Fixed email domains workspace isolation - added workspace_id column and updated all 6 API endpoints #lopodesk

Domain whitelisting complete - workspaces can now restrict which websites embed their chat widget. Backwards compatible (empty = allow all). #lopodesk

Created domain configuration UI in chat settings - add/remove domains with pattern validation and localhost support for dev. #lopodesk

Secured all public chat API endpoints (start, messages.get, messages.post) with Origin/Referer header validation against allowed domains. #lopodesk

Built domain validation utility with wildcard support - *.example.com now matches all subdomains including base domain. #lopodesk

Added chat_allowed_domains TEXT[] column to crm_workspaces table for storing allowed domain patterns per workspace. #lopodesk

Identified security concern with chat widget - anyone with chat code could embed it on unauthorized domains. Planning domain whitelisting feature. #lopodesk

Designed a new favicon for Lopodesk - geometric "LD" letters with cyan-to-purple gradient on dark background. SVG format for crisp rendering at any size. #lopodesk

Added embeddable chat widget with security hardening (XSS, CSS injection, rate limiting, input validation) #lopodesk

Fix visitor message color - changed gradient to solid gray for readability #lopodesk

Add resizable chat window (drag top edge to expand height) #lopodesk

Add chat archive functionality in CRM with archive button in chat list #lopodesk

Auto-open chat windows when new visitor messages arrive in CRM #lopodesk

Implement email domain configuration page (Resend API integration) #lopodesk

Add close chat functionality for visitors and CRM agents #lopodesk

Fix chat widget padding issues for visitor page #lopodesk

Added invite cancellation via API endpoint #lopodesk

Fixed invited users skipping onboarding correctly #lopodesk

Configured Resend SMTP for Supabase auth emails #lopodesk

Created SQL function to fetch workspace members #lopodesk