feat(dashboard): Redesign Convoy dashboard

.gitignore

@@ -42,6 +42,7 @@ convoy
 convoy.json
 convoy.sentinel.json
 docker-compose.yml
+configs/local/convoy.install.generated.json
 configs/local/docker-compose.install.generated.yml
 configs/local/docker-compose.install.override.yml
 compose.yml

api/billing_integration_test.go

@@ -496,8 +496,9 @@ func (s *BillingIntegrationTestSuite) Test_StartSelfHostedTrial_OrganisationAdmi
 	}()
 
 	body, err := json.Marshal(map[string]string{
-		"email": "buyer@example.com",
-		"host":  "https://customer.example.com",
+		"email":         "buyer@example.com",
+		"host":          "https://customer.example.com",
+		"referral_code": "refcode99",
 	})
 	require.NoError(s.T(), err)
 	req := createRequest(http.MethodPost, "/ui/billing/sh_trial/start", "", bytes.NewBuffer(body))
@@ -510,6 +511,7 @@ func (s *BillingIntegrationTestSuite) Test_StartSelfHostedTrial_OrganisationAdmi
 	require.Equal(s.T(), http.StatusOK, w.Code, w.Body.String())
 	require.Equal(s.T(), 1, client.trialCalls)
 	require.Equal(s.T(), "buyer@example.com", client.lastTrial.Email)
+	require.Equal(s.T(), "refcode99", client.lastTrial.ReferralCode)
 	require.NotEmpty(s.T(), client.lastTrial.AttemptID)
 
 	var resp map[string]interface{}

api/handlers/billing_checkout.go

@@ -19,10 +19,11 @@ import (
 )
 
 type startSelfHostedCheckoutRequest struct {
-	Email    string `json:"email"`
-	PlanID   string `json:"plan_id"`
-	Interval string `json:"interval"`
-	Host     string `json:"host"`
+	Email        string `json:"email"`
+	PlanID       string `json:"plan_id"`
+	Interval     string `json:"interval"`
+	Host         string `json:"host"`
+	ReferralCode string `json:"referral_code"`
 }
 
 type completeSelfHostedCheckoutRequest struct {
@@ -32,8 +33,9 @@ type completeSelfHostedCheckoutRequest struct {
 }
 
 type startSelfHostedTrialRequest struct {
-	Email string `json:"email"`
-	Host  string `json:"host"`
+	Email        string `json:"email"`
+	Host         string `json:"host"`
+	ReferralCode string `json:"referral_code"`
 }
 
 // Self-hosted checkout attempt statuses, persisted on datastore.SelfHostedCheckoutAttempt.
@@ -157,6 +159,7 @@ func (h *BillingHandler) StartSelfHostedCheckout(w http.ResponseWriter, r *http.
 		AttemptID:         attemptID,
 		CheckoutNonceHash: nonceHash,
 		LicenseKey:        resubscribeKey,
+		ReferralCode:      strings.TrimSpace(req.ReferralCode),
 	})
 	if err != nil {
 		renderBillingClientError(w, r, err, http.StatusServiceUnavailable)
@@ -235,6 +238,7 @@ func (h *BillingHandler) StartSelfHostedTrial(w http.ResponseWriter, r *http.Req
 		Host:             host,
 		OrganisationName: h.activeOrganisationName(r.Context(), r),
 		AttemptID:        attemptID,
+		ReferralCode:     strings.TrimSpace(req.ReferralCode),
 	})
 	if err != nil {
 		if billingClientErrorIsDefinitive(err) {

api/handlers/event.go

@@ -455,19 +455,22 @@ func (h *Handler) BatchReplayEvents(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		endpointIDs, innerErr := h.getEndpoints(r, portalLink)
+		// Filter may narrow to the caller's endpointId; ownership must stay the full
+		// portal allowlist so multi-endpoint events that only touch owned endpoints still replay.
+		allowed, innerErr := h.getEndpoints(r, portalLink)
 		if innerErr != nil {
 			_ = render.Render(w, r, util.NewServiceErrResponse(innerErr))
 			return
 		}
 
+		endpointIDs := filterAllowedEndpointIDs(data.Filter.EndpointIDs, allowed)
 		if len(endpointIDs) == 0 {
 			_ = render.Render(w, r, util.NewServerResponse("0 successful, 0 failed", nil, http.StatusOK))
 			return
 		}
 
 		data.Filter.EndpointIDs = endpointIDs
-		ownedEndpointIDs = endpointIDs
+		ownedEndpointIDs = allowed
 	}
 
 	ep := datastore.Pageable{}
@@ -560,15 +563,15 @@ func (h *Handler) GetEventsPaged(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		endpointIDs, err := h.getEndpoints(r, portalLink)
+		endpointIDs, err := h.portalScopedEndpointIDs(r, portalLink, data.Filter.EndpointIDs)
 		if err != nil {
 			_ = render.Render(w, r, util.NewServiceErrResponse(err))
 			return
 		}
 
 		if len(endpointIDs) == 0 {
 			_ = render.Render(w, r, util.NewServerResponse("App events fetched successfully",
-				models.PagedResponse{Content: endpointIDs, Pagination: &datastore.PaginationData{PerPage: int64(data.Filter.Pageable.PerPage)}}, http.StatusOK))
+				models.PagedResponse{Content: []models.EventResponse{}, Pagination: &datastore.PaginationData{PerPage: int64(data.Filter.Pageable.PerPage)}}, http.StatusOK))
 			return
 		}
 
@@ -631,7 +634,7 @@ func (h *Handler) CountAffectedEvents(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		endpointIDs, err := h.getEndpoints(r, portalLink)
+		endpointIDs, err := h.portalScopedEndpointIDs(r, portalLink, data.Filter.EndpointIDs)
 		if err != nil {
 			_ = render.Render(w, r, util.NewServiceErrResponse(err))
 			return

api/handlers/event_delivery.go

@@ -139,7 +139,7 @@ func (h *Handler) BatchRetryEventDelivery(w http.ResponseWriter, r *http.Request
 			return
 		}
 
-		endpointIDs, err := h.getEndpoints(r, portalLink)
+		endpointIDs, err := h.portalScopedEndpointIDs(r, portalLink, data.Filter.EndpointIDs)
 		if err != nil {
 			_ = render.Render(w, r, util.NewServiceErrResponse(err))
 			return
@@ -309,15 +309,15 @@ func (h *Handler) GetEventDeliveriesPaged(w http.ResponseWriter, r *http.Request
 			return
 		}
 
-		endpointIDs, err := h.getEndpoints(r, portalLink)
+		endpointIDs, err := h.portalScopedEndpointIDs(r, portalLink, data.Filter.EndpointIDs)
 		if err != nil {
 			_ = render.Render(w, r, util.NewServiceErrResponse(err))
 			return
 		}
 
 		if len(endpointIDs) == 0 {
-			_ = render.Render(w, r, util.NewServerResponse("App events fetched successfully",
-				models.PagedResponse{Content: endpointIDs, Pagination: &datastore.PaginationData{PerPage: int64(data.Filter.Pageable.PerPage)}}, http.StatusOK))
+			_ = render.Render(w, r, util.NewServerResponse("Event deliveries fetched successfully",
+				models.PagedResponse{Content: []models.EventDeliveryResponse{}, Pagination: &datastore.PaginationData{PerPage: int64(data.Filter.Pageable.PerPage)}}, http.StatusOK))
 			return
 		}
 
@@ -365,7 +365,7 @@ func (h *Handler) CountAffectedEventDeliveries(w http.ResponseWriter, r *http.Re
 			return
 		}
 
-		endpointIDs, err := h.getEndpoints(r, portalLink)
+		endpointIDs, err := h.portalScopedEndpointIDs(r, portalLink, data.Filter.EndpointIDs)
 		if err != nil {
 			_ = render.Render(w, r, util.NewServiceErrResponse(err))
 			return

api/handlers/portal_link.go

@@ -406,6 +406,41 @@ func portalLinkResponse(pl *datastore.PortalLink, baseUrl string) datastore.Port
 	}
 }
 
+// filterAllowedEndpointIDs returns the requested endpoint IDs that fall within
+// the portal link's allowed set. If no endpoint IDs were requested, the full
+// allowed set is returned. Requested IDs outside the allowed set are dropped,
+// so a portal token can never widen its scope.
+func filterAllowedEndpointIDs(requested, allowed []string) []string {
+	if len(requested) == 0 {
+		return allowed
+	}
+
+	allowedSet := make(map[string]struct{}, len(allowed))
+	for _, id := range allowed {
+		allowedSet[id] = struct{}{}
+	}
+
+	results := make([]string, 0, len(requested))
+	for _, id := range requested {
+		if _, ok := allowedSet[id]; ok {
+			results = append(results, id)
+		}
+	}
+
+	return results
+}
+
+// portalScopedEndpointIDs resolves the portal allowlist, then intersects it with
+// any caller-supplied endpoint filter. Failure policy: empty intersection means
+// no accessible endpoints (caller should return empty success, not widen scope).
+func (h *Handler) portalScopedEndpointIDs(r *http.Request, portalLink *datastore.PortalLink, requested []string) ([]string, error) {
+	allowed, err := h.getEndpoints(r, portalLink)
+	if err != nil {
+		return nil, err
+	}
+	return filterAllowedEndpointIDs(requested, allowed), nil
+}
+
 func (h *Handler) getEndpoints(r *http.Request, pl *datastore.PortalLink) ([]string, error) {
 	results := make([]string, 0)
 	if !util.IsStringEmpty(pl.OwnerID) {

api/handlers/portal_link_filter_test.go

@@ -0,0 +1,31 @@
+package handlers
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestFilterAllowedEndpointIDs(t *testing.T) {
+	allowed := []string{"ep-a", "ep-b", "ep-c"}
+
+	t.Run("no request returns full allowlist", func(t *testing.T) {
+		require.Equal(t, allowed, filterAllowedEndpointIDs(nil, allowed))
+		require.Equal(t, allowed, filterAllowedEndpointIDs([]string{}, allowed))
+	})
+
+	t.Run("keeps only requested ids that are allowed", func(t *testing.T) {
+		require.Equal(t, []string{"ep-b"}, filterAllowedEndpointIDs([]string{"ep-b"}, allowed))
+		require.Equal(t, []string{"ep-a", "ep-c"}, filterAllowedEndpointIDs([]string{"ep-a", "ep-c"}, allowed))
+	})
+
+	t.Run("drops ids outside the allowlist", func(t *testing.T) {
+		require.Empty(t, filterAllowedEndpointIDs([]string{"ep-outside"}, allowed))
+		require.Equal(t, []string{"ep-a"}, filterAllowedEndpointIDs([]string{"ep-outside", "ep-a"}, allowed))
+	})
+
+	t.Run("empty allowlist never widens", func(t *testing.T) {
+		require.Empty(t, filterAllowedEndpointIDs([]string{"ep-a"}, nil))
+		require.Empty(t, filterAllowedEndpointIDs([]string{"ep-a"}, []string{}))
+	})
+}