Phase 9.5: project workspace UI, sender secrets, opt-in fix #51

Merged

vmanne-poc merged 6 commits from phase-9.5 into main

2026-10-15 07:52:12 -04:00

vmanne-poc commented

2026-10-15 07:48:49 -04:00

Owner

Summary

Phase 9.5 (v0.10.0).

#25 Project sidebar. Inside a project, the sidebar lists Overview, Contacts, Segments, Campaigns, Templates, Forms, Senders, Members and Settings, with "← All projects" and the current section marked (aria-current). Account, Users and System info stay at the bottom. The link rows at the top of pages are removed.
#26 Project overview. /projects/:id shows a card per section with a live figure, plus a "Get ready to send" checklist (sender → contacts → first campaign) until the project is set up. New GET /projects/:id/summary. The contacts list moved to /projects/:id/contacts.
#27 Project settings. Rename (PATCH /projects/:id, owners only) and delete, which requires typing the project name. Members get a read-only view.
#28 System info. GET /system/info, administrator only: version, Node, database and migrations, registration, system mail, SES feedback, scheduler and URLs. It never returns secrets.
#30 (security) Sender responses no longer include SMTP passwords or SES secret keys (hasSecret flag instead).
#31 (security) Single opt-in forms can no longer re-subscribe unsubscribed, bounced or complained contacts.

No database migrations.

Testing

Backend: 53 unit and 39 e2e tests. New tests cover rename permissions and validation, the summary figures, system info access and the no-secrets check, sender secret masking, and opt-in statuses.
Frontend: 39 tests. New tests cover sidebar sections and the active state, overview checklist states and card figures, settings rename/delete/read-only, and the system info page.
Live stack through nginx: rename, summary, system info (no secrets), sender list without credentials, and every new route serving the app.

Not verified

No manual click-through in a browser; component tests and the production bundle check cover the UI.

Closes #25
Closes #26
Closes #27
Closes #28
Closes #30
Closes #31

## Summary Phase 9.5 (v0.10.0). - **#25 Project sidebar.** Inside a project, the sidebar lists Overview, Contacts, Segments, Campaigns, Templates, Forms, Senders, Members and Settings, with "← All projects" and the current section marked (`aria-current`). Account, Users and System info stay at the bottom. The link rows at the top of pages are removed. - **#26 Project overview.** `/projects/:id` shows a card per section with a live figure, plus a "Get ready to send" checklist (sender → contacts → first campaign) until the project is set up. New `GET /projects/:id/summary`. The contacts list moved to `/projects/:id/contacts`. - **#27 Project settings.** Rename (`PATCH /projects/:id`, owners only) and delete, which requires typing the project name. Members get a read-only view. - **#28 System info.** `GET /system/info`, administrator only: version, Node, database and migrations, registration, system mail, SES feedback, scheduler and URLs. It never returns secrets. - **#30 (security)** Sender responses no longer include SMTP passwords or SES secret keys (`hasSecret` flag instead). - **#31 (security)** Single opt-in forms can no longer re-subscribe unsubscribed, bounced or complained contacts. No database migrations. ## Testing - Backend: 53 unit and 39 e2e tests. New tests cover rename permissions and validation, the summary figures, system info access and the no-secrets check, sender secret masking, and opt-in statuses. - Frontend: 39 tests. New tests cover sidebar sections and the active state, overview checklist states and card figures, settings rename/delete/read-only, and the system info page. - Live stack through nginx: rename, summary, system info (no secrets), sender list without credentials, and every new route serving the app. ## Not verified - No manual click-through in a browser; component tests and the production bundle check cover the UI. Closes #25 Closes #26 Closes #27 Closes #28 Closes #30 Closes #31

vmanne-poc added this to the Phase 9.5: Project workspace UI milestone

2026-10-15 07:48:49 -04:00

vmanne-poc added the

security

bug

feature

labels

2026-10-15 07:48:49 -04:00

vmanne-poc added 5 commits

2026-10-15 07:48:49 -04:00

Never return sender passwords or secret keys 74d970b050

Sender responses drop pass/password/secretAccessKey/apiKey from config and add hasSecret. Credentials stay stored for sending.

Closes #30

Single opt-in forms no longer re-activate opted-out contacts 24398efcdf

Unsubscribed, bounced and complained contacts keep their status; the response is unchanged so the form reveals nothing. e2e tests for both fixes.

Closes #31

Project rename and summary endpoints; administrator system info 147186b615

PATCH /projects/:id (owners), GET /projects/:id/summary, GET /system/info (root, no secrets). e2e tests.

Refs #26, #27, #28

Project workspace UI: sidebar, overview, settings, system info 6e457a411b

Project sidebar with sections and active state; overview with section cards and setup checklist; contacts moved to /projects/:id/contacts; settings page (rename, delete with name confirmation); System info page. Breadcrumb rows removed. Component tests.

Closes #25

Closes #26

Closes #27

Closes #28