Changelog
68c88d4 Merge pull request 'Release v0.7.0' (#348) from release/v0.7.0 into main
ffc2e71 Release v0.7.0
4222354 Merge pull request 'feat(web): external-link icon on the Community nav button (BUNYIP-341)' (#347) from feat/BUNYIP-341-community-external-icon into main
880bf24 feat(web): mark the Community nav link with an external-link icon (BUNYIP-341)
7729611 Merge pull request 'feat(seed): embedded template library + import-by-name (PSA-57 part 1)' (#346) from feat/PSA-57-template-library into main
2183539 feat(admin-web): first-run setup panel and empty-catalog prompt (PSA-57 part 2)
eb77d7e fix(seed): declare owns on the minimal template and drop the orphan restricted app
5494c42 Merge remote-tracking branch 'origin/main' into feat/PSA-57-template-library
c0c0ad4 Merge pull request 'feat(seed): template-declared owns scope and password_env (PSA-56 part 1)' (#345) from feat/PSA-56-owns-scope-password-env into main
5c2384d feat(seed): embedded template library + import-by-name (PSA-57 part 1)
355fcaf fix(seed): reject empty/unset seed passwords and non-reserved owns.domains
a86a319 feat(seed): reset scoped to owns + retire bunyip-e2e-bootstrap to a template (PSA-56 part 2)
0cad1e8 docs(seed): update the reserved-domain wording for the owns scope
3b97d6d feat(seed): template-declared owns scope and password_env (PSA-56 part 1)
2b581e8 Merge pull request 'feat(seed): admin import/export API for seed data (PSA-52 part 1)' (#344) from feat/PSA-52-admin-import-export into main
624764b fix(seed): raise the import endpoint's payload cap above the web form limit
47b0a13 feat(admin-web): seed data import/export page (PSA-52 part 2)
5ff29cd Merge pull request 'feat(seed): demo-msp template generator and committed template (PSA-51)' (#343) from feat/PSA-51-demo-seed-template into main
d926c6b feat(seed): admin import/export API for seed data (PSA-52 part 1)
b0e451d fix(seed): keep demo admins off member tiers; note key-order determinism
d4589e3 feat(seed): demo-msp template generator and committed template (PSA-51)
2540b81 Merge pull request 'feat(seed): canonical seed-file schema, validation, and safety gates (PSA-50)' (#342) from feat/PSA-50-seed-import-foundation into main
e5b7211 fix(seed): reject enum typos, require feedback author email, harden reset match
9dbfacb feat(seed): DB loader and seed CLI for file-driven seed data
7e31d4f feat(seed): canonical seed-file schema, validation, and safety gates
e52e779 Merge pull request 'docs(e2e): document mail-sink secret format, de-personalize example (BUNYIP-272)' (#337) from docs/BUNYIP-272-e2e-mail-secret-format into main
f333c5f Merge branch 'main' into docs/BUNYIP-272-e2e-mail-secret-format
def173d Merge pull request 'feat(admin-web): rate-limit list view and reset action' (#341) from feat/BUNYIP-317-web-rate-limits into main
392a26b Merge branch 'main' into feat/BUNYIP-317-web-rate-limits
b1a16c1 Merge pull request 'fix(web): stop Tailwind v4.3 container capping content below 1400px' (#340) from fix/BUNYIP-338-container-fills-viewport into main
2c75094 fix(web): stop Tailwind v4.3 container capping content below 1400px
22fb567 Merge pull request 'fix(web): show per-field registration errors and preserve inputs' (#339) from fix/BUNYIP-271-register-field-errors into main
b8806c8 fix(web): show per-field registration errors and preserve inputs
b4de9af Merge branch 'main' into docs/BUNYIP-272-e2e-mail-secret-format
0b78723 Merge pull request 'chore(scripts): dry-run-first staging test-account purge (BUNYIP-273)' (#336) from chore/BUNYIP-273-purge-test-accounts into main
5885130 Merge branch 'main' into chore/BUNYIP-273-purge-test-accounts
c137c27 Merge pull request 'fix(feedback): suppress admin notification and email for honeypot spam' (#338) from fix/BUNYIP-270-suppress-spam-feedback-admin-notification into main
3785315 Merge branch 'main' into chore/BUNYIP-273-purge-test-accounts
e67c77e fix(feedback): suppress admin notification and email for honeypot spam
7beea24 docs(e2e): document the mail-sink secret format, de-personalize the example (BUNYIP-272)
c2ae942 Merge pull request 'feat(web): add Bunyip favicon derived from hero art' (#335) from feat/BUNYIP-339-favicon into main
86cf01e chore(scripts): add dry-run-first staging test-account purge (BUNYIP-273)
b545282 fix(web): serve favicon.ico at the web root
9239431 feat(web): add Bunyip favicon derived from hero art
bd18834 Merge pull request 'fix(logging): attribute request logs to the external client IP' (#334) from fix/BUNYIP-328-log-external-client-ip into main
82f01bb fix(logging): attribute request logs to the external client IP
a003688 Merge pull request 'fix(auth): normalize user emails to lowercase on write' (#333) from fix/BUNYIP-325-normalize-email-lowercase into main
314c5a0 fix(auth): normalize user emails to lowercase on write
a28355d feat(admin-web): rate-limit list view and reset action
01ea399 Merge pull request 'feat(admin): reset an active rate limit for a user or key, audited' (#332) from feat/BUNYIP-316-admin-rate-limit-reset into main
a3a5050 feat(admin): reset an active rate limit for a user or key, audited
b3b50fd Merge pull request 'feat(admin): list currently rate-limited entities, resolved to users' (#331) from feat/BUNYIP-315-admin-rate-limits-list into main
519789e feat(admin): list currently rate-limited entities, resolved to users
705b2da Merge pull request 'feat(admin-web): IP auto-bans list view and unban action' (#330) from feat/BUNYIP-320-web-ip-bans into main
cfed80e feat(admin-web): IP auto-bans list view and unban action
24e817b Merge pull request 'feat(admin): list active IP auto-bans and lift a ban, audited' (#329) from feat/BUNYIP-319-admin-ip-bans-api into main
7ed0905 feat(admin): list active IP auto-bans and lift a ban, audited
f210303 Merge pull request 'feat(auto-ban): add immediate unban and list_bans to AutoBanService' (#328) from feat/BUNYIP-318-autoban-unban-list into main
b2ffecb feat(auto-ban): add immediate unban and list_bans to AutoBanService
a2bf39b Merge pull request 'fix(email): attach a Message-ID header to every outbound message' (#327) from fix/BUNYIP-334-message-id-header into main
846618c fix(email): attach a Message-ID header to every outbound message
1c70b22 Merge pull request 'fix(startup): populate applications.webhook_url for mokosh from MOKOSH_WEBHOOK_URL' (#326) from fix/BUNYIP-336-mokosh-webhook-url-upsert into main
e3e797c fix(startup): populate applications.webhook_url for mokosh from MOKOSH_WEBHOOK_URL
8ec37c1 Merge pull request 'fix(webhooks): sign outbound webhooks with a dedicated secret, not JWT_SECRET' (#324) from fix/BUNYIP-332-dedicated-webhook-signing-secret into main
9f02ec6 ci: retrigger against rebased tip (post-BUNYIP-331 e2e fix)
055bcfb fix(webhooks): sign outbound webhooks with a dedicated secret, not JWT_SECRET
47d0ab0 Merge pull request 'test(e2e): stop setInputValue hanging when BUNYIP-331 auto-submit detaches the input' (#325) from test/BUNYIP-331-setinputvalue-tolerate-detach into main
7ee4aa5 Merge pull request 'feat(auth): permanently reserve soft-deleted emails against re-registration' (#320) from fix/BUNYIP-330-block-reregister-deleted-email into main
8e55dce test(e2e): stop setInputValue hanging when BUNYIP-331 auto-submit detaches the input
ec861f5 Merge pull request 'feat(2fa): auto-submit six-digit TOTP code fields (BUNYIP-331)' (#323) from feat/BUNYIP-331-2fa-autosubmit into main
ae82527 test(e2e): avoid generating a near-expiry TOTP code in fillTotpStep
bd1634d feat(2fa): auto-submit six-digit TOTP code fields
c09f312 Merge pull request 'feat(admin): router-style in-app error log view' (#322) from feat/BUNYIP-327-admin-error-log-view into main
ec30ea0 fix(api): log a rate-limit trip once per window, not per over-limit request
411abe6 feat(admin): router-style in-app error log view (BUNYIP-327)
a7359da Merge pull request 'fix(web): route verification-resend feedback back to the originating page' (#321) from fix/BUNYIP-324-resend-verification-feedback into main
485a1ea refactor(web): apply clamp_msg inside the shared banner helpers
3cbb3fb fix(web): route verification-resend feedback back to the page it came from
2073bf8 test(e2e): fixme reregister-blocked while staging still runs pre-330 build
9a76556 feat(auth): permanently reserve soft-deleted emails against re-registration
a22dd34 Merge pull request 'fix(auth): logout clears cookies unconditionally, even when access_token is stale' (#319) from fix/BUNYIP-323-logout-clears-cookies-unconditionally into main
0b13c11 Merge pull request 'fix(web): rotate at+jwt when /users/me reports a different role than the cookie's JWT' (#308) from fix/BUNYIP-308-rotate-jwt-on-role-mismatch into main
e5cb164 fix(auth): logout clears cookies unconditionally, even when access_token is stale
567f443 Merge pull request 'fix(web): show billing period end date instead of "N/A" on cancel control' (#318) from fix/BUNYIP-330 into main
4829c24 fix(web): show billing period end date instead of "N/A" on cancel control
b9bea20 Merge pull request 'docs(env): document BUNYIP_COMMUNITY_URL for deployers' (#316) from docs/BUNYIP-329-community-env-example into main
8e2f01e docs(env): document BUNYIP_COMMUNITY_URL in the .env examples
2098d3a Merge pull request 'feat(web): add authenticated Community (Let's Chat) button for members' (#315) from feat/BUNYIP-329-community-button into main
a8eadc8 feat(web): move Community from a dashboard card to the left sidebar nav
1f1a292 chore(compose): pass BUNYIP_COMMUNITY_URL through to bunyip-web
00eaf22 style: elide needless lifetime on community_redirect_target
0de27d9 feat(web): add Community button to the member dashboard
d14aa2a feat(web): add authenticated /community redirect into Let's Chat
d72c55c feat(web): add BUNYIP_COMMUNITY_URL config for the Let's Chat instance
fa0e1d1 Merge pull request 'feat(tiers): verify early-adopter/standard trials + add members-by-tier admin view' (#314) from feat/BUNYIP-291-membership-tiers into main
8a3af52 style: satisfy rustfmt and clippy for the tier changes
373fd55 refactor(membership): lock resubscribe-no-new-trial as a testable rule
283a36f feat(admin-web): members-by-tier view with early-adopter occupancy
20af618 feat(admin-api): add members-by-tier filter to the memberships endpoint
2dec578 feat(membership): merge the two cancel buttons into one cancel control
8810c7d feat(tiers): label the applied signup trial (early-adopter vs standard)
b2c52e9 feat(domain): extract pure tier-selection and trial-days decisions
8414a2b Merge pull request 'fix(build): sync Cargo.lock to v0.6.0 so --locked image builds pass' (#313) from fix/bunyip-cargo-lock-0.6.0 into main
d479d23 fix(build): sync Cargo.lock to workspace v0.6.0 so --locked image builds pass
0f9181b fix(web): rotate at+jwt when /users/me reports a different role than the cookie's JWT
nrupard released this