Skip to content

v0.2.0.6

Choose a tag to compare

View all tags
@Anton-Barinov Anton-Barinov released this 21 Aug 09:52
· 255 commits to main since this release
v0.2.0.6
7292b51

v0.2.0.6 (2026-08-21)

Added

  • Client portal (external users). Full client portal with invite/accept/RLS isolation for contacts linked to counterparties. Invited guests set their own password and see only their company's projects and tasks.

  • Client portal: route allowlist. External guest sessions restricted to explicit endpoints enforced centrally. Any unauthorized endpoint returns 403.

  • Client portal: pages show only what a client can use. Task and project pages show only client-relevant sections; internal blocks hidden.

  • Client portal: interface isolation. Navigation limited to Projects/Tasks/Notifications for external accounts.

  • Client portal: security contract test. Database-free CI check that fails if destructive/admin endpoints gain portal access.

  • Client portal: observer and executor roles. Invited guests are observers (read/comment) or executors (can also log time). Role chosen at invite time.

  • Client portal: executors can start task timer. Worklog creation/listing reachable for executor role only.

  • Client portal: multi-project access for executors. Staff can grant/revoke access to individual projects across counterparties.

  • Client portal: invite login = email. Portal accounts log in with their email address.

  • Client portal: invite UI on counterparty page. Same invite flow as Contacts page, with role selection and project-access panel.

  • Client portal: chat integration. External users participate in project-level chat from the project card.

  • Client portal: knowledge base integration. Articles marked client_visible readable by portal guests.

  • Installer: regenerate MySQL schema snapshot. Fresh installs start with all 151 core tables.

  • Installer: check both lock files. checks both lock files consistently.

  • Updater: harden migration runner. Individual migrations wrapped in try-catch; raised max_migrations_per_request to 5.

Fixed

  • Security: PII leak on task update. Staff names no longer leak in task-update responses for external users.

  • Security: SQLite-safe migrations. uses PRAGMA on SQLite.

  • Security: LIKE search rewritten. Counterparty/contact/project search safe across MySQL versions.

  • Client portal: external flag never applied. now read during session loading.

  • Client portal: guest role received no permissions. Correct permission codes seeded.

  • Client portal: internal comments visible to clients. SQL-level filtering ensures internal comments stay internal.

  • Client portal: attachments unreachable. File access granted through company scoping.

  • Client portal: lists could come back unfiltered. Missing contact link returns empty list instead of unrestricted.

  • Client portal: internal comments leaked via notifications. Portal users no longer receive internal comment notifications.

  • Client portal: own profile returned 403. Profile route added to portal page allowlist.

  • Client portal: project card broken layout. Summary/milestones endpoints reachable for guest's own project.

  • Client portal: staff replies invisible to guests. Comment visibility toggle for staff.

  • Counterparty search ESCAPE syntax error. MySQL LIKE search rewritten without ESCAPE clause.

Removed

  • MySQL Integration CI workflow. Removed from GitHub Actions; was failing independently of changes.
Assets 2
Loading