43 lines
2.9 KiB
Markdown
43 lines
2.9 KiB
Markdown
RenewCMS now knows who owns the workspace. The owner manages invites, including cancelling and renewing them, while every admin keeps the same access to content. A new Settings page shows which build is running.
|
|
|
|
## New
|
|
|
|
**Owner and admin roles**
|
|
- The first registered account is the owner. Everyone who joins through an invite is an admin.
|
|
- Only the owner can send, cancel or renew invites. Admins keep the same access to articles, images, the Users list, their Profile and Settings.
|
|
- There is exactly one owner. Roles can't be changed or transferred yet.
|
|
- Existing installs are migrated automatically: the oldest account becomes the owner and every other account an admin.
|
|
|
|
**Invite management**
|
|
- Pending invites get a Cancel invite action on the Users page. The invite link stops working.
|
|
- Expired invites get a Renew invite action. It sends a new email with a new personal link valid for 3 days, and the old link stays dead.
|
|
|
|
**Users list**
|
|
- The Users table and the mobile card list now show Email, Display name (a dash when empty), Role, Invite status and Created.
|
|
- A new role badge tells the owner and admins apart.
|
|
|
|
**Settings page**
|
|
- A new Settings page at `/settings` sits after Integration in the sidebar and the mobile drawer. It shows the version of the running build.
|
|
|
|
## Improvements and fixes
|
|
- The desktop account menu's icons, labels and check mark are now centred in their 32 px rows.
|
|
- The account menu follows the redesigned board: System, Light and Dark stay in both the menu and the mobile sheet.
|
|
- The article editor's toolbar scrolls horizontally on mobile instead of overflowing.
|
|
- The editor's last-saved label now moves from minutes to hours and days instead of counting minutes only.
|
|
|
|
## API
|
|
- `DELETE /v1/user/invite/{id}` cancels a pending invite and returns 204.
|
|
- `POST /v1/user/invite/{id}/renew` returns 200 with a new code, sets `expires_at` to now plus 3 days and `created_at` to now, and resends the invitation email.
|
|
- Changed: `POST /v1/user/invite` is now owner-only, like the two endpoints above. Other users get 403 with "Only the owner can do this."
|
|
- `GET /v1/settings` (authenticated, verified users) returns the running build's version.
|
|
- Changed: user objects from `GET /v1/user/`, `GET /v1/auth/me` and `POST /v1/auth/verify` now include `role` (`owner` or `admin`).
|
|
|
|
## Upgrading
|
|
- Replace the binary and restart. Your `.env` and SQLite file stay as they are.
|
|
- The database migrates itself on startup. It adds a `role` column to `users` and fills it in: the account with the lowest id becomes the owner, every other account an admin. A database that already has roles is left unchanged. Back up your SQLite file first as a precaution.
|
|
- Behaviour change: admins who joined through a v2.3.0-beta invite can no longer send invites.
|
|
- No new environment variables.
|
|
|
|
## Known limitations
|
|
- No endpoint changes or transfers the owner role, and users can't be removed yet.
|