Matthew Meszaros 78ec522758 feat: challenge a sign-in that could not physically be the same person, which a remembered device cannot catch because an attacker holding the cookie looks familiar: sign-ins were only ever a Redis device fingerprint with a TTL, so nothing durable recorded WHERE an account was used and there was nothing to compare a new one against; login_history keeps a bounded window per user, the geo lookup gains the coordinates the city database already had, and a journey implying more than 1000 km/h forces the emailed code even on a known device; it declines to judge a first sign-in, a hop under 500 km, an interval under two minutes or a missing position, because a false challenge locks a real person out of their own account and that is the worse failure, and repeated anomalies inside a fortnight reach the workspace posture while one odd trip does not

2026-08-28 12:08:17 -07:00

..

apns

feat: mobile push notifications end to end - APNs provider-token client, device_tokens table with session-scoped register/delete endpoints, a push channel in notification preferences (web + iOS toggles), and Redis-backed immediate-then-digest batching (first event pushes now, bursts summarize when the 5h window closes) wired in backend and consumer, with iOS registration/badge sync and docs for the channel, endpoints, and APNS_* deploy env

2026-07-13 16:11:15 +02:00

cache

Analytics & Tracking

2026-01-29 05:59:04 +01:00

cloudprovider

feat: move infrastructure state off dynamodb

2026-06-02 15:54:12 +02:00

codec

feat: move kafka behind a build tag so the default build is cgo-free

2026-07-20 09:56:16 +02:00

db

feat: challenge a sign-in that could not physically be the same person, which a remembered device cannot catch because an attacker holding the cookie looks familiar: sign-ins were only ever a Redis device fingerprint with a TTL, so nothing durable recorded WHERE an account was used and there was nothing to compare a new one against; login_history keeps a bounded window per user, the geo lookup gains the coordinates the city database already had, and a journey implying more than 1000 km/h forces the emailed code even on a known device; it declines to judge a first sign-in, a hop under 500 km, an interval under two minutes or a missing position, because a false challenge locks a real person out of their own account and that is the worse failure, and repeated anomalies inside a fortnight reach the workspace posture while one odd trip does not

2026-08-28 12:08:17 -07:00

encryptedkeys

feat: store envelope-encryption DEKs per organization

2026-06-10 17:15:47 +02:00

eventbus

feat: make the worker answer every SEND_EMAIL it acks with exactly one per-task EMAIL_FAILED or EMAIL_SENT, raising the typed account events (auth, disabled, rate limited, server error) in addition with the EmailErrorEvent body the consumer expects instead of a SendEmailResult it could not parse; a mailbox that is not loaded yet or a storage blip is left for a few bus redeliveries before being reported, using the new Message.Attempt and Redelivers fields the NATS and Kafka buses now fill in, and an SMTP INVALID_CREDENTIALS send failure is classified as an auth error

2026-08-23 10:18:24 -07:00

gtasks

Add sample auth UI theme

2026-02-10 19:30:47 +01:00

kafka

feat: move kafka behind a build tag so the default build is cgo-free

2026-07-20 09:56:16 +02:00

kms

infra(kms): pluggable Provider interface + local AES-256-GCM impl

2026-05-27 14:40:56 +00:00

pubsub

feat: import a mailbox's recent history on connect and govern sync by fair use: a backfill on every provider (newest first, inside an operator-editable window and cap, resumable through a durable per-provider cursor relayed as SYNC_STATE), a per-mailbox sync governor with priority, live and backfill lanes on shared Redis windows that defers over-budget mail with the cursor held instead of dropping it and only deactivates a mailbox for a flood or chronic daily overage, sync.* budgets on the admin instance settings shipped inside ADD_EMAIL, saved IMAP folder cursors and last_synced_at finally written, a Sync card in the mailbox drawer fed by GET /emails/:id/sync, and docs

2026-08-18 09:09:52 -07:00

secrets

New Repository: Add Backend Code

2026-01-17 14:11:14 +00:00

ssm

New Repository: Add Backend Code

2026-01-17 14:11:14 +00:00

storage

feat: add a filesystem blob storage backend

2026-07-20 09:56:02 +02:00