Commit Graph

8131 Commits

Author SHA1 Message Date
Tomas Costantino 52fcca9438 remove unnecessary callback 2025-12-11 10:25:34 +01:00
Tomas Costantino fb0b787f10 rename surroundings to adjacent columns 2025-12-11 10:25:17 +01:00
Tomas Costantino df7e597066 Merge branch 'main' into update-columns-on-actions 2025-12-11 10:17:15 +01:00
Jorge Manrubia dcdd8537af Merge pull request #2066 from basecamp/text-change-for-golden-tickets
Update tip text for turning a card into a Golden Ticket
2025-12-11 07:36:22 +01:00
Jeremy Daer 5d181af391 Storage: ignore jobs for now-deleted targets 2025-12-10 20:13:19 -08:00
Jankees van Woezik 477b4d65f2 API: Support created_at for API card and comment creation (#2056)
* Add support to set `created_at`

Discussed in
https://github.com/basecamp/fizzy/pull/1766#issuecomment-3637846074,
this allows users to import cards from another system with entries from
the past. For instance I'm importing all our Github issues (including
the closed onces) to Fizzy.

* Iron out published state tracking

---------

Co-authored-by: Jeremy Daer <jeremy@37signals.com>
2025-12-10 19:57:38 -08:00
Jeremy Daer 90452a4236 Enforce CSP (#2070) 2025-12-10 17:55:02 -08:00
Jeremy Daer 22da6dc19d CSP: full config with env vars per source (#2069)
* Configure all sources with CSP_* vars. Space separated source list.
* Fall back to `config.x.content_security_policy.*`
* Move our sources to fizzy-saas

References https://github.com/basecamp/fizzy-saas/pull/24
2025-12-10 17:21:09 -08:00
Jeremy Daer 761d0b4a76 Speedy, auditable, deadlock-resistant storage tracking (#2026)
An append-only storage ledger replaces deadlock-prone synchronous
counter updates and drift-prone async updates.

All content storage (card images, card/comment/board description embeds)
is tracked. Account exports (which expire) and avatars are not tracked.

Storage is accounted for by Account and Board. Both consume the same
event stream independently: no bubble-up storage bumps triggering
deadlocks due to lock sequencing. Each calculates its own total from
the underlying ledger with independent cursors and materialization.

* Storage::Entry: Append-only ledger recording attach/detach/transfer
  events with delta bytes. Single event stream indexed for both
  Account and Board cursor queries.

* Storage::Total: Polymorphic snapshot cache with cursor (last_entry_id)
  tracking which entries have been materialized.

* Storage::Totaled concern: Provides bytes_used (fast snapshot) and
  bytes_used_exact (snapshot + pending) query modes, plus
  materialize_storage! to roll up pending entries.

* Storage::Tracked concern: For models owning attachments (Card,
  Comment, Board). Provides board_for_storage_tracking for models
  where board is determined differently (Board returns self).
  Handles board transfers by recording transfer_out/transfer_in entries.

* Storage::AttachmentTracking: Hooks ActiveStorage::Attachment lifecycle
  to record attach/detach entries. Handles ActionText::RichText embeds
  by traversing to the actual model. Snapshots context in before_destroy
  to handle cascading deletes where parent record may be gone by
  after_destroy_commit.

* MaterializeJob: Rolls up pending entries into snapshot. Concurrency
  limited per owner to prevent duplicate work.

* ReconcileJob: On-demand reconciliation against actual attachment
  storage for support/debugging. Compares ledger total to real bytes
  from card images, card embeds, comment embeds, and board embeds.

Usage:
* account.bytes_used / board.bytes_used: fast, slightly stale bytesize
* account.bytes_used_exact / board.bytes_used_exact: real-time bytesize
* Storage::Entry: audit trail for debugging and point-in-time queries
2025-12-10 16:04:30 -08:00
Jeremy Daer 94e991df07 Gitleaks: ignore legit non-sensitive API keys and tokens in docs/ and test/ (#2068) 2025-12-10 14:23:55 -08:00
Mike Dalessio d750c9e5f2 Merge pull request #2067 from basecamp/flavorjones/gitleaks-20251210
Get gitleaks-audit green again
2025-12-10 17:14:40 -05:00
Mike Dalessio 3191c4ec1e Get gitleaks-audit green again 2025-12-10 17:05:19 -05:00
dependabot[bot] ef538abb4f Bump actions/checkout from 4 to 6 (#2047)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-10 13:25:42 -08:00
dependabot[bot] 19cd7bfeec Bump docker/login-action from 3.5.0 to 3.6.0 (#2046)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v3.5.0...v3.6.0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-10 13:25:17 -08:00
dependabot[bot] 9ee8b131c5 Bump docker/metadata-action from 5.8.0 to 5.10.0 (#2045)
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](https://github.com/docker/metadata-action/compare/v5.8.0...v5.10.0)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-version: 5.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-10 13:25:02 -08:00
dependabot[bot] a90ad88bab Bump sigstore/cosign-installer from 3.9.2 to 4.0.0 (#2044)
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.9.2 to 4.0.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](https://github.com/sigstore/cosign-installer/compare/v3.9.2...v4.0.0)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-10 13:24:47 -08:00
Hosmel Quintana df9a4b255c make MySQL SSL mode configurable via env var (#2036) 2025-12-10 13:22:38 -08:00
Brian Bailey aad3d51e15 Update tip text for turning a card into a Golden Ticket
Clarified with JF after noticing language like "turning it into a Golden card" in the help content. We're okay with using "ticket" in this case.
2025-12-10 15:48:14 -05:00
Andy Smith bed0e4bd9e Merge pull request #2009 from nqst/clickable-checkbox-labels
Make toggle switch labels clickable
2025-12-10 14:47:51 -06:00
Andy Smith 0e9350d637 Revert "Fix Lexxy prompt list padding by lowering rich-text specificity"
This reverts commit 31fec69822.
2025-12-10 14:12:34 -06:00
Andy Smith 31fec69822 Fix Lexxy prompt list padding by lowering rich-text specificity 2025-12-10 14:12:14 -06:00
Stanko Krtalić 96b6c6e9dc Merge pull request #2060 from basecamp/improve-api-docs-phrasing
Improve phrasing
2025-12-10 20:54:34 +01:00
Stanko K.R. 3f2e3e6b62 Improve phrasing 2025-12-10 20:49:36 +01:00
Stanko Krtalić ce4be3462c Merge pull request #2057 from basecamp/api-fixes
Followup API fixes
2025-12-10 18:52:45 +01:00
Stanko K.R. 4e092407ab Fix crash due to missing partial 2025-12-10 18:47:00 +01:00
Stanko K.R. b0b90cef66 Fix status and filter mistakes 2025-12-10 18:42:23 +01:00
Kevin McConnell 858439a5de Merge pull request #2051 from basecamp/run-jobs-by-default
In non-SaaS, run jobs in container by default
2025-12-10 16:59:24 +00:00
Mike Dalessio 6c73049261 Merge pull request #2053 from basecamp/flavorjones/fix-system-comment-injection
Prevent HTML injection into system comments (card activity feed)
2025-12-10 11:01:34 -05:00
Mike Dalessio cb4883a655 Merge pull request #2052 from basecamp/flavorjones/fix-join-codes-bignum
Add validation for the join code usage limit
2025-12-10 10:50:54 -05:00
Mike Dalessio e0c821f69b Autolinking is more robust
and handles URLs with CGI params, recognizes more (and multiple)
trailing punctuation marks including entity-encoded punctuation like
`&quot;`.
2025-12-10 10:42:24 -05:00
Mike Dalessio c5721b8187 Avoid unescaping characters when auto-linking
which could lead to Nokogiri unintentionally parsing tags from a
previously-escaped text node.
2025-12-10 10:38:43 -05:00
Mike Dalessio 83360ec6f3 Escape the names used to generate system comments
including user names, board titles, column names, and card titles.
2025-12-10 10:38:42 -05:00
Mike Dalessio fa118a7d83 Add validation for the join code usage limit
which is preferred to generating a database error
2025-12-10 10:10:08 -05:00
Stanko Krtalić 754aaa5a76 Merge pull request #1766 from basecamp/basic-api
Add basic API
2025-12-10 15:43:58 +01:00
Kevin McConnell 2a3fda02f4 Merge pull request #1939 from hosmelq/active-storage-env-config
Make Active Storage service configurable
2025-12-10 14:36:47 +00:00
Stanko K.R. 714f7642b2 Rename /identity to /my/identity in docs 2025-12-10 15:32:50 +01:00
Stanko K.R. 3257e4a6e9 Inline partials 2025-12-10 15:27:56 +01:00
Stanko K.R. 5ce71bf941 Move Identities to My::Identities 2025-12-10 15:13:35 +01:00
Kevin McConnell a5396bbb1a Don't overwrite storage service from engine 2025-12-10 14:08:08 +00:00
Stanko K.R. 90e6322092 Return no content on update 2025-12-10 15:07:22 +01:00
Stanko K.R. 566def581e Remove redundant respond_to 2025-12-10 15:05:13 +01:00
Kevin McConnell 6f002b66d8 In non-SaaS, run jobs in container by default 2025-12-10 12:32:35 +00:00
Stanko K.R. 79e77a3780 Handle user update failures 2025-12-10 09:23:53 +01:00
Stanko K.R. 8dc6c48db5 Remove composite cache key
This prevents jbuilder from fetching multiple records at once, but it's no longer needed as the column and board touch all their associated cards on update so we can remove it
2025-12-10 09:23:53 +01:00
Stanko K.R. cbbddf9ffe Add cache directives 2025-12-10 09:23:53 +01:00
Stanko K.R. 462470ed1d Remove endpoints section
It was too easy to get lost in the ### sections for each resource. With rescources being ## sections I hope it will be easier to find things.
2025-12-10 09:23:53 +01:00
Stanko K.R. a7ca41e548 Move the tags section close to the cards 2025-12-10 09:23:53 +01:00
Stanko K.R. 7b30ca203e Add index actions for Comments and Columns
Also, fix crash when a deactivated user is serialized (they don't have
an identity).
2025-12-10 09:23:52 +01:00
Stanko K.R. bea8e60fd0 Document Card-related APIs 2025-12-10 09:23:52 +01:00
Stanko K.R. 707bf45063 Add steps to cards 2025-12-10 09:23:52 +01:00