- Header: X-Gaiia-Webhook-Signature with t=timestamp,v1=signature format
- Signed payload: timestamp.body (not just body)
- 5-minute timestamp tolerance to prevent replay attacks
- Updated tests to match new 4-arity verify_signature/4
Added Permissions-Policy header with browsing-topics=() to suppress console
warnings about unrecognized Privacy Sandbox API features. Header is now applied
in all environments (dev and prod) while other security headers remain
production-only.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Escape HEEx template braces in GraphQL/API docs with raw(~S[...])
- Fix test assertions for updated marketing copy and UI text
- Extract helper functions in GraphQL resolvers to reduce nesting depth
- Create shared ErrorHelpers module for API controllers
- Fix ETS race condition in brute force whitelist cache for async tests
- Fix property test generators to use ASCII instead of printable unicode
- Add alert_severity helper to site_live/show
- Update accounts fixtures for explicit user confirmation
- Replace terse helper text with step-by-step setup guide in config form
- Add what-gets-synced breakdown when PagerDuty is enabled
- Clear visual hierarchy with numbered steps and inline callout
- Remove auto-confirmation on registration (register_user and register_user_with_organization)
- Add deliver_user_confirmation_instructions/2 and confirm_user/1 to Accounts context
- Add verify_email_token_query/2 and by_user_and_contexts_query/2 to UserToken
- Make deliver_confirmation_email public in UserNotifier
- Send confirmation email after registration in both flows
- Block unconfirmed users at password login with helpful message
- Add UserConfirmationController with confirm/resend routes
- Add resend confirmation link to login page
- Update test fixtures to confirm users after registration
- Activity feed: use schema modules instead of string table names in Ecto
queries to fix UUID encoding (Postgrex expected binary, got string)
- Changelog parser: remove plain hyphen from separator character class
to prevent splitting on date hyphens (2026-02-13)
- Fix broken route paths in dashboard (/discovery, /subscribers/trace, /config-changes)
- Fix insights empty state settings link (org-scoped route)
- Add underscores to all 86400 literals across 6 files
- Alphabetize aliases in search.ex and agent_channel.ex
- Extract changelog parser helper to reduce nesting
- Extract dashboard impact calculation to reduce nesting
- Refactor agent_channel config change detection (pattern match, extract function)
- Combine double Enum.reject into single call in trace.ex
- Fix line length in trace.ex search query
- Replace length/1 > 0 with != [] in trace_live
- Run mix format on all files
- ChangelogParser: parses priv/static/changelog.txt into structured entries
- ChangelogLive: timeline view with DaisyUI styling
- Route at /changelog in authenticated scope
- What's New link in org dropdown menu
- Group alerts by site (tower/location) with collapsible sections
- Show alert count badges per site, critical count highlighted
- Color-code alerts by severity and age (red >1h, orange >15m, yellow new)
- Add Resolve button with confirmation dialog
- Show subscriber impact from Gaiia inventory at site and alert level
- Filter tabs: Unresolved, Critical, All, Resolved with counts
- Sort options: Severity (default), Oldest First, Subscriber Impact
- Sites with most critical alerts and highest subscriber impact sort first
- Use DaisyUI collapse, badge, tab, and btn components
- Add summary stat cards (subscribers, MRR, device count, alerts)
- Add QoE summary with capacity bar (qoe_color, qoe_bg, capacity_bar_color)
- Device health grid with status dots and response times (status_dot_class, format_response_time)
- Active alerts panel with urgency icons (insight_urgency_class, insight_urgency_icon, time_ago)
- Config changes panel with size labels (change_size_label, change_size_color, time_ago)
- Preseem insights panel with urgency styling
- Keep existing latency chart
- Use DaisyUI card/badge components throughout
