u

Author: danielehrhardt

src/app/(legal)/layout.tsx

@@ -0,0 +1,16 @@
+import type { Viewport } from "next"
+import { getSettings } from "@/server/settings"
+import { SiteChrome } from "@/components/marketing/site-chrome"
+import "@/components/marketing/marketing.css"
+
+export const viewport: Viewport = { themeColor: "#FAF9F5" }
+
+/**
+ * Imprint, privacy policy and terms. Always public (the sign-in page links
+ * here), with the full site chrome when the marketing site is on and a
+ * minimal header otherwise.
+ */
+export default async function LegalLayout({ children }: { children: React.ReactNode }) {
+  const general = await getSettings("general")
+  return <SiteChrome variant={general.marketingSite === false ? "minimal" : "full"}>{children}</SiteChrome>
+}

src/app/(marketing)/legal/[slug]/page.tsx src/app/(legal)/legal/[slug]/page.tsxsrc/app/(marketing)/legal/[slug]/page.tsx renamed to src/app/(legal)/legal/[slug]/page.tsx

@@ -26,22 +26,31 @@ export function generateStaticParams() {
 export async function generateMetadata({ params }: PageProps<"/legal/[slug]">): Promise<Metadata> {
   const { slug } = await params
   if (!isLegalSlug(slug)) return {}
-  return { title: pages[slug].title, alternates: { canonical: `/legal/${slug}` } }
+  const legal = await getSettings("legal")
+  const published = Boolean(legal[pages[slug].field].trim())
+  return {
+    title: pages[slug].title,
+    alternates: { canonical: `/legal/${slug}` },
+    // Placeholder pages shouldn't end up in search results.
+    ...(published ? {} : { robots: { index: false } }),
+  }
 }
 
 /** Operator-provided Markdown → sanitized HTML. */
 function renderMarkdown(md: string): string {
   const html = marked.parse(md, { async: false, gfm: true, breaks: false })
   return sanitizeHtml(html, {
-    allowedTags: sanitizeHtml.defaults.allowedTags.concat(["h1", "h2", "img"]),
+    allowedTags: sanitizeHtml.defaults.allowedTags.concat(["h2", "img"]),
     allowedAttributes: {
-      a: ["href", "title", "name", "target", "rel"],
+      a: ["href", "title", "target", "rel"],
       img: ["src", "alt", "title", "width", "height"],
       th: ["align"],
       td: ["align"],
     },
     allowedSchemes: ["http", "https", "mailto", "tel"],
     transformTags: {
+      // The page already has an <h1>; demote Markdown top-level headings.
+      h1: "h2",
       a: (tagName, attribs) => {
         const external = /^https?:\/\//.test(attribs.href ?? "")
         return {
@@ -94,10 +103,6 @@ export default async function LegalPage({ params }: PageProps<"/legal/[slug]">)
               <FileText className="size-4 text-muted-foreground" aria-hidden />
             </span>
             <p className="mt-5 text-[15px] font-medium">The operator of this instance hasn&apos;t published this page yet.</p>
-            <p className="mt-1.5 max-w-sm text-[13.5px] leading-relaxed text-muted-foreground">
-              Administrators can add it in Admin → Settings → Legal. It&apos;s written in Markdown and appears here
-              right away.
-            </p>
           </div>
         )}
       </div>

src/app/(marketing)/layout.tsx

@@ -1,42 +1,19 @@
+import type { Viewport } from "next"
 import { redirect } from "next/navigation"
 import { getSettings } from "@/server/settings"
-import { getCurrentUser } from "@/server/auth/session"
-import { AnnouncementBar } from "@/components/marketing/announcement-bar"
-import { FloatingCta } from "@/components/marketing/floating-cta"
-import { getMarketingNav } from "@/components/marketing/nav"
-import { SiteFooter } from "@/components/marketing/site-footer"
-import { SiteHeader } from "@/components/marketing/site-header"
-import { formatStars, getGitHubStars } from "@/components/marketing/lib/github"
+import { SiteChrome } from "@/components/marketing/site-chrome"
 import { APP_ENTRY } from "@/content/marketing/site"
 import "@/components/marketing/marketing.css"
 
+export const viewport: Viewport = { themeColor: "#FAF9F5" }
+
 /**
  * Public marketing site. Instances can switch it off in Admin → General
  * (`marketingSite`), in which case every marketing URL forwards to the app.
+ * Legal pages live in the (legal) group so they stay reachable either way.
  */
 export default async function MarketingLayout({ children }: { children: React.ReactNode }) {
   const general = await getSettings("general")
   if (general.marketingSite === false) redirect(APP_ENTRY)
-
-  const [user, stars] = await Promise.all([getCurrentUser().catch(() => null), getGitHubStars()])
-  const starLabel = formatStars(stars)
-  const nav = getMarketingNav()
-
-  return (
-    <div className="mk-light flex min-h-dvh flex-col overflow-x-clip">
-      <a
-        href="#main"
-        className="sr-only z-50 rounded-[4px] bg-primary px-3 py-2 text-sm text-primary-foreground focus:not-sr-only focus:fixed focus:top-3 focus:left-3"
-      >
-        Skip to content
-      </a>
-      <AnnouncementBar stars={starLabel} />
-      <SiteHeader groups={nav.groups} pricing={nav.pricing} signedIn={Boolean(user)} stars={starLabel} />
-      <main id="main" className="flex-1">
-        {children}
-      </main>
-      <SiteFooter stars={starLabel} />
-      <FloatingCta signedIn={Boolean(user)} stars={starLabel} />
-    </div>
-  )
+  return <SiteChrome variant="full">{children}</SiteChrome>
 }

src/app/(marketing)/page.tsx

@@ -324,7 +324,7 @@ function Automate() {
           className="md:col-span-2 lg:col-span-4"
           layout="row"
           title="Rules & automation."
-          quiet="When, if, then: label, assign, move or notify automatically."
+          quiet="When, if, then: label, assign, snooze or close automatically."
           visual="rules"
           href="/features/rules-automation"
         />

src/app/(marketing)/pricing/page.tsx

@@ -4,7 +4,7 @@ import { CtaSection } from "@/components/marketing/cta-section"
 import { FaqSection } from "@/components/marketing/faq"
 import { clientPricing, getCloudPricing, type CloudPricing } from "@/components/marketing/lib/pricing"
 import { PageHero } from "@/components/marketing/page-hero"
-import { Bool, PlanCards, referencePrice } from "@/components/marketing/pricing-parts"
+import { Bool, PlanCards } from "@/components/marketing/pricing-parts"
 import { JsonLd, MonoLabel, PixelMark, Section, SectionHeading } from "@/components/marketing/primitives"
 import { competitors, PRICES_AS_OF } from "@/content/marketing/competitors"
 import type { Faq } from "@/content/marketing/types"
@@ -23,7 +23,7 @@ export default async function PricingPage() {
   const rivals = ["missive", "front", "hiver", "help-scout"]
     .map((s) => competitors.find((c) => c.slug === s))
     .filter((c) => c !== undefined)
-    .map((c) => ({ name: c.name, plan: c.referencePlan, price: referencePrice(c) }))
+    .map((c) => ({ name: c.name, plans: c.plans, referencePlan: c.referencePlan }))
 
   return (
     <>

src/app/(marketing)/security/page.tsx

@@ -147,7 +147,7 @@ export default async function SecurityPage() {
           <ul className="space-y-3 self-center">
             {[
               "Mail stays in the original mailbox; Dispatch keeps a synced copy in your own Postgres",
-              "No telemetry: a self-hosted instance doesn't phone home",
+              "No telemetry: Dispatch never reports usage data anywhere",
               "The AI assistant is off by default and only uses the provider and API key you configure",
               "Stripe is contacted only when an operator turns billing on",
               "Open source under AGPL-3.0, so every claim on this page can be verified in the code",

src/app/api/w/[slug]/conversations/[id]/route.ts

@@ -14,15 +14,16 @@ export const GET = route<P>(async (req, { params }) => {
   return json(thread)
 })
 
-/** PATCH /api/w/[slug]/conversations/[id]  body: ConversationPatch → ConversationListItem */
+/**
+ * PATCH /api/w/[slug]/conversations/[id]  body: ConversationPatch
+ *   → { item: ConversationListItem | null } (null when the change removed your access, e.g. unassigning yourself)
+ */
 export const PATCH = route<P>(async (req, { params }) => {
   const { slug, id } = await params
   const { ctx, scope } = await inboxContext(req, slug, { write: true })
   const patch = await parseJson(req, conversationPatchSchema)
   await applyConversationPatch(ctx, scope, [assertUuid(id, "Conversation")], patch)
-  const item = await getListItem(ctx, scope, id)
-  if (!item) throw new ApiError(404, "Conversation not found", "not_found")
-  return json(item)
+  return json({ item: await getListItem(ctx, scope, id) })
 })
 
 /** DELETE /api/w/[slug]/conversations/[id] → permanently delete (must be in trash) */

src/app/api/w/[slug]/events/route.ts

@@ -1,5 +1,5 @@
 import type { NextRequest } from "next/server"
-import { and, eq } from "drizzle-orm"
+import { and, eq, gt, isNull, or } from "drizzle-orm"
 import { errorResponse, requireApiOrg } from "@/server/api"
 import { SESSION_COOKIE, validateSessionToken } from "@/server/auth/session"
 import { subscribe } from "@/server/realtime"
@@ -56,7 +56,17 @@ export async function GET(req: NextRequest, { params }: { params: Promise<{ slug
       const heartbeat = setInterval(() => send(`: ping ${Date.now()}\n\n`), HEARTBEAT_MS)
       const recheck = setInterval(async () => {
         try {
-          const session = ctx.via === "session" ? await validateSessionToken(token) : { user: ctx.user }
+          const session =
+            ctx.via === "session"
+              ? await validateSessionToken(token)
+              : await db.query.apiKeys.findFirst({
+                  where: and(
+                    eq(schema.apiKeys.id, ctx.apiKeyId!),
+                    isNull(schema.apiKeys.revokedAt),
+                    or(isNull(schema.apiKeys.expiresAt), gt(schema.apiKeys.expiresAt, new Date()))
+                  ),
+                  columns: { id: true },
+                })
           const membership = session
             ? await db.query.memberships.findFirst({
                 where: and(eq(schema.memberships.orgId, orgId), eq(schema.memberships.userId, me), eq(schema.memberships.status, "active")),

src/app/api/w/[slug]/presence/route.ts

@@ -25,14 +25,12 @@ export const POST = route<{ slug: string }>(async (req, { params }) => {
   const orgId = ctx.org.id
   const me = ctx.user.id
 
-  if (input.left && input.left !== input.conversationId) {
+  // Leaving: only if my presence still points at that conversation (requests can arrive out of order).
+  if (input.left && input.left !== input.conversationId && getViewers(orgId, input.left).some((v) => v.userId === me)) {
     touchPresence(orgId, me, "", false)
     await publish({ orgId, type: "presence", conversationId: input.left, actorId: me, data: { viewers: getViewers(orgId, input.left).map((v) => ({ userId: v.userId, composing: normalize(v.composing) })) } })
   }
-  if (!input.conversationId) {
-    if (!input.left) touchPresence(orgId, me, "", false)
-    return json({ viewers: [] })
-  }
+  if (!input.conversationId) return json({ viewers: [] })
 
   const scope = await loadScope(ctx)
   const row = await loadOneAccessible(ctx, scope, input.conversationId)

src/app/api/w/[slug]/uploads/route.ts

@@ -1,6 +1,7 @@
 import { ApiError, json, route } from "@/server/api"
 import { inboxContext } from "@/server/conversations/context"
 import { storeUpload } from "@/server/conversations/files"
+import { getSettings } from "@/server/settings"
 
 /**
  * POST /api/w/[slug]/uploads (multipart/form-data, field "file")
@@ -9,6 +10,12 @@ import { storeUpload } from "@/server/conversations/files"
  */
 export const POST = route<{ slug: string }>(async (req, { params }) => {
   const { ctx } = await inboxContext(req, (await params).slug, { write: true })
+  // Reject oversized bodies before buffering them (exact per-file check happens in storeUpload).
+  const storage = await getSettings("storage")
+  const length = Number(req.headers.get("content-length") || 0)
+  if (length > storage.maxAttachmentMb * 1024 * 1024 + 64 * 1024) {
+    throw new ApiError(413, `Files can be at most ${storage.maxAttachmentMb} MB`, "file_too_large")
+  }
   let form: FormData
   try {
     form = await req.formData()