Commit Graph

4156 Commits

Author SHA1 Message Date
Stanko K.R. 25b2daad93 Limit access to webhooks to admins 2025-09-16 20:04:20 +02:00
Stanko K.R. 1d192c9d42 Ignore low-volume webhooks for delinquency checks 2025-09-16 20:04:20 +02:00
Stanko K.R. fee25a49ea Periodically cleanup deliveries 2025-09-16 20:04:20 +02:00
Stanko K.R. 9d77b17b8c Remove encryption 2025-09-16 20:04:20 +02:00
Stanko K.R. d7db973397 Use the same timestamp from the body in the header
Else replay attack prevention doesn't work
2025-09-16 20:04:20 +02:00
Stanko K.R. df87ee8b35 Rename private IP ranges to disallowed IP ranges 2025-09-16 20:04:20 +02:00
Stanko K.R. b8317ce88d Fix indentation 2025-09-16 20:04:20 +02:00
Stanko K.R. 5e4d15d802 Remove concurrency limit
It won't be useful in practice for now, and we can always put it back in if the need arises
2025-09-16 20:04:20 +02:00
Stanko K.R. 1b09a39b1a Adhere to the redirect and params sanitization convention 2025-09-16 20:04:20 +02:00
Stanko K.R. 2fc9215b1d Add support for Basecamp, Campfire & Slack webhooks 2025-09-16 20:04:20 +02:00
Stanko K.R. 4879995013 Serialize events 2025-09-16 20:04:20 +02:00
Stanko K.R. 0bdbc5f5e8 Add abuse prevention 2025-09-16 20:04:18 +02:00
Stanko K.R. 4da69fb69f Move reactivation out of edit 2025-09-16 20:03:57 +02:00
Stanko K.R. 5c6cad057f Extract triggering logic into a concern 2025-09-16 20:03:57 +02:00
Stanko K.R. 9d717239e7 Dispatch Webhooks on event creation 2025-09-16 20:03:57 +02:00
Stanko K.R. 1930067e08 Allow Webhooks to be disabled 2025-09-16 20:03:57 +02:00
Stanko K.R. 9cfd1e43af Enable subscribing to specific actions 2025-09-16 20:03:57 +02:00
Stanko K.R. a515ea3b1f Create webhooks 2025-09-16 20:03:55 +02:00
Jorge Manrubia b5a2c4a25e Tidy up code a bit 2025-09-16 13:18:13 +02:00
Jorge Manrubia 6fe28c53e7 Extract common method 2025-09-16 13:06:01 +02:00
Jason Zimdars c56eb9ecd1 Cards in On Deck adopt some entropy behavior as ones in Doing 2025-09-16 13:06:01 +02:00
Jorge Manrubia 12d57678da Minor tweaks for default settings 2025-09-16 13:00:05 +02:00
Jason Zimdars 4b61c3ae30 Grant access to the creator and set their involvement to watching 2025-09-16 12:58:56 +02:00
Jorge Manrubia 7750b2e776 Merge pull request #1117 from basecamp/bundles-fixes
Fix problem where we can generate overlapping bundles due to flushing
2025-09-16 12:32:04 +02:00
Jorge Manrubia a6eb928688 Fix: update ends_at when flushing bundles
If not, it can happen that the bundlers remains in a delivered state
even when it is not covering its window anymore because it has been delivered.
2025-09-16 12:10:06 +02:00
Stanko Krtalić 0e2c7f7d4d Escape HTML everywhere where html_safe is used (#1114)
* Escape HTML everywhere where html_safe is used
* Mark search results as HTML safe at the attribute
2025-09-16 11:52:15 +02:00
Jorge Manrubia 97506c9a6c Remove trace 2025-09-16 11:22:44 +02:00
Jorge Manrubia 09325403e5 Add missing test (we were only testing this logic via the bundle test) 2025-09-16 11:22:14 +02:00
Andy Smith 27a99b4e1d Remember nav section collapsed state 2025-09-15 16:29:32 -05:00
Mike Dalessio d5a4239d19 Rename the queenbee_id and signal_user_id columns
to be more generic for the open-source release.

Find the signal account via Account#external_account

Find the signal user via User#external_user
2025-09-15 13:57:53 -04:00
Andy Smith 60e515e462 Merge pull request #1098 from basecamp/collapsible-nav-sections
Collapsible nav sections
2025-09-15 12:54:21 -05:00
Jorge Manrubia 48f7f914dc Fix: the system to filter at the current view was broken after moving menu to turbo frame
https://fizzy.37signals.com/5986089/cards/1723
2025-09-15 17:07:09 +02:00
Jorge Manrubia 2e4138b585 Tie etag to sessions
So that we don't get CSRF token issues if sharing sessions in the same browser
2025-09-15 16:31:01 +02:00
Jorge Manrubia 3d8437bd5f Truncate summaries to keep within API limits
https://fizzy.37signals.com/5986089/cards/1739
2025-09-15 16:14:29 +02:00
Jorge Manrubia 0e3d25707c Debug the overlapping bundle 2025-09-15 14:01:57 +02:00
Mike Dalessio 2630e4bd74 Extract 37id and QB controllers, models, and tests 2025-09-13 16:03:02 -04:00
Mike Dalessio e7dcefb25b Extract SignalUser and SignalAccount, and QB routes 2025-09-13 16:03:02 -04:00
Mike Dalessio 8f39c015ea Tests now pass with local authentication
This is the first step of a multi-step SaaS engine extraction.

Looking ahead to an open source release, we need to make sure that
local authentication is treated as an "official" option, and not just
a hack I added for Kevin to do load testing outside our DC. So this PR
gets to green, and adds a CI step in "local authentication" mode.

This all probably feels a little hacky to you, Reader, but the goal of
this change is to ease the next step, which will be extracting the
37id and Queenbee integrations into a proprietary "SaaS mode" engine.

In service of that goal, this commit simply wraps all of the dependent
code and tests with a conditional check on
`config.x.local_authentication`.
2025-09-13 15:21:00 -04:00
Jason Zimdars 154c1a8a15 This was a debug value 2025-09-12 18:09:52 -05:00
Jason Zimdars 25a6a63952 Give it a little more width 2025-09-12 17:28:08 -05:00
Jason Zimdars 36c3571848 Fix spacing, simplify layout 2025-09-12 16:08:24 -05:00
Jason Zimdars f0a2d50195 Move to constant, whitespace 2025-09-12 15:33:09 -05:00
Jason Zimdars 24d4bd2551 Limit to one row 2025-09-12 14:32:42 -05:00
Jason Zimdars e717875dfc Fix button style regression 2025-09-12 13:57:33 -05:00
Andy Smith cab6992555 Merge branch 'main' into collapsible-nav-sections
* main: (32 commits)
  Fix VCR fixtures
  Format
  Touch user on modification to invalidate cache
  Fix add card not working in the cards screen
  Submit and refresh results as you type terms
  Fix: When expanding filters, submitting filters should keep the filters expanded
  Invalidate cache when filter changes
  Switch to gpt-5-chat
  Reorded method and remove unnecessary param
  Add migration to convert accesses
  Handle filter toggles with JS
  Prevent glitch where you see the filter bar expanded when you clear it
  Remove unused templates
  Fix: all collections link not working after moving to turbo frame
  Restore cache I deleted by mistake
  Speed up filter expansion with turbo stream
  Fix: filtering collections not working after moving menu to turbo frame
  Respect params when loading the menu or they won't be reflected!
  Add HTTP cache for the menu
  Load main menu lazily with a turbo frame
  ...
2025-09-12 12:53:44 -05:00
Andy Smith 6924b86b23 Remove redundant vars 2025-09-12 12:36:49 -05:00
Andy Smith 373b139b9a Add collapsible nav sections 2025-09-12 12:32:32 -05:00
Jorge Manrubia 9e5108bcae Touch user on modification to invalidate cache
For the new "add card" in the cards screen
2025-09-12 18:59:18 +02:00
Andy Smith e1a428b46b Straighten out icon and radio sizes 2025-09-12 11:59:16 -05:00
Jorge Manrubia ba3b782d21 Merge branch 'main' into watchers
* main:
  Fix add card not working in the cards screen
  Submit and refresh results as you type terms
  Fix: When expanding filters, submitting filters should keep the filters expanded
  Invalidate cache when filter changes
  Switch to gpt-5-chat
  Handle filter toggles with JS
  Prevent glitch where you see the filter bar expanded when you clear it
  Remove unused templates
  Fix: all collections link not working after moving to turbo frame
  Restore cache I deleted by mistake
  Speed up filter expansion with turbo stream
  Fix: filtering collections not working after moving menu to turbo frame
  Respect params when loading the menu or they won't be reflected!
  Add HTTP cache for the menu
  Load main menu lazily with a turbo frame
  Inline :has(&) as it's REALLY slow in Safari
  Extract helper method
  Remove transition that is making Safari choke when navigating to Fizzy menus
  Reduce page size to reduce load for processing local times on initial page load
  Avoid having to parse strings

# Conflicts:
#	app/views/cards/index/_add_card_button.html.erb
#	test/vcr_cassettes/period_highlight_test-test_don_t_generate_highlights_for_existing_periods.yml
#	test/vcr_cassettes/period_highlight_test-test_generate_period_highlights.yml
#	test/vcr_cassettes/user/highlights_test-test_don_t_generate_highlights_for_existing_periods.yml
#	test/vcr_cassettes/user/highlights_test-test_generate_weekly_highlights.yml
2025-09-12 18:52:17 +02:00