Changelog - Dev - 07.30.2026
All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog.
[Unreleased] - 2026-07-30
Added
- Server-signed wave accept endpoint: Wave accepts are now validated and processed server-side via POST /lanterns/wave/:waveId/accept instead of client-side Firestore mutations. This improves privacy by removing client-side validation logic and centralizes the wave lifecycle on the server. (#743)
enhancementprivacyanalytics
Update - 2026-07-30 17:25 UTC
Added
- Integrate Prelude OTP costs into billing system: OTP verification spend is now tracked and billed per successful verification event (~$0.035 each) rather than per send attempt. Billable events are counted uniformly across all verification paths (signup, appeals, future callers) at the provider seam, with dedicated metrics storage and admin visibility for cost monitoring and cap alerting. (#744)
enhancement
Update - 2026-07-30 18:02 UTC
Added
- Add drop-rate alerting and abuse logging for analytics: Introduces Cloud Monitoring log-match alerts on analytics-api write failures and an abuse log to close out observability gaps in the analytics pipeline. Completes the hardening work started in the cluster upgrade by adding visibility into data loss and anomalous behavior. (#745)
enhancement
Update - 2026-07-30 18:52 UTC
Changed
- Enforce authentication across all Cloud Run services: All Cloud Run API services now have strict authentication enforcement with zero OpenAPI drift. The openapi-sync scanner now resolves dispatcher routing patterns, enabling full coverage of services like auth that use express.Router sub-mounts. (#746)
devops
Update - 2026-07-30 19:36 UTC
Changed
- Period dashboards now read from BigQuery: Period dashboards now query BigQuery instead of the operational Firestore store, improving performance and data accuracy. This also fixes a critical bug where period calculations were returning zeros because the dashboards were filtering on incorrect timestamp fields (createdAt instead of litAt/sentAt). (#747)
enhancement
Update - 2026-07-30 20:08 UTC
Removed
- Retire dead Cloud Function modules: Removed legacy Cloud Function modules (adminAuth.js, moderation.js, phoneLookup.js) that have been fully replaced by Cloud Run endpoints for months. An audit confirmed zero callers remain in the codebase, reducing maintenance burden and technical debt. (#748)
devops
Update - 2026-07-30 20:46 UTC
Added
- Migrate system health to analytics API: System health monitoring is now available via GET /analytics/admin/system-health endpoint, consolidating six monitoring sections (Firestore counts, Cloud Monitoring, Cloudflare, Railway, client errors, uptime checks) into a single analytics API behind existing admin authentication. The admin portal's System Health page now consumes this API instead of a standalone Cloud Function. (#750)
enhancement
Update - 2026-07-30 22:06 UTC
Added
- Migrate feature request callables to assistant-api: Moves the createFeatureRequest and checkDuplicates Cloud Function callables into the assistant-api service behind POST /assistant/feature-requests and /check-duplicates endpoints. All validation, sanitization, rate limiting, and Discord notification behavior is preserved from the original implementation. (#751)
enhancement
Update - 2026-07-30 22:58 UTC
Added
- Migrate GitHub console callables to assistant-api: Consolidated 12 GitHub-related Cloud Functions (~1,600 lines) into the assistant-api backend under /assistant/github/* with proper admin authentication and rate limiting. This centralizes repo access, collaborator status checks, invite management, and user search behind a unified, secured endpoint. (#752)
enhancement