merge: upstream v2.25.1 (135 commits - billing redesign, settings tabs, creation modal, email queues)

[JOY (JOY)]

What kind of change does this PR introduce?

Upstream sync (Feature + Bug fix) across backend, frontend, orchestrator and the Prisma schema. It merges gitroomhq/postiz-app 8e42f09c..91c91f63 (= tag v2.25.1, 135 commits since the v2.25.0 sync in #67) into dev. Follow-up commits fix the brand leaks the merge brought in and clear the ESLint and CodeQL code-scanning findings on the merged lines. Fork surfaces stay as they were: DOS shared billing in billing.controller.ts and main.billing.component.tsx, the branding engine, MCP tool aliases, and the DOS ID SSO.

Why was this change needed?

Upstream shipped v2.25.1. Per ADR-0001, the fork keeps tracking upstream so it gets provider fixes, billing and Stripe hardening, and new MCP and calendar features, without losing its own billing and brand surfaces.

Technical Details & Scope

Upstream highlights

• Billing: redesigned billing page with plan cards and invoice history (GET /billing/invoices).
• Stripe fixes: guard against duplicate subscriptions, cancel/reactivate toggle persists cancelAt, channels are re-enabled when a plan upgrade can hold them all, webhook failures are logged instead of swallowed.
• Settings: reorganised into Integrations, Plugs, Apps (developer + approved apps) and Authentication tabs. /plugs and /third-party now redirect into Settings.
• Composer: new post creation modal, automatic RTL text direction in the composer and previews, mobile top bar.
• Calendar: channel multi-select filter (server-side in list view), green frame on published posts, open-post link icon (TikTok UPLOAD drafts included), curated provider errors in the tooltip, batch schedules (Post.batchId), AM/PM in the date picker.
• Channels and tags: rename a channel (Integration.customName), edit tags from the tags dropdown.
• Media: GET /public/v1/media and an MCP mediaListTool.
• Admin: superadmin public API endpoint to reset an org's AI credits (SuperAdminGuard).
• Emails: each email is now its own sendSingleEmailWorkflow, on the rate-limited email / email-bulk task queues. Auth emails (activation, password reset) are sent synchronously. The old sendEmailWorkflow stays registered so the running one can drain.
• Long-running workflows: autopost and missing-post now continue-as-new behind patched(). Streak moved to streakWorkflowV2. All of these follow the versioning rules.
• Provider fixes: reconnect keeps the new refresh token, refresh channel limit check by internalId, YouTube Google Workspace invalid_rapt message, Instagram trial reel limit error, TikTok post id persistence, X, Threads, Listmonk and WordPress fixes.
• Leaner responses: channel delete and /user/organizations return only the fields their callers need.

Conflicts resolved

• CLAUDE.md: union. Upstream's rule that webhook code must never throw is appended.
• package.json: kept the fork's pnpm exec prisma scripts and took upstream's removal of --accept-data-loss from prisma-db-push. This matches the fork's own audit item C2.
• billing.controller.ts /cancel:
  • DOS branch kept. The feedback email now goes out after dos.me accepts the cancel, so a 409/502 no longer sends a false email.
  • Stripe path is upstream's: email only when cancel_at is set.
• main.billing.component.tsx: took upstream's redesign and re-applied DOS mode on top:
  • monthly-only Plus ($9) / Pro ($19) cards, through a new optional PlanCard label prop
  • yearly toggle hidden, 3-column grid
  • portal/cancel box behind showPortalAndCancel
  • BillingHistory hidden, and the portal button keeps "/ Invoices History", because invoices live in dos.me
  • upstream's cancel-toggle toasts skipped, because a dos.me cancel never toggles
• load.tools.service.ts: kept the fork's agentId and tool aliases, added upstream's coreToolNames(). The self-hosted relay now checks only canonical tool names, so the fork's aliases no longer show up as "missing tools" on a self-hosted instance.
• email.service.ts: union of imports.
• plugs / third-party pages: took upstream's redirects. The fork's branded metadata no longer renders there.

Follow-up commits

• Branding (fix(sync)):
  • The branding guard blocked upstream's new uploadFromUrlTool / uploadWidgetTool hints. They pointed agents at docs.postiz.com and at the upstream CLI, which defaults to the upstream cloud. They now point at POST /public/v1/upload and brand.docsUrl.
  • The YouTube Workspace message now names the deployment brand.
• ESLint code-scanning gate, 23 React Compiler react-hooks errors and 12 warnings on merged lines. All cleared:
  • missing hook deps added
  • t declared before use in teams.component.tsx
  • the composer toolbar now gets the TipTap editor from state (OnlyEditor onEditor prop) instead of reading editorRef while rendering
  • the editor rebuild and the calendar channel-filter reset on a customer switch now adjust state while rendering instead of in an effect
  • manage.modal.tsx memoises existingPosts / channel
  • two <img> replaced with the repo's SafeImage / ImageWithFallback
• CodeQL js/double-escaping (high, 7.8), in libraries/helpers/src/utils/strip.html.validation.ts:
  • The html branch of stripHtmlValidation decoded & before " /   / ', so the literal text " (stored as ") came out as a bare quote. & is now decoded last.
  • The decoding order is unchanged since before the sync. CodeQL counted it as new because upstream reformatted that block for inline images.
  • Found with a local CodeQL run (javascript-code-scanning suite, base vs head). It is the only alert that starts on a changed line.
• Every fork-side edit is recorded in docs/fork-delta.md.

Schema (deploy gating): two new nullable columns plus an index. Additive only: no existing column changes meaning. Beta and the shared prod DB need this DDL before the new code serves traffic. Prod goes through the DOS-Me ledger as before.

ALTER TABLE "Integration" ADD COLUMN IF NOT EXISTS "customName" TEXT;
ALTER TABLE "Post" ADD COLUMN IF NOT EXISTS "batchId" TEXT;
CREATE INDEX IF NOT EXISTS "Post_batchId_idx" ON "Post"("batchId");

Ops: the orchestrator now also polls the email and email-bulk task queues. Do not list them in EXCLUDE_QUEUE, or emails stop sending.

Verification & Testing

• pnpm install --frozen-lockfile: lockfile unchanged, since upstream changed no dependencies.
• tsc --noEmit: clean on backend and orchestrator (tsconfig.build.json) and on frontend.
• pnpm run build (frontend + backend + orchestrator): passes. build:frontend was re-run after the lint fixes and passes.
• npx tsx scripts/branding-guard.ts: passes. Before the fix(sync) commit it failed with 6 leaks.
• ESLint on every PR-changed file in apps/frontend / apps/backend: 0 errors and 0 warnings on changed lines, down from 23 errors and 21 warnings.
• CodeQL CLI 2.27.2 with the javascript-code-scanning suite on base and head: 0 alerts start on a changed line, down from 1.
• stripHtmlValidation('html', …) spot-checked with tsx:
  • Tom & Jerry → Tom & Jerry
  • " → literal "
  • "q" → "q"
• pnpm run test:frontend: 14/14 pass.
• Bootstrap jest suite against a throwaway Postgres + Redis, schema pushed without --accept-data-loss: 58/58 pass.
• Two agent passes compared the fork-side edits with existing patterns: one on the merge resolution, one on the lint fixes. The DOS 3-plan grid and DOS toast issues they found are fixed. Neither pass found a render loop or a stale editor.

QA

1. On beta, apply the three DDL statements above, deploy this branch, and confirm the backend and orchestrator start with no Prisma "column does not exist" errors.
2. Log in through DOS ID as the owner of an org on DOS Plus, and open /billing.
3. Expect three cards (Free, Plus $9 / month, Pro $19 / month) in one row with no empty fourth column, no Monthly/Yearly toggle, no "Billing history" table, and Plus marked Active.
4. Click "Update Payment Method / Invoices History". Expect a redirect to the dos.me billing portal, not Stripe.
5. Back on /billing, click "Cancel subscription" and submit at least 20 characters of feedback. Expect "Subscription set to canceled successfully", or no toast if dos.me has not reported the cancel yet. Never expect "already set to cancel, so it has been reactivated". The EMAIL_FROM_ADDRESS inbox gets one "Subscription Cancelled" email.
6. Open /plugs and /third-party. Expect redirects to /settings?tab=plugs and /settings?tab=integrations. Settings shows the Integrations, Plugs, Apps tabs and an Authentication box ("Single sign-on") under Global Settings.
7. Trigger a password reset for a test user. Expect the email to arrive within a minute. In the Temporal UI, sent notification emails show up as send_email_<uuid> workflows on the email / email-bulk queues.
8. On the calendar, rename a channel from its menu, then create a post for two channels. Expect the custom name in the calendar, and both posts linked as one batch in the preview.
9. In the composer, type a line and click Bold, then Underline, the signature button and an emoji. Each applies straight away, with no need to type first. Switch to a channel whose post settings turn inline images on (for example an X article). The editor rebuilds once and the toolbar keeps working.
10. On the calendar with customers set up, pick two channels in the channel filter, then switch the customer. The channel filter resets to all channels of the new customer, and the list view shows no posts from the previous filter.
11. Connect an MCP client to /mcp/<api key> and list the tools. uploadFromUrlTool must mention POST /public/v1/upload and the deployment's docs URL, with no docs.postiz.com and no postiz upload. mediaListTool is listed.
12. Schedule a post to an HTML-output channel (for example WordPress) whose text contains Tom & Jerry and the literal characters ". The published post shows Tom & Jerry and the literal ", not a bare ".

Checklist:

• My code follows the project's code style and architectural conventions.
• Local build passes (pnpm run build).
• Branding guard validation passes (pnpm dlx tsx scripts/branding-guard.ts).
• Tests and typecheck have been verified without errors.
• Documentation has been updated (if applicable).
• No secrets or sensitive credentials are included in this PR.
• I have filled in the QA / Verification section above with real steps to verify this change.

Not changed here, needs a decision (pre-existing): in DOS mode, "Reactivate subscription" calls /billing/cancel, which always cancels on dos.me and never toggles. On top of that, syncOrg stores current_period_end as cancelAt for every active DOS plan, so paid DOS orgs may see the Reactivate button and the "will be canceled" banner. Whether this is real depends on how dos.me's cancel endpoint and the period end behave, so it is left for a separate fix.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XFwPKMsHCF5VarWHQAsHtJ

[claude]

⚠️ Code review skipped — your organization has no extra usage available to pay for this review.

If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.

Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.

[github-advanced-security]

ESLint found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

[JOY (JOY)]

Update: the code-scanning findings on this PR are now fixed. This replaces my earlier note here, which said the ESLint alerts would be left as they were.

• ESLint, 23 errors (a445c399): React Compiler react-hooks errors on lines the v2.25.1 merge brought in. Fixed by:
  • adding the missing useCallback deps
  • declaring t before use in teams.component.tsx
  • giving the composer toolbar the TipTap editor from state instead of reading editorRef while rendering
  • turning two setState-in-effect resets into state adjusted while rendering
• ESLint, 12 warnings (540a9727):
  • hook deps completed; manage.modal.tsx now memoises existingPosts / channel so the save and delete callbacks can list them
  • two <img> replaced with the repo's SafeImage / ImageWithFallback
• CodeQL, js/double-escaping (high, 7.8) (6114dc54): libraries/helpers/src/utils/strip.html.validation.ts, html branch of stripHtmlValidation.
  • Cause: & was decoded before " /   / ', so the literal text " (stored as ") came out as a bare quote. The order was already like this before the sync; it was flagged as new because upstream reformatted that block for inline images. & is now decoded last.
  • How I found it: a local CodeQL run with the javascript-code-scanning suite, comparing base and head, showed this is the only alert starting on a changed line.
  • Correction: my first guess, the console.log in no.auth.integrations.controller.ts (813f4d54), was wrong. That line is reverted to upstream's.

Locally, ESLint and CodeQL both report 0 findings starting on changed lines. Frontend and backend typecheck, build:frontend and vitest all pass. Each fork-side change is recorded in docs/fork-delta.md.

---

Generated by Claude Code

[gemini-code-assist]

Code Review

This pull request introduces significant enhancements to the billing, subscription, and post editor systems, including a new billing history view, inline image support in the editor, mobile-responsive UI components like bottom sheets, and optimized Temporal workflows using continue-as-new. The code review identified several critical robustness issues: a potential runtime error when accessing nested user arrays without optional chaining, a missing Day.js UTC plugin extension that could cause crashes, an unhandled ChangeEvent case in the editor's drag-and-drop handler, a potential RangeError in currency formatting, and a regex limitation that strips images using single quotes.

[gemini-code-assist]

Defensive programming check: f.users[0] is accessed directly. If f.users is empty or undefined, this will throw a runtime TypeError. Use optional chaining to safely access the property.

Suggested change

	.filter((f) => !f.users[0].disabled)
	.filter((f) => !f.users?.[0]?.disabled)

[JOY (JOY)]

Leaving this as is: users[0] can't be missing here. getOrgsByUserId only returns orgs where users: { some: { userId } } holds, and its include filters users to that same userId, so every returned org has exactly that row at users[0]. The f.users[0].disabled filter was already in this file before the sync; upstream only added the .map that narrows the fields.

---

Generated by Claude Code

[gemini-code-assist]

The dayjs.utc method is used in formatDate but the utc plugin is not imported or extended in this file. This will cause a runtime crash (TypeError: dayjs.utc is not a function) if the plugin hasn't been initialized globally. Import and extend the utc plugin to ensure it works reliably.

Suggested change

	import dayjs from 'dayjs';
	import dayjs from 'dayjs';
	import utc from 'dayjs/plugin/utc';
	dayjs.extend(utc);

[JOY (JOY)]

Leaving this as is, it doesn't reproduce. BillingHistory is only rendered from main.billing.component.tsx, which imports newDayjs from components/layout/set.timezone.tsx. That module runs dayjs.extend(utc) at import time, before any render, and main.billing.component.tsx itself already relies on dayjs.utc the same way. Adding a per-file extend would add fork delta to an upstream file without changing behaviour.

---

Generated by Claude Code

[gemini-code-assist]

When files are uploaded via the file picker (clicking the button) instead of drag-and-drop, the event is a ChangeEvent rather than a DragEvent. This means clientX and clientY will be undefined, and passing them to posAtCoords can cause a runtime crash. Add a guard to ensure these coordinates are valid numbers before calling posAtCoords.

Suggested change

	if (inlineImages) {
	// uploads land at the cursor, move it to where the files were dropped
	const editor = editorRef?.current?.editor;
	const { clientX, clientY } = event as DragEvent;
	const position = editor?.view?.posAtCoords({
	left: clientX,
	top: clientY,
	});
	if (position) {
	if (inlineImages) {
	// uploads land at the cursor, move it to where the files were dropped
	const editor = editorRef?.current?.editor;
	const { clientX, clientY } = event as DragEvent;
	if (typeof clientX === 'number' && typeof clientY === 'number') {
	const position = editor?.view?.posAtCoords({
	left: clientX,
	top: clientY,
	});
	if (position) {
	editor.commands.focus(position.pos);
	}
	}
	}

[JOY (JOY)]

Leaving this as is: there is no file-picker path into this onDrop. The editor only spreads getRootProps() (editor.tsx:939) and never renders getInputProps(). With react-dropzone's default useFsAccessApi: false, a click on the root finds no input and opens nothing. So onDrop only fires from a real drop, whose event is a DragEvent with numeric clientX/clientY. Uploads from the media button go through the Uppy uploader, not this handler.

---

Generated by Claude Code

[gemini-code-assist]

The Intl.NumberFormat constructor will throw a RangeError if the currency parameter is invalid or unsupported. Since this value comes from external API data, wrap the formatting logic in a try-catch block to prevent a rendering crash.

const formatAmount = (amount: number, currency: string) => {
  try {
    const formatter = new Intl.NumberFormat('en-US', {
      style: 'currency',
      currency: currency.toUpperCase(),
    });
    return formatter.format(
      amount / 10 ** (formatter.resolvedOptions().maximumFractionDigits ?? 2)
    );
  } catch (e) {
    return `${currency.toUpperCase()} ${(amount / 100).toFixed(2)}`;
  }
};

[JOY (JOY)]

Leaving this as is. currency comes from StripeService.getInvoices, i.e. Stripe's invoice.currency, which is always a lowercase ISO 4217 code that Intl.NumberFormat accepts. There is no realistic input that makes it throw, so a fallback formatter here (in an upstream file) would be code without a trigger.

---

Generated by Claude Code

[gemini-code-assist]

The regular expressions for extracting src and alt only match double quotes. If the HTML uses single quotes (e.g., <img src='...'>), the image will be completely stripped. Update the regex to support both single and double quotes.

Suggested change

	export const convertImages = (value: string) => {
	return value.replace(/<img\b[^>]*>/gi, (match) => {
	const src = /\ssrc="(https?:\/\/[^"]*)"/i.exec(match)?.[1];
	const alt = /\salt="([^"]*)"/i.exec(match)?.[1];
	export const convertImages = (value: string) => {
	return value.replace(/<img\b[^>]*>/gi, (match) => {
	const src = /\ssrc=["'](https?:\/\/[^"']*)["']/i.exec(match)?.[1];
	const alt = /\salt=["']([^"']*)["']/i.exec(match)?.[1];

[JOY (JOY)]

Leaving this as is. Post content goes through sanitizePostContent (DOMPurify, applied in CreatePostDto) before it is stored, and DOMPurify always serialises attributes with double quotes. So a single-quoted <img> never reaches convertImages. The helper is also a deliberate allow-list (only an http(s) src plus the alt), so dropping anything that doesn't match is the safe failure mode, and widening the quote handling would cut against the quote checks it already does.

---

Generated by Claude Code