52 lines
4.0 KiB
Markdown
52 lines
4.0 KiB
Markdown
This release lets people manage their own account: change their email address, download a copy of their data and delete their account.
|
|
|
|
## New
|
|
|
|
**Change your email address**
|
|
- Profile has a form to change your email. It needs your current password and sends a confirmation link to the new address.
|
|
- The old address is told about the request and keeps working until the link is opened. You can resend or cancel the pending change.
|
|
|
|
**Your data**
|
|
- A Your data card on Profile downloads a ZIP with your profile, the content you created, your uploaded media references and your account activity. It never holds your password hash, codes or API key hashes.
|
|
- One export is allowed every 15 minutes per user.
|
|
|
|
**Delete your account**
|
|
- A Danger zone card on Profile deletes your account with your password and the typed word `DELETE`.
|
|
- Your API keys and personal activity details are removed. Your author profile is deleted, or kept as "Deleted user" without personal details when articles credit it. Your articles, entries and media stay and show "Deleted user".
|
|
- The last Owner, and the last administrator, cannot delete their account until another verified user holds the role.
|
|
- A short confirmation mail is sent to the address the account had.
|
|
|
|
## Improvements and fixes
|
|
|
|
- Users can be removed by someone with the `users.remove` permission, and the removal is recorded in the Activity log.
|
|
- The media panel shows when an image is used by an author or a site, and the "used in" badge stays readable on a selected card.
|
|
- The role editor footer stays at the bottom of the screen, and other footers no longer float.
|
|
- Table cells no longer overflow each other.
|
|
- Date separators are hidden while a date picker field is idle, so labels no longer overlap.
|
|
- French button labels no longer overflow.
|
|
- The PostgreSQL backup bug and a stale PostgreSQL connection in the tests are fixed.
|
|
|
|
## API
|
|
|
|
- `POST /v1/auth/email/change`, `POST /v1/auth/email/resend`, `DELETE /v1/auth/email/change` and `POST /v1/auth/email/confirm` change the email of a verified, signed-in user. Refusals are plain text codes such as `same_email`, `wrong_password`, `no_pending_email_change`, `invalid_email_change_code` and `email_unavailable`. Change and resend share a limit of 5 per user per 15 minutes.
|
|
- `GET /v1/user/me/export` answers the ZIP of your data. It needs a real session and answers `429` with `Retry-After` when used twice within 15 minutes.
|
|
- `DELETE /v1/user/me` takes `{"current_password", "confirmation": "DELETE"}` and answers `204`. It answers `403` `wrong_password` or `409` `last_admin` (with `X-Last-Role`) when refused, and `429` after 5 attempts in 15 minutes.
|
|
- `DELETE /v1/user/{id}?expected_role_id=N` removes a user and needs `users.remove`. It answers `409` `user_role_changed` when the target's role changed.
|
|
- `POST /v1/role/{id}/reassign` answers `409` `target_role_not_found` when the target role no longer exists.
|
|
- Changed: `GET /v1/auth/me` carries `pending_email`, a string or `null`.
|
|
- `GET /v1/activity` accepts the new `user.request_email_change`, `user.resend_email_change`, `user.cancel_email_change`, `user.confirm_email_change`, `user.export_data`, `user.delete_account` and `user.remove` events.
|
|
|
|
## Under the hood
|
|
|
|
- Three new mail templates: `verify-new-email`, `email-change-notice` and `account-deleted`.
|
|
- The own-scope visibility filter moved into the repositories, and list calls no longer ignore their errors.
|
|
- New feature specs and tests in `features/account_change_email.feature`, `features/account_export_data.feature` and `features/account_delete.feature`.
|
|
- `docs/privacy.md` and `docs/api.md` describe the new self-service rights.
|
|
|
|
## Upgrading
|
|
|
|
- Replace the binary, or pull the new image. Back up the database first as usual.
|
|
- The schema migrates by itself at startup: `users` gets `pending_email`, `email_change_code` and `email_change_expiration`, and the activity log gets an index on its target.
|
|
- No new environment variable.
|
|
- Email change and account deleted mails use your existing SMTP settings.
|