feat: approved campaign sends for a separate send identity (v0.4.0) #18

Merged

jlxq0 merged 1 commit from feat/approved-send into master

2026-10-30 14:59:50 +00:00

jlxq0 commented

2026-10-30 14:58:04 +00:00

Owner

Julian (30 Oct 2026) approves sending through MCP case by case. Meets HARDGATE_DESIGN's four conditions: a distinct send identity (LISTMONK_MCP_SEND_TOKEN_SHA256, must differ from read tokens, recorded in the request scope by the auth middleware), per-campaign authorization (id + exact subject, campaign lists within LISTMONK_MCP_SEND_LISTS, startable state), every campaign send path gated (send, schedule, status running/scheduled), transactional/opt-in/import/SMTP test still refused for everyone, and red/green tests through the real HTTP app (tests/test_approved_send.py). Julian explicitly allowed merging without independent review.

Release steps: merge, tag v0.4.0 on the merge commit, platform rollout with the send digest and LISTMONK_MCP_SEND_LISTS=3.

🤖 Generated with Claude Code

https://claude.ai/code/session_01E2xQRZ4ZSWoBgs1TvyWXFY

Julian (30 Oct 2026) approves sending through MCP case by case. Meets HARDGATE_DESIGN's four conditions: a distinct send identity (`LISTMONK_MCP_SEND_TOKEN_SHA256`, must differ from read tokens, recorded in the request scope by the auth middleware), per-campaign authorization (id + exact subject, campaign lists within `LISTMONK_MCP_SEND_LISTS`, startable state), every campaign send path gated (send, schedule, status running/scheduled), transactional/opt-in/import/SMTP test still refused for everyone, and red/green tests through the real HTTP app (`tests/test_approved_send.py`). Julian explicitly allowed merging without independent review. Release steps: merge, tag `v0.4.0` on the merge commit, platform rollout with the send digest and `LISTMONK_MCP_SEND_LISTS=3`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01E2xQRZ4ZSWoBgs1TvyWXFY

jlxq0 added 1 commit

2026-10-30 14:58:04 +00:00

feat: approved campaign sends for a separate send identity (v0.4.0)

CI / python (pull_request) Successful in 42s

Details

CI / docker (pull_request) Successful in 50s

Details

f041b048ea

Julian, 30 Oct 2026: send, schedule and status changes stay guarded but
work when he approves them case by case. A second token
(LISTMONK_MCP_SEND_TOKEN_SHA256), distinct from every read token, is the
only identity that may start a campaign; the auth middleware records it in
the request scope, so no argument can claim it. A send must name the
campaign by id and exact subject, target only LISTMONK_MCP_SEND_LISTS and
start from draft, paused or scheduled. The read identity never sends;
transactional, opt-in, import and SMTP-test mail stay refused for both.
Red/green tests drive the real HTTP app for every path.

Carried patch: fleet policy, not for upstream.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E2xQRZ4ZSWoBgs1TvyWXFY

jlxq0 merged commit b7e05ce19e into master

2026-10-30 14:59:50 +00:00

jlxq0 deleted branch feat/approved-send

2026-10-30 14:59:50 +00:00

jlxq0 referenced this pull request from a commit

2026-10-30 14:59:52 +00:00

Merge pull request 'feat: approved campaign sends for a separate send identity (v0.4.0)' (#18) from feat/approved-send into master