85bfa7aa48
Rename method
2026-01-05 16:01:25 +01:00
5f38e8957e
Reapply "Make sure new card drafts are refreshed when reused"
...
This reverts commit 045ddf78f3
2026-01-05 15:58:29 +01:00
045ddf78f3
Revert "Make sure new card drafts are refreshed when reused"
...
This reverts commit 3008011175
2026-01-05 15:58:16 +01:00
3008011175
Make sure new card drafts are refreshed when reused
...
To deal with old timestamps messing with card ordering and so.
https://app.fizzy.do/5986089/cards/3495
2026-01-05 15:57:48 +01:00
87977eb770
Merge pull request #2211 from basecamp/card-nav-hotkeys
...
Add hotkeys for triaging cards in columns
2025-12-23 09:45:24 -06:00
3fcf5a9d08
Require authorization for direct uploads
...
Respond with 403 to JSON requests that are unauthorized, instead of
redirecting.
2025-12-23 11:08:51 +01:00
d4ace2752c
Ensure the flash notice passes through the redirect
2025-12-20 18:04:56 -06:00
0adcfabe4c
Stub welcome letter for newly created accounts
2025-12-19 15:36:52 -06:00
641e67dc2e
Remove status from allowed parameters in CardsController#update
...
We don't allow changing the status via this action, and it's confusing
and can lead to cases where someone can set someone's else card as
draft, effectively hiding it.
2025-12-19 22:35:30 +01:00
6e90a6dbfb
Add hotkeys for triaging cards in columns
...
Hover to select items
2025-12-19 14:33:47 -06:00
ca388c2b84
Replace handle_ naming
2025-12-19 19:21:58 +01:00
df1dfde2b3
Use same constant for fake magic links
2025-12-19 19:21:58 +01:00
3af8bdbe37
Replace FakeMagicLink with a temporary object
2025-12-19 19:21:58 +01:00
52d57c4681
Tidy up session_token
2025-12-19 19:21:57 +01:00
e0270c6c49
Clean up interfaces
...
I talked to the mobile team, and to keep things simple we agreed to send
the token via a cookie.
2025-12-19 19:21:57 +01:00
1a1f4a077b
Simplify auth logic
2025-12-19 19:21:57 +01:00
cddddcf83a
Fix due to unit test when creating with invalid emails
2025-12-19 19:21:57 +01:00
b3c8d02709
Cleanup session creation
2025-12-19 19:21:57 +01:00
6e8d6a3df0
Update to always return a pending auth token for JSON responses.
2025-12-19 19:21:57 +01:00
877f82c0cc
Pass a server token when creating a magic link via API
2025-12-19 19:21:57 +01:00
a75a939289
Simplify code a bit
2025-12-19 19:21:57 +01:00
360e14352f
Simplify session create logic for both html and json
2025-12-19 19:21:57 +01:00
e5bdb3b071
Add back missing development magic link prompt
2025-12-19 19:21:57 +01:00
c0a0786539
Return the session cookie
...
We had a call about this. In short, we could reuse access tokens but then the user would see access tokens for every mobile device they have without any indication as to what is going on. So, since this really is just logging in instead of an integration which seems to be the primary purpose of access tokens, we can just use our regular session cookie for authentication.
2025-12-19 19:21:57 +01:00
54ceb4df7c
Remove email address and users from magic link response
...
The identity endpoint can be used to fetch that information
2025-12-19 19:21:57 +01:00
b92982b244
Cleanup & simplify sign in
2025-12-19 19:21:57 +01:00
093240c6f7
Return email and users too
2025-12-19 19:21:57 +01:00
ab0f7a3ea5
Dev: Set magic link as header when JSON request in development
2025-12-19 19:21:57 +01:00
7644bb7411
Allow JSON requests submitting a magic link code
2025-12-19 19:21:57 +01:00
c8eb592746
Allow JSON requests to send a magic link
2025-12-19 19:21:57 +01:00
eb1d112013
Merge pull request #2203 from basecamp/remove-unused-param
...
Remove unused `tag_ids` parameter from `CardsController#update`
2025-12-19 12:16:32 +01:00
33fc239571
Merge pull request #2140 from dilberryhoundog/fix-stale-account-cache
...
Fix: resolve stale account names in jump menu and page titles
2025-12-19 11:26:23 +01:00
2cbbdfbd19
Merge pull request #2138 from italomatos/refactor/replace-reverse-merge-with-with-defaults
...
Refactor: Replace reverse_merge with with_defaults for improved readability
2025-12-19 11:24:46 +01:00
1e640643e9
Remove unused tag_ids parameter from CardsController#update
...
This is no longer used in the normal flow of the app. The tags are added
via `Cards::TaggingsController`.
2025-12-19 11:16:20 +01:00
42185a8d6d
Merge pull request #2153 from basecamp/limit-the-number-of-asignees-on-a-card
...
Limit the number of asignees on a card
2025-12-18 12:08:45 +01:00
ee80b87c8c
Add billing system with Stripe
...
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-Authored-By: Jason Zimdars <jz@37signals.com >
2025-12-16 16:44:20 +01:00
15cb1f7fe1
Add UI to prevent assigning more than 10 asignees
2025-12-15 16:40:52 +01:00
741eff7bdc
Revert "Merge pull request #1865 from basecamp/public-avatar-caching"
...
This reverts commit c628f14c014bafc73236
2025-12-15 13:07:13 +00:00
2058743be9
Merge pull request #2146 from basecamp/show-only-published-cards-on-public-boards
...
Show only public cards on public boards
2025-12-15 13:26:12 +01:00
c628f14c01
Merge pull request #1865 from basecamp/public-avatar-caching
...
Serve own avatar from its own endpoint
2025-12-15 12:20:28 +00:00
87081aa617
Show only public cards on public boards
2025-12-15 13:15:36 +01:00
f01a648441
🐛 fix: resolve stale account names in jump menu and page titles
...
Add account data to fresh_when etag arrays so Rails serves fresh responses after account changes.
- Add @accounts to menus controller etag
- Add Current.account to boards controller etag
- Add ETag cache invalidation tests for both controllers
2025-12-15 15:59:25 +08:00
cd4fbc011c
Refactor: Replace reverse_merge with with_defaults for improved readability
...
Replace all occurrences of reverse_merge with with_defaults across the codebase.
The with_defaults method provides clearer intent and better readability when
setting default values for hash parameters.
Changes:
- app/helpers/columns_helper.rb: Update column_frame_tag method
- app/models/user/email_address_changeable.rb: Update generate_email_address_change_token method
- app/models/account.rb: Update create_with_owner method
- app/controllers/concerns/filter_scoped.rb: Update filter_params method
This refactoring maintains the same functionality while improving code clarity.
2025-12-14 14:22:06 -03:00
31542373ee
Merge pull request #2112 from JangoCG/feature/rate-limit-join-codes
...
feat: protect join codes from brute-force attacks
2025-12-14 09:43:28 +01:00
d7e5d4218f
Merge pull request #2032 from tomycostantino/update-columns-on-actions
...
Fix: board columns actions are stale when moving a column moves
2025-12-14 09:28:57 +01:00
82626f020d
Tailscale serve support ( #2126 )
...
Ensure we can serve the app from multiple hosts without breaking links.
* Switch unnecessary full URLs to paths
* Drop default host/port URL options for controllers
Shell 1
```bash
bin/dev
```
Shell 2
```bash
tailscale serve http://fizzy.localhost:3006
```
2025-12-13 09:29:50 -08:00
9cff236f66
Drop staff restriction in beta and staging
...
because it was preventing testing of signups.
2025-12-12 15:12:46 -05:00
7f5fa6d715
Use Sec-Fetch-Site exclusively for CSRF protection
...
And close the gap with JSON requests, which shouldn't be allowed if
Sec-Fetch-Site is 'cross-site' or 'none', only if it's empty as this
wouldn't be coming from a browser.
2025-12-12 18:37:32 +01:00
09a2e7d7d7
feat: add rate limit to join codes controller
2025-12-12 17:21:57 +01:00
eec96ff384
Serve own avatar from its own endpoint
...
This allows us to have different cache controls depending on whether
you're viewing your own avatar, or someone else's. Your own avatar will
always be fresh, while other folks' avatars can be pulled from the CDN.
2025-12-12 09:03:35 +00:00
Jorge Manrubia