Andrey Antukh
39ca4c264c
🔥 Remove onboarding A/B test and welcome file creation ( #11707 )
...
Drop the onboarding-03 experiment consulted through
external-feature-flag, keeping the false-branch behavior: registration
never requests a welcome file and the workspace never shows the
onboarding modals. Remove the now-unused welcome-file machinery on the
backend (RPC wiring, welcome_file namespace, welcome-file-id prop and
the post-login redirect). Keep the external-feature-flag helper as the
seam for future experiments and note it in mem:frontend/core.
Closes #11705
AI-assisted-by: muse-spark-1.3-contributor
2026-09-15 14:14:32 +02:00
Miguel de Benito Delgado
93b9f5c567
🐛 Follow 302 redirects when downloading templates ( #10308 )
...
* 💄 Update URIs for templates to avoid redirects
* 🐛 Follow 302 redirects when downloading templates
2026-06-18 18:14:56 +02:00
Yamila Moreno
ddba2ffa75
📎 Update Kaleidos Copyright ( #9929 )
2026-05-29 11:24:58 +02:00
Andrey Antukh
279231240d
🐛 Harden outbound HTTP requests against SSRF and restrict assets handlers ( #9390 )
...
* ⬆️ Update root deps
* 🐛 Harden outbound HTTP requests against SSRF and restrict unauthenticated asset access
- Add app.util.ssrf URL/host validator that resolves hostnames and blocks
loopback, link-local, site-local, cloud metadata, and operator-supplied CIDRs
- Add app.media.sanitize image EOF truncator that strips trailing data after
PNG IEND, JPEG EOI, GIF trailer, and WebP RIFF markers
- Disable HTTP client auto-redirect; add req-with-redirects! helper that
revalidates every redirect hop against the SSRF blocklist
- Wire SSRF validation and EOF sanitization into media/download-image
- Validate webhook URLs and OIDC profile picture URLs against SSRF
- Restrict /assets/by-id to require authentication for non-public buckets
(profile) while keeping public access for file-media-object,
file-object-thumbnail, team-font-variant, and file-data-fragment
- Add config knobs: ssrf-protection-enabled, ssrf-allowed-hosts,
ssrf-extra-blocked-cidrs
Signed-off-by: Andrey Antukh <niwi@niwi.nz>
---------
Signed-off-by: Andrey Antukh <niwi@niwi.nz>
2026-05-08 09:18:22 +02:00
Andrey Antukh
bcaf76d055
✨ Make the virtual clock by profile and not global
...
And make it affect only RPC/HTTP requests and not worker
tasks.
2026-01-09 12:58:44 +01:00
Andrey Antukh
4fddf3d986
♻️ Make management key derivable from secret key
...
Still preserves the ability to set management
2025-11-20 12:20:13 +01:00
Andrey Antukh
83763b46ce
✨ Add RPC methods for manage deleted files
...
This includes: get already deletedf files, restore deleted files
and permanently delete files marked for deletion.
2025-10-31 16:07:23 +01:00
Andrey Antukh
bd63598185
🎉 Add virtual clock implementation
2025-10-07 12:08:00 +02:00
Andrey Antukh
efd4a11ae2
🐛 Add support for multiple formats on clone-template
2025-01-23 08:09:23 +01:00
Pablo Alba
afb5ab7430
✨ Rename welcome file
2024-10-25 12:23:35 +02:00
Andrey Antukh
002b1679c3
♻️ Clean assertion and schema chechking API
2024-10-08 15:30:33 +02:00
Andrey Antukh
b882b9e283
🔥 Remove usage of public usage of sm/define funcion
2024-09-13 11:30:55 +02:00
Pablo Alba
81b7972347
🎉 Test A/B for start in workspace
2024-09-04 17:19:39 +02:00
Andrey Antukh
22757a449f
✨ Add minor performance enhancements on template setup service
2023-12-11 17:14:20 +01:00
Andrey Antukh
37e4939af7
✨ Add usability improvements to schema validation subsystem
2023-11-23 17:19:37 +01:00
Andrey Antukh
f174264f7f
🎉 Add flex layout playground template to the dashboard carousel
2023-07-28 13:20:57 +02:00
Andrey Antukh
494c585e2f
✨ Make builtin templates download ondemand if cache is not present
2023-07-10 15:07:17 +02:00
Andrey Antukh
8468e7af24
🎉 Add admin example service to default docker compose file
2023-01-20 16:52:58 +01:00
Andrey Antukh
bafe3ec087
⏪ Revert some changes related to admin that are no longer necessary
2023-01-13 10:19:39 +01:00
Andrey Antukh
b929564fa7
♻️ Add admin facilities on the code base
...
- Fix bugs related to orphan teams on profile deletion
- Separate session based profile-id param from api user provided
2022-12-22 16:42:45 +01:00
Andrey Antukh
8bad9d8340
♻️ Refactor loggers/audit, auth/oidc, and http/clent modules
2022-12-05 08:53:00 +01:00
luz paz
e30bea0b6f
🔧 Fix typos in source code
...
Found via `codespell -q 3 -S *.po,./frontend/yarn.lock -L childs,clen,fpr,inflight,ody,ot,ro,te,trys,ue`
2022-10-04 10:40:34 +02:00
Andrey Antukh
41134f22e9
📎 Update license header
2022-09-20 23:23:22 +02:00
Andrey Antukh
ec3651d85b
🎉 Add optional rate limit support for RPC calls
2022-08-31 12:55:48 +02:00
Andrey Antukh
d6d9d25fce
♻️ Refactor token generation API
2022-08-31 11:01:07 +02:00
Andrey Antukh
ed701fd9c5
♻️ Move management mutations to commands
2022-08-03 14:28:33 +02:00
Andrey Antukh
d832482dae
🎉 Add builtin template loading mechanism
2022-08-03 14:28:33 +02:00
Andrés Moya
1894fc7cfa
🐛 Fix linter error
2021-07-06 18:08:08 +02:00
Andrey Antukh
d1cce44616
🎉 Add keys namespace.
...
A modularized approach for key derivation.
2021-07-06 10:49:27 +02:00
Andrey Antukh
188126a895
✨ Properly use dumped objects on initial data load process.
2021-05-20 10:52:20 +02:00
Andrey Antukh
f545e41d10
📎 Fix license header.
2021-04-12 16:49:43 +02:00
Andrey Antukh
708ba3d7ac
🐛 Fix initial data loading issues.
2021-03-08 22:35:11 +01:00
Andrey Antukh
6a345c4b8a
✨ Complete backend behavior when duplicate and move
2021-03-03 12:38:34 +01:00
Andrey Antukh
52a3cd6ae4
🐛 Don't show update library message on onboarding files.
2021-03-01 16:38:28 +01:00
Andrey Antukh
f12f46981b
🐛 Add mising remap-id on onboarding files setup.
2021-03-01 15:41:39 +01:00
Andrey Antukh
2a8a0afd09
🐛 Fix many bugs on onboarding file loading process.
2021-02-28 19:58:15 +01:00
Andrey Antukh
e3727aaefe
🎉 Add onboarding data to the database.
2021-02-24 16:31:56 +01:00
