vmanne-poc/Postak
1
0
Fork 0
Code Issues 13 Pull requests Projects Releases 15 Packages Wiki Activity Actions
15 releases 15 tags
  • v0.11.0 c0c123137d

    v0.11.0 — Phase 10: Contacts, Senders & Sending Stable

    vmanne-poc released this 2026-10-15 08:51:52 -04:00 | 32 commits to main since this release

    Merged in PR #52. Closes #32–#38.

    Upgrading: back up the database first. The two new migrations only add to the schema.

    • SMTP senders now verify TLS certificates. A server with a self-signed certificate needs "Allow a self-signed certificate" ticked on its sender.
    • The backend port is now bound to 127.0.0.1. Reach the API through nginx on port 3000.

    Added

    • Contact pages (#32): details, custom data, external ID, campaigns received and activity, plus new, edit and delete.
    • Search and paging (#33): search by email, name or external ID, filter by status, pages of 25.
    • CSV import and export (#34):
      • The file is read in the browser, and you see how each column will be used before importing.
      • Choose whether to update contacts that already exist (matched by external ID, then email).
      • Rejected rows are reported and can be downloaded.
      • A template and instructions for Excel, LibreOffice and Google Sheets are included.
      • Import never changes a contact's status. Exports defuse cells that look like formulas.
    • Sender setup (#35): edit pages, reply-to, SMTP security (SSL/TLS, STARTTLS, none), username and password, self-signed option, and a test send to yourself. Passwords stay write-only.
    • Background sending (#36):
      • Sending returns right away and a worker delivers in the background.
      • Per-sender limits (per second, minute and hour) are honoured.
      • Temporary failures are retried with back-off.
      • The campaign list shows progress, and the report shows failures with the server's reason.
    • Segment editor (#37): OR groups of AND conditions, a JSON query, a live list of matching contacts, and a CSV download.

    Security

    • Rate limiting (#38): 10 requests per minute per client on sign-in, password reset, registration, form submissions and test emails; 600 per minute elsewhere. nginx sets the client address, so clients can't fake it.
    • TLS certificates are verified by default. From and Reply-To headers can no longer be broken by unusual names.

    Verified

    • Tests: backend 62 unit and 46 end-to-end; frontend 63. npm audit: 0 for both.
    • Live stack through nginx and Mailpit:
      • background send (request returned in 26 ms; 4 emails delivered with correct headers)
      • import, search and CSV exports
      • test email
      • login rate limiting, including with a spoofed X-Forwarded-For
      • a sender saved before this release still works

    Full details are in CHANGELOG.md.

    Downloads