ScreenTinker c0b220836a fix(signup): make admin-notify recipient env-driven, not hardcoded ... The admin signup-notify recipient was hardcoded to support@screentinker.com and shipped in the open-source code. Combined with the opt-out SELF_HOSTED gate, any self-hoster who configured their own Graph credentials but forgot SELF_HOSTED=true would fire their users' signup PII (email, IP, country) into our support inbox. Source the recipient from ADMIN_NOTIFY_EMAIL instead, defaulting to null. When unset, the admin notification is skipped entirely and logged ("[SIGNUP-EMAIL] admin notify skipped (ADMIN_NOTIFY_EMAIL unset)"); the user's welcome email is unaffected. Hosted prod sets the env var so its notifications continue; self-hosters send nothing to us by default, and the .com address no longer ships in code. Document ADMIN_NOTIFY_EMAIL (and the related mail/self-host vars) in a new .env.example. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>		2026-05-30 16:16:33 -05:00
..
activity.js	feat(workspaces): rename via switcher dropdown - new PATCH /api/workspaces/:id route, per-row pencil affordance in switcher (visible only when caller can_admin), small rename modal with name + slug fields, validation (name <=80 chars, slug ^[a-z0-9]+(?:-[a-z0-9]+)*$ <=60 chars, blank slug -> NULL), 409 on per-org slug collision. Permission gating via new canAdminWorkspace(db, user, ws) helper in lib/permissions.js - reused-ready for future Phase 3 admin actions. /me query now joins organization_members to compute can_admin per accessible_workspaces entry. Drive-by fixes surfaced: (1) activityLogger method filter was missing PATCH, added; (2) routes that operate on a target workspace by URL param need to stamp req.workspaceId from the param so activityLogger captures the right tenant attribution - documented in the route. Smoke fixture: switcher-test@local.test is workspace_admin of Studio A and workspace_editor of Field Crew (no org_owner) so the can_admin true/false split is exercised in one login.	2026-05-12 11:06:55 -05:00
alerts.js	feat(email): Microsoft Graph send + alert spam protection + preferences UI	2026-05-12 18:16:40 -05:00
email.js	feat(signup): welcome email + admin signup notification (slice 1)	2026-05-30 14:50:27 -05:00
heartbeat.js	feat(workspaces): invite/accept-invite backend (slice 1+3)	2026-05-16 12:19:59 -05:00
scheduler.js	feat(socket): delivery queue for offline-device emits	2026-05-14 13:06:43 -05:00
signupEmails.js	fix(signup): make admin-notify recipient env-driven, not hardcoded	2026-05-30 16:16:33 -05:00