Matthew Meszaros cc1dc2f64c feat: answer refused realtime handshakes with a JSON code and reason, name a reused ws ticket or signed-out session, use the not_a_member slug on org joins, warn at boot when REALTIME_ALLOW_QUERY_CREDENTIALS is on, stop the admin socket reconnecting on admin_mfa_required, not_an_admin and jwt_required with a clear message, and have the seeder, updater, webhook and notification URL checks, instance health, fleet join and log mail transport say which setting applies and what to do

2026-10-23 19:53:03 +02:00

..

handler

feat: answer refused realtime handshakes with a JSON code and reason, name a reused ws ticket or signed-out session, use the not_a_member slug on org joins, warn at boot when REALTIME_ALLOW_QUERY_CREDENTIALS is on, stop the admin socket reconnecting on admin_mfa_required, not_an_admin and jwt_required with a clear message, and have the seeder, updater, webhook and notification URL checks, instance health, fleet join and log mail transport say which setting applies and what to do

2026-10-23 19:53:03 +02:00

middleware

feat: merge fail-closed ban and attempt-budget reads, 48-hour invitations and tester passwords with one-click resend, transactional invitation consumption, development-only seeding and redacted log mail links

2026-10-23 16:06:29 +02:00

cors.go

feat: move infrastructure state off dynamodb

2026-06-02 15:54:12 +02:00

resource_scope_routes_test.go

feat: answer a repeated single-valued query parameter with 400 duplicate_query_parameter and a repeated Authorization, X-Warmbly-Token, Idempotency-Key or Origin header with 400 duplicate_header on the API and forms service, keep the documented list parameters repeatable, fold X-Forwarded-For lines and read the last line of the other forwarding headers there and in the tracking service

2026-10-23 16:03:06 +02:00

routes.go

feat: merge decoded-byte image validation with download-safe serving, own-domain form and domain redirects, TLS-only SMTP AUTH negotiation and pinned per-server certificate opt-outs, with MAIL_TLS_INSECURE honoured on self-hosted and development instances and resolved by the control plane for joining nodes

2026-10-23 16:20:30 +02:00

upload_limit_test.go

feat: let contact file uploads use their own 50 MB cap instead of the global 10 MB one and say when a file is too large, refuse an import list limit below one, hold an imported update to the contact size limit, keep a company logo laid out while it lazy-loads, neutralize formula cells in the sync error download, settle the draft save indicator when an edit is undone, and document the draft save route

2026-09-27 22:10:02 -07:00