Matthew Meszaros 4ddcb24bcd feat: make the campaign content check actually fire, fixing a link cap that counted zero links on every HTML email because the URLs live in href attributes that tag-stripping discards, a preflight that scored wait and action nodes as copy and so failed every campaign using one at 55/100 because GetSequencesByCampaignID never selected the kind column, a content_warning log level of "warning" that never matched the dashboard's "warn" amber tier, an unvalidated min_content_score an API caller could set to 5000, attachments the send path scored but preflight ignored, and a docs claim of live editor scoring that was really a manual button

2026-08-28 21:54:29 -07:00

..

reference

feat: make the campaign content check actually fire, fixing a link cap that counted zero links on every HTML email because the URLs live in href attributes that tag-stripping discards, a preflight that scored wait and action nodes as copy and so failed every campaign using one at 55/100 because GetSequencesByCampaignID never selected the kind column, a content_warning log level of "warning" that never matched the dashboard's "warn" amber tier, an unvalidated min_content_score an API caller could set to 5000, attachments the send path scored but preflight ignored, and a docs claim of live editor scoring that was really a manual button

2026-08-28 21:54:29 -07:00

authentication.mdx

docs: refresh the documentation site, fix inaccurate claims and contact addresses, add SEO primitives (#90)

2026-08-05 10:37:27 +02:00

endpoints.mdx

feat: build the browser half of social sign-in, which was never wired: GOOGLE_CLIENT_ID was read at boot and made the login screen render a Google button, but the button opened a popup at /auth/google/login which no route served, and authService.GoogleAuth/AppleAuth had no caller anywhere in the codebase; internal/app/socialauth now runs Google and Apple through the flow generic OIDC already used (one-time state, PKCE, nonce, id_token verified against the provider JWKS, identity keyed on issuer and subject, JIT provisioning, the ban and 2FA gates), the redirect URI defaults to API_PUBLIC_URL/v1/auth/<provider>/callback and is logged at boot because registering the dashboard origin instead is the mistake that produces a valid OAuth client and a dead button, /auth/config advertises only providers the backend can actually complete, the SSO landing page no longer swallows a two_fa_required response, and OIDC_PROVIDER_NAME finally reaches the button it documents

2026-08-28 01:33:08 -07:00

error-codes.mdx

feat: bind a browser sign-in to the browser that started it, so a handoff link cannot be forwarded: one-time state proves the callback answers a request this server made, not one THIS browser made, so anyone could run the flow against their own Google or OIDC account and send the resulting URL to someone else, whose browser would then hold the sender's session (RFC 9700 4.7.1); begin now mints a binding secret that never reaches the provider and never appears in a URL, the callback carries it into the handoff, and the exchange refuses a collection that cannot present it with sso_wrong_browser, while the comments this PR added are condensed to the constraint they exist to state

2026-08-28 01:44:39 -07:00

index.mdx

docs: refresh the documentation site, fix inaccurate claims and contact addresses, add SEO primitives (#90)

2026-08-05 10:37:27 +02:00

mcp.mdx

docs: refresh the documentation site, fix inaccurate claims and contact addresses, add SEO primitives (#90)

2026-08-05 10:37:27 +02:00

meta.json

feat: restyle the docs site without decorative sidebar icons (frontmatter icons dropped, lucide source plugin disabled, AGENTS.md conventions updated), add LangTab language-logo code tabs, and document the new agent tools plus panel resize/placement/shortcuts in the assistant guide and MCP reference

2026-07-16 07:50:24 +02:00

oauth.mdx

feat: add one-command MCP OAuth connect on api.warmbly.com/v1/mcp — RFC 7591 dynamic client registration for public PKCE clients (dcr.go), RFC 9728 protected-resource metadata + WWW-Authenticate challenge via MCPAuthMiddleware, /v1/mcp now accepts an API key or OAuth token, public-client auth with no secret and mandatory PKCE reusing the existing OAuth 2.1 server (nullable-org clients, migration 000066), executable-redirect-scheme hardening on the open register endpoint, plus mcp/oauth/authentication/endpoints docs

2026-07-16 08:57:19 +02:00

openapi.mdx

feat: restyle the docs site without decorative sidebar icons (frontmatter icons dropped, lucide source plugin disabled, AGENTS.md conventions updated), add LangTab language-logo code tabs, and document the new agent tools plus panel resize/placement/shortcuts in the assistant guide and MCP reference

2026-07-16 07:50:24 +02:00

permissions.mdx

docs: refresh the documentation site, fix inaccurate claims and contact addresses, add SEO primitives (#90)

2026-08-05 10:37:27 +02:00

realtime.mdx

feat: make the realtime service survive a client that spams channel joins, and stop both clients from being that client: ws_join is now spent per phx_join in a shared RealtimeWeb.ChannelGuard that every channel runs BEFORE its Auth lookup (it was only ever spent on the socket handshake, so an established socket could issue unlimited joins and each one cost a Postgres query), handshakes move to their own ws_connect bucket so a reconnect storm cannot eat the budget a client needs to rejoin with, the retry_after_ms hint now points at the next window instead of shrinking as overage grew, every channel's join rejection carries the numeric code the API reference already promised (plus 4005 for a malformed topic), BulkChannel only pushes an event to the user who owns the operation instead of to anyone who guesses the id, and the web and admin clients treat a rate_limited join as transient (wait out the hint, keep the socket) while backing off per-channel rejoins on a decaying schedule rather than reconnecting on the 120ms floor forever; adds an ExUnit suite for realtime and a vitest suite for admin, both wired into CI

2026-08-26 21:14:34 -07:00

sdks.mdx

feat: restyle the docs site without decorative sidebar icons (frontmatter icons dropped, lucide source plugin disabled, AGENTS.md conventions updated), add LangTab language-logo code tabs, and document the new agent tools plus panel resize/placement/shortcuts in the assistant guide and MCP reference

2026-07-16 07:50:24 +02:00