2682 Commits (2e18084a04edef0ce092b5da1c214a22695a090e)

 

All Branches   

Search

Author	SHA1	Message	Date
mohammed-guiga	2e18084a04	Fix Clerk SSO auto-admin: fail closed + explicit admin allowlist (BLO-287) ... clerk_email_allowed? failed OPEN on an empty CLERK_ALLOWED_EMAIL_DOMAINS (empty env = anyone could sign in), and both SSO entrypoints (from_clerk_oidc and the apex-cookie ClerkDeviseBridge) auto-provisioned every first-time user as ADMIN_ROLE. - Fail closed: an unset/empty allowlist now matches no one. - New CLERK_ADMIN_EMAIL_DOMAINS allowlist gates admin provisioning; SSO never silently mints an admin. - Single chokepoint User.provision_clerk_admin used by both SSO paths. - Add RSpec coverage (none existed).	2 weeks ago
Omar Shaarawi	2ba9dc2ec1	Guard Litestream to production so preview envs can't clobber prod R2 (#2) ... Mirrors frontdesk/norblom/bloomcrawl. start.sh ran 'litestream replicate' unconditionally; a Railway PR-preview env clones prod R2_* creds and would replicate its writes back over the prod backup. Gate on RAILWAY_ENVIRONMENT_NAME: only production runs Litestream; non-prod runs an ephemeral local DB. Prerequisite for project-wide prDeploys.	2 weeks ago
Omar	09647afe3d	Remove AWS Fargate deploy automation (rolled back to Railway)	3 weeks ago
Omar Shaarawi	14b9c94106	Add deploy workflow: ping bloombilt-infra on push to master	3 weeks ago
Omar Shaarawi	24816341db	Add Litestream->R2 replication + start.sh + Dockerfile for AWS Fargate (#1)	3 weeks ago
Omar Shaarawi	ca9e6cedbf	Add robots.txt (Disallow: /) and RFC 9116 security.txt	3 weeks ago
Omar	9e41d3a577	Bridge Clerk apex SSO into Devise via clerk-sdk-ruby ... Reads the __session cookie set by accounts.bloombilt.com on the .bloombilt.com apex, verifies it via the official Clerk Ruby SDK, then finds or auto-provisions the matching Devise User on Account.first so the rest of the app (CanCanCan + Devise) sees the request as authenticated. Sign-out and unauthed redirects both target accounts.bloombilt.com/sign-in so 1Password sees a single saved entry across all Bloombilt apps. This is independent of the dead Clerk OIDC code already on master — that path requires Clerk Pro to register an OAuth Application on the production instance and is left dormant (gated by Docuseal.clerk_oidc_enabled?) in case we upgrade later. The session-cookie bridge works on Clerk free. Devise password login at /users/sign_in stays reachable as emergency access but isn't linked from the UI. Files: - Gemfile: add clerk-sdk-ruby (requires bundle install) - config/initializers/clerk.rb: SDK config (uses ENV['CLERK_SECRET_KEY']) - app/controllers/concerns/clerk_devise_bridge.rb: the bridge itself - app/controllers/application_controller.rb: include the concern, override authenticate_user! to redirect to Account Portal - app/controllers/sessions_controller.rb: override respond_to_on_destroy to send sign-out to Account Portal Gemfile.lock NOT updated in this commit — needs `bundle install` on a host with Ruby 4.0.1 before deploy will succeed.	4 weeks ago
Omar	232380d378	Fix: require lib/docuseal in devise initializer (autoload not ready)	4 weeks ago
Omar	ed1fbc681a	Add optional Clerk OIDC login ... Adds omniauth_openid_connect with Clerk as the IdP, gated on CLERK_DISCOVERY_URL / CLERK_CLIENT_ID / CLERK_CLIENT_SECRET. When unset, behaves identically to upstream. Password login + 2FA preserved as fallback. Access gate (v1): email-domain allowlist via CLERK_ALLOWED_EMAIL_DOMAINS. First-time login auto-creates the User on the singleton Account with role=admin. Drops into the empty _omniauthable.html.erb partial DocuSeal already reserved in the login view.	4 weeks ago
Alex Turchyn	60082655d4	Merge from docusealco/wip	1 month ago
Pete Matsyburka	7fe56941fd	optimize pdf images	1 month ago
Pete Matsyburka	abd498dd33	adjust validation message	1 month ago
Pete Matsyburka	99ca0136ed	add percent format	1 month ago
Pete Matsyburka	e52830c9b4	add authorization checks	1 month ago
Pete Matsyburka	755decca27	adjust capture revision	1 month ago
Pete Matsyburka	41604008d1	clamp area box	1 month ago
Pete Matsyburka	5bddce8969	fix i18n	1 month ago
Pete Matsyburka	b25503f141	fix i18n	1 month ago
Pete Matsyburka	bdf1850448	resend emails	1 month ago
Pete Matsyburka	230d3ccf69	fix with download config	1 month ago
Pete Matsyburka	e378025a2d	fix refactor complete button	1 month ago
Alex Turchyn	04129ded90	add complete button to signing form header	1 month ago
Pete Matsyburka	a7891f89f8	do not override custom webhook header	1 month ago
Pete Matsyburka	37d4a8e834	update gem	1 month ago
Alex Turchyn	528a1216f8	Merge from docusealco/wip	1 month ago
Pete Matsyburka	f2479bd259	adjust open revisions	1 month ago
Pete Matsyburka	135f0826d2	fix style	1 month ago
Pete Matsyburka	5710f0177b	update gh stars	1 month ago
Pete Matsyburka	1a3a0528ba	fix i18n	1 month ago
Pete Matsyburka	59793ff374	adjust builder	1 month ago
Pete Matsyburka	3c4ed42419	fix i18n	1 month ago
Pete Matsyburka	6a17b61550	update gem	1 month ago
Pete Matsyburka	76659497b7	typos	1 month ago
Pete Matsyburka	ee50c957cb	update gem	1 month ago
Pete Matsyburka	a9dd200919	add pdfium rotate	1 month ago
Pete Matsyburka	1fa953104a	update gh stars	1 month ago
Pete Matsyburka	50eb5b070e	fix typo	1 month ago
Pete Matsyburka	10fd624bec	add revisions	1 month ago
Alex Turchyn	04ec2f8260	allow permanent delete submissions in archived templates	1 month ago
Pete Matsyburka	d828d79574	improve log	1 month ago
Pete Matsyburka	01dd3fefe5	retry webhooks in test mode	1 month ago
Pete Matsyburka	45ae954c0c	add hmac webhook secret	1 month ago
Pete Matsyburka	1304849b55	update gh stars	1 month ago
Pete Matsyburka	0875faa079	fix date preview	1 month ago
Pete Matsyburka	3aa15d6ea6	update gem	1 month ago
Pete Matsyburka	6557329e97	gh 13k	1 month ago
Pete Matsyburka	be27ce4161	Merge pull request #666 from aqilaziz/docs-fix-readme-typos ... docs: fix README typos	1 month ago
aqilaziz	a3391a970e	docs: fix README typos	1 month ago
Alex Turchyn	744d45d2c5	Merge from docusealco/wip	2 months ago
Pete Matsyburka	310b16f54a	use mcp source	2 months ago