawer, document titles, a Sentry-wired route error boundary and permission gates on every route, replace polling with the realtime spine wherever an event exists, fold Analytics into Overview with a signups-by-channel card, merge System Status into Setup and health and Settings, Notifications and Effective limits into Configuration as tabs with redirects from every old path, add the Sync, Sends, Jobs, Fleet, Admins and Transfers pages plus API-key, webhook and transfer tabs on the organization page, mailbox reassignment on the worker page and abuse and action-history tabs on Warmup, and add the admin-panel docs page with every nav reference updated
2026-09-07 21:40:38 -07:00
2026-06-02 15:54:40 +02:00
2026-09-09 04:54:01 -07:00
feat: frontend half of the admin panel upgrade: drop ten unused dependencies, the dead worker-load and plan requests, the stub pages and the retired permission names, fix the analytics client that sent the wrong query parameters and the mail test toasts that used an unmounted toaster, add a Cmd-K command palette with live user, organization, mailbox and worker search, a mobile nav drawer, document titles, a Sentry-wired route error boundary and permission gates on every route, replace polling with the realtime spine wherever an event exists, fold Analytics into Overview with a signups-by-channel card, merge System Status into Setup and health and Settings, Notifications and Effective limits into Configuration as tabs with redirects from every old path, add the Sync, Sends, Jobs, Fleet, Admins and Transfers pages plus API-key, webhook and transfer tabs on the organization page, mailbox reassignment on the worker page and abuse and action-history tabs on Warmup, and add the admin-panel docs page with every nav reference updated
2026-09-07 21:40:38 -07:00
feat: frontend half of the admin panel upgrade: drop ten unused dependencies, the dead worker-load and plan requests, the stub pages and the retired permission names, fix the analytics client that sent the wrong query parameters and the mail test toasts that used an unmounted toaster, add a Cmd-K command palette with live user, organization, mailbox and worker search, a mobile nav drawer, document titles, a Sentry-wired route error boundary and permission gates on every route, replace polling with the realtime spine wherever an event exists, fold Analytics into Overview with a signups-by-channel card, merge System Status into Setup and health and Settings, Notifications and Effective limits into Configuration as tabs with redirects from every old path, add the Sync, Sends, Jobs, Fleet, Admins and Transfers pages plus API-key, webhook and transfer tabs on the organization page, mailbox reassignment on the worker page and abuse and action-history tabs on Warmup, and add the admin-panel docs page with every nav reference updated
2026-09-07 21:40:38 -07:00
2026-09-12 09:45:31 -07:00
2026-09-12 09:45:31 -07:00
2026-05-28 08:57:45 +02:00
2026-08-28 22:47:24 -07:00
feat: give a suspended workspace a way back, because risk_state was a one-way door: the derived band is no longer pinned at suspended by the UPDATE in pg_org_risk, an operator's decision is now an explicit risk_override that outranks the score and survives every later detector write until it is lifted, the one-shot detectors (signup origin, import list quality, repeated sign-in anomalies) file findings with a 30-day expiry that a six-hourly consumer sweep retires so a score falls on its own, migration 000104 backfills that expiry onto findings already on file, and four admin endpoints plus an Abuse posture panel in admin/ let an operator finally read the evidence the customer endpoint withholds, retract a finding, pin a band and lift the pin; also stops the reviewing admin's identity reaching the tenant's own audit feed (which resolves an actor to a name and email) by recording the platform as the actor there and the operator in the admin trail, and stops risk_signals riding along in a customer-downloadable org export
2026-08-28 22:42:57 -07:00
2026-09-12 09:45:31 -07:00
2026-09-09 06:34:43 -07:00
feat: frontend half of the admin panel upgrade: drop ten unused dependencies, the dead worker-load and plan requests, the stub pages and the retired permission names, fix the analytics client that sent the wrong query parameters and the mail test toasts that used an unmounted toaster, add a Cmd-K command palette with live user, organization, mailbox and worker search, a mobile nav drawer, document titles, a Sentry-wired route error boundary and permission gates on every route, replace polling with the realtime spine wherever an event exists, fold Analytics into Overview with a signups-by-channel card, merge System Status into Setup and health and Settings, Notifications and Effective limits into Configuration as tabs with redirects from every old path, add the Sync, Sends, Jobs, Fleet, Admins and Transfers pages plus API-key, webhook and transfer tabs on the organization page, mailbox reassignment on the worker page and abuse and action-history tabs on Warmup, and add the admin-panel docs page with every nav reference updated
2026-09-07 21:40:38 -07:00
2026-09-25 20:56:11 -07:00
feat: frontend half of the admin panel upgrade: drop ten unused dependencies, the dead worker-load and plan requests, the stub pages and the retired permission names, fix the analytics client that sent the wrong query parameters and the mail test toasts that used an unmounted toaster, add a Cmd-K command palette with live user, organization, mailbox and worker search, a mobile nav drawer, document titles, a Sentry-wired route error boundary and permission gates on every route, replace polling with the realtime spine wherever an event exists, fold Analytics into Overview with a signups-by-channel card, merge System Status into Setup and health and Settings, Notifications and Effective limits into Configuration as tabs with redirects from every old path, add the Sync, Sends, Jobs, Fleet, Admins and Transfers pages plus API-key, webhook and transfer tabs on the organization page, mailbox reassignment on the worker page and abuse and action-history tabs on Warmup, and add the admin-panel docs page with every nav reference updated
2026-09-07 21:40:38 -07:00
feat: address the CodeRabbit review on the admin frontend PR by warning about the last admin who can grant access only when the whole admin list is on screen, resetting the convert-to-dedicated form on Cancel, following a changed ?q= on the mailboxes page instead of only its first value, treating the all sentinel as the sync state default and not as a search term, naming the lease window in the webhook reclaim confirmation only once it is loaded, walking transfer group dependents transitively so unticking a group drops everything that needs it, labelling the shown-page scope of the worker bulk move, closing the mobile drawer when the viewport reaches the desktop breakpoint, dropping the stale plan mention from the users page description, and completing the accessibility contract of the status segments, passphrase fields, icon-only delete button and search combobox
2026-09-07 23:08:56 -07:00
feat: mask every revealed secret in session replay by tagging API key, client and signing secrets, inbound webhook URLs, join commands, tester passwords, pairing codes and the TOTP QR, block inputs holding credentials, mask token, session and code URL parameters in dashboard analytics, give the admin panel the same masking with console recording off, and update the privacy page to match
2026-10-04 02:57:17 -07:00
feat: frontend half of the admin panel upgrade: drop ten unused dependencies, the dead worker-load and plan requests, the stub pages and the retired permission names, fix the analytics client that sent the wrong query parameters and the mail test toasts that used an unmounted toaster, add a Cmd-K command palette with live user, organization, mailbox and worker search, a mobile nav drawer, document titles, a Sentry-wired route error boundary and permission gates on every route, replace polling with the realtime spine wherever an event exists, fold Analytics into Overview with a signups-by-channel card, merge System Status into Setup and health and Settings, Notifications and Effective limits into Configuration as tabs with redirects from every old path, add the Sync, Sends, Jobs, Fleet, Admins and Transfers pages plus API-key, webhook and transfer tabs on the organization page, mailbox reassignment on the worker page and abuse and action-history tabs on Warmup, and add the admin-panel docs page with every nav reference updated
2026-09-07 21:40:38 -07:00
2026-05-28 10:00:29 +02:00
2026-09-14 21:06:14 -07:00
2026-08-27 03:21:25 -07:00
feat: address the CodeRabbit review on the admin frontend PR by warning about the last admin who can grant access only when the whole admin list is on screen, resetting the convert-to-dedicated form on Cancel, following a changed ?q= on the mailboxes page instead of only its first value, treating the all sentinel as the sync state default and not as a search term, naming the lease window in the webhook reclaim confirmation only once it is loaded, walking transfer group dependents transitively so unticking a group drops everything that needs it, labelling the shown-page scope of the worker bulk move, closing the mobile drawer when the viewport reaches the desktop breakpoint, dropping the stale plan mention from the users page description, and completing the accessibility contract of the status segments, passphrase fields, icon-only delete button and search combobox
2026-09-07 23:08:56 -07:00
feat: frontend half of the admin panel upgrade: drop ten unused dependencies, the dead worker-load and plan requests, the stub pages and the retired permission names, fix the analytics client that sent the wrong query parameters and the mail test toasts that used an unmounted toaster, add a Cmd-K command palette with live user, organization, mailbox and worker search, a mobile nav drawer, document titles, a Sentry-wired route error boundary and permission gates on every route, replace polling with the realtime spine wherever an event exists, fold Analytics into Overview with a signups-by-channel card, merge System Status into Setup and health and Settings, Notifications and Effective limits into Configuration as tabs with redirects from every old path, add the Sync, Sends, Jobs, Fleet, Admins and Transfers pages plus API-key, webhook and transfer tabs on the organization page, mailbox reassignment on the worker page and abuse and action-history tabs on Warmup, and add the admin-panel docs page with every nav reference updated
2026-09-07 21:40:38 -07:00
2026-09-14 07:44:34 -07:00
2026-09-17 04:15:05 -07:00
feat: mask every revealed secret in session replay by tagging API key, client and signing secrets, inbound webhook URLs, join commands, tester passwords, pairing codes and the TOTP QR, block inputs holding credentials, mask token, session and code URL parameters in dashboard analytics, give the admin panel the same masking with console recording off, and update the privacy page to match
2026-10-04 02:57:17 -07:00
2026-10-02 08:02:36 +02:00