vmanne-poc/Postak
1
0
Fork 0
Code Issues 13 Pull requests Projects Releases 15 Packages Wiki Activity Actions
15 releases 15 tags
  • v0.13.0 d483b5282b

    v0.13.0 — Phase 12: Templates & Campaign Editor Stable

    vmanne-poc released this 2026-10-15 12:39:27 -04:00 | 21 commits to main since this release

    Upgrading: back up the database first. One additive migration (templates_and_campaign_editor) adds style, footer, and default settings to templates, and tracking, public link, and campaign data to campaigns. Deleting a template now clears it from sent campaigns instead of failing. Existing campaigns keep tracking on and their public link off. nginx now forwards /c/ (the public web view) to the backend.

    Added

    • Styled templates with a live preview (#43): Styled (Postak's responsive layout, Markdown content), HTML, and Plain text types. Style options for the page, content, headings, links, buttons, quotes, and footer, stored as validated settings. A Markdown footer (Postak adds an unsubscribe link if it's missing). Clone a template and mark one as the project default. Preview runs in a sandboxed iframe with no scripts.
    • Campaign editor (#45): new and edit pages with sender, recipients (live count), subject, Plain text / Markdown / HTML editor, and template, plus a side-by-side preview for a chosen contact. Send a test email to up to 5 addresses (marked [Test], not tracked or counted). Duplicate any campaign, delete drafts, and confirm with the recipient count before sending or scheduling.
    • Preheader, personalisation, and campaign data (#46): the preview text becomes the hidden preheader (up to 150 characters). {{ contact.data.<key> }}, {{ campaign.data.<key> }}, and | default: "..." fallbacks. Unknown placeholders render as nothing and show a warning in the preview.
    • Tracking options and a public web view (#47): turn open/click tracking off per campaign (no pixel, no rewritten links). An optional public link serves a sent campaign at /c/<id> with neutral contact data and no tracking, and {{ web_view_url }} links to it.
    • Detailed campaign report (#48): clicks and unique clickers per link, a paged recipients table filterable by status with CSV export, opens and clicks over time (hourly for 48 hours, then daily) in an accessible chart with a table fallback, and a 14-day trend on the project overview.

    Fixed

    • Template type is respected (#44): Markdown bodies are converted first and then placed in the template layout, so HTML templates are no longer run through the Markdown parser.
    • Deleting a used template (#44) returns 409 when unsent campaigns use it, and clears it from sent campaigns, instead of a 500.

    Security

    • Contact and campaign data values are HTML-escaped in HTML bodies. The placeholder language is a small subset that can't run code.
    • The web view sends Content-Security-Policy: sandbox; default-src 'none' (images and inline styles only), nosniff, no-referrer, and no-store, and never shows recipient details.
    • Sent campaigns can't have their content edited.

    Verified

    • Backend: 101 unit and 55 end-to-end tests; migrations on an adopted legacy database and a fresh one. Frontend: 87 tests.
    • Live smoke through nginx and Mailpit: 51 of 51 checks passed (styled test send, personalised delivery, tracking, web view and its headers, report endpoints and CSV, and every new page rendered in headless Edge with no script errors).

    PR #54.

    Downloads