* main: (82 commits)
We can remove ad-hoc handling now that we rely on page refreshes in the card perma
Only broadcast when the preview changes, use the _later variant for the broadcast, add tests
Update pinned cards when the title changes
Rename to be more consistent
Beautify board watchers list (#1946)
Add missing data-attr on public board
Fix hotkey text size on tiny viewports
Use buil-in support for :self in Stimulus
Save a bunch of invocations on morph events from children elements
Fix: memoization was showing stale values when morphing
GitHub actions: limit GITHUB_TOKEN permissions (#1933)
Validate Identity email address
Drop defunct user creation script
Golden cards should be placed at the top
Animate the column height with a stimulus controller so that it does not depend to the server to update when you D&D
mise: respect .ruby-version
Support custom validation messages
Move css bit to the new blank slates CSS
Prevent board names with only spaces and show validation message
Keep the column color when D&D cards
...
using the "standard" email regexp URI::MailTo::EMAIL_REGEXP. The form
field will validate this in the browser, but if bots are creating
identities, they can put whatever they want in here. So let's add some
protection against that.
The HtmlHelper regex was renamed here to avoid confusing Brakeman,
which does imprecise constant lookup and was confusing the two
constants, one of which uses `\A` and `\z` and the other does
not (intentionally).
ref: https://app.fizzy.do/5986089/cards/3276
We missed this one when we went to MySQL. This can results in cards tagged with cards
from other accounts. No data leaked though: the symptom is that you see the card
tagged as expected but you don't see the tag in the menu.
Users could reorder columns they didn't have access to. Fixed by
limiting ColumnScoped to User::Accessor#accessible_columns.
References https://hackerone.com/reports/3449905
#sample uses PRNG under the hood which is pseudo random, which means that given enough magic link codes you can predict which code would come next. To fix that we have to switch to CSPRNG - SecureRandom.random_number - which isn't easy to predict based on previous results.
Aligns with Rails conventions for organizing concerns in a dedicated
concerns directory alongside existing concerns like Attachments,
Mentions, Searchable, etc.
Patch load_schmema! to set the default value for UUID primary keys. This
removes the need to patch ApplicationRecord + Rails models individually.
It also means we no longer need to patch the default in for the integer
primary key in Search::Record::SQLite.
* main: (85 commits)
Fix crash when inserting an emoji into a max length reaction
change the object type in the example code (#1824)
We can't hide public boards like this
Consistent breakpoints for min- and max-width
Repair tooltip z-index selector
Fix bin/setup to explicitly use bash syntax for mise hook-env (#1813)
Update AGENTS.md (#1818)
Bundler: normalize platforms (#1822)
Robots, begone (#1812)
Account for input padding on autoresize pseudo-element
Updated database.sqlite.yml
(account): encode external_account_id in slug
Allow typing magic links on mobile
Add contributing guide
Disconnect action cable when user is deactivated
Disable ARM image builds
Disable image builds for PRs
Add libssl-dev
Add automated Docker image builds
Make the jump nav hotkeys look like the others
...
- Adds a button in Account Settings where you can request a ZIP export of your
Fizzy data
- Export files are created in the background. When ready, a link to
download them is sent to the requester.
- Exports expire after 24 hours. And are limited to 10 per day.
The problem was that publishing a card with `#publish` was tracking the event
after updating the status, which was clearing the saved changes and preventing the
code from detecting the mention.
See:
https://app.fizzy.do/5986089/cards/2835
* main: (26 commits)
Update fizzy-saas
Update to fizzy-saas to remove jobs from beta
Claude can fetch the .mcp.json file that shipyard places in your home
Update fizzy-saas
This was moved to the engine
Introduce an "owner" role, and prevent it from being administered
Make sure the sqlite db is prepared in SAAS mode
Update fizzy-saas gem
Move env-specific config bits to the saas gem
Migrate sqlite schema
Use main branch of fizzy-saas
Change copy
Make sign up Magic Links work across devices
Remove unused view
Update signup with the design from signin
Revert "Update to latest version with the env config bits moved"
Update to latest version with the env config bits moved
Organize everything under Signups
Create signups controller
update pipelines
...
Previously if someone started signing in on their phone, but finished it on their laptop, they'd end up on the menu screen with no account. Bu tracking the purpose of a Magic Link we can always direct the user to sign up if they requested a magic link through sign up. This also makes the logic for changing the copy in the email more robust.
If no record exists, create it. This fixes a test in fizzy-saas in
test/models/signup_test.rb that was not actually testing with a valid
external account id.
* main: (112 commits)
Switch from report-only to actually using Sec-Fetch-Site for CSRF protection
Add minimal contribution section
Remove configure-lb scripts (moved to fizzy-saas gem)
Test
Update to latest gem
Moved to sentry
Moving this to shipyard
Add yabeda metrics check only in SaaS mode
Format
Add gitleaks from main
We need the check in both test/code
Move yabeda/prometheus stuff to the gem
Move sentry to engine
Add note about VAPID
Only staff can access beta/staging
Review README
Review README
Initial README and LICENSE
Style copy
Add note on CRUD controllers
...
Adrien Maston