Matthew Meszaros ab39429e37 feat: send HSTS from the forms service only on FORMS_DOMAIN and strip it in the installer's Caddy block for customer-owned domains, so no customer apex is pinned to HTTPS

2026-10-04 05:19:22 -07:00

..

handler

feat: hold every API key to its creator's current workspace role on each gated route and AI tool, and stop a key, including on the realtime socket, once its creator leaves the workspace (api_key_holder_left)

2026-10-04 05:15:30 -07:00

middleware

feat: send HSTS from the forms service only on FORMS_DOMAIN and strip it in the installer's Caddy block for customer-owned domains, so no customer apex is pinned to HTTPS

2026-10-04 05:19:22 -07:00

cors.go

feat: move infrastructure state off dynamodb

2026-06-02 15:54:12 +02:00

routes.go

feat: keep the key and blob brokers on NODE_BROKER_TOKEN only, and let an operator admit INTERNAL_API_TOKEN on the other node routes with NODE_ACCEPT_INTERNAL_TOKEN=true while nodes joined before the split upgrade

2026-10-04 05:18:01 -07:00

upload_limit_test.go

feat: let contact file uploads use their own 50 MB cap instead of the global 10 MB one and say when a file is too large, refuse an import list limit below one, hold an imported update to the contact size limit, keep a company logo laid out while it lazy-loads, neutralize formula cells in the sync error download, settle the draft save indicator when an edit is undone, and document the draft save route

2026-09-27 22:10:02 -07:00