3252a8
0032c1804b
fix: drop clear-text values and ids from panel dry-run logs
...
Rebuild logged endpoints from constant path templates and reduce every
payload leaf to a JSON type token, so user/squad UUIDs and PII (email,
telegramId) can never reach the dry-run log as clear text. Resolves
CodeQL py/clear-text-logging-sensitive-data findings.
2026-06-01 22:48:21 +03:00
3252a8
5218ede0f1
fix: normalize required channel checks
2026-06-01 22:13:35 +03:00
3252a8
5b19ba2c2f
fix: keep deeplink gateway open during app prompt
2026-06-01 20:34:49 +03:00
3252a8
687fc03e8c
fix: reset trial eligibility from web admin
2026-06-01 19:30:16 +03:00
3252a8
8366a73575
style: format admin users api
2026-06-01 15:58:28 +03:00
3252a8
d7840d3a86
feat: expose admin user list metrics
2026-06-01 15:52:54 +03:00
3252a8
6a40d0c9ce
feat: add expired subscription broadcast target
2026-06-01 15:05:10 +03:00
3252a8
0d932b0915
style: ruff format panel dry-run service
2026-06-01 14:22:33 +03:00
3252a8
2b763efef9
fix: redact secrets and ids from panel dry-run logs
...
CodeQL flagged clear-text logging of sensitive information in the panel
dry-run logger: it dumped the full request payload (which can include
proxy credentials like trojanPassword/ssPassword and PII such as email
and telegramId) and the raw endpoint (embedding user UUIDs).
Recursively redact values under sensitive keys before building the
payload preview, and mask opaque id-like segments in logged endpoints.
2026-06-01 14:20:38 +03:00
3252a8
a0ea2261f4
feat: anonymous opt-out install telemetry beacon
...
Add a once-a-day anonymous heartbeat (PostHog) so maintainers can see
active installs and version/OS breakdowns. Self-hosted friendly: opt out
via TELEMETRY_ENABLED in .env or the Admin -> System toggle (applied
without a restart), or by clearing the endpoint/key.
- Share version resolution in bot/utils/app_version.py so the admin
sidebar and the beacon report the same build version
- TelemetryWorker sends an opaque install id plus coarse facts only
(version, OS/arch, python, locale, enabled providers, user-count
range); never tokens, domains or user data
- Register the worker in main_worker.py behind a Redis single-flight lock
- Expose TELEMETRY_* settings and an Admin -> System manifest toggle
- Document the payload and opt-out in docs/configuration/telemetry.md
- Cover bucketing, payload shape and anonymity with tests
2026-06-01 14:14:02 +03:00
3252a8 and GitHub
63ec3a6152
Merge pull request #18 from 3252a8/feature/multicurrency
...
Add ability to use different currency than rub
2026-06-01 11:26:18 +03:00
3252a8
3896c455b8
fix: decouple docs email previews from bot deps
2026-06-01 11:23:45 +03:00
3252a8
d97afbec18
fix: apply ruff formatting
2026-06-01 11:16:28 +03:00
3252a8
21079f78dc
fix: satisfy ruff line length
2026-06-01 11:11:15 +03:00
3252a8
391487811b
feat: add remnawave panel dry-run mode
2026-06-01 10:32:38 +03:00
3252a8
939bc37995
Merge branch 'dev' into feature/multicurrency
2026-06-01 08:18:25 +03:00
3252a8
c2344824dc
feat: show referral relationships in admin user cards
2026-06-01 00:36:05 +03:00
3252a8
ecf779763c
feat: audit outbound user notifications
2026-05-31 23:05:40 +03:00
3252a8
1578a9da36
fix: align traffic top-up flows and unlimited overrides
2026-05-31 23:05:29 +03:00
3252a8
80e5f0c80d
feat: add multicurrency tariff payments
2026-05-31 22:17:28 +03:00
3252a8
45543983c2
fix: run migrations after database restore
2026-05-31 14:57:32 +03:00
3252a8
eda5d3e633
fix: localize support email templates
2026-05-31 14:41:26 +03:00
3252a8
cf3af17243
fix: avoid Telegram notification probe messages
2026-05-31 00:17:20 +03:00
3252a8
93353db511
feat: split subscription stats by access type
2026-05-31 00:08:31 +03:00
3252a8
c1e2fe2c95
chore: improve admin logs user cards
2026-05-30 22:15:33 +03:00
3252a8
3541f2f78b
feat: block crawlers from production webapp
2026-05-30 21:25:03 +03:00
3252a8
acc222da41
feat: prompt users to start Telegram bot for notifications
2026-05-30 21:15:17 +03:00
3252a8
c6c5352813
fix: format premium traffic limits from bytes
2026-05-30 12:00:01 +03:00
3252a8
067d6fb59f
chore: clarify panel webhook subscription logs
2026-05-30 11:52:07 +03:00
3252a8
c3e55bc853
feature: sync user email notifications
2026-05-30 11:46:07 +03:00
3252a8
09be82aad5
fix: improve subscription email renewal flow
2026-05-30 00:23:53 +03:00
3252a8
49781af921
feat: surface remnawave panel webhook settings
2026-05-29 23:55:12 +03:00
3252a8
923ff9b208
fix: hide inactive devices usage summary
2026-05-29 23:23:55 +03:00
3252a8
7fe8e676cd
feat: group referral bonus display by tariff
2026-05-29 22:55:01 +03:00
3252a8
6803c7801f
fix: configure referral bonuses per tariff period
2026-05-29 22:30:31 +03:00
3252a8
cab963dcdc
fix: prevent subscription worker deadlocks
2026-05-29 22:07:16 +03:00
3252a8
001e54cfe2
fix: preserve subscriptions on panel lookup failures
2026-05-29 21:46:42 +03:00
3252a8
19f0f27a3b
feat: mirror subscription lifecycle notifications
2026-05-29 18:08:28 +03:00
3252a8
d299a3c524
feature: Add local subscription notification worker
2026-05-28 22:48:48 +03:00
3252a8
1c1ef06e29
fix: Fix trial settings persistence
2026-05-28 22:48:48 +03:00
3252a8
bea62d75a9
fix: persist account language changes
2026-05-28 22:07:43 +03:00
3252a8
3ab6c18a76
fix: preserve account language on telegram auth
2026-05-28 11:31:45 +03:00
3252a8
ef4b493e65
chore: change backup archive name style
2026-05-27 23:01:42 +03:00
3252a8
ded044b4c0
fix: make support replies finish promptly
2026-05-27 22:21:24 +03:00
3252a8
bce78c4f28
chore: backup warning details
2026-05-27 19:08:49 +03:00
3252a8
75586d8883
fix: harden hwid provider payment edge cases
2026-05-27 18:31:14 +03:00
3252a8
f2fc335221
fix: anchor hwid pricing to paid period
2026-05-27 18:13:27 +03:00
3252a8
1c9e55d797
fix: wire subscription service for yookassa hwid payments
2026-05-27 18:13:22 +03:00
3252a8
25056602d8
fix: serialize webapp datetime payloads
2026-05-27 14:55:05 +03:00
3252a8
fe34edfe73
chore: verify formatting checks
2026-05-27 14:29:45 +03:00
3252a8
