 Florian Sylvain
|
10a66cd979
|
feat: change email, export my data, delete account (with data anonymization)
|
2026-10-30 20:19:07 +01:00 |
|
|
Florian Sylvain
|
b39a41be88
|
refac: DELETE /v1/user/{id}?expected_role_id=N, user.remove audit event, 409 target_role_not_found, GetAll returns its error, Own-scope visibility filter moved into repos, JSON tags removed from use-case types
|
2026-10-29 16:28:25 +01:00 |
|
|
Florian Sylvain
|
80f7037d3a
|
feat: Users API, ownership transfer and removal of the legacy role string
|
2026-10-27 03:08:15 +01:00 |
|
|
Florian Sylvain
|
094df63a7f
|
feat: /v1/role list, get, create, update and delete. Reassign members on delete. Write-time validation (ValidateGrants, duplicates, typed keys against real content types). Name uniqueness (role_name_taken), role_locked, role_has_members, role_conflict on version mismatch. No-escalation: nobody grants a permission they don't hold, and roles.edit_owner_only guards the Owner role. Activity events for role changes. Typed-key exposure in /auth/me. Cleanup of typed rows when a content type is deleted. | Backend only. Will carry the deferred ListGrants decision.
|
2026-10-27 00:45:24 +01:00 |
|
|
Florian Sylvain
|
a043f7f41a
|
refac: debt on role backend
|
2026-10-26 23:34:35 +01:00 |
|
|
Florian Sylvain
|
de142f6c5f
|
feat: more role backend and admin/writer roles additions and adjustments
|
2026-10-26 18:15:26 +01:00 |
|
|
Florian Sylvain
|
8c6c6456da
|
feat: roles system backend
|
2026-10-26 05:02:49 +01:00 |
|
|
Florian Sylvain
|
4cff43fefb
|
feat: llms.txt and llms-full.txt, openapi.json, MCP server
|
2026-10-23 01:29:59 +02:00 |
|
|
Florian Sylvain
|
ea98c5ec05
|
fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)
|
2026-10-22 00:49:19 +02:00 |
|
|
Florian Sylvain
|
c68e9a7858
|
refac: removed 7 direct and 12 indirect go modules for custom code instead
|
2026-10-21 23:13:46 +02:00 |
|
|
Florian Sylvain
|
73a75d5cb9
|
feat: custom content type icons, built-in types, user lookup
|
2026-10-19 18:22:55 +02:00 |
|
|
Florian Sylvain
|
58d58f5a04
|
feat: custom content types backend
|
2026-10-19 17:01:37 +02:00 |
|
|
Florian Sylvain
|
daf3594316
|
fix: technical debts left by the Sites, Authors and SEO slices, plus backend support for the new Sites and Authors pagination
|
2026-10-19 00:25:31 +02:00 |
|
|
Florian Sylvain
|
eb9876fde3
|
feat: SEO backend output (2/4)
|
2026-10-15 21:48:55 +02:00 |
|
|
Florian Sylvain
|
b34a173d83
|
feat: Authors feature backend (and upgraded deprecated mods)
|
2026-10-14 17:45:00 +02:00 |
|
|
Florian Sylvain
|
a11338094e
|
feat: Sites feature backend
|
2026-10-14 03:56:50 +02:00 |
|
 fsylvain
|
d768668014
|
feat: image variants cache panel
|
2026-10-08 21:13:32 +02:00 |
|
|
fsylvain
|
951fef18ba
|
feat: image variants per image
|
2026-10-08 19:57:51 +02:00 |
|
|
fsylvain
|
f1d56ef50e
|
feat: image variants engine
|
2026-10-08 02:33:32 +02:00 |
|
|
fsylvain
|
e37a46a027
|
feat: activity log producers
|
2026-10-06 22:25:23 +02:00 |
|
|
fsylvain
|
50b1649965
|
feat: activity log backend foundation
|
2026-10-06 20:35:03 +02:00 |
|
|
fsylvain
|
81e299f09a
|
refac: decouple persistence and image storage behind driver registries
|
2026-10-06 02:13:35 +02:00 |
|
|
fsylvain
|
e82d0ce254
|
feat: media duplicate purge, part 1 of 3: persisted purge settings and the purge API
|
2026-10-05 18:24:03 +02:00 |
|
|
fsylvain
|
1d4f4bd2cc
|
fix: missing security headers on every response, including the SPA and uploaded images
|
2026-10-05 16:19:37 +02:00 |
|
|
fsylvain
|
844842fdae
|
feat: integration v2 and API key PART 1/3
|
2026-10-04 21:56:14 +02:00 |
|
|
fsylvain
|
54e8fd5fed
|
feat: restart to apply update, privileged helper, rollback
|
2026-10-01 21:36:40 +02:00 |
|
|
fsylvain
|
70460e4170
|
feat: update button (download, verify, stage)
|
2026-10-01 18:13:45 +02:00 |
|
|
fsylvain
|
834493a4f5
|
feat: signed releases, release feed, notification (read-only)
|
2026-10-01 15:01:53 +02:00 |
|
|
fsylvain
|
b3793d5dbb
|
feat: media picker and image removal
|
2026-10-01 05:04:58 +02:00 |
|
|
fsylvain
|
0d99544579
|
feat(API): media library
|
2026-09-30 18:35:28 +02:00 |
|
|
fsylvain
|
153fd8719a
|
feat: invite management API: DELETE /v1/user/invite/:id (204, cancels a pending invite) and POST /v1/user/invite/:id/renew (200, new code, expires_at = now+3d, created_at = now, resends the invitation email, old link dead)
|
2026-09-30 01:36:43 +02:00 |
|
|
fsylvain
|
461e93e3b5
|
feat: add Role (owner|admin) to the user domain, persistence model and mapper
|
2026-09-30 00:58:58 +02:00 |
|
|
fsylvain
|
162fea4afb
|
feat: settings page, sidebar and drawer destination "Settings" (icon settings, after Integration), route /settings (verified), showing only the running build's Version
|
2026-09-30 00:19:29 +02:00 |
|
|
fsylvain
|
55525c06d6
|
feat: invitation accept screen and api
|
2026-09-29 09:21:53 +02:00 |
|
|
fsylvain
|
acdef18b37
|
feat(API): user invitations and emails
|
2026-09-29 07:15:17 +02:00 |
|
|
fsylvain
|
7aae704d0a
|
feat(API): optional display name on users
|
2026-09-29 06:52:58 +02:00 |
|
|
fsylvain
|
b29d0ed045
|
feat: editor image removal QOLs
|
2026-09-29 02:44:31 +02:00 |
|
|
fsylvain
|
2a64991916
|
refac: GET /v1/auth/registration
|
2026-09-25 15:54:42 +02:00 |
|
|
fsylvain
|
61828783a1
|
refac: GET /static/uploadedImages/{filename}
|
2026-09-25 15:40:21 +02:00 |
|
|
fsylvain
|
8d17a12e92
|
refac: GET /v1/auth/me
|
2026-09-25 15:17:39 +02:00 |
|
|
fsylvain
|
0e050c36ff
|
fix: rate limiting X-Real-IP from the real peer
|
2026-09-25 06:49:55 +02:00 |
|
|
fsylvain
|
9b47685002
|
refac: split the auth handler into registration and login, account verification, and password reset handlers, each with its own dependencies
|
2026-09-25 06:14:53 +02:00 |
|
|
fsylvain
|
cbb403011a
|
fix: login and password reset requests are rate-limited per client (not in the README; there is currently no brute-force protection on the public auth routes)
|
2026-09-25 05:33:02 +02:00 |
|
|
fsylvain
|
f3ec3d2fa2
|
fix: resetting the password or cancelling a registration ends existing sessions: a token issued before the change is refused
|
2026-09-25 05:03:34 +02:00 |
|
|
fsylvain
|
81c4b62175
|
fix: reading a single article follows the same rule as the list: anyone can read an online article, a verified user can also read an offline one, and an unknown or hidden id returns 404
|
2026-09-24 16:32:40 +02:00 |
|
|
fsylvain
|
aa865af2e9
|
refac: reamaining auth surface rewrite, T0
|
2026-09-24 05:11:49 +02:00 |
|
|
fsylvain
|
0b4e614ec9
|
refac: runtime settings are read once at startup and passed in through the composition root; no handler, router or repository reads environment variables
|
2026-09-24 01:30:00 +02:00 |
|
|
fsylvain
|
e474f03d91
|
refac: authenticated user can upload an image to an existing article and receives its public location; an unknown article returns 404 and a disallowed type returns 400
|
2026-09-24 00:33:26 +02:00 |
|
|
fsylvain
|
c16fdbd26d
|
refac: authenticated user can edit an article's body; an unknown id returns 404
|
2026-09-23 23:24:03 +02:00 |
|
|
fsylvain
|
8822bdddd0
|
refac: authenticated user can publish and unpublish an article; an unknown id returns 404
|
2026-09-23 22:54:44 +02:00 |
|