AsterDrive v0.7.0

Release Highlights

Storage, workspace visibility, and independent workers. This release adds Google Drive storage with resumable browser uploads, file attribution and workspace activity, audited administrator workspace inspection, and independently scalable API/worker roles with cooperative task cancellation. Aster Metrics v1 and security hardening complete the upgrade. Upgrade all roles and primary/follower nodes together, use the matching frontend, migrate monitoring queries, and review the backup and migration requirements below.

Breaking

• API/worker and task contract migration — Upgrade every role to one release and migrate Forge consumers together. Existing task concurrency settings now limit each worker; configure the new cluster-wide settings separately. Migration creates task_resource_publications. Mixed-version execution is unsupported: stop old writers, preserve the task table and storage, upgrade together, then resume consumers. Rollback to an older binary requires restoring a matching database and storage backup. (#634)
• Metrics node and role identity — aster_node_mode="primary" or "follower" identifies the node independently of aster_role="all", "api" or "worker". The former aster_role="primary" / "follower" filters must migrate; Follower currently exports role all. Update external dashboards and alerts alongside the bundled node-mode/role selectors. (#634)
• Internal protocol and browser upload compatibility — Internal storage requires protocol v7 on every primary and follower; old signatures are rejected. Browser upload responses replace standalone upload_url and next_expected_ranges fields with coordinated instructions, so custom clients must migrate with the server. Existing OneDrive and Google Drive upload sessions remain recoverable with the matching frontend.

Added

• CORS policy rejection responses — Origin and preflight method/header denials now return the Drive error envelope with the existing forbidden code. Rejections retain security headers, request IDs and HTTP observation; parsing failures remain validation errors and response construction failures remain internal errors. Allowed, inactive, exempt and handler-generated responses retain their own behavior. (#668)

• API/worker roles and cooperative cancellation — The same binary supports serve all/api/worker, defaulting to all; Follower remains config-selected. Independent capacity-bounded consumers run outside singleton scheduling, with atomic shared quotas, fenced takeover, role probes and staged shutdown. Helm/Kustomize support independent workloads and HPA. Workspace cancellation exposes Canceling until acknowledgement, retains committed changes and permits retry after Canceled. Archive/offline publications commit durable receipts with product mutations to avoid duplicate files/quota after recovery; replay notifications request authoritative usage refresh without reapplying a storage delta. (#634)

• Audited administrator workspace inspection — Administrators can inspect personal and team folder trees, thumbnails and the target workspace recycle bin through the shared file browser, download retained current or historical revisions, and navigate full-card blob references to logical files. Blob details have refreshable URLs and aligned uploader identities. The workspace access action indicates that it opens a separate tab with shared file/trash navigation, full-row folder navigation and target identity in the sidebar; file/folder details switch in place and retain content through exit animations; version history keeps the detail panel open. Logical-file downloads start directly without an additional reason form, with audit recorded only at initialization; audit records preserve target-name snapshots and display localized reasons, outcomes, and supplied remarks without reconstructing historical names from current accounts. Workspace inspection defaults to disabled and requires a reason and a short-lived session-bound context. All content downloads retain live authorization and persisted mandatory initialization audit. Download initialization preserves presigned delivery and pins the selected revision; issued provider URLs retain their existing expiry. Upgrades add the admin_content_accesses table; database migration preserves access contexts and their session bindings.

• Workspace file attribution and activity — File and folder lists, search and details show creators and last business modifiers. Durable workspace activities commit with each mutation, remain independent of optional audit logging and retention, and provide authorized team/resource history with CSV export. Upgrades add workspace_activities and nullable business-modification fields; historical modifiers remain unknown rather than inferred from content revisions. All writer instances must be upgraded for complete attribution and activity capture.

• Workspace activity performance boundaries — Resource activity loads only after the user opens it, uses bounded keyset pages, and cancels stale requests. Batch moves, copies, deletes, and folder-tree mutations reuse locked snapshots and bulk-write attribution/activity records; exports and retention cleanup remain streaming/bounded.

• Google Drive storage backend — Administrators can authorize an encrypted Google OAuth application and use a folder, shared drive, or appDataFolder as an AsterDrive blob pool, with an optional relative base path created beneath the selected root on writes. Existing blobs and unfinished uploads prevent pool relocation. Uploads support bounded server relay and backend-coordinated browser-direct resumable transfer; account quota observation uses Google's cross-service usage and reports unavailable shared-drive bounds honestly. Downloads and Range reads retain the current AsterDrive filename through server relay. Administrator OAuth tokens stay on the server; only browser-direct uploads receive a temporary capability URL for their own session.

• Extensible browser upload coordination — Resumable drivers own response parsing and generate bounded HTTP instructions; the frontend executes uploads without provider-specific parsers. Protocol snapshots, private state and request IDs survive reloads, with authoritative recovery after lost responses and guarded updates during cancellation or concurrent coordination. Progress and recovery lists read stored snapshots; transfers explicitly reconcile authoritative provider state before sending bytes. Existing OneDrive and Google Drive sessions remain recoverable. The matching latest frontend is required; standalone upload_url and next_expected_ranges response fields are removed.

Changed

• Dialog lifecycle — Business dialogs retain their titles, drafts, loaded content and image URLs through exit animations, release presentation resources after exit, and isolate stale requests and mutation UI callbacks when closing, reopening or switching targets. Desktop details switch in place, nested dialogs retain focus behavior, and sensitive generated credentials are masked immediately on close. Overlapping creations retain every one-time WebDAV credential; the connection test uses the newest pair. Closing or reopening the creation form does not discard results or overwrite a new draft. (#665)

• Aster Metrics v1 (breaking) — Adopt standard OTel HTTP/DB/process signals and Aster Drive product instruments with a versioned schema and generated catalog. Update queries, alerts and Grafana with the application; old aliases are removed. Native pool state uses explicit main.writer/main.reader identities; HTTP status attributes retain integer types in OTLP and HEAD completes without false cancellation. Response-body lifetime, local task handler execution and task-snapshot freshness are now observable. Grafana legends and documentation use the v1 label names, task idle backoff stays at or below 164 seconds to leave scrape cadence headroom inside the 180-second freshness window, and OTLP profile resources are wire-tested. Prometheus remains opt-in pull; OTLP HTTP/protobuf remains optional.

• Recycle-bin navigation — The recycle bin uses the file browser address bar, refresh control and view switcher, keeping navigation and content alignment consistent with regular file browsing.

• Node.js build toolchain — Local development and CI select Node.js 26.13.0 from .nvmrc; the Docker frontend build pins the same patch and checks its binary version. Frontend and documentation packages require Node.js >=26.13.0 <27.

• Deployment release versions — Helm application metadata and its default image tag, plus the production Kustomize example, now target 0.7.0 so the API/worker manifests use the matching release. CI checks these references and the frontend version against the Rust workspace version.

Fixed

• JWT signing configuration — Startup and read-only configuration checks reject auth.jwt_secret values shorter than 32 UTF-8 bytes after environment overrides, reporting the field and required/actual lengths without exposing or replacing the secret. Defensive runtime signing diagnostics retain the key-length failure reason. (#661)
• Selection shortcuts after list updates — Ctrl/Cmd+A and Escape use the latest committed list callbacks immediately, including when search results appear before passive effects run.
• OneDrive authorization races — A delayed OAuth callback can no longer overwrite a newer application configuration or recreate a deleted credential. Authorization flows retain the saved credential revision through the final transaction. Unfinished authorization pages opened before the upgrade must restart the flow; existing saved authorizations are retained.

Security

• Built-in external authentication destinations — Google, GitHub and QQ sign-in use the fixed provider destinations enforced by Forge; persisted endpoint overrides cannot redirect those drivers. Google connection tests reject a custom issuer instead of accepting an ignored override.
• WebDAV upload receive limits — PUT now enforces the configured body limit, storage-policy bounds and remaining workspace quota before writing each chunk, including uploads without Content-Length. Rejected uploads stop reading immediately and clean staging files or partial remote objects; known-length uploads are checked before staging. Final-size routing and transactional quota checks remain authoritative. (#650)
• Internal protocol request-body coverage (v7) — HMAC signatures on the primary↔follower control plane and object protocol now include a canonical request-body SHA-256 line, carried on the wire as an x-aster-content-sha256 declaration header so followers verify the signature before reading the body and reconcile it against the streamed bytes afterward. All object uploads are covered with no buffering added: uploads whose digest is known up front sign it directly (committed upfront), while relay-streamed uploads whose digest is unknown until completion sign an explicit placeholder and are reconciled through a new signed-response mechanism — followers return the computed digest under an HMAC response signature bound to the request nonce, which primaries verify before accepting the transfer. Any tampering is rejected and the existing object remains untouched. The legacy five-line signatures are rejected outright: primary and follower instances must be upgraded together — mixed-version clusters fail internal requests with 401 instead of degrading silently. Outbound remote requests now disable redirects so signed headers cannot leak to other origins.
• Share password cookie expiry and password binding — Public share password cookies are HMAC-bound to the verified password hash and an issuance timestamp, expire after one hour with bounded clock skew, and stop verifying after the share password changes or the cookie is tampered with. Cookies issued by older versions no longer verify.
• Disabled master binding write protection — Followers reject storage-target create/update/delete for disabled master bindings (HTTP 412) while keeping binding sync and target listing available so the primary can re-enable the node.
• WebDAV account hygiene — WebDAV usernames are trimmed and validated (visible ASCII, no colon, bounded byte length), new WebDAV passwords require at least 8 characters, and disabled or invalid WebDAV accounts return a uniform 401 without revealing account state.
• TOTP replay protection — Each TOTP code can now be consumed once across login challenges and sensitive-action confirmations (factor deletion, recovery-code regeneration): successful verification atomically records the matched 30-second time step, and replays within the acceptance window are rejected as invalid codes. A new mfa_totp_used_steps table backs the guard and prunes expired steps automatically; factor deletion and admin MFA resets clean up the records.
• Trusted client IP resolution for audit trails — Every audited endpoint now derives the client IP from network_trust.trusted_proxies (resolved once at startup and injected as shared app data) instead of trusting client-supplied Forwarded/X-Forwarded-For/X-Real-IP headers. Requests from untrusted peers record the TCP peer address; a spoofed forwarded header can no longer plant arbitrary IPs into audit rows. With no proxies configured the peer address is recorded, so self-hosted direct deployments keep working unchanged. The legacy extraction entry points were removed; AuditContext::from_request/AuditRequestInfo::from_request keep their signatures.
• Assorted hardening — Constant-time signature comparisons for internal and presigned verification, single-use nonce entries kept alive beyond the timestamp acceptance window, rate limiting on follower enrollment, audit CSV export neutralization with strict client IP validation, and a dummy password verification for unknown accounts to damp user-enumeration timing signals.

Database Migrations

• Four migrations add mfa_totp_used_steps, workspace_activities, admin_content_accesses, and task_resource_publications, plus nullable last-modification fields on files and folders. Historical business modifiers remain unknown. Back up the database and storage, drain old consumers and stop old writers, then upgrade all roles together without deleting queued tasks or their inputs. The first new process runs the coordinated migrations; resume consumers after initialization and API verification. Downgrading requires restoring a matching database and storage backup.

Notes

• Prometheus and OTLP metrics remain optional build capabilities and require explicit runtime configuration. This release does not add OTLP traces or logs.
• .cargo/audit.toml retains exceptions for rsa (RUSTSEC-2023-0071), paste (RUSTSEC-2024-0436), and h2 0.3 (RUSTSEC-2026-0258), and records crypto-bigint 0.5.x (RUSTSEC-2026-0387). These upstream advisories are not claimed fixed by this release.

---

Download

Platform	Architecture	Archive
Linux	x86_64	aster_drive_v0.7.0_linux_x86_64.tar.gz
Linux	x86	aster_drive_v0.7.0_linux_i686.tar.gz
Linux	ARM64	aster_drive_v0.7.0_linux_aarch64.tar.gz
Linux	ARMv7	aster_drive_v0.7.0_linux_armv7.tar.gz
Windows	x86_64	aster_drive_v0.7.0_windows_x86_64.exe.zip
Windows	x86	aster_drive_v0.7.0_windows_i686.exe.zip
Windows	ARM64	aster_drive_v0.7.0_windows_arm64.zip
macOS	x86_64	aster_drive_v0.7.0_macos_x86_64.tar.gz
macOS	ARM64	aster_drive_v0.7.0_macos_aarch64.tar.gz

Extract with tar -xzf (Linux/macOS) or unzip (Windows).

Checksums: checksums.txt

Verify signatures

All release archives are signed with Sigstore cosign. To verify:

# Download checksums + signature + certificate
wget https://github.com/AsterCommunity/AsterDrive/releases/download/v0.7.0/{checksums.txt,checksums.txt.sig,checksums.txt.pem}

# Verify signature
cosign verify-blob checksums.txt \
  --signature checksums.txt.sig \
  --certificate checksums.txt.pem \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'github.com/AsterCommunity/AsterDrive'

# Verify archive integrity
sha256sum -c checksums.txt

What's Changed

• fix(security): internal protocol v7, TOTP replay guard, audit IP trust and hardening by @AptS-1547 in #652
• feat(storage): add Google Drive backend by @ZhouBx634 in #655
• fix(webdav): enforce streaming PUT receive limits by @AptS-0152 in #658
• feat(storage): 后端协调可扩展的 provider 浏览器上传 by @AptS-1547 in #659
• Feat/otel metrics profile by @AptS-1547 in #664
• feat(admin): 可审计的工作空间查看与文件版本下载 by @AptS-1547 in #666
• refactor(frontend): 统一业务弹窗生命周期与退出资源释放 by @AptS-1547 in #667
• feat(runtime)!: API/worker 分离、持久化取消与 CORS 拒绝响应 by @AptS-1547 in #669

New Contributors

• @ZhouBx634 made their first contribution in #655

Full Changelog: v0.6.3...v0.7.0