RenewCMS/docs/releases/v3.7.0-beta.md

This release lets people manage their own account: change their email address, download a copy of their data and delete their account.

New

Change your email address

• Profile has a form to change your email. It needs your current password and sends a confirmation link to the new address.
• The old address is told about the request and keeps working until the link is opened. You can resend or cancel the pending change.

Your data

• A Your data card on Profile downloads a ZIP with your profile, the content you created, your uploaded media references and your account activity. It never holds your password hash, codes or API key hashes.
• One export is allowed every 15 minutes per user.

Delete your account

• A Danger zone card on Profile deletes your account with your password and the typed word DELETE.
• Your API keys and personal activity details are removed. Your author profile is deleted, or kept as "Deleted user" without personal details when articles credit it. Your articles, entries and media stay and show "Deleted user".
• The last Owner, and the last administrator, cannot delete their account until another verified user holds the role.
• A short confirmation mail is sent to the address the account had.

Improvements and fixes

• Users can be removed by someone with the users.remove permission, and the removal is recorded in the Activity log.
• The media panel shows when an image is used by an author or a site, and the "used in" badge stays readable on a selected card.
• The role editor footer stays at the bottom of the screen, and other footers no longer float.
• Table cells no longer overflow each other.
• Date separators are hidden while a date picker field is idle, so labels no longer overlap.
• French button labels no longer overflow.
• The PostgreSQL backup bug and a stale PostgreSQL connection in the tests are fixed.

API

• POST /v1/auth/email/change, POST /v1/auth/email/resend, DELETE /v1/auth/email/change and POST /v1/auth/email/confirm change the email of a verified, signed-in user. Refusals are plain text codes such as same_email, wrong_password, no_pending_email_change, invalid_email_change_code and email_unavailable. Change and resend share a limit of 5 per user per 15 minutes.
• GET /v1/user/me/export answers the ZIP of your data. It needs a real session and answers 429 with Retry-After when used twice within 15 minutes.
• DELETE /v1/user/me takes {"current_password", "confirmation": "DELETE"} and answers 204. It answers 403 wrong_password or 409 last_admin (with X-Last-Role) when refused, and 429 after 5 attempts in 15 minutes.
• DELETE /v1/user/{id}?expected_role_id=N removes a user and needs users.remove. It answers 409 user_role_changed when the target's role changed.
• POST /v1/role/{id}/reassign answers 409 target_role_not_found when the target role no longer exists.
• Changed: GET /v1/auth/me carries pending_email, a string or null.
• GET /v1/activity accepts the new user.request_email_change, user.resend_email_change, user.cancel_email_change, user.confirm_email_change, user.export_data, user.delete_account and user.remove events.

Under the hood

• Three new mail templates: verify-new-email, email-change-notice and account-deleted.
• The own-scope visibility filter moved into the repositories, and list calls no longer ignore their errors.
• New feature specs and tests in features/account_change_email.feature, features/account_export_data.feature and features/account_delete.feature.
• docs/privacy.md and docs/api.md describe the new self-service rights.

Upgrading

• Replace the binary, or pull the new image. Back up the database first as usual.
• The schema migrates by itself at startup: users gets pending_email, email_change_code and email_change_expiration, and the activity log gets an index on its target.
• No new environment variable.
• Email change and account deleted mails use your existing SMTP settings.