Move outbound email off Django's deprecated EMAIL_* settings onto Django
6.1's MAILERS setting, and make the SMTP backend configurable from env
vars (EMAIL_HOST/PORT/HOST_USER/HOST_PASSWORD/USE_TLS/USE_SSL/TIMEOUT).
Auth-email Celery tasks now catch OSError alongside ClientError so an
SMTP failure is logged instead of raising. Documents Mailtrap as the
example SMTP provider.
- Added `FirstRefusalThrottleMixin` to various views to prevent a single client from consuming shared throttle limits.
- Introduced new throttles: `MagicLinkIPThrottle`, `MagicLinkGlobalThrottle`, `PortalLoginIPThrottle`, and `PortalLoginOrgThrottle`.
- Updated environment variables in `.env.example` to include new throttle settings.
- Enhanced tests to verify that refused clients do not affect global limits.
- Updated documentation to reflect changes in authentication and throttling behavior.
- Updated phone viewport test to check for new text related to SNS topics.
- Enhanced audit log screen tests with new credential events and filters.
- Modified mailbox form sheet tests to handle SNS Topic ARN correctly.
- Introduced new tests for ticket form close date functionality, ensuring correct behavior for optional close dates.
- Added support for organization timezone handling in tests, ensuring accurate date calculations based on user organization.
- Improved unit tests for mailbox and organization date handling, ensuring proper behavior for various scenarios.
- Implemented bulk close date functionality in ticket selection tests, verifying correct behavior for date selection and submission.
- Implement tests for closing tickets via menu and status picker, ensuring correct API interactions and error handling.
- Create tests for calendar feed provider, verifying throttling behavior and success responses.
- Add tests for deal board provider, covering reading and moving deals, including edge cases for card movement and filters.
- Enhance macro tests to validate action parsing and application to tickets, including error handling.
- Introduce session cache tests to ensure proper cleanup on sign-out and validate session-scoped providers.
- Extend web form model tests to cover lead rotation functionality, ensuring correct serialization and defaults.
- Implement tests for ticket approval panel to verify approval request logic and visibility based on user roles.
- Add functionality to handle ticket movement based on server response for both tickets and leads.
- Introduce new tests for duplicate checking API to ensure correct handling of duplicates and merging logic.
- Remove outdated permissions tests that are no longer relevant.
- Update ticket board and lead board providers to include 'can_move' field for better control over ticket actions.
- Refactor existing tests to improve coverage and ensure accurate representation of API responses.
- Implement tests for `isOrgAdminProvider` to validate admin roles based on organization membership and role.
- Create tests for `saved_views_provider` to ensure correct API interactions for saving, renaming, and deleting saved views.
- Enhance ticket tree tests to accurately reflect inactive and merged ticket handling.
- Update CSV import tests to verify error handling and file saving functionality.
- Introduce tests for deal cards to ensure correct display of next steps and task statuses.
- Implement comprehensive tests for the ticket board provider to validate kanban and pipeline modes, including ticket movement and error handling.
- Create tests for ticket status settable to ensure proper status selection logic.
- Enhance web form model tests to cover ticket-specific fields and submission behavior.
- Introduce CSV import sheet tests to verify file handling and error reporting.
- Add deal aging badge tests to confirm correct display of aging statuses.
- Implement tickets selection tests to ensure UI responsiveness and functionality at various screen sizes.
- Implement tests for web forms screen to ensure proper rendering and behavior on different devices.
- Create unit tests for web form model to validate JSON serialization and deserialization.
- Add tests for web forms provider to verify API interactions and state management.
- Ensure that publishing rules and field validations are correctly enforced in the tests.
- Implemented a new customer portal for users to manage their support requests.
- Added functionality for users to create and view their support cases.
- Updated article publishing logic to clarify the distinction between approval and visibility in the ticket reply panel.
- Enhanced the comment model to include the author's name when comments are made through the customer portal.
- Improved UI/UX for the solutions and cases pages, ensuring better clarity on article status and visibility.
- Updated documentation to reflect changes in the API and customer portal features.
- Removed unused imports and cleaned up test files for better readability.
- Updated `FRONTEND_URL` handling in `crm/settings.py` to enforce absolute URL requirements in production environments, preventing dead links in emails.
- Added comprehensive tests for `FRONTEND_URL` validation to ensure it does not accept loopback addresses or non-absolute URLs outside of development.
- Improved documentation to clarify the purpose and requirements of `FRONTEND_URL` in the context of email links and deployment.
- Updated dependencies in `pyproject.toml` and `uv.lock` to include `ruff` for enhanced linting capabilities.
- Removed serialization of full account, contact, lead, and opportunity objects from the dashboard API response.
- Added new fields for urgent counts, pipeline by stage, revenue metrics, hot leads, tasks, activities, and goal summary.
- Updated the context building logic to only include counts and essential data.
Enhance JWT signing key validation in settings
- Added a check to ensure the SECRET_KEY is at least 32 bytes for HS256 JWT signing.
- Introduced warnings for development environments when the key is shorter than required.
Update environment variable documentation
- Clarified the requirements for the SECRET_KEY in the environment variables documentation, emphasizing the minimum length for security.
Revise mobile app API configuration for self-hosting
- Updated the mobile app to allow self-hosting by using `--dart-define` for API_BASE_URL and GOOGLE_SERVER_CLIENT_ID.
- Ensured that the app enforces HTTPS in release builds to secure JWT transmission.
Implement entity lookup for task linking in mobile app
- Created a new EntityLookup model to handle task attachments to accounts, leads, opportunities, and tickets.
- Refactored task form screen to utilize the new lookup mechanism, improving the user experience by providing real-time loading states and error handling.
Add unit tests for new features and configurations
- Implemented unit tests for API configuration, entity lookup, and task link picker to ensure functionality and reliability.
- Updated the `ORG_SCOPED_TABLES` to clarify the exclusion of `security_audit_log` and its implications for RLS policies.
- Added tests to ensure `security_audit_log` remains unexposed and verify the absence of RLS policies.
- Implemented tests for HSTS settings behind a TLS-terminating proxy to ensure proper header emission.
- Enhanced notification API tests to enforce RLS context during notification creation and access.
- Adjusted notification model tests to ensure RLS context is correctly applied for cross-tenant scenarios.
- Refined RLS context management in `conftest.py` to ensure proper session handling across tests.
- Removed deprecated Salesforce settings from the frontend and updated documentation to reflect changes in API behavior.
- Cleaned up environment variable documentation to clarify the impact of `TRUST_PROXY_SSL_HEADER` and other settings.
- Replaced custom admin check with `is_org_admin` in `custom_field_views.py`, `organization_views.py`, `user_views.py`, and `macros/views.py` for consistency and clarity.
- Removed the unused `_is_admin` function from `custom_field_views.py` and `macros/views.py`.
- Updated organization-related views to streamline admin checks and improve error handling.
- Removed `SWAGGER_ROOT_URL` and `GOOGLE_REDIRECT_URI` settings from `settings.py` as they were not utilized.
- Cleaned up Swagger parameters across various modules to remove the now-irrelevant `org` header.
- Adjusted documentation to reflect the removal of `GOOGLE_REDIRECT_URI` and clarify Google OAuth configuration.
- Added database indexes for `Order` and `OrderLineItem` models to improve query performance.
- Introduced tests for frontend URL generation in `test_client_links.py` to ensure all links in emails are reachable and correctly formatted.
- Added authorization tests for deleting attachments in `test_attachment_delete_authz.py` for leads and opportunities, ensuring proper access control based on user roles and organization boundaries.
- Updated `LeadAttachmentView` and `OpportunityAttachmentView` to use `get_scoped_or_404` for safer object retrieval, preventing unauthorized access to attachments across organizations.
- Improved documentation regarding the organization API key and personal access tokens, clarifying their scopes and security implications.
- Enhanced frontend token management to support new scope enforcement, allowing users to specify access levels when creating tokens.
- Removed the `/api/notifications/stream/` endpoint and associated SSE logic.
- Updated `Bell.svelte` and `notifications.svelte.js` to implement polling for notifications every 45 seconds.
- Introduced connection pooling configuration in environment variables documentation.
- Updated production deployment documentation to recommend WSGI over ASGI for improved database connection management.
- Created production-deploy.md to outline production deployment steps and configurations.
- Added requirements.md detailing environment prerequisites for self-hosting.
- Introduced security-hardening.md as a checklist for securing multi-tenant deployments.
- Developed troubleshooting.md to address common issues in RLS-backed deployments.
- Configured mkdocs.yml for documentation structure and navigation.
