merge: upstream v2.25.0 (87 commits - self-hosting connector, responsive UI, media hardening)

[JOY (JOY)]

Upstream sync 374fb20..8e42f09 (= tag v2.25.0), 87 commits since upstream-sync-20260926 (PR #65).

Features: self-hosting connector (relay a self-hosted Postiz to Postiz Cloud MCP), responsive UI pass, channel group rename from menu, Canva intent, Instagram custom thumbnail as reel cover, MCP video cover attachments.

Fixes: media pipeline hardening (SSRF-safe reads via axios client, stalled-read 2min timeout + fail instead of repeating publish, HTTP Range honored/clamped, batch upload failure isolation, upload-step error surfacing), TikTok publish/analytics id resolution, Facebook temporary posting-rate retry (368/1390008), Telegram no longer logs post text, Sentry pinned 10.56.0 (span/scope leak), editor no longer wipes in-flight uploads, web3/custom-fields/extension connect flows stop on 402.

Conflicts resolved:

• .env.example + CLAUDE.md: union (Crove blocks + upstream additions).
• pnpm-lock.yaml: upstream side regenerated against the merged package.json.
• main.billing.component: keep Crove's showPortalAndCancel plan gating, add upstream's responsive button classes.
• oauth.controller: union imports (self-hosted endpoint plumbing, inert without env).
• onboarding.modal / public.component / oauth/authorize/page: took the CROVE side wholesale - these are the brand-gated upstream-shared UI surfaces (official connector directory URLs route users to the upstream cloud; the branding guard exists to keep them out). Upstream's self-hosted connector UI is a Postiz-Cloud branding surface and is intentionally not shipped here.

Schema (deploy gating): new OAuthSelfHostedAuthorization table + OAuthApp.organizationId index. Beta DB gets the idempotent DDL at deploy; the shared prod DB goes through the DOS-Me ledger before the prod deploy (rule 9). Migration SQL follows via the DOS-Me handoff.

---

📌 TL;DR

This PR introduces a self-hosted MCP relay authorization flow, adds HTTP Range request support to the upload API to fix video uploads, and implements extensive mobile responsiveness improvements across the dashboard, calendar, and developer tools.

🎯 Type of Change

• 🚀 New feature
• 🐛 Bugfix
• 🧹 Refactor
• ⚡ Performance
• 📚 Documentation
• ⚙️ CI / Configuration

🔍 Changes Walkthrough

File	Summary of Changes
.env.example	Added configuration variables for Apple Sign-In, Canva App Origin, OpenAI/ChatGPT OAuth, and MCP self-hosted relay settings.
apps/backend/src/api/routes/enterprise.controller.ts	Minor formatting adjustment to JWT verification logic.
apps/backend/src/api/routes/integrations.controller.ts	Added PUT /customers/:id endpoint to update customer names.
apps/backend/src/api/routes/oauth.controller.ts	Implemented POST /authorize/self-hosted for MCP relay connections, added throttling, and fixed token endpoint status code to 200 for Canva compatibility.
apps/backend/src/main.ts	Added CANVA_APP_ORIGIN to the CORS allowed origins list.
apps/backend/src/public-api/routes/v1/public.integrations.controller.ts	Added GET /me endpoint to return organization and user details for OAuth app tokens.
apps/backend/src/services/auth/public.auth.middleware.ts	Propagated userId from OAuth authorization to the request object for the new /me endpoint.
apps/frontend/src/app/(app)/api/uploads/[[...path]]/route.ts	Implemented HTTP Range request handling (206 Partial Content) to support chunked video uploads for providers like TikTok and YouTube.
apps/frontend/src/app/global-error.tsx	Simplified Sentry error reporting to avoid dependency on the variables context which is unavailable in the global error boundary.
apps/frontend/src/components/agents/agent.tsx	Added mobile-specific layout classes to stack agent list and threads vertically on small screens.
apps/frontend/src/components/billing/main.billing.component.tsx	Adjusted button and text alignment for mobile responsiveness.
apps/frontend/src/components/developer/developer.component.tsx	Added mobile padding, flex-wrap, and text-break classes to OAuth application management UI.
apps/frontend/src/components/launches/add.provider.component.tsx	Added handling for 402 Payment Required responses during integration connection and adjusted grid layout for mobile.
apps/frontend/src/components/launches/calendar.context.tsx	Defaulted calendar view to "day" on mobile devices to prevent overflow.
apps/frontend/src/components/launches/calendar.tsx	Added tablet/mobile grid column adjustments and shrink-0 classes to prevent layout collapse.
apps/frontend/src/components/launches/filters.tsx	Made filter bar flex-wrap and adjusted widths for mobile screens.
apps/frontend/src/components/launches/helpers/date.picker.tsx	Adjusted date picker positioning and text size for mobile.
apps/frontend/src/components/launches/launches.component.tsx	Implemented a mobile bottom-sheet pattern for the channels sidebar and added a group name editing modal.
apps/frontend/src/components/launches/menu/menu.tsx	Added logic to prevent context menus from overflowing the right edge of the viewport on small screens.
apps/frontend/src/components/layout/impersonate.tsx	Adjusted impersonation banner layout for mobile devices.

📊 Architectural Flow

sequenceDiagram
    participant Client as MCP Client (e.g., Claude)
    participant Backend as Postiz Backend
    participant Relay as MCP Relay Service
    participant SelfHosted as Self-Hosted Instance

    Client->>Backend: POST /oauth/authorize/self-hosted
    Note right of Client: Includes instance_url, api_key, client_id
    Backend->>Backend: Validate Authorization Request
    Backend->>Relay: connect(instance_url, api_key)
    Relay->>SelfHosted: Verify Connection
    SelfHosted-->>Relay: Success
    Relay-->>Backend: Instance Metadata
    Backend->>Backend: Create Self-Hosted Authorization Code
    Backend-->>Client: Redirect with Code
    Client->>Backend: POST /oauth/token
    Note right of Client: Exchange Code for Token
    Backend-->>Client: Access Token (200 OK)

Loading

[gemini-code-assist]

Code Review

This pull request introduces support for connecting and relaying Model Context Protocol (MCP) and OAuth requests to self-hosted Postiz instances, alongside various mobile responsiveness and UI enhancements across the frontend. Key feedback includes addressing a potential hydration mismatch in the calendar context by avoiding dynamic window checks during render, replacing blocking synchronous file reads (readFileSync) with asynchronous alternatives (promises.readFile) in the social integrations abstract class, and adding optional chaining to prevent runtime errors when integrations are undefined during loading states.

[gemini-code-assist]

Initializing the cookie default value dynamically using window.matchMedia during render will cause a Hydration Mismatch in Next.js. The server-rendered HTML (which defaults to 'week' because window is undefined) will not match the client-rendered HTML on mobile devices (which defaults to 'day').

To fix this, initialize the cookie with a static default value (e.g., 'week'), and use a useEffect hook to dynamically switch to 'day' on mount if the user is on a mobile device and no cookie has been set yet.

Suggested change

	// A 7-column week doesn't fit a phone, so default small screens (tailwind `mobile`) to the day view
	const [displaySaved, setDisplaySaved] = useCookie(
	'calendar-display',
	typeof window !== 'undefined' &&
	window.matchMedia('(max-width: 1025px)').matches
	? 'day'
	: 'week'
	);
	const display = searchParams.get('display') || displaySaved;
	const [displaySaved, setDisplaySaved] = useCookie('calendar-display', 'week');
	const display = searchParams.get('display') || displaySaved;
	useEffect(() => {
	if (window.matchMedia('(max-width: 1025px)').matches) {
	const hasCookie = document.cookie.includes('calendar-display=');
	if (!hasCookie) {
	setDisplaySaved('day');
	}
	}
	}, [setDisplaySaved]);

[gemini-code-assist]

Import promises from 'fs' instead of readFileSync to allow asynchronous, non-blocking file reads.

Suggested change

	import { createReadStream, readFileSync, statSync } from 'fs';
	import { createReadStream, promises, statSync } from 'fs';

[gemini-code-assist]

Use promises.readFile instead of readFileSync to prevent blocking the Node.js event loop when reading local media files.

Suggested change

	return readFileSync(path);
	return promises.readFile(path);

[gemini-code-assist]

If integrations is undefined or null (e.g., during the initial loading state), calling .find() on it will throw a runtime error. Use optional chaining integrations?.find to safely handle this case.

Suggested change

	const integration = integrations.find(
	(i) => i.id === post.integration.id
	);
	const integration = integrations?.find(
	(i) => i.id === post.integration.id
	);

[JOY (JOY)]

Reviewer disposition (verified finding re: Range handling in the uploads route): accepted-as-is, not patched.

The verified claim is that the Range regex does not match multi-range headers, so a multi-range request is served a full-file 200 instead of 206/416. That is RFC 7233-compliant behavior (a server MAY ignore Range and return 200; every mainstream upload client handles it), it is upstream's shipped-and-tested v2.25.0 code, and patching upstream logic in a sync PR is against the standing no-shared-rebuilds directive. If a real client ever breaks on this, a targeted follow-up patch (take first range, 206) is the documented remediation.

The two security claims (authorizeSelfHosted public endpoint, public.auth.middleware userId) were verified-dismissed by the critic - no authorization bypass; apiKey validation happens in McpRelayService and userId is signature-bound.