Chat Systems 3.7.0

Upgrading from 3.6.0

• Pull both images and restart api, realtime, worker and frontend together; the API
  runs migrations 80–81 on start, which add slack_channels.created_by_import and lowercase
  every email address, so snapshot first. On its first start the worker moves workspace photos
  into the object store's avatars/ prefix and workspace icons into icons/, outside file
  retention (see the RUNBOOK upgrade notes); going back to 3.6.0 means restoring the snapshot.
• Check for addresses that differ only in case. Migration 81 refuses mixed-case addresses
  from then on. If two accounts differ only in case it stops before changing anything and names
  them, and the api does not start until one is erased or given an address of its own; the
  RUNBOOK says how.
• Channels mapped by an earlier Slack import count as ones it merged into, so a re-run never
  archives them.
• Reactivating an account that has no password and no SSO link (an imported Slack leaver), from
  the admin page or with SCIM active: true, leaves it pending instead of active; invite
  the person to let them in.
• For API clients: DELETE /admin/users/{id}/data reports removed.edits, reactions,
  votes, comments, scheduled and files beside messages. Taking over a workflow
  gives it a new webhook_url, and POST /workflows/{id}/rotate makes one on demand; the
  old URL answers 401 in both cases.
• For API clients: POST /conversations/{id}/read is gone; a conversation is read like a
  channel, POST /channels/{id}/read with the message read up to. Unread counts carry
  last_read_at and a first message page last_read_before_at, the time of the read.
• For API clients: a workspace photo is uploaded with POST /workspaces/{id}/profile/avatar
  and a workspace icon with POST /workspaces/{id}/icon; either uploaded through
  /files/upload is an ordinary file and no longer readable by the workspace.
  PATCH /hooks/{id} with { "is_active": true } turns a stopped hook back on.
• For API clients: POST /workspaces/{id}/invites answers email_status (sent,
  not_configured, failed, or null for a link invite) instead of email_sent. Search hits
  from /search and /search/files carry channel_name. A reply to a deleted root with no
  replies left answers 404 instead of 422.

Security

• SSO lets nobody around a suspension. An account already linked to the provider was
  signed in without its status being checked, so a suspended or erased person got a session
  through SSO. Erasing an account now also removes its SSO link.
• A hard erase removes everything they wrote. A message others answered kept every earlier
  version in its edit history, and their files, reactions, votes, list comments, scheduled
  messages and the notifications quoting them stayed. All of it goes now, files with their
  stored objects.
• A hook stops when its creator loses the role. An outgoing webhook or slash command made
  by an admin who is now a member kept sending channel traffic; it turns off, saying why.
• A taken-over workflow gets a new URL. The old owner could still start it from the link
  they knew. New URL in the workflow replaces it at any time.
• A Slack import keeps out of private channels. A private Slack channel merged into a local
  private channel of the same name, adding Slack's members to it and its history to theirs.
  Private channels never merge now; a taken name becomes <name>-slack.
• A re-import leaves a merged channel open. Running an import again, or Start again,
  archived a local channel the first run had merged an archived Slack channel into.
• An archived channel is read-only all the way. Editing, deleting and pinning a message,
  voting in a poll, adding or removing members, bookmarks, renaming and starting a huddle still
  changed an archived channel; every one answers 403 now, and the client hides them.
• A guest calls only whom they could message. Starting a DM huddle checked only that the
  other person was in the workspace, so a guest could ring a member they could not message, and
  invite them into a huddle. Both follow the DM rule now.

Fixed

• An archived private channel can be found again. The sidebar leaves archived channels out
  and Browse channels listed public ones only, so nobody could reach one to unarchive it. Browse
  now lists those you are a member of, under the archived public ones.
• A message that arrives while a channel opens is shown. The first page of a channel was
  still loading when a new message came in over the socket, so the message was dropped until
  the next reload. It now reloads the page instead.
• Read state matches what you read. Mark all read could leave a channel's read position
  on a reply kept in its thread, so opening it loaded the whole history looking for it. A
  mention in a reply also sent to the channel stayed unread after reading the channel, and its
  email went out. A reply notification under a deleted message opened nothing, a DM opened at
  an old New line, and a keyword quoted in a forward alerted its owner. Each now behaves as
  it does in a channel.
• A failed send stays where you sent it. A reply from the Threads view that failed
  vanished from its card, a failed message was lost on reload, a send the server took just before
  the request failed showed twice, and scheduling dropped a file that had failed to upload. The
  card shows the failed reply with Retry and Discard, failed messages survive a reload, a
  delivered message never keeps a failed copy, and scheduling refuses a failed file as sending
  does.
• An address works in any case. An invite to Ana@Firma.com made an account SSO could not
  find as ana@firma.com, so it refused or made a second one, and signing in with the password
  needed the exact case. Addresses are stored lowercase now.
• A workspace photo stays. It was a file of that workspace, so file retention deleted it with
  old attachments. It has a place of its own now, shown to that workspace's members.
• A stopped hook can be turned back on. One switched off because its creator left or lost
  the channel could only be deleted and made again; Integrations has Turn on, and whoever
  turns it on becomes its creator.
• Push goes to the device you are using. A laptop shut mid-use counted as active for up to
  two and a half minutes, holding back push to the phone; it now stops within about 30 seconds,
  and leaving or hiding the page says so at once. The push badge counted notifications from
  workspaces you had left, and a desktop notification from a second server opened nothing. The
  badge now matches the app's, and the click opens the message on its server.
• The survey's small things. A search hit from a public channel you are not in names its
  channel. A thread whose deleted root lost its last reply shows no composer. An export's date
  range covers edits, reactions, polls and votes, not only messages and files. An invite whose
  email failed says so instead of claiming email is not set up. A card in Threads has
  Also send to and scheduling, as the thread panel does.
• Everyone sees the workspace icon, and it stays. It was an ordinary file with no message,
  so only the admin who uploaded it could load it, file retention could delete it, and a
  replaced one was never removed. It has a place of its own now, shown to the workspace's
  members.