Perfuse v0.1.11

Several facilities on one engine

• Channel groups. Limit a person or an API token to some channel groups, and they see and act on those channels only: the channel list, dashboard, flow map, messages and content search, counts, charts, queue, alerts, metrics, certificates and contracts. A channel outside their groups does not exist for them. Set it in Users and Tokens; the header shows a person's groups.
• Facility administrators. An administrator limited to groups manages their own groups' people and tokens, starts and stops their channels and clears their queues. Server-wide settings, sign-on, restart and alert rules stay with unlimited administrators.
• Two new roles. Monitor sees status, counts, alerts, charts and queue depth, with no message contents and no channel files: for a help desk or a wall screen. Operator can resend, replay and retry, but not change a channel. Roles are now monitor, viewer, operator, editor, admin and platform.
• Limits per tenant. On a shared server (-multi-tenant), the platform operator sets each organisation's maximum channels, messages a minute and stored megabytes on a new Tenants screen. Over a limit, work is refused the way a busy receiver refuses it (no MLLP acknowledgement, HTTP 429, SOAP 503, DICOM retryable), so senders resend; nothing is dropped. The channel limit also applies on a single-tenant server.

Also new

• Restart from the console. Settings that apply at a restart can be applied with a button (administrators only, audited as server.restart). On Linux and macOS the process keeps its PID.
• Prior-authorization tracker can be kept in a file (written atomically, mode 0600), so pending and expiring requests survive a restart. A decision now replaces its pending entry instead of sitting beside it.

Fixed

• Content search crossed tenants. On a multi-tenant server, POST /api/messages/search (searching inside message content) returned every tenant's messages. It is now limited to the caller's tenant. Upgrade if you run -multi-tenant.
• Prior-authorization decisions are recorded correctly.

Not yet

• Single sign-on (OIDC, SAML, LDAP) maps directory groups to viewer, editor and admin only, not yet to monitor, operator or channel groups.
• A person has one role across all their groups.

See docs/multi-facility.md and the Security chapter of the manual.