4e7236a366
feat(notifications): register queueForNotifications resource in worker and request containers
...
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-05-06 14:00:45 +12:00
a02eb3f41c
merge: ST1 NOTIFICATION_TYPE_* rename
2026-05-06 13:48:16 +12:00
b9a928d3f8
merge: ST5 alert response model
2026-05-06 13:46:53 +12:00
d79be3a6e3
feat(notifications): add alert and alertList response models
...
Adds Alert response model and MODEL_ALERT/MODEL_ALERT_LIST constants
so future GET /v1/account/alerts endpoint can return MODEL_ALERT_LIST.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-05-06 13:44:27 +12:00
a5587ff096
feat(notifications): track read state and enable per-recipient alert idempotency
...
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-05-06 13:42:10 +12:00
3df219df66
refactor(notifications): consolidate channel constants under NOTIFICATION_TYPE_* prefix
...
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-05-06 13:41:59 +12:00
7839b3bb3f
refactor(notifications): align webhook signing with per-recipient signatureKey
...
Drop the global _APP_NOTIFICATIONS_WEBHOOK_SECRET env var. There's no
analogous global webhook secret in Appwrite; the existing Webhooks
worker carries a per-webhook signatureKey on the webhook document.
Move the same pattern into the Notification event: each webhook
recipient may carry an optional signatureKey, which the worker
forwards to the Webhook adapter for HMAC-SHA256 signing. Recipients
without a key are delivered unsigned and a tag is logged for audit.
2026-05-01 15:51:25 +12:00
5ee92e1844
fix(notifications): move alerts collection to platform DB
...
Alerts is a platform-DB-only concern. Move from common.php to
platform.php where it belongs alongside other platform collections.
2026-05-01 15:51:25 +12:00
a546c41662
docs(notifications): document _APP_NOTIFICATIONS_WEBHOOK_SECRET
...
Registers the webhook signing secret in app/config/variables.php under a
new Notifications category, threads it through the worker container in
docker-compose.yml and tests/resources/docker/docker-compose.yml, and
adds an empty default to .env so operators see the knob alongside the
existing SMTP block.
When set, outbound webhook deliveries from the notifications worker
include an X-Appwrite-Webhook-Signature header carrying
sha256=<hex(hmac_sha256(timestamp.body, secret))>. When unset, the
worker delivers payloads unsigned — receivers must decide whether to
accept them.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-05-01 15:51:25 +12:00
725ba86239
feat(notifications): add notifications schema and channel constants
...
Adds the alerts collection used by the console channel, plus channel and
provider type constants shared by the worker and adapters.
2026-05-01 12:07:40 +12:00
fbbab0f7e1
Merge pull request #12181 from appwrite/set-global-collection
...
Set global collection
2026-04-30 12:49:00 +03:00
d98bd8c972
Remove line
2026-04-30 10:44:21 +03:00
c0bba74eee
set setGlobalCollections logs
2026-04-30 10:36:12 +03:00
337d47b1d9
fix(locale): add Spanish session alert translations
2026-04-30 09:33:08 +02:00
f03cc847f8
Merge branch '1.9.x' of https://github.com/appwrite/appwrite into set-global-collection
...
# Conflicts:
# composer.lock
2026-04-29 17:07:32 +03:00
6088fd55c8
Merge pull request #12138 from appwrite/feat-out-of-order-chunk-uploads
2026-04-29 18:04:57 +04:00
8eed06678b
formatting
2026-04-29 15:54:05 +03:00
7a9a2899ff
setGlobalCollections
2026-04-29 15:41:56 +03:00
32ebfc6cb8
Fix backwards compatibility
2026-04-29 14:14:49 +02:00
e1b8f5bf98
review improvements
2026-04-29 14:04:54 +02:00
4d86e67006
Fix missing scopes for tables
2026-04-29 14:03:44 +02:00
e010bf25d5
Fix formatting
2026-04-29 13:57:16 +02:00
aaf91f3816
Improve scopes quality
2026-04-29 13:52:13 +02:00
dfbf45f4cc
Merge branch '1.9.x' into feat-out-of-order-chunk-uploads
2026-04-29 15:03:33 +04:00
8ab26aab44
Merge pull request #12171 from appwrite/migration-refractor
...
Refactor migrations API to module style
2026-04-29 21:44:19 +12:00
fd42b8fa64
Merge pull request #12175 from appwrite/feat-console-key-scopes-endpoint
...
Feat: Console key scopes endpoint
2026-04-29 11:17:49 +02:00
e75fc5b859
Add list scopes endpoint for Console
2026-04-29 10:08:31 +02:00
57b8305144
Merge pull request #12134 from appwrite/fix-realtime-span-exporter
...
added a guard to skip double import
2026-04-29 20:02:04 +12:00
aca11ed073
Merge pull request #12170 from appwrite/feat-create-dynamic-keys
...
Feat: create dynamic keys
2026-04-29 09:58:22 +02:00
dae9cbcf45
Merge pull request #12070 from appwrite/realtime-action-channels
...
Realtime action channels
2026-04-29 10:49:13 +05:30
c1f61b22aa
Merge branch '1.9.x' into feat-create-dynamic-keys
2026-04-28 17:18:36 +02:00
980762fc3e
Rename from dynamic key to ephemeral key (api keys)
2026-04-28 17:18:06 +02:00
cd851bff24
Merge branch '1.9.x' into migration-refractor
2026-04-28 20:32:54 +05:30
3f5dcc81fd
Refactor migrations API to module style
2026-04-28 15:57:41 +01:00
b2ce95a0cd
Dynamic key backwards compatibility
2026-04-28 16:14:10 +02:00
ed9b47f6ce
Migrate project jwt to dynamic api key
2026-04-28 15:57:37 +02:00
67d24d3ef1
Merge branch '1.9.x' into feat/impersonation-query-params
2026-04-28 19:11:14 +05:30
87ed7c3817
feat: add query param fallback for all impersonation params and simplify tests
2026-04-28 19:10:55 +05:30
8f176166c9
Re-introduce project JWT endpoint
2026-04-28 15:31:10 +02:00
a0ef145b92
Merge branch '1.9.x' of https://github.com/appwrite/appwrite into feat-out-of-order-chunk-uploads
2026-04-28 17:10:56 +04:00
cb4cff120b
Add Keycloak oauth support
2026-04-28 10:54:13 +02:00
49e6a38e7f
Add fusionauth oauth
2026-04-28 10:43:16 +02:00
bda823ac0e
chore: format
2026-04-28 13:38:00 +05:30
5afc8f462d
fix: allow same-site in CSRF guard to support Console on subdomains
2026-04-28 13:26:13 +05:30
d25707346f
Add console oauth endpoint
2026-04-28 09:47:27 +02:00
a3f6cf4645
fix: restrict CSRF guard to same-origin only, drop same-site
2026-04-28 13:00:18 +05:30
5465be6301
fix: make CSRF guard fail-closed by requiring explicit same-origin Sec-Fetch-Site
2026-04-28 12:27:57 +05:30
46a457bfa3
fix: block impersonateUserId query param on cross-site requests to prevent CSRF
2026-04-28 12:10:51 +05:30
4c989f99c3
fix: cast impersonateUserId query param to string to prevent array injection
2026-04-28 12:05:02 +05:30
8f1d73a6cb
chore: clarify intentional header-only restriction for email/phone impersonation
2026-04-28 12:02:00 +05:30
Jake Barnby
Shmuel Fogel
frubio
Torsten Dittmann
Matej Bačo
Matej Bačo
ArnabChatterjee20k
premtsd-code
Harsh Mahajan
harsh mahajan