• fsylvain released this 2026-09-27 18:12:04 +02:00 | 117 commits to main since this release

    A ground-up rewrite of RenewCMS's backend architecture and frontend. The Go-template UI is replaced by a Vue 3 single-page app embedded in the same binary.

    New

    Vue 3 single-page app

    • Built with Vite, Pinia and vue-router, and embedded into the single binary. There is no separate frontend deployment.
    • The UI uses Nuxt UI (migrated from an initial PrimeVue base) with shared design tokens.
    • New screens: login, registration, home and navigation, article list, article editor (ProseMirror-based) with a creation modal, image upload, and an account and integration screen.
    • A typed API client and a session store handle 401, unverified 403, 429 and offline states the same way everywhere.

    Domain-driven backend

    • internal/domain (entities, sentinel errors, repository interfaces) is isolated from persistence (GORM), mailer and API concerns, with a strict inward dependency rule.
    • Business logic moved out of handlers and the persistence layer into use cases: article rules, image validation, password and code hashing, not-found handling, and session invalidation on password reset.
    • The composition root (api/dependecyInjection.go) wires the database, repositories and use cases explicitly. Runtime settings are read once at startup.
    • The auth handler is split into dedicated registration, login, verification and password-reset handlers, each with per-client rate limiting on the public routes.

    Improvements and fixes

    • API responses no longer leak password hashes, verification or reset code hashes, or their expiry dates.
    • Article read rules now apply the same way to the single-article and list endpoints: the public sees online articles only, verified users also see offline ones.
    • Registration only opens when no verified account exists, and deleting a user frees its username and email for reuse.
    • Rate limiting now keys off the real peer IP.

    Under the hood

    • Use cases are covered by a full in-memory fake test suite with clean gremlins mutation coverage.
    • Vitest and Vue Test Utils run the frontend tests, and an automated visual-parity check compares the app to the design source boards.

    Upgrading

    • Deployment is unchanged: a single binary, systemd and a reverse proxy. Replace the binary and restart.
    Downloads