Matthew Meszaros ae1a324801 Merge pull request #562 from rocker1166/feat/direct-mail-analytics ...

feat: add accurate direct-mail analytics and opt-in engagement tracking

2026-09-17 11:47:50 +00:00

..

admin_ops.go

fix: retire the warmup invalid-token band with its table, metric query, service and repository methods and admin tab, since nothing has fed it since #481 and no attributable forged-token signal exists; key the live pool fixtures on the canonical pool ids so the warmup, repository routing and tasks routing suites run on a fresh database, and correct every doc, site and advisor line that still described the retired signal or a spam-score threshold nothing implements (#490)

2026-09-13 08:09:01 -07:00

admin_outreach.go

feat: expand admin management queries

2026-06-02 15:54:29 +02:00

admin_permission.go

feat: tester accounts, creatable from the admin panel (#483)

2026-09-13 03:07:10 -07:00

admin.go

fix: retire the warmup spam score, a counter that grew with volume rather than misbehaviour and that no band could act on (#508)

2026-09-14 07:44:34 -07:00

advanced_outreach_test.go

fix: stop every out-of-office notice and bounce opening a high-priority CRM follow-up by classifying machine replies from their headers and gating the task on a per-intent setting, and give the Tasks page multi-select with select-all-matching, bulk status, priority and delete over new PATCH and DELETE /crm/tasks endpoints (issue #471)

2026-09-14 12:20:47 -07:00

advanced_outreach.go

fix: stop every out-of-office notice and bounce opening a high-priority CRM follow-up by classifying machine replies from their headers and gating the task on a per-intent setting, and give the Tasks page multi-select with select-all-matching, bulk status, priority and delete over new PATCH and DELETE /crm/tasks endpoints (issue #471)

2026-09-14 12:20:47 -07:00

advisor.go

feat: add the Advisor, continuous sending checks surfaced on the row they are about (#86)

2026-07-30 17:15:09 +02:00

agent.go

feat: add workspace-shared assistant history: a manage_settings toggle on the organization (assistant_shared_history, off by default) makes every conversation visible to and continuable by every member with the use-AI permission — the service resolves a session to its owner's rows so open/continue/approve/delete all work cross-member while credits still charge the acting member, the org-wide listing joins owner names for attribution in the history rail, the workspace settings page gains the AI assistant section with the toggle and an explicit exposure warning, and the assistant guide's access and privacy sections describe both modes

2026-07-19 13:22:56 +02:00

analytics.go

feat(analytics): report on mail written by hand, with opt-in open and click tracking per mailbox

2026-09-17 10:26:25 +00:00

api_key.go

feat: add a permanent delete for API keys, DELETE /api-keys/:id/permanent plus a Delete key button under a revoked key in the dashboard drawer and warmbly key purge, taking the key's usage logs with it and refusing any key that could still authenticate so revoking stays the step that records why a credential ended (issue #414)

2026-09-10 05:02:05 -07:00

api_permission.go

feat: say segments out loud in the API scope catalog: the READ_CONTACTS and WRITE_CONTACTS descriptions served to the API key dialog (and the docs permission table) now name segments, since segment CRUD, previews, member overrides and enrolment ride on the contact scopes and the picker never said so

2026-09-01 01:32:56 -07:00

attachment.go

feat: add Delete and Duplicate campaign actions to the dashboard (issue #185): every campaign row and the detail header get a ⋯ menu (Edit, Duplicate, Start/Pause, Delete) plus a Delete card at the bottom of Settings, all permission-gated with a confirm that spells out what goes; DELETE /campaigns/:id is now organization-scoped instead of user_id-scoped so teammates can delete, runs in one transaction that also deletes the campaign's pending tasks and cancels a wakeup tick claimed at that moment (campaign_tasks only nulls its link, so those rows kept firing), removes attachment objects and publishes CAMPAIGN_DELETED so a teammate's open detail page is sent back to the list; new POST /campaigns/:id/duplicate copies the campaign row as a draft with steps and their branch graph rewired onto new step ids, tags, folders, senders with rotation reset, A/B variants, advanced settings and attachments (quota-checked, blobs undone if the copy fails) and none of the leads, progress, logs, counters, ramp level, guardrail trip or past dates, naming it (copy)/(copy N) inside the 50 byte cap without splitting runes; a claimed campaign tick whose campaign vanished now ends the chain instead of staying active forever; covered by TestLiveCampaignLifecycle* against real SQL, RemapBranchTargets and duplicateName unit tests and a react-query vitest for the list cache, with API reference, endpoint map and campaigns guide updated

2026-08-25 08:54:51 -07:00

audit.go

feat: hold a lead whose mailbox answers out of office until they are back, resuming at the return date it names, plus a manual per-contact pause in one campaign that unsubscribing and the suppression list were the only stand-ins for

2026-09-14 09:26:06 -07:00

auth.go

feat: bind a browser sign-in to the browser that started it, so a handoff link cannot be forwarded: one-time state proves the callback answers a request this server made, not one THIS browser made, so anyone could run the flow against their own Google or OIDC account and send the resulting URL to someone else, whose browser would then hold the sender's session (RFC 9700 4.7.1); begin now mints a binding secret that never reaches the provider and never appears in a URL, the callback carries it into the handoff, and the exchange refuses a collection that cannot present it with sso_wrong_browser, while the comments this PR added are condensed to the constraint they exist to state

2026-08-28 01:44:39 -07:00

automation_graph.go

feat: rework automation AI steps to mirror campaign step types with one agentic AI step plus an AI switch, per-case switch handles on the canvas, a Stop node, and a step-type add menu

2026-07-22 10:58:35 +02:00

behavior.go

feat: give each mailbox a human sending persona (randomized daily and hourly caps, send spacing, work start/end, lunch break and working weekdays, rolled once per local day in the mailbox's own timezone and applied across the campaign, warmup and smart-send schedulers), add campaign auto-pause guardrails that stop a campaign when its bounce, complaint or reply rate leaves the configured band, make mailbox rotation actually rotate for tag-resolved and all-mailbox campaigns, stop every scheduler from ever returning a slot in the past, and correct the mailbox min-gap field that stored seconds while labelling them minutes

2026-08-13 16:51:29 +02:00

campaign_log.go

Analytics & Tracking

2026-01-29 05:59:04 +01:00

campaign.go

fix: campaign follow-ups opened a new conversation instead of replying in the contact's thread, so carry In-Reply-To/References and the Gmail threadId from the previous send, give every step a reply-in-thread switch, and let a threading step inherit the conversation's subject (issue #472) (#489)

2026-09-13 20:51:41 -07:00

cli_auth.go

feat: device-code sign-in for the CLI, with a browser approval page at /cli that mints a scoped API key, self-revocation at DELETE /api-keys/self so a read-only credential can always end itself, and app_url plus websocket_url on /auth/config so a client can find the dashboard and the realtime gateway on a self-hosted layout

2026-09-04 20:14:27 -07:00

clock_test.go

feat: let a warmup recipient answer the mailbox that wrote to it (#230)

2026-08-28 10:40:25 -07:00

clock.go

feat: let a warmup recipient answer the mailbox that wrote to it (#230)

2026-08-28 10:40:25 -07:00

contact_campaign_state.go

feat: hold a lead whose mailbox answers out of office until they are back, resuming at the return date it names, plus a manual per-contact pause in one campaign that unsubscribing and the suppression list were the only stand-ins for

2026-09-14 09:26:06 -07:00

contact_export.go

feat: add recipient-level engagement to the campaign Leads view by adding an engagement search filter (opened, not_opened, clicked, not_clicked, replied, not_replied, bounced) that composes with lead_status as AND and rejects unknown values with stable 400 codes, counting only human opens so machine opens never read as engagement, adding contacted/opened/clicked/replied_any totals to lead_counts, rendering Opened/Clicked/Replied columns and clickable server-backed status and engagement chips in the Leads table with matching Filters sheet sections, offering lead_status/lead_opened/lead_clicked/lead_replied export columns from a campaign, covering every filter value with a live Postgres test, and documenting the columns, filters, error codes and export fields (issue #250)

2026-08-29 03:12:02 -07:00

contact_import.go

feat: answer the CodeRabbit review on #386 by making ContactImportResult.SegmentsPinned a *bool so omitempty stops collapsing a failed membership write into the same absent value as an import that asked for none, warning in the result step when a pin did not land instead of leaving it to a note under a green Import complete, holding the pinned-contacts truncation notice until the overrides listing has actually arrived so it cannot read the newest 0 of 5,000 while it loads, and pointing that notice at the contact drawer, since a pinned-out contact can never be reached from the member list it used to name

2026-09-08 05:19:03 -07:00

contact_timeline_test.go

feat: reject a contact timeline cursor whose source rank names no merged table with a 400 in the handler through ContactTimelineSource.Valid, since rank zero is reserved for the legacy before bound and a rank past the last source would re-admit the events at the cursor's instant

2026-09-03 20:21:42 -07:00

contact.go

feat: classify ambiguous Outlook and Apple image-proxy opens by delivery timing and stop inventing recipient device metadata

2026-09-17 04:27:34 -07:00

credentials.go

feat(admin): manage worker fleet from dashboard with encrypted credentials and GitHub release auto-update

2026-05-18 13:09:11 +00:00

credits.go

feat: extend the per-member AI limit to all three windows: member_limit_daily and member_limit_weekly join the monthly ceiling on org_ai_settings, MemberSpentInWindows sums the acting member's debits per window in one query, checkSpendLimits enforces day/week/month member ceilings with window-specific 429 messages, and the billing card's Per-member limits row grows the same three fields as the workspace caps

2026-07-19 13:22:56 +02:00

crm_task_search_test.go

fix: stop every out-of-office notice and bounce opening a high-priority CRM follow-up by classifying machine replies from their headers and gating the task on a per-intent setting, and give the Tasks page multi-select with select-all-matching, bulk status, priority and delete over new PATCH and DELETE /crm/tasks endpoints (issue #471)

2026-09-14 12:20:47 -07:00

crm.go

fix: stop every out-of-office notice and bounce opening a high-priority CRM follow-up by classifying machine replies from their headers and gating the task on a per-intent setting, and give the Tasks page multi-select with select-all-matching, bulk status, priority and delete over new PATCH and DELETE /crm/tasks endpoints (issue #471)

2026-09-14 12:20:47 -07:00

danger_zone.go

style: gofmt danger_zone.go

2026-05-24 04:42:43 +00:00

discount.go

feat: add the admin panel's Promo codes page and route the six /admin/discounts endpoints that existed as handlers but were never wired, so a launch offer is built in the operator UI instead of an INSERT against production, with caps that an explicit null can actually clear on PATCH

2026-09-16 04:04:09 -07:00

email_auth_test.go

feat: enforce the persisted SPF/DKIM/DMARC state as a real cold-send and warmup gate behind a 72h grace clock and an operator toggle, after first fixing the DMARC organizational-domain fallback in dnsauth so a dedicated sending subdomain covered by its parent's record stops reading as unauthenticated, adding auth_state to the four mailbox loaders that never selected it (which would have made the gate dead code), stamping auth_failing_since on entry to failing so a resolver hiccup can never stop a campaign, notifying the org on that transition, and reporting an all-gated pool as ErrDomainAuthFailing instead of a message about sending windows (#160)

2026-08-22 09:37:26 -07:00

email_image.go

feat: address the CodeRabbit review on the email editor PR by generating email image object keys from a uuid and the sniffed extension instead of the uploader's filename so a name carrying '..' cannot produce a key the public route refuses to serve and a private filename never travels inside a recipient's URL, deleting the stored object before its row and refusing the request when storage will not take it so a failed delete leaves nothing loadable that the quota has stopped counting, accepting only https image addresses, resynchronising the HTML source view when a template replaces the body underneath it, and rendering the campaign preview through the inbox's sandboxed frame so markup written in the source view can neither run nor restyle the dashboard for a teammate

2026-09-08 21:17:36 -07:00

email.go

feat(analytics): report on mail written by hand, with opt-in open and click tracking per mailbox

2026-09-17 10:26:25 +00:00

event_schema_process_test.go

feat: strengthen the Avro round-trip tests after a cutover they failed to catch (#536)

2026-09-15 20:25:21 -07:00

event_schema_registry_test.go

feat: make the bus envelopes Avro-encodable (#535)

2026-09-15 10:50:30 -07:00

event_schema_test.go

feat: strengthen the Avro round-trip tests after a cutover they failed to catch (#536)

2026-09-15 20:25:21 -07:00

event_schema.go

feat: give EmailSentEvent and WarmupEmailSentEvent their own derived Avro schemas so the email-events and warmup-events analytics streams stop failing at serialize on every send and finally register a subject (#546)

2026-09-16 04:20:15 -07:00

event_variants.go

feat: make the bus envelopes Avro-encodable (#535)

2026-09-15 10:50:30 -07:00

event_w_auth.go

feat: make the bus envelopes Avro-encodable (#535)

2026-09-15 10:50:30 -07:00

event_w_bounce.go

feat: make the bus envelopes Avro-encodable (#535)

2026-09-15 10:50:30 -07:00

event_w_complaint.go

feat: make the bus envelopes Avro-encodable (#535)

2026-09-15 10:50:30 -07:00

event_w_emails.go

feat: make the bus envelopes Avro-encodable (#535)

2026-09-15 10:50:30 -07:00

event_w_google.go

feat: make the bus envelopes Avro-encodable (#535)

2026-09-15 10:50:30 -07:00

event_w_graph.go

feat: make the bus envelopes Avro-encodable (#535)

2026-09-15 10:50:30 -07:00

event_w_health.go

worker: WorkerHealth event, capacity view, smarter SelectSharedWorker

2026-05-27 15:56:01 +00:00

event_w_mailbox.go

feat: make the bus envelopes Avro-encodable (#535)

2026-09-15 10:50:30 -07:00

event_worker_validation.go

feat: make the bus envelopes Avro-encodable (#535)

2026-09-15 10:50:30 -07:00

event.go

fix: read a mailbox's Gmail send-as addresses from the worker holding it rather than from the backend, which was decrypting a mailbox credential in the control plane and showing Google a second client address for a mailbox whose mail moves through a worker, by round-tripping a new MAILBOX_IDENTITY command answered on the process channel like a credential validation, leaving the OAuth handshake as the one place the control plane still calls the provider (#522)

2026-09-14 21:28:07 -07:00

fleet_node.go

feat: replace the worker tier/type/risk-pool/egress categories with a scored placement model and make the fleet pull-based, so a machine joins with one command, workers and consumers share one node registry with usage and liveness, nodes self-update to the version the control plane resolves, and the Hetzner provisioning, worker profiles and SSH orchestrator are removed

2026-09-09 04:54:01 -07:00

fleet_release.go

feat: replace the worker tier/type/risk-pool/egress categories with a scored placement model and make the fleet pull-based, so a machine joins with one command, workers and consumers share one node registry with usage and liveness, nodes self-update to the version the control plane resolves, and the Hetzner provisioning, worker profiles and SSH orchestrator are removed

2026-09-09 04:54:01 -07:00

form_event.go

feat: forms v2, a full redesign of the hosted form and its builder: eight one-click themes, card/wide/split layouts with a brand cover panel, classic paged and Typeform-style focus modes split on a new page_break block, logo/cover/background uploads with size, fit and veil controls, an optional header bar that can span the page or sit with the form, a real HSV colour picker and font preview, per-contact personalized links that prefill and attribute without email verification, a render-token gate so the form JSON cannot be scraped without loading the page, funnel analytics with per-page drop-off and identified visitors, a leads-style forms list and responses table, and an organization custom forms domain verified by CNAME with hourly re-checks

2026-09-01 09:27:28 -07:00

form.go

feat: forms v2, a full redesign of the hosted form and its builder: eight one-click themes, card/wide/split layouts with a brand cover panel, classic paged and Typeform-style focus modes split on a new page_break block, logo/cover/background uploads with size, fit and veil controls, an optional header bar that can span the page or sit with the form, a real HSV colour picker and font preview, per-contact personalized links that prefill and attribute without email verification, a render-token gate so the form JSON cannot be scraped without loading the page, funnel analytics with per-page drop-off and identified visitors, a leads-style forms list and responses table, and an organization custom forms domain verified by CNAME with hourly re-checks

2026-09-01 09:27:28 -07:00

group.go

New Repository: Add Backend Code

2026-01-17 14:11:14 +00:00

identity_link.go

feat: make self-hosted auth work without a mail relay by rewriting the platform SMTP transport with real AUTH and TLS (it did neither, so SMTP_USERNAME/SMTP_PASSWORD were dead and every documented relay was unreachable), adding MAIL_TRANSPORT=smtp|log|ses with a log transport that prints codes so a fresh install can sign in with no relay, demoting the emailed login code to AUTH_LOGIN_CODE=always|new_device|off (off on self-host, per NIST SP 800-63B and OWASP ASVS), claiming the first owner through a single-use setup link or WARMBLY_BOOTSTRAP_* instead of register-then-psql, deriving every emailed URL from APP_URL rather than a hardcoded app.warmbly.com that leaked live reset tokens to the vendor, fixing the confirm hooks that read path params against paramless routes and broke login, register and reset confirmation in the dashboard everywhere, adding generic OIDC with PKCE, one-time state, verified nonce and (issuer,subject) identity binding, enforcing 2FA on the social paths that skipped it, adding a per-IP limiter and trusted-proxy handling to the unthrottled auth group, refusing boot on the published default secrets, and dropping mailpit from the default stack (#99)

2026-08-14 14:57:09 +02:00

identity.go

feat: add Identity model for the GET /v1/me caller-identity response shape

2026-06-28 19:09:37 +02:00

inbox_agent.go

Fix truncated, unformatted and mis-encoded email content in the unibox (#137)

2026-08-21 18:45:09 +02:00

integration_capability.go

feat: expand integration and meeting APIs

2026-06-08 06:25:40 +02:00

integration_config.go

feat: expand integration and meeting APIs

2026-06-08 06:25:40 +02:00

integration.go

feat: add CleanMyList contact verification with API key setup and built-in fallback

2026-09-10 20:06:29 +01:00

lead_sync.go

feat: give a saved Google Sheets sync source segment targets (migration 000136 adds lead_sync_sources.segment_ids) that pin every synced row into those segments on each run, validated against the organization when the source is written and dropped from the run when a segment is deleted later, and filter GET /lead-sync/sources by ?segment_id= through a jsonb containment test so a segment can list the sources feeding it

2026-09-08 04:59:18 -07:00

logs.go

New Repository: Add Backend Code

2026-01-17 14:11:14 +00:00

mail_security_test.go

feat: address the review on the loopback mailbox mode by building every mail address with net.JoinHostPort, so an IPv6 literal keeps the brackets a host:port string needs and "::1" on 1143 stops dialling a host called "::1:1143" with no port, by moving the self-hosted half of the rule into the dialers as well as the connect form, because an organization archive exported from a self-hosted instance carries its mailboxes and an import must not hand a hosted worker one that dials its own loopback in the clear, by refusing an unencrypted CSV row on a hosted instance where the API would only reject it a moment later, and by saying in the docs that the port never selects the mode and that the whole 127.0.0.0/8 range counts

2026-09-07 08:27:54 -07:00

mailbox.go

feat: make the bus envelopes Avro-encodable (#535)

2026-09-15 10:50:30 -07:00

mcp.go

feat: connect external MCP servers whose tools the AI assistant can use - ai_mcp_servers table with bearer tokens sealed by the org DEK cipher (never returned) and SSRF-validated https urls, a dependency-free streamable-HTTP JSON-RPC client (initialize/tools/list/tools/call over safehttp dial-time IP blocking with SSE+JSON handling and body caps), an mcp service that discovers tools on connect and contributes only enabled servers' tools to the dashboard agent as namespaced mcp_<server>_<tool> defs that are always write-class and never auto-allowed, a registry DynamicToolSource hook so per-org tools join the agent's tool set and resume executes them through ToolDefs, /ai/connections CRUD gated on manage_settings with an mcp_server audit entity and spine, a Connections settings page to add servers and review/enable discovered tools, and docs

2026-07-13 20:05:24 +02:00

notification.go

feat: enforce the persisted SPF/DKIM/DMARC state as a real cold-send and warmup gate behind a 72h grace clock and an operator toggle, after first fixing the DMARC organizational-domain fallback in dnsauth so a dedicated sending subdomain covered by its parent's record stops reading as unauthenticated, adding auth_state to the four mailbox loaders that never selected it (which would have made the gate dead code), stamping auth_failing_since on entry to failing so a resolver hiccup can never stop a campaign, notifying the org on that transition, and reporting an all-gated pool as ErrDomainAuthFailing instead of a message about sending windows (#160)

2026-08-22 09:37:26 -07:00

nullable_test.go

feat: add the admin panel's Promo codes page and route the six /admin/discounts endpoints that existed as handlers but were never wired, so a launch offer is built in the operator UI instead of an INSERT against production, with caps that an explicit null can actually clear on PATCH

2026-09-16 04:04:09 -07:00

nullable.go

feat: add the admin panel's Promo codes page and route the six /admin/discounts endpoints that existed as handlers but were never wired, so a launch offer is built in the operator UI instead of an INSERT against production, with caps that an explicit null can actually clear on PATCH

2026-09-16 04:04:09 -07:00

oauth_app.go

feat: add one-command MCP OAuth connect on api.warmbly.com/v1/mcp — RFC 7591 dynamic client registration for public PKCE clients (dcr.go), RFC 9728 protected-resource metadata + WWW-Authenticate challenge via MCPAuthMiddleware, /v1/mcp now accepts an API key or OAuth token, public-client auth with no secret and mandatory PKCE reusing the existing OAuth 2.1 server (nullable-org clients, migration 000066), executable-redirect-scheme hardening on the open register endpoint, plus mcp/oauth/authentication/endpoints docs

2026-07-16 08:57:19 +02:00

order.go

New Repository: Add Backend Code

2026-01-17 14:11:14 +00:00

org_transfer.go

feat: scope the tag, category and folder registries and unibox conversation labels to the organization instead of the creating user, so a teammate sees and can edit the labels the owner made, splitting a label two workspaces shared into one copy each and guarding every label write against ids from another workspace (#457)

2026-09-12 03:37:31 -07:00

organization_acquisition_test.go

feat: address the CodeRabbit review on the PostHog PR by dropping a referrer that is not a hostname instead of storing its query string or fragment, redacting email-shaped values out of every acquisition field before they reach the database or an analytics property, counting an invited signup which returned before the count was taken, hanging subscription_started off the persisted trial-to-paid transition so a redelivered webhook cannot report a second start, capturing the validated provider in both OAuth mailbox paths including Warmbly Cloud, making the two acquisition toggles mutually exclusive and naming them after what they actually select, and replacing the unsupported CNIL consent-exemption claim with what the guidance says and an explicit note that qualifying is a deployment-specific assessment this document does not make

2026-09-07 05:45:11 -07:00

organization_acquisition.go

feat: address the CodeRabbit review on the PostHog PR by dropping a referrer that is not a hostname instead of storing its query string or fragment, redacting email-shaped values out of every acquisition field before they reach the database or an analytics property, counting an invited signup which returned before the count was taken, hanging subscription_started off the persisted trial-to-paid transition so a redelivered webhook cannot report a second start, capturing the validated provider in both OAuth mailbox paths including Warmbly Cloud, making the two acquisition toggles mutually exclusive and naming them after what they actually select, and replacing the unsupported CNIL consent-exemption claim with what the guidance says and an explicit note that qualifying is a deployment-specific assessment this document does not make

2026-09-07 05:45:11 -07:00

organization_permission.go

feat: introduce the Use AI organization permission (bit 15, the last of the 16-bit mask) gating every AI surface: assistant session routes, generation write/edit, and the compose and reply draft endpoints get a member-permission layer (API keys re-check their existing bit), migration 000073 backfills the bit onto all existing roles and member overrides so nobody loses access, defaults grant it to admin and manager but not viewer, and the web mirrors it in the permission catalog with gating on the header spark button, Cmd+I, the panel itself, and the AI drafting caret (plus team-roles and endpoint-map docs)

2026-07-19 11:04:58 +02:00

organization.go

feat: make mailboxes truly unlimited under a fair-use allowance of one mailbox per daily send the plan includes (15,000 on Business), drop the 200 hard cap and the 5-per-day connect throttle, open a request-more dialog with inline limit requests and plan upgrade when the allowance is reached, add bulk CSV mailbox import with live progress and a downloadable failed-rows file, reserve attachment storage atomically under a per-org lock so concurrent uploads cannot pass the quota (#326), report storage and the allowance on the billing usage meters, and honor approved daily-send overrides in the sender

2026-09-04 21:00:26 -07:00

orgrisk.go

feat: give a suspended workspace a way back, because risk_state was a one-way door: the derived band is no longer pinned at suspended by the UPDATE in pg_org_risk, an operator's decision is now an explicit risk_override that outranks the score and survives every later detector write until it is lifted, the one-shot detectors (signup origin, import list quality, repeated sign-in anomalies) file findings with a 30-day expiry that a six-hourly consumer sweep retires so a score falls on its own, migration 000104 backfills that expiry onto findings already on file, and four admin endpoints plus an Abuse posture panel in admin/ let an operator finally read the evidence the customer endpoint withholds, retract a finding, pin a band and lift the pin; also stops the reviewing admin's identity reaching the tenant's own audit feed (which resolves an actor to a name and email) by recording the platform as the actor there and the operator in the admin trail, and stops risk_signals riding along in a customer-downloadable org export

2026-08-28 22:42:57 -07:00

pagination.go

feat: make public API list cursors opaque base64 tokens (internal/utils/paging) instead of raw record UUIDs, decoding on input with a 400 on a bad cursor; admin endpoints keep transparent UUID cursors

2026-06-13 07:18:23 +02:00

poollink.go

Self-hosted pool plan: a price the server resolves, and a checkout that reaches it (#494)

2026-09-13 21:22:12 -07:00

provisioning.go

ci(go): gofmt all flagged files

2026-05-27 16:40:23 +00:00

rate_limit.go

refactor: drop burst_multiplier in favor of fixed per-user/per-plan limits

2026-05-27 12:06:18 +00:00

realtime.go

feat: expand integration and meeting APIs

2026-06-08 06:25:40 +02:00

referral.go

feat: add referral domain models, Plan month-equivalent and reward-cents helpers, and the referral and referral_credit audit entity types in internal/models

2026-06-28 05:09:50 +00:00

research.go

feat: AI contact research agent that gathers cited web findings per contact with sync and background-batch runs - contact_research_runs table plus a strict save_research schema (every signal and public_artifact must carry a url, confidence high/medium/low, signals<=5 hooks<=3, reject-and-reprompt once then fail), a text/template runtime prompt injecting org voice, contact record, objective, and 5-search/6-fetch budgets, a research service that drives search_web/fetch_url through the provider loop and charges 2 credits on save (billable even for nothing_found, refund-free since charged only on save, balance and abuse-cap pre-checked so a capped org never does free work), POST/GET /contacts/:id/research plus a 500-cap /contacts/research/batch draining through a bounded pool of 4 workers over FOR-UPDATE-SKIP-LOCKED claims (no new Kafka), an org-scoped AI_RESEARCH_PROGRESS realtime event gated to view_contacts, APIPermAIResearch bit 23, a ContactEdit Research tab and a ContactsTable bulk Research action, and docs; also org-scopes every credit and research idempotency key so a client-supplied Idempotency-Key can never replay across tenants

2026-07-13 19:34:11 +02:00

risk.go

feat: replace the worker tier/type/risk-pool/egress categories with a scored placement model and make the fleet pull-based, so a machine joins with one command, workers and consumers share one node registry with usage and liveness, nodes self-update to the version the control plane resolves, and the Hetzner provisioning, worker profiles and SSH orchestrator are removed

2026-09-09 04:54:01 -07:00

segment_test.go

feat: add the segment model with the typed condition DSL, the filterable field catalog, operator sets per field kind, validation and normalization of every condition, and the segment audit entity type

2026-08-29 23:45:05 -07:00

segment.go

fix: a campaign's linked segments are its audience, so detaching one withdraws its leads (#510) (#523)

2026-09-14 22:12:15 -07:00

send_lifecycle_test.go

feat: wire the unreachable reserve send-lifecycle state to a real per-mailbox hold (POST /emails/:id/hold and /release behind manage_emails and WRITE_EMAILS, SetSendHold on the email service forcing the lifecycle past the rebalancer guard, a Hold from campaigns toggle on the mailbox drawer's Overview tab with the reserve notice rewritten to point at it, warmblyctl mailbox hold/release, and docs in the mailboxes guide, API reference and scope map), and drop the warming state nothing ever set from the model, the web type, the docs table and the DB check via migration 000104, which folds any legacy warming row back to active

2026-08-28 22:47:31 -07:00

send_lifecycle.go

feat: wire the unreachable reserve send-lifecycle state to a real per-mailbox hold (POST /emails/:id/hold and /release behind manage_emails and WRITE_EMAILS, SetSendHold on the email service forcing the lifecycle past the rebalancer guard, a Hold from campaigns toggle on the mailbox drawer's Overview tab with the reserve notice rewritten to point at it, warmblyctl mailbox hold/release, and docs in the mailboxes guide, API reference and scope map), and drop the warming state nothing ever set from the model, the web type, the docs table and the DB check via migration 000104, which folds any legacy warming row back to active

2026-08-28 22:47:31 -07:00

sequence_thread_test.go

fix: campaign follow-ups opened a new conversation instead of replying in the contact's thread, so carry In-Reply-To/References and the Gmail threadId from the previous send, give every step a reply-in-thread switch, and let a threading step inherit the conversation's subject (issue #472) (#489)

2026-09-13 20:51:41 -07:00

sequence.go

fix: campaign follow-ups opened a new conversation instead of replying in the contact's thread, so carry In-Reply-To/References and the Gmail threadId from the previous send, give every step a reply-in-thread switch, and let a threading step inherit the conversation's subject (issue #472) (#489)

2026-09-13 20:51:41 -07:00

skill.go

feat: org AI skills (playbooks) that every AI feature loads and follows - ai_skills table (org-scoped, unique name per org, 32KB content cap) with a skills service exposing CRUD plus an enabled-skills preamble injected into the dashboard agent, contact research, and reply-draft prompts and a load_skill read-tool that returns a playbook's full content by name, /ai/skills CRUD gated on manage_settings (JWT) or the AI_AGENT scope (API) with an ai_skill audit entity and spine entry, an AI skills settings page (list rows opening a right-side drawer with name, one-line description, enable toggle, and a markdown body), and docs with two example playbooks

2026-07-13 19:46:25 +02:00

subscriptions_json_test.go

fix: carry the managed flag on the base subscription type so GET /subscription reports it, because that is the endpoint the dashboard decides entitlements from and the flag only existed on the limits response (#478)

2026-09-12 22:32:14 -07:00

subscriptions_managed_test.go

feat: plans an operator can grant, visible in the admin panel (#467)

2026-09-12 09:45:31 -07:00

subscriptions.go

Self-hosted pool plan: a price the server resolves, and a checkout that reaches it (#494)

2026-09-13 21:22:12 -07:00

sync.go

feat: make the bus envelopes Avro-encodable (#535)

2026-09-15 10:50:30 -07:00

team.go

feat: add organization teams API

2026-06-07 07:03:49 +02:00

template.go

feat: full reply templates (search/reorder/duplicate/render + UI)

2026-05-24 12:01:37 +00:00

token.go

feat: add cookieless PostHog analytics for the hosted marketing site and dashboard with server-side signup and subscription events, a first-party acquisition record written once at signup on a new organization_acquisition table registered in the org-transfer spec, an acquisition column and channel filter in the admin org list, and never a single request from a self-host because every key is unset by default

2026-09-07 04:18:33 -07:00

totp.go

feat: add two factor auth core

2026-06-08 15:04:36 +02:00

unibox_folder_sync_test.go

feat: split a unibox message's provider placement into its own provider_folder column (migration 000146) so Archive and Delete in the thread header survive the next sync without the sync losing the ability to follow a real provider move, and narrow PATCH /unibox/folder to inbox/archive/trash behind the unibox feature gate with an audit entry so the move reaches every teammate's list live

2026-09-11 03:23:19 -07:00

unibox.go

feat: reject outbound mailbox copies and mismatched campaign threads before they can mark contacts replied for stop-on-reply (issue #549)

2026-09-16 08:24:19 -07:00

user.go

feat: tester accounts, creatable from the admin panel (#483)

2026-09-13 03:07:10 -07:00

warmup_content.go

feat: automate warmup conversation generation, coherent replies, adaptive rotation, and admin observability

2026-07-22 12:11:19 +02:00

warmup_routing_test.go

feat: customer-defined warmup routing rules on premium pool

2026-05-25 15:42:50 +00:00

warmup_routing.go

style: gofmt struct alignment after burst_multiplier removal

2026-05-27 16:17:53 +00:00

warmup.go

feat: make the bus envelopes Avro-encodable (#535)

2026-09-15 10:50:30 -07:00

webauthn.go

feat: add Safari-ready passkey login

2026-06-01 03:09:17 +02:00

webhook_test.go

feat: add a Stripe-grade webhook platform with a typed event catalog, HMAC-signed delivery, retries with backoff, endpoint ownership verification, per-endpoint throttling, an audit-spine event bridge, and firehose emit sites (migration 000048)

2026-06-15 08:11:20 +02:00

webhook.go

feat: turn automations into a lead-intake path so a Facebook, Instagram, LinkedIn or TikTok lead form pushed by Zapier, Make, n8n or any webhook becomes a tagged, campaign-enrolled contact without leaving Warmbly: add the warmbly.upsert_contact and warmbly.add_to_campaign built-in actions with templated field mapping, custom fields, tags, campaign and an if-exists policy, fire a rich contact.created event from the one contact write path (silent for file imports, sheet syncs and API batches over 100) and expose contact.created and form.submitted as automation triggers with condition fields, variables and sample data, carry an automation depth through events raised by an action so a flow that creates a contact cannot re-trigger itself past five hops, stamp automation-created contacts with the new automation source (migration 000129), share the campaign picker between the sheet sync wizard and the automation builder, document lead intake in the automations, Zapier, Make, contacts, forms, integrations, expressions and webhook pages plus a new n8n guide, mirror the new triggers and actions on the marketing automations page, and drop the 34 MB cli binary that was committed by mistake

2026-09-06 00:36:05 -07:00

website_tracking.go

feat: add website visitor tracking for issue #255 with migration 000106 (website_tracking_settings, website_visitors, website_page_hits, all registered in the orgtransfer spec), a consent-gated dependency-free tracking.js served by the Rust tracking service with a rate-limited, size-capped, prefetch-filtered POST /p ingest that forwards to a new backend internal page-hits endpoint for server-side user-agent and GeoIP enrichment, contact identification only through the click ticket the redirect appends to registered hosts, a per-workspace retention job, page_hit events with an expandable detail view in the contact Activity timeline, a Settings > Website tracking page for the snippet and consent, location and retention configuration, realtime PAGE_HIT fanout, and a website tracking guide plus endpoint, export and configuration docs

2026-08-29 03:25:50 -07:00

worker.go

fix: campaign follow-ups opened a new conversation instead of replying in the contact's thread, so carry In-Reply-To/References and the Gmail threadId from the previous send, give every step a reply-in-thread switch, and let a threading step inherit the conversation's subject (issue #472) (#489)

2026-09-13 20:51:41 -07:00