Skip to content

v0.7.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Apr 21:11
· 80 commits to main since this release
v0.7.0
This tag was signed with the committer’s verified signature.
fabracht Fabrício Bracht
GPG key ID: B77DC109C4A7E6EC
Verified
Learn about vigilant mode.
46c2dc3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Affected crates: mqdb-core (0.5.0), mqdb-agent (0.6.0), mqdb-cli (0.7.0).

Added

  • Password reset endpoints: POST /auth/password/reset/start and POST /auth/password/reset/submit (HTTP, unauthenticated) for "forgot password" flow
  • Password reset MQTT topics: $DB/_auth/password/reset/start and $DB/_auth/password/reset/submit for authenticated users
  • Challenge purpose field to distinguish password reset from email verification challenges
  • Purpose guard in handle_verify_submit to reject password reset challenges
  • --no-rate-limit now disables all HTTP rate limiters (login, register, verify, password change, password reset)
  • AdminRequired topic protection now falls through to ACL for non-admin users, enabling operator-provisioned service accounts

Security

  • Promote $DB/_verify/# to AdminRequired topic protection tier to prevent leakage of verification codes and receipt spoofing
Assets 6
Loading