Promote dev to main (upstream v2.25.1 + code-scanning fixes)

CLAUDE.md

@@ -95,3 +95,4 @@ The backend app is mostly used to write controllers and import from the librarie
 - Exposing a stored field to a new external surface (public API, MCP, webhooks) is a data-exposure decision — ask first, and check what existing production rows hold for that column before shipping it.
 - Never silently change the meaning or format of a value persisted in an existing DB column; that affects every reader and all historical rows, so ask first. 
 - Never return a raw Prisma row from a model that holds credentials (`Integration`, `User` and similar) in a controller response. Repository writes on those models must use a `select` with only the fields the caller needs (like `setTimes` with `select: { id: true }`), or the controller returns nothing. This applies even where nearby code looks different.
+- Be extra careful with code invoked by webhooks of external systems (Stripe, RevenueCat and other payment providers), including everything they call down the stack (e.g. `SubscriptionService.createOrUpdateSubscription`, `modifySubscription`, `deleteSubscription`). That code must not throw exceptions: never add a `throw`, and wrap any call that can fail (DB, provider API) so a failure is caught and logged instead of propagating. A webhook that throws leaves billing state half-applied for a paying customer.

SECURITY.md

@@ -66,7 +66,7 @@ If you discover a security vulnerability in the Postiz app, report it through [G
 
 Email the maintainers only when the report requires immediate, time-critical attention. Email does not replace submitting the report through GAdvisory.
 
-- @egelhaus ([E-Mail](mailto:egelhaus@ennogelhaus.de))
+- Gelhaus Solutions (@egelhaus): [contact@gplatform.org](mailto:contact@gplatform.org)
 
 ### AI Reports
 

apps/backend/src/api/routes/billing.controller.ts

@@ -21,6 +21,11 @@ import { UsersService } from '@gitroom/nestjs-libraries/database/prisma/users/us
 import { DosSharedBillingService } from '@gitroom/nestjs-libraries/dos-billing/dos-shared-billing.service';
 import { PaymentService } from '@gitroom/nestjs-libraries/services/payment/payment.service';
 import { BillingSyncDto } from '@gitroom/nestjs-libraries/dtos/billing/billing.sync.dto';
+import { CheckPolicies } from '@gitroom/backend/services/auth/permissions/permissions.ability';
+import {
+  AuthorizationActions,
+  Sections,
+} from '@gitroom/backend/services/auth/permissions/permission.exception.class';
 
 @ApiTags('Billing')
 @Controller('/billing')
@@ -178,6 +183,12 @@ export class BillingController {
     };
   }
 
+  @Get('/invoices')
+  @CheckPolicies([AuthorizationActions.Create, Sections.ADMIN])
+  async getInvoices(@GetOrgFromRequest() org: Organization) {
+    return (await this.provider(org)).getInvoices(org.id);
+  }
+
   @Get('/')
   async getCurrentBilling(
     @GetOrgFromRequest() org: Organization,
@@ -198,15 +209,14 @@ export class BillingController {
     @GetUserFromRequest() user: User,
     @Body() body: { feedback: string }
   ) {
-    await this._notificationService.sendEmail(
-      process.env.EMAIL_FROM_ADDRESS,
-      'Subscription Cancelled',
-      `Organization ${org.name} has cancelled their subscription because: ${body.feedback}`,
-      user.email
-    );
-
     if (this._dosBilling.enabled()) {
       await this._dosBilling.cancel(user);
+      await this._notificationService.sendEmail(
+        process.env.EMAIL_FROM_ADDRESS,
+        'Subscription Cancelled',
+        `Organization ${org.name} has cancelled their subscription because: ${body.feedback}`,
+        user.email
+      );
       try {
         await this._dosBilling.syncOrg(user, org.id);
       } catch {}
@@ -215,7 +225,18 @@ export class BillingController {
       return { cancel_at: sub?.cancelAt || null };
     }
 
-    return (await this.provider(org)).setToCancel(org.id);
+    const result = await (await this.provider(org)).setToCancel(org.id);
+
+    if (result.cancel_at) {
+      await this._notificationService.sendEmail(
+        process.env.EMAIL_FROM_ADDRESS,
+        'Subscription Cancelled',
+        `Organization ${org.name} has cancelled their subscription because: ${body.feedback}`,
+        user.email
+      );
+    }
+
+    return result;
   }
 
   @Post('/prorate')

apps/backend/src/api/routes/integrations.controller.ts

@@ -20,6 +20,7 @@ import { ApiTags } from '@nestjs/swagger';
 import { GetUserFromRequest } from '@gitroom/nestjs-libraries/user/user.from.request';
 import { PostsService } from '@gitroom/nestjs-libraries/database/prisma/posts/posts.service';
 import { IntegrationTimeDto } from '@gitroom/nestjs-libraries/dtos/integrations/integration.time.dto';
+import { IntegrationNameDto } from '@gitroom/nestjs-libraries/dtos/integrations/integration.name.dto';
 import { CustomerNameDto } from '@gitroom/nestjs-libraries/dtos/integrations/customer.name.dto';
 import { PlugDto } from '@gitroom/nestjs-libraries/dtos/plugs/plug.dto';
 import {
@@ -98,6 +99,15 @@ export class IntegrationsController {
     return this._integrationService.updateOnCustomerName(org.id, id, body.name);
   }
 
+  @Put('/:id/custom-name')
+  async updateCustomName(
+    @GetOrgFromRequest() org: Organization,
+    @Param('id') id: string,
+    @Body() body: IntegrationNameDto
+  ) {
+    return this._integrationService.updateCustomName(org.id, id, body.name);
+  }
+
   @Get('/list')
   async getIntegrationList(@GetOrgFromRequest() org: Organization) {
     return {
@@ -109,7 +119,8 @@ export class IntegrationsController {
             p.providerIdentifier
           );
           return {
-            name: p.name,
+            name: p.customName || p.name,
+            originalName: p.name,
             id: p.id,
             internalId: p.internalId,
             disabled: p.disabled,

apps/backend/src/api/routes/no.auth.integrations.controller.ts

@@ -63,7 +63,11 @@ export class NoAuthIntegrationsController {
       ? 'none'
       : await ioRedis.get(`login:${body.state}`);
     if (!getCodeVerifier) {
-      throw new Error('Invalid state');
+      // The state expires after an hour and is deleted once used (page reload)
+      throw new HttpException(
+        'This connection link expired or was already used, please connect the channel again',
+        400
+      );
     }
 
     const organization = await ioRedis.get(`organization:${body.state}`);
@@ -137,7 +141,14 @@ export class NoAuthIntegrationsController {
               refresh,
               auth.accessToken
             );
-            return res({ ...newAuth, refreshToken: body.refresh });
+            // keep the fresh refresh token and expiration from the new
+            // authentication, otherwise the stored refresh token is wiped and
+            // the channel breaks again as soon as the access token expires
+            return res({
+              ...newAuth,
+              refreshToken: auth.refreshToken,
+              expiresIn: auth.expiresIn,
+            });
           } catch (err: any) {
             return res({
               error: err.message,
@@ -165,6 +176,7 @@ export class NoAuthIntegrationsController {
           });
         }
 
+        console.log(`Authentication failed for ${integration}:`, err);
         return res({
           error: 'Authentication failed',
           accessToken: '',

apps/backend/src/api/routes/posts.controller.ts

@@ -60,6 +60,14 @@ export class PostsController {
     return this._postsService.getMissingContent(org.id, id);
   }
 
+  @Get('/:id/release-url')
+  async getReleaseURL(
+    @GetOrgFromRequest() org: Organization,
+    @Param('id') id: string
+  ) {
+    return this._postsService.getReleaseURL(org.id, id);
+  }
+
   @Put('/:id/release-id')
   async updateReleaseId(
     @GetOrgFromRequest() org: Organization,

apps/backend/src/api/routes/public.controller.ts

@@ -54,8 +54,10 @@ export class PublicController {
 
   @Get(`/posts/:id`)
   async getPreview(@Param('id') id: string) {
+    // the batch only links the posts in the dashboard, it stays out of the
+    // public preview
     return (await this._postsService.getPostsRecursively(id, true)).map(
-      ({ childrenPost, ...p }) => ({
+      ({ childrenPost, batchId, ...p }) => ({
         ...p,
         ...(p.integration
           ? {

apps/backend/src/api/routes/users.controller.ts

@@ -97,7 +97,7 @@ export class UsersController {
       process.env.AGENT_MEDIA_SSO_KEY
     );
 
-    return { url: `https://agent-media.ai/sso/${token}` };
+    return { url: `https://app.agent-media.ai/sso/${token}` };
   }
 
   @Get('/self')
@@ -319,9 +319,14 @@ export class UsersController {
 
   @Get('/organizations')
   async getOrgs(@GetUserFromRequest() user: User) {
-    return (await this._orgService.getOrgsByUserId(user.id)).filter(
-      (f) => !f.users[0].disabled
-    );
+    return (await this._orgService.getOrgsByUserId(user.id))
+      .filter((f) => !f.users[0].disabled)
+      .map((p) => ({
+        id: p.id,
+        name: p.name,
+        users: p.users,
+        subscription: p.subscription,
+      }));
   }
 
   @Post('/organizations')

apps/backend/src/public-api/routes/v1/public.integrations.controller.ts

@@ -14,6 +14,7 @@ import {
   UseInterceptors,
 } from '@nestjs/common';
 import { streamUploadOptions } from '@gitroom/nestjs-libraries/upload/multer.stream.engine';
+import { omit } from 'lodash';
 import { ApiTags } from '@nestjs/swagger';
 import { GetOrgFromRequest } from '@gitroom/nestjs-libraries/user/org.from.request';
 import { GetIncludeDeletedFromRequest } from '@gitroom/nestjs-libraries/user/include.deleted.from.request';
@@ -34,6 +35,7 @@ import {
 import { VideoDto } from '@gitroom/nestjs-libraries/dtos/videos/video.dto';
 import { VideoFunctionDto } from '@gitroom/nestjs-libraries/dtos/videos/video.function.dto';
 import { UploadDto } from '@gitroom/nestjs-libraries/dtos/media/upload.dto';
+import { GetMediaDto } from '@gitroom/nestjs-libraries/dtos/media/get.media.dto';
 import { ClippingDto } from '@gitroom/nestjs-libraries/dtos/clipping/clipping.dto';
 import { ClippingService } from '@gitroom/nestjs-libraries/database/prisma/clipping/clipping.service';
 import { NotificationService } from '@gitroom/nestjs-libraries/database/prisma/notifications/notification.service';
@@ -54,6 +56,8 @@ import { ioRedis } from '@gitroom/nestjs-libraries/redis/redis.service';
 import { AdminStatsService } from '@gitroom/nestjs-libraries/database/prisma/admin-stats/admin-stats.service';
 import { OrganizationService } from '@gitroom/nestjs-libraries/database/prisma/organizations/organization.service';
 import { GetOrgActivityDto } from '@gitroom/nestjs-libraries/dtos/analytics/get.org.activity.dto';
+import { ResetCreditsDto } from '@gitroom/nestjs-libraries/dtos/billing/reset.credits.dto';
+import { SubscriptionService } from '@gitroom/nestjs-libraries/database/prisma/subscriptions/subscription.service';
 import dayjs from 'dayjs';
 
 @ApiTags('Public API')
@@ -69,7 +73,8 @@ export class PublicIntegrationsController {
     private _usersService: UsersService,
     private _adminStatsService: AdminStatsService,
     private _organizationService: OrganizationService,
-    private _clippingService: ClippingService
+    private _clippingService: ClippingService,
+    private _subscriptionService: SubscriptionService
   ) {}
 
   @Post('/upload')
@@ -133,7 +138,14 @@ export class PublicIntegrationsController {
   ) {
     Sentry.metrics.count('public_api-request', 1);
     const body = await this._postsService.mapTypeToPost(
-      rawBody,
+      {
+        ...rawBody,
+        // a date per channel is a dashboard feature, the public API keeps one
+        // date for the whole request
+        posts: Array.isArray(rawBody?.posts)
+          ? rawBody.posts.map((post: any) => omit(post, 'date'))
+          : rawBody?.posts,
+      },
       org.id,
       rawBody?.type === 'draft' || true
     );
@@ -230,6 +242,30 @@ export class PublicIntegrationsController {
     return { connected: true };
   }
 
+  @Get('/media')
+  async getMedia(
+    @GetOrgFromRequest() org: Organization,
+    @Query() query: GetMediaDto
+  ) {
+    Sentry.metrics.count('public_api-request', 1);
+    const { pages, results } = await this._mediaService.getMedia(
+      org.id,
+      query.page,
+      query.search
+    );
+
+    return {
+      pages,
+      results: results.map((p) => ({
+        id: p.id,
+        name: p.name,
+        originalName: p.originalName,
+        path: p.path,
+        createdAt: p.createdAt,
+      })),
+    };
+  }
+
   // `user` is only known for OAuth app tokens; an API key belongs to the
   // whole organization
   @Get('/me')
@@ -269,7 +305,7 @@ export class PublicIntegrationsController {
       .filter((integration) => !group || integration.customer?.id === group)
       .map((integration) => ({
         id: integration.id,
-        name: integration.name,
+        name: integration.customName || integration.name,
         identifier: integration.providerIdentifier,
         picture: integration.picture,
         disabled: integration.disabled,
@@ -411,6 +447,25 @@ export class PublicIntegrationsController {
     });
   }
 
+  @Post('/credits/reset')
+  @UseGuards(SuperAdminGuard)
+  async resetCredits(
+    @GetOrgFromRequest() org: Organization,
+    @Body() body: ResetCreditsDto
+  ) {
+    Sentry.metrics.count('public_api-request', 1);
+    const reset = await this._subscriptionService.resetCredits(
+      org.id,
+      body.type
+    );
+
+    if (!reset) {
+      throw new HttpException({ msg: 'No subscription found' }, 404);
+    }
+
+    return reset;
+  }
+
   @Get('/notifications')
   async getNotifications(
     @GetOrgFromRequest() org: Organization,
@@ -573,7 +628,13 @@ export class PublicIntegrationsController {
     @Body('releaseId') releaseId: string
   ) {
     Sentry.metrics.count('public_api-request', 1);
-    return this._postsService.updateReleaseId(org.id, id, releaseId);
+    // the batch only links the posts in the dashboard
+    const { batchId, ...post } = await this._postsService.updateReleaseId(
+      org.id,
+      id,
+      releaseId
+    );
+    return post;
   }
 
   @Get('/analytics/:integration')

apps/backend/src/services/auth/auth.service.ts

@@ -7,7 +7,6 @@ import { OrganizationService } from '@gitroom/nestjs-libraries/database/prisma/o
 import { AuthService as AuthChecker } from '@gitroom/helpers/auth/auth.service';
 import { AuthProviderManager } from '@gitroom/backend/services/auth/providers/providers.manager';
 import dayjs from 'dayjs';
-import { NotificationService } from '@gitroom/nestjs-libraries/database/prisma/notifications/notification.service';
 import { ForgotReturnPasswordDto } from '@gitroom/nestjs-libraries/dtos/auth/forgot-return.password.dto';
 import { EmailService } from '@gitroom/nestjs-libraries/services/email.service';
 import { NewsletterService } from '@gitroom/nestjs-libraries/newsletter/newsletter.service';
@@ -18,7 +17,6 @@ export class AuthService {
   constructor(
     private _userService: UsersService,
     private _organizationService: OrganizationService,
-    private _notificationService: NotificationService,
     private _emailService: EmailService,
     private _providerManager: AuthProviderManager
   ) {}
@@ -74,11 +72,10 @@ export class AuthService {
             : false;
 
         const obj = { addedOrg, jwt: await this.jwt(create.users[0].user) };
-        await this._emailService.sendEmail(
+        await this._emailService.sendEmailSync(
           body.email,
           'Activate your account',
-          `Click <a href="${process.env.FRONTEND_URL}/auth/activate/${obj.jwt}">here</a> to activate your account`,
-          'top'
+          `Click <a href="${process.env.FRONTEND_URL}/auth/activate/${obj.jwt}">here</a> to activate your account`
         );
         return obj;
       }
@@ -301,10 +298,10 @@ export class AuthService {
       expires: dayjs().add(20, 'minutes').format('YYYY-MM-DD HH:mm:ss'),
     });
 
-    await this._notificationService.sendEmail(
+    await this._emailService.sendEmailSync(
       user.email,
       'Reset your password',
-      `You have requested to reset your passsord. <br />Click <a href="${process.env.FRONTEND_URL}/auth/forgot/${resetValues}">here</a> to reset your password<br />The link will expire in 20 minutes`
+      `You have requested to reset your password. <br />Click <a href="${process.env.FRONTEND_URL}/auth/forgot/${resetValues}">here</a> to reset your password<br />The link will expire in 20 minutes`
     );
   }
 
@@ -354,11 +351,10 @@ export class AuthService {
 
     const jwt = await this.jwt(user);
 
-    await this._emailService.sendEmail(
+    await this._emailService.sendEmailSync(
       user.email,
       'Activate your account',
-      `Click <a href="${process.env.FRONTEND_URL}/auth/activate/${jwt}">here</a> to activate your account`,
-      'top'
+      `Click <a href="${process.env.FRONTEND_URL}/auth/activate/${jwt}">here</a> to activate your account`
     );
 
     return true;