Skip to content

Helpdock 0.5.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Oct 11:48
· 12 commits to main since this release
v0.5.0
60cad34
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

M10 Meta channels, and the code half of M9 Hardening: the fixes from
the internal pre-pentest review, the gaps the ASVS L2 re-walk of Telegram, AI
and the API found, the automated accessibility audit, and four follow-ups M6
and M7 had left open. What still needs a person before 1.0 is listed under
known gaps.

M10 Meta channels

  • WhatsApp numbers, Facebook Pages and Instagram professional accounts are
    ticket channels.     A customer's message opens a ticket or continues the
    conversation's open one, and an agent's public reply, text and files, goes
    back on the same platform through the outbox. Images, video, documents,
    voice notes and stickers arrive on the ticket; locations and shared
    contacts are filed as text. The first message of a reply opens with the
    agent's first name and the brand.
  • One webhook for the install. Every post from Meta is checked against
    the app secret before it is parsed, routed to the account it names, filed
    within the request and answered at once. Channels › Meta shows the callback
    URL and the verify token to paste into Meta's dashboard.
  • Connect an account per platform on Channels › Meta by pasting the
    dashboard's token, test it before saving and route it to a department.
    Once an hour a job checks the token and the webhook subscription; the
    account's page offers Subscribe now and Reconnect when Meta drops
    either.
  • The reply window. A reply outside Meta's 24-hour window is refused when
    it is written, and the ticket view says how long the window stays open. A
    person's reply to a Messenger or Instagram customer between 24 hours and
    7 days goes out with Meta's Human Agent tag when the account's switch is
    on.
  • Delivery states on every reply: sent, delivered and read as Meta
    reports them, failed with Retry, and refused in Meta's words when the
    window had closed.
  • Identities. The ticket view shows which number, Page or account a
    ticket is with, the customer's platform id, phone, name or handle, and
    which of them is verified. Messenger and Instagram names are looked up by
    a job and kept once they arrive.
  • The whole of it is in
    docs/guides/meta-channels.md: what each
    platform needs, what Meta charges for WhatsApp, App Review, and developing
    without Meta.

M9 Hardening

  • Visitor addresses behind a proxy. TRUST_PROXY now takes a list of
    proxy addresses, CIDRs or the names loopback, linklocal and
    uniquelocal, so the api believes the hop from Caddy and not an address a
    client wrote into X-Forwarded-For. The Cloudflare Caddyfile trusts
    Cloudflare's published ranges and forwards the visitor's address.
  • Widget sockets spend a budget of 120 events a minute per visitor, and a
    visitor's sockets are closed when their signed identity is withdrawn or
    changed.
  • OAuth sign-in is bound to the browser that started it by a ten-minute
    cookie.
  • API keys can expire (expiresAt when one is created), a refused key
    leaves a trace in the audit log, an API key gets 403 instead of 500 on
    routes that act for a person, and webhooks:manage no longer reads data on
    its own.
  • Brands scheduled for deletion. During the 30-day grace, the brand's API
    keys answer 410 and its webhook deliveries are skipped.
  • Model addresses are checked when saved: https, and no private, loopback
    or metadata address unless its range is in OUTBOUND_ALLOW_CIDRS.
  • Retention purges finished webhook deliveries and sent or failed Telegram
    replies after 30 days, and stored Idempotency-Key answers after 24 hours.
    "Anonymise contact" also erases the contact's Telegram chats, the redaction
    maps of AI calls on their tickets and the webhook deliveries that carry
    their data.
  • Uploaded and Google Drive DOCX files are refused past 1,000 entries or
    100 MiB unpacked. JSON answers carry Cache-Control: no-store. A Notion or
    Google Drive connection callback works once.
  • Accessibility. Zoom, reflow, forced colours, screen-reader markup and
    mixed-direction text are checked by Playwright on the widget and the help
    center in both languages, and what they found is fixed
    (record). The ASVS L2 record
    reads 198 Met, 35 Partial and 0 Gap (record).

Gaps closed from M6 and M7

  • Telegram bots have their own language prompt. /start asks for English
    or Arabic with the bot's question, edited on the bot's page under
    Channels › Telegram.
  • The widget's handoff line says when the team is back. A visitor writing
    out of hours after a handoff reads when the team is away until, by the
    department's calendar, else the brand's. A conversation carries the new
    optional hours.
  • The ticket list says what the assistant did. A row's caption ends with
    "AI paused" or "AI answered".
  • Agent assist sends the brand's Arabic system prompt for an Arabic
    ticket, as auto-reply already did.

Upgrade notes

  • Run the migrations (0048–0052). Restart the worker so it picks up the
    Meta jobs (sending, media, profile names and the hourly health check).
  • The Compose file now sets TRUST_PROXY=uniquelocal instead of true.
    true still works and still believes every hop. Behind Cloudflare, copy the
    new docker/caddy/Caddyfile.cloudflare and run docker compose up -d
    (install guide); behind a proxy
    of your own, list its address
    (install guide).
  • API keys that manage webhooks need the read scope of the endpoint's
    events     (tickets:read, contacts:read or articles:read), or they get
    403 webhook-event-scope. Endpoints that already exist keep delivering.
  • Keys already issued never expire; set expiresAt through the API when you
    want one to.
  • A Google or GitHub sign-in begun just before the upgrade has to be started
    again.
  • To connect a Meta account, set the Meta app's id and secret in .env
    (HD_META_APP_ID, HD_META_APP_SECRET) and restart the api and the worker;
    there is no Meta section on the Settings screen in this release
    (the four settings).
    Optional: META_GRAPH_VERSION, META_GRAPH_API_ROOT and
    META_INSTAGRAM_API_ROOT, whose defaults are Meta's.

Known gaps

  • The Meta channels have not been run against a real Meta app yet. CI
    uses a stand-in for the Graph API. The milestone document lists what only a
    real run settles: which secret signs Instagram webhooks (both are tried),
    the exact closed-window error code, whether Business Verification is
    required for App Review, and whether a Page the operator administers returns
    a customer's name without the profile feature. Until an install has been
    through App Review, a Messenger contact can be "Messenger user" with its
    id.
  • WhatsApp templates (M10-09), which reach a customer after the window,
    come in a later release; the satisfaction survey is not sent on these
    channels until they do.
  • What still needs a person before 1.0: the external pentest
    (scope), the screen-reader pass
    (runbook), the load-test host run, the
    clean-VM onboarding run with outside testers, and the restore drill for the
    record (M9).
  • The rest is listed in
    M10.

What's Changed

Full Changelog: v0.4.0...v0.5.0

Contributors

Docker-Hunterpedia
Assets 3
Loading