diff --git a/README.md b/README.md
index ec2b1b9f9e4..cdcbc6c4a75 100644
--- a/README.md
+++ b/README.md
@@ -121,12 +121,12 @@ npx novu@latest connect
## Embeddable Inbox component
-Using the Novu API and admin panel, you can easily add a real-time notification center to your web app without building it yourself. You can use our [React](https://docs.novu.co/inbox/react/get-started?utm_source=github&utm_medium=readme&utm_campaign=react-starter-link), or build your own via our API and SDK. React native, Vue, and Angular are coming soon.
+Using the Novu API and admin panel, you can easily add a real-time notification center to your web app without building it yourself. You can use our [React](https://docs.novu.co/platform/quickstart/react?utm_source=github&utm_medium=readme&utm_campaign=react-starter-link), or build your own via our API and SDK. React native, Vue, and Angular are coming soon.
-Read more about how to add a [notification center Inbox](https://docs.novu.co/inbox/react/get-started?utm_source=github&utm_medium=readme&utm_campaign=read-more-react-link) to your app.
+Read more about how to add a [notification center Inbox](https://docs.novu.co/platform/quickstart/react?utm_source=github&utm_medium=readme&utm_campaign=read-more-react-link) to your app.
@@ -251,7 +251,7 @@ Expand a channel below to browse supported providers.
| Provider |
| --- |
-| [Novu Inbox](https://docs.novu.co/inbox/react/get-started?utm_source=github&utm_medium=repository&utm_campaign=inbox-channel-link) |
+| [Novu Inbox](https://docs.novu.co/platform/quickstart/react?utm_source=github&utm_medium=repository&utm_campaign=inbox-channel-link) |
@@ -275,9 +275,7 @@ Novu is a commercial open source company, which means some parts of this open so
The following modules and folders are licensed under the enterprise license:
-- `enterprise` folder at the root of the project and all of their subfolders and modules
-- `apps/web/src/ee` folder and all of their subfolders and modules
-- `apps/dashboard/src/ee` folder and all of their subfolders and modules
+- `enterprise` folder at the root of the project and all of its subfolders and modules
## 💪 Thanks to all of our contributors
diff --git a/apps/api/package.json b/apps/api/package.json
index ae609f96a0f..67faa74147f 100644
--- a/apps/api/package.json
+++ b/apps/api/package.json
@@ -1,6 +1,6 @@
{
"name": "@novu/api-service",
- "version": "3.19.0",
+ "version": "3.19.1",
"description": "description",
"author": "",
"private": "true",
diff --git a/apps/api/src/app/integrations/utils/validate-outbound-integration-credentials.spec.ts b/apps/api/src/app/integrations/utils/validate-outbound-integration-credentials.spec.ts
new file mode 100644
index 00000000000..d4b54a3313c
--- /dev/null
+++ b/apps/api/src/app/integrations/utils/validate-outbound-integration-credentials.spec.ts
@@ -0,0 +1,61 @@
+import { EmailProviderIdEnum, PushProviderIdEnum, SmsProviderIdEnum } from '@novu/shared';
+import { expect } from 'chai';
+import { validateOutboundIntegrationCredentials } from './validate-outbound-integration-credentials';
+
+const ORIGINAL_CI_EE_TEST = process.env.CI_EE_TEST;
+const ORIGINAL_SELF_HOSTED = process.env.IS_SELF_HOSTED;
+
+function restoreEnv(name: string, value: string | undefined): void {
+ if (value === undefined) {
+ delete process.env[name];
+
+ return;
+ }
+
+ process.env[name] = value;
+}
+
+describe('validateOutboundIntegrationCredentials', () => {
+ beforeEach(() => {
+ process.env.CI_EE_TEST = 'true';
+ process.env.IS_SELF_HOSTED = 'false';
+ });
+
+ afterEach(() => {
+ restoreEnv('CI_EE_TEST', ORIGINAL_CI_EE_TEST);
+ restoreEnv('IS_SELF_HOSTED', ORIGINAL_SELF_HOSTED);
+ });
+
+ const privateTargetCases = [
+ [EmailProviderIdEnum.Infobip, { baseUrl: 'http://127.0.0.1:3000' }],
+ [EmailProviderIdEnum.Braze, { apiURL: 'http://127.0.0.1:3000' }],
+ [EmailProviderIdEnum.Mailgun, { baseUrl: 'http://127.0.0.1:3000' }],
+ [SmsProviderIdEnum.SmsCentral, { baseUrl: 'http://127.0.0.1:3000' }],
+ [SmsProviderIdEnum.Mobishastra, { baseUrl: 'http://127.0.0.1:3000' }],
+ [SmsProviderIdEnum.Kannel, { host: '127.0.0.1', port: '3000' }],
+ [PushProviderIdEnum.AppIO, { AppIOBaseUrl: 'http://127.0.0.1:3000' }],
+ ] as const;
+
+ for (const [providerId, credentials] of privateTargetCases) {
+ it(`blocks a private ${providerId} target on Cloud`, async () => {
+ let error: Error | undefined;
+
+ try {
+ await validateOutboundIntegrationCredentials(providerId, credentials);
+ } catch (caughtError) {
+ error = caughtError as Error;
+ }
+
+ expect(error?.message).to.match(/blocked|not allowed/i);
+ });
+ }
+
+ it('preserves private Kannel targets for self-hosted deployments', async () => {
+ process.env.IS_SELF_HOSTED = 'true';
+
+ await validateOutboundIntegrationCredentials(SmsProviderIdEnum.Kannel, {
+ host: '10.0.0.1',
+ port: '13013',
+ });
+ });
+});
diff --git a/apps/api/src/app/integrations/utils/validate-outbound-integration-credentials.ts b/apps/api/src/app/integrations/utils/validate-outbound-integration-credentials.ts
index 6929f57e257..01cba4bc6d6 100644
--- a/apps/api/src/app/integrations/utils/validate-outbound-integration-credentials.ts
+++ b/apps/api/src/app/integrations/utils/validate-outbound-integration-credentials.ts
@@ -1,5 +1,12 @@
import { BadRequestException } from '@nestjs/common';
-import { assertAllowedSinchSmsRegion, EmailProviderIdEnum, ICredentials, SmsProviderIdEnum } from '@novu/shared';
+import { resolveSafeInfobipBaseUrl, resolveSafeProviderUrl } from '@novu/providers';
+import {
+ assertAllowedSinchSmsRegion,
+ EmailProviderIdEnum,
+ ICredentials,
+ PushProviderIdEnum,
+ SmsProviderIdEnum,
+} from '@novu/shared';
type ValidateSmtpOutboundTargetModule = typeof import('@novu/shared/dist/cjs/utils/validate-smtp-outbound-target');
@@ -27,6 +34,52 @@ export async function validateOutboundIntegrationCredentials(
if (providerId === SmsProviderIdEnum.Sinch) {
assertAllowedSinchSmsRegion(credentials.region);
}
+
+ if (providerId === EmailProviderIdEnum.Infobip) {
+ resolveSafeInfobipBaseUrl(credentials.baseUrl);
+ }
+
+ if (providerId === EmailProviderIdEnum.Braze) {
+ resolveSafeProviderUrl(credentials.apiURL, {
+ blockedPrefix: 'Braze API URL blocked',
+ isHostnameAllowed: (hostname) => /^rest\.[a-z0-9-]+\.braze\.(com|eu)$/.test(hostname),
+ requireHttps: true,
+ });
+ }
+
+ if (providerId === EmailProviderIdEnum.Mailgun) {
+ resolveSafeProviderUrl(credentials.baseUrl || 'https://api.mailgun.net', {
+ allowedHostnames: ['api.mailgun.net', 'api.eu.mailgun.net'],
+ blockedPrefix: 'Mailgun base URL blocked',
+ requireHttps: true,
+ });
+ }
+
+ if (providerId === SmsProviderIdEnum.SmsCentral) {
+ resolveSafeProviderUrl(credentials.baseUrl || 'https://my.smscentral.com.au/api/v3.2', {
+ blockedPrefix: 'SMS Central base URL blocked',
+ });
+ }
+
+ if (providerId === SmsProviderIdEnum.Mobishastra) {
+ resolveSafeProviderUrl(credentials.baseUrl, {
+ blockedPrefix: 'Mobishastra base URL blocked',
+ });
+ }
+
+ if (providerId === SmsProviderIdEnum.Kannel) {
+ resolveSafeProviderUrl(`http://${credentials.host}:${credentials.port}/cgi-bin`, {
+ blockedPrefix: 'Kannel host blocked',
+ });
+ }
+
+ if (providerId === PushProviderIdEnum.AppIO) {
+ resolveSafeProviderUrl(credentials.AppIOBaseUrl || 'https://api.io.italia.it/api/v1', {
+ allowedHostnames: ['api.io.italia.it'],
+ blockedPrefix: 'AppIO base URL blocked',
+ requireHttps: true,
+ });
+ }
} catch (error) {
if (error instanceof Error) {
throw new BadRequestException(error.message);
diff --git a/apps/dashboard/package.json b/apps/dashboard/package.json
index cb921ade6ba..8695da33670 100644
--- a/apps/dashboard/package.json
+++ b/apps/dashboard/package.json
@@ -1,7 +1,7 @@
{
"name": "@novu/dashboard",
"private": true,
- "version": "3.19.2",
+ "version": "3.19.3",
"type": "module",
"portless": {
"name": "dashboard.novu"
diff --git a/apps/dashboard/src/components/agents/create-agent-fields/claude-credentials-fields.tsx b/apps/dashboard/src/components/agents/create-agent-fields/claude-credentials-fields.tsx
deleted file mode 100644
index a255d45a85c..00000000000
--- a/apps/dashboard/src/components/agents/create-agent-fields/claude-credentials-fields.tsx
+++ /dev/null
@@ -1,140 +0,0 @@
-import { useId, useState } from 'react';
-import { RiArrowRightUpLine, RiEyeLine, RiEyeOffLine, RiInformation2Line } from 'react-icons/ri';
-import { Input } from '@/components/primitives/input';
-import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/primitives/tooltip';
-import {
- ANTHROPIC_API_KEY_HREF,
- CLAUDE_WORKSPACE_HREF,
- type CreateAgentFormErrors,
- DEFAULT_CLAUDE_WORKSPACE_ID,
-} from './types';
-
-type ClaudeCredentialsFieldsProps = {
- apiKey: string;
- workspaceId: string;
- errors: CreateAgentFormErrors;
- disabled?: boolean;
- onApiKeyChange: (next: string) => void;
- onWorkspaceIdChange: (next: string) => void;
-};
-
-export function ClaudeCredentialsFields({
- apiKey,
- workspaceId,
- errors,
- disabled,
- onApiKeyChange,
- onWorkspaceIdChange,
-}: ClaudeCredentialsFieldsProps) {
- const formId = useId();
- const apiKeyId = `${formId}-api-key`;
- const workspaceIdInputId = `${formId}-workspace-id`;
- const [showSecret, setShowSecret] = useState(false);
-
- return (
-
-
-
-
-
-
-
-
-
-
-
- Your Anthropic API key is encrypted and stored securely. It is used to provision the agent on Claude
- Platform.
-
-
-
-
-
-
-
-
-
-
-
- The Anthropic workspace your API key is scoped to. Leave empty for the Default Workspace. For custom
- workspaces, paste the `wrkspc_…` id from the Claude Console (Settings → Workspaces). Used for the
- in-product "Open in Claude" deep link.
-
-
-