Commit graph

96 commits

Author SHA1 Message Date
Kailash Nadh
d27d2c32cf Remove dangerous tpl funcs in Sprig that's enabled by default.
`env` and `expandenv` template functions in the Sprig library allow
accessing system environment variables within campaign templates.
2025-06-08 15:06:56 +05:30
Kailash Nadh
7791327547 Make Must config variables non-Must so that the app doesn't panic on their absence. 2025-04-23 00:21:57 +05:30
Kailash Nadh
12bc79866f Make OIDC provider name display on login button configurable. Closes #2211 2025-04-23 00:09:24 +05:30
Kailash Nadh
20e4b100ca Fix DB state issues in visual campaign cloning. 2025-04-20 20:48:51 +05:30
Kailash Nadh
78366ab7e4 Clean up main initialization to remove app interdepencies in init.
`App{}` now is used purely as a container for HTTP handlers.
2025-04-06 00:28:35 +05:30
Kailash Nadh
88489223c9 Remove superfluous consts dep in init functions by separating URL consts. 2025-04-05 23:39:08 +05:30
Kailash Nadh
e2f24a140e Turn notifs into a special stateful global singleton package, removing clunky deps. 2025-04-05 22:45:19 +05:30
Kailash Nadh
b3d46a8c85 Refactor system notification callbacks into a new notifs package. 2025-04-05 19:07:06 +05:30
Kailash Nadh
00c858fc49 Refactor all HTTP handlers and attach them to a single struct.
- Attach all HTTP handlers to a new `Handlers{}` struct.
- Remove all `handle*` function prefixes.
- Remove awkward, repetitive `app = c.Get("app").(*App)` from all handlers
  and instead, simply access it from `h.app` from `Handlers{}`

Originally proposed in #2292.
2025-04-05 15:42:35 +05:30
Kailash Nadh
007f4de850 Fix a number of cosmetic inconsistenies across handlers and functions.
- Make the beginning of handlers consistent with uniform variable declaration
  and grouping.
- Add missing comments.
- Fix staticcheck/vet warnings and idiom issues.
2025-04-05 13:41:31 +05:30
Kailash Nadh
17998fbff5 Refactor user auth models and permission checks.
- Move user models from `/models` to `internal/auth`.
- Move and refactor various permission check functions into `User.()`
- Refactor awkward `get, manage bool` function args into `Get|Manage` bitflags.
2025-04-05 00:19:27 +05:30
Kailash Nadh
a271bf54d5 Introduce per-campaign filter permissions. Closes #2325.
This patch introduces new `campaigns:get_all` and `campaigns:manage_all`
permissions which alter the behaviour of the the old `campaigns:get` and
`campaigns:manage` permissions. This is a subtle breaking behavioural change.

Old:

- `campaigns:get` -> View all campaigns irrespective of a user's list
  permissions.
- `campaigns:manage` -> Manage all campaigns irrespective of a user's list
  permissions.

New:

- `campaigns:get_all` -> View all campaigns irrespective of a user's list
  permissions.
- `campaigns:manage_all` -> Manage all campaigns irrespective of a user's list
  permissions.
- `campaigns:get` -> View only the campaigns that have at least one list to
  which which a user has get or manage access.
- `campaigns:manage` -> Manage only the campaigns that have at list one list
  to which a user has get or manage access.

In addition, this patch refactors and cleans up certain permission related
logic and functions.
2025-03-31 16:39:42 +05:30
Kailash Nadh
92e5d630ca Fix various static-check/idiom warnings. 2025-03-30 11:21:50 +05:30
Kailash Nadh
b8f50eafa3 Add support for domain allowlists in addition to blocklists. Closes #2230.
This patch introduces a new `Domain allowlist` input in Settings -> Privacy UI
as a new tab alongside domain `Domain blocklist`. If any domains are entered
here, then only subscriptions/imports/additions of e-mails from those particular
domains are accepted. blocklist is mutually exclusive with allowlist when there
are values in the allowlist.
2025-03-29 23:31:34 +05:30
Kailash Nadh
2defef3857 Refactor SMTP name to always have email- prefix for consistency. 2025-02-14 18:38:47 +05:30
lcd1232
d055cc5311
Add support for selecting SMTP per campaign (#2290)
This patch adds a new optional `name` field to SMTP server config on the UI.
When a name is given to an SMTP server, it's initialized as a standalone messenger
which shows up as a sub-group item under the main "email" messenger
on the campaign page.

Co-authored-by: Kailash Nadh <kailash@nadh.in>
2025-02-11 22:41:45 +05:30
Kailash Nadh
e8fd12bddf Add List-Unsubscribe header to opt-in confirmation mails. Closes #2224. 2025-01-19 11:41:17 +05:30
Kailash Nadh
abe09d67ed Refactor OIDC redirect state to have nonce validation. Closes #2138. 2024-11-10 22:27:11 +05:30
Shaun Warman
cb8b54fd00
Add ForwardEmail (provider) bounce integration (#2016)
* Add ForwardEmail one-click SMTP form option.
* Add bounce webhook integration.

---------

Co-authored-by: Kailash Nadh <kailash@nadh.in>
2024-11-10 21:45:07 +05:30
Abhinand KR
4eefd4215e
Remove redundant campaign manager config validations (#2095) 2024-10-27 17:25:48 +05:30
Kailash Nadh
5b3d6e2be0 Add first-time Super Admin setup UI on fresh install.
- Don't setup username+password from config file during fresh install.
- If `LISTMONK_ADMIN_USER` and `LISTMONK_ADMIN_PASSWORD` env vars are
  set during `--install`, use them.
- Otherwise, render new username+password creation UI on `/admin/login`.
- Add Cypress tests.
2024-10-26 19:47:01 +05:30
Kailash Nadh
ae2a386193 Add support for "list roles".
This commit splits roles into two, user roles and list roles, both of which
are attached separately to a user.

List roles are collection of lists each with read|write permissions, while
user roles now have all permissions except for per-list ones.

This allows for easier management of roles, eliminating the need to clone and
create new roles just to adjust specific list permissions.
2024-10-13 17:03:58 +05:30
Kailash Nadh
2da920d634 Add legacy TOML user+password to API auth on init with warning. 2024-10-13 16:59:52 +05:30
Kailash Nadh
5024ded763 Add API user authentication to auth module with caching of creds on user CRUD. 2024-10-13 16:59:52 +05:30
Kailash Nadh
e6ec1cb9b3 User legacy (TOML) admin credentials as API creds for backwards compatibility. 2024-10-13 16:59:52 +05:30
Kailash Nadh
1e875afa67 Add OIDC auth hooks (init, callback, session) and finish OIDC support. 2024-10-13 16:59:52 +05:30
Kailash Nadh
a8c17780f9 Add warning on admin UI for legacy creds in the TOML file. 2024-10-13 16:59:52 +05:30
Kailash Nadh
d4e4c5fa99 Add granular permissions and role management to backend and admin UI. 2024-10-13 16:59:51 +05:30
Kailash Nadh
906e0f57b6 Refactor handler groups and add mising auth features like logout. 2024-10-13 16:59:51 +05:30
Kailash Nadh
57ac9dca4b Add public login page and auth middleware and handlers. 2024-10-13 16:59:51 +05:30
Kailash Nadh
8ca95f6827 Refactor OIDC middleware handler logic. 2024-10-13 16:59:50 +05:30
Kailash Nadh
e406b2516a Add a settings UI for OIDC. 2024-10-13 16:59:50 +05:30
Marc Bärtschi
1b7128abf2 Implement OIDC
This is a simple OIDC implementation. It's very basic and just logs the user in. Access control needs to be done on the IDP side.
2024-10-13 16:59:50 +05:30
Jonas Sulzer
1d32d4c368
👌 IMPROVE: make RootURL available in email templates (#1812)
Signed-off-by: Jonas Sulzer <jonas@violoncello.ch>
2024-04-04 22:57:52 +05:30
Muhammed Kadir Tan
2afac2469e
fix: check errors.Is instead of strings.Contains for http: Server closed error (#1779) 2024-03-12 11:06:35 +05:30
Kailash Nadh
6cb9982aac Add .IndividualTracking to public templates. Closes #1663. 2024-01-27 22:38:26 +05:30
Kailash Nadh
5a3664aee2 Add support for caching slow queries on large databases.
- Add materialized views for list -> subscriber counts, dashboard chart,
  and dashboard aggregate stats that slow down significantly on large
  databases (with millions or tens of millions of subscribers). These
  slow queries involve full table scan COUNTS().

- Add a toggle to enable caching slow results in Settings -> Performance.

- Add support for setting a cron string that crons and periodically
  refreshes aggregated stats in materialized views.

Closes #1019.
2024-01-27 15:51:12 +05:30
Kailash Nadh
0c9dc07479 Add a ?v=hash cache breaker (that changes on restart) to static assets. 2023-12-31 22:20:37 +05:30
Kailash Nadh
5d635744c0 Skip non-existent dirs in --static-dir mode to use default stuffed dirs. Closes #1599. 2023-12-23 10:55:46 +05:30
Kailash Nadh
8f2a08b8db Fix invalid suffix 'd' in timestring string in s3 expiry config. 2023-09-19 14:45:51 +05:30
Kailash Nadh
717a6362d2 Add Sprig and other tpl functions to static templates as well. Closes #1527. 2023-09-19 11:19:34 +05:30
Kailash Nadh
2b95c88188
Add Postmark bounce webhook support (refactor #1385) (#1485)
Co-authored-by: Thomas Siebers <tom@tsiebers.de>
2023-08-31 21:27:34 +05:30
Kailash Nadh
104c4fc993 Remove non-crossplatform syscalls from /api/about.
The only way to get precise OS information cross platform is to have
a separate file for each platform with a build tag that returns the
info, which seems excessive for this usecase.
2023-08-06 10:49:20 +05:30
Kailash Nadh
ad80c716f9 Add new privacy option 'Record opt-in IP' to record IP address of optin confirmation.
- Add new 'Subscriptions' table on the subscriber list form that shows subs,
  IP, and other data.
- Add new `meta` JSONB field to `subscriber_lsts` table.

Closes #1329.
2023-07-26 23:00:32 +05:30
Kailash Nadh
c581fe2f3a Add GET /api/about that returns useful system info. Closes #1354. 2023-06-24 13:07:13 +05:30
Kailash Nadh
3b9a0f782e
Add support for file attachments on campaigns (#1341)
- Adds support for arbitrary file uploads with an admin setting to select allowed file extensions.
- Adds support for attaching media (files) to campaigns.
2023-05-18 16:55:59 +05:30
Kailash Nadh
917696a543 Refactor Messenger interface.
Remove `messenger.go` and move the interface definition to `manager`
and the `Message` struct to the `models` package, removing superflous
and redundant message structs used in multiple places.
2023-05-08 22:43:25 +05:30
Kailash Nadh
13ad9adb8b Upgrade koanf to v2. 2023-04-10 12:45:25 +05:30
Kailash Nadh
98729f63df Refactor email domain blocklist config field in importer package. 2023-04-09 14:04:02 +05:30
Justin Beaty
476d5bebf2
Add support for publishing full content in public archive RSS feed body (#1262)
- Introduces a new option on the settings UI to optionally publish the full campaign body in
  public archive RSS feeds.

Closes #1033 

Co-authored-by: Kailash Nadh <kailash@nadh.in>
2023-04-08 09:39:10 +05:30