Matthew Meszaros b75fdcf86c Merge remote-tracking branch 'origin/main' into feature/self-hosted-warmup-pool-access ...

# Conflicts:
#	internal/scheduler/warmup_scheduler.go

2026-08-29 07:10:38 -07:00

..

admin.go

Analytics & Tracking

2026-01-29 05:59:04 +01:00

apikey_test.go

feat: bound auth login network waits

2026-06-01 16:56:24 +02:00

apikey_usage.go

feat: full api key support across data routes

2026-05-24 11:59:05 +00:00

apikey.go

feat: add first-touch contact source attribution (migration 000106: contacts.source with a CHECK, source_detail, first_seen_at, existing rows stamped unknown) stamped at every creation site (dashboard manual/campaign, file import, Google Sheets sync, API key, AI assistant), write contact_created / campaign_added / campaign_removed / category_added / category_removed lifecycle events into contact_activities inside the same transactions as the links and merge them into the contact timeline, refactor FindNextRoutedPair's routing into a campaignRouter shared with a per-contact RouteContact and split CalculateNextCampaignTime into campaignSenders + placeCampaignSend so a read-only PreviewContactSend derives a contact's next step through the scheduler's own constraints, expose it as GET /contacts/:id/campaigns behind the contact service, render a per-campaign state panel, Campaigns/Lifecycle filter chips and expandable event rows in the Activity tab plus a Source section on Overview, cover it with TestLive* for the timeline events and the next-action preview (step wait, sending window, paused), and document it in the contacts, campaigns and API reference docs (issue #255)

2026-08-29 03:28:16 -07:00

auth.go

Organization, Subscription, Inqueries, limits.

2026-01-27 05:55:48 +01:00

handler.go

feat: let a self-hosted instance warm its mailboxes in the hosted pool: device-code link approved at /connect, instance-token API that enrolls SMTP/IMAP mailboxes as warmup-only accounts (no history import, non-warmup mail dropped), free for 10 mailboxes and unlimited on the seeded $15 pool plan, tier fallback to proven healthy mailboxes when a pool runs thin, local warmup stands down for enrolled mailboxes, Settings > Warmbly Cloud step flow and linked-instances page, docs guide, marketing copy, and fix SetWarmupLifecycle re-reading the row with an org-scoped lookup so every warmup start/pause returned 404

2026-08-29 07:09:04 -07:00

idempotency_test.go

feat: bound auth login network waits

2026-06-01 16:56:24 +02:00

idempotency.go

feat: add api idempotency keys

2026-05-30 04:31:43 +00:00

internal_auth_test.go

feat: bound auth login network waits

2026-06-01 16:56:24 +02:00

internal_auth.go

infra(encryptedkeys): pluggable DEK store with HTTP proxy for workers

2026-05-27 14:42:11 +00:00

mcp.go

feat: add one-command MCP OAuth connect on api.warmbly.com/v1/mcp — RFC 7591 dynamic client registration for public PKCE clients (dcr.go), RFC 9728 protected-resource metadata + WWW-Authenticate challenge via MCPAuthMiddleware, /v1/mcp now accepts an API key or OAuth token, public-client auth with no secret and mandatory PKCE reusing the existing OAuth 2.1 server (nullable-org clients, migration 000066), executable-redirect-scheme hardening on the open register endpoint, plus mcp/oauth/authentication/endpoints docs

2026-07-16 08:57:19 +02:00

oidc.go

feat: make google, apple and turnstile optional at boot

2026-07-20 09:56:17 +02:00

organization.go

Organization, Subscription, Inqueries, limits.

2026-01-27 05:55:48 +01:00

poollink.go

feat: let a self-hosted instance warm its mailboxes in the hosted pool: device-code link approved at /connect, instance-token API that enrolls SMTP/IMAP mailboxes as warmup-only accounts (no history import, non-warmup mail dropped), free for 10 mailboxes and unlimited on the seeded $15 pool plan, tier fallback to proven healthy mailboxes when a pool runs thin, local warmup stands down for enrolled mailboxes, Settings > Warmbly Cloud step flow and linked-instances page, docs guide, marketing copy, and fix SetWarmupLifecycle re-reading the row with an org-scoped lookup so every warmup start/pause returned 404

2026-08-29 07:09:04 -07:00

ratelimit_ip.go

feat: make self-hosted auth work without a mail relay by rewriting the platform SMTP transport with real AUTH and TLS (it did neither, so SMTP_USERNAME/SMTP_PASSWORD were dead and every documented relay was unreachable), adding MAIL_TRANSPORT=smtp|log|ses with a log transport that prints codes so a fresh install can sign in with no relay, demoting the emailed login code to AUTH_LOGIN_CODE=always|new_device|off (off on self-host, per NIST SP 800-63B and OWASP ASVS), claiming the first owner through a single-use setup link or WARMBLY_BOOTSTRAP_* instead of register-then-psql, deriving every emailed URL from APP_URL rather than a hardcoded app.warmbly.com that leaked live reset tokens to the vendor, fixing the confirm hooks that read path params against paramless routes and broke login, register and reset confirmation in the dashboard everywhere, adding generic OIDC with PKCE, one-time state, verified nonce and (issuer,subject) identity binding, enforcing 2FA on the social paths that skipped it, adding a per-IP limiter and trusted-proxy handling to the unthrottled auth group, refusing boot on the published default secrets, and dropping mailpit from the default stack (#99)

2026-08-14 14:57:09 +02:00

ratelimit.go

ci: drop unused/unconvert/gosimple + shadow/nilness, run gofmt

2026-05-23 16:54:12 +00:00

request_id_test.go

feat: bound auth login network waits

2026-06-01 16:56:24 +02:00

request_id.go

feat: add api request ids

2026-05-30 04:26:12 +00:00

version.go

feat: serve the entire customer API (auth + resources) only under /v1 with no unversioned alias, and repoint the web and admin clients to the versioned base accordingly

2026-06-13 07:18:23 +02:00