Repository navigation
fix: batch 2026-07-10 — Slack destinations (form-encoding + dedup), OAuth returnTo, realtimews org check - #119
Merged
Merged
Conversation
…sers.list honor types/limit/cursor Slack's cursor-paginated read methods ignore JSON-body args and fall back to defaults (limit 100, first page only, public channels only). Sending params form-encoded is why the picker was missing private channels (e.g. solidping-dev) and never paginated past the first 100. The fake test servers now enforce form encoding so a regression back to a JSON body fails loudly.
…eny cross-org DB super-admin)
fclairamb
changed the title
fclairamb
enabled auto-merge (squash)
July 10, 2026 00:10
Merged
fclairamb
added a commit
that referenced
this pull request
Jul 10, 2026
🤖 Release **v0.2.3** — a bug-fix release focused on the Slack integration. ## [0.2.3](v0.2.2...v0.2.3) (2026-07-10) ### Bug Fixes - **slack:** send `conversations.list`/`users.list` parameters **form-encoded** so Slack honors `types`/`limit`/`cursor`. Sending them in a JSON body made Slack fall back to defaults (100 items, first page only, **public channels only**), so the destination picker silently dropped private channels (e.g. `#solidping-dev`) and every channel past the first 100. ([#119](#119)) - **slack:** de-duplicate destination channels and users by ID and stop pagination on a non-advancing/repeating cursor, fixing the picker listing each channel dozens of times. ([#119](#119)) - **dash0:** preserve the deep `returnTo` destination through third-party (OAuth/SSO) login instead of always landing on the organization root. ([#119](#119)) - **realtimews:** align the WebSocket handshake organization check with the REST middleware, denying cross-org database super-admin access. ([#119](#119)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please).
fclairamb
added a commit
that referenced
this pull request
Jul 12, 2026
…s, MCP endpoint & page, DNSBL fixes, realtime EventNotifier leak fix (+14 more) (#121) Batch integration of the `/implement-todos` run on `batch/2026-07-10`. PR #119 already squash-merged the early slice (Slack destinations, OAuth returnTo, realtimews org check); this PR is the remaining **21 specs** accumulated on the branch since. Each spec was implemented on the batch branch, gated by an independent completeness audit, and archived to `specs/done/2026/07/`. A curated `## Unreleased` section has been added to `CHANGELOG.md`. ## Features - **checks:** new **RDP** protocol check type — pre-auth X.224 negotiation with NLA and cert-expiry knobs - **checks:** optional **per-check timeout** (1–30s) in the shared check form; 30s server-side cap, context = timeout + 1s - **checks:** **configurable global check timeout** (default 15s), context = timeout + 1s - **checks:** **export format v2** — defaults block, human durations, deterministic ordering - **dash0:** badges check picker swapped the capped `Select` for a live-search `CheckPicker` - **dash0:** AI assistants (**MCP**) page moved under Account + command-palette entry (findable by "MCP"/"AI"); legacy paths redirect - **dash0:** empty-state onboarding hero offers the MCP / AI path for creating checks - **status:** rich link previews — per-page **Open Graph** metadata + branded 1200×630 default image - **admin:** region slugs resolve to friendly "{emoji} {name}" labels, seeded from `SP_REGIONS` - **integrations:** "Default for new checks" toggle starts **enabled** on integration create - **i18n:** idiomatic FR/ES/DE auth-page headline translations ## Bug Fixes - **realtime:** fix EventNotifier listener leak — `GetJobWait` leaked one channel per job and eventually silenced the realtime WS (zero logs); adds `Unlisten`, non-stacking pg keepalive ping, listener-growth warning - **dash0:** unify the `useCheck` query key so a live check update fetches the check **once, not twice** - **dash0:** incidents and checks list pages now subscribe to live updates (were update-on-reload only) - **mcp:** method-aware `/api/v1/mcp` (GET redirect/405, DELETE session termination) + JSON 404 for unmatched `/api/` paths - **rate-limiting:** bearer-token bucket keying with per-IP cap, XFF off-by-one fix, coalesced live-hint invalidations - **auth:** SSO callbacks set the `access_token` cookie so MCP OAuth consent skips the login bounce - **checks (DNS):** repair the DNS check form (Domain→host key, DNS-server + record-type fields, samples load) - **checks (DNSBL):** treat Spamhaus `127.255.255.x` replies as error codes, not listings (false-positive fix) - **dash0 (DNSBL):** DNSBL result card renders human-readable Spamhaus status-code labels - **status:** Atom feed no longer 500s on Postgres — bind `status_page_uid` through bun (`$1` → `?`) ## QA Per-spec QA (surface-appropriate `make build-backend lint-back test` / `make build-dash0` + `bun run lint` / docs builds) passed as each spec landed. E2E specs were authored for the frontend changes; some are authored-but-not-run locally (no `SP_RUNMODE=test` devloop). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This was referenced Sep 8, 2026
Closed
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Batch 2026-07-10 — Slack integration fixes + OAuth deep-link + realtime WS org check.
Bug Fixes
Slack channel picker — missing & duplicated destinations
Two spec'd fixes, then the real root cause found during live testing:
specs/done/2026/07/...-01-...):paginatenow stops on a non-advancing/repeating cursor andListChannels/ListUsersde-dup by Slack ID.conversations.list,users.list) silently ignore, falling back to defaults:limit100, first page only, and public channels only. That's why private channels (e.g.#solidping-dev) never appeared and only the first 100 channels came back. Now sent form-encoded viacallFormAPI; write methods keep JSON. The fake Slack test servers now reject a JSON body so this can't regress.OAuth/SSO login discarded
returnTo(
specs/done/2026/07/...-02-...) Third-party auth always landed on the org root, losing the deep page the user came from. The pre-React handoff inmain.tsxnow resolves the destination through the same safe-path/org-match guards as every other login path (resolveHandoffDestination), preserving the deepreturnTo.Realtime WS handshake org check
fix(realtimews): align the WebSocket handshake org check with the REST middleware so a cross-org DB super-admin is denied (silent-failure e2e coverage added).Verification
make build-backend lint-back testgreen; dash0 build + unit tests green.#solidping-devnow resolves in the picker, channels are distinct and complete.🤖 Generated with Claude Code