Skip to content

v0.2.0

Choose a tag to compare

View all tags
@Nonetss Nonetss released this 09 Oct 10:29
· 70 commits to main since this release
v0.2.0
5cc6e7a

v0.2.0 — Two-step verification, closed sign-up and signing by touch

Authentication and limits

  • Optional TOTP two-step verification: each user turns it on from their
    profile and is asked for the code at sign-in, typed into per-digit slots
    that submit once complete. New two_factor table and
    user.two_factor_enabled (migration included).
  • DISABLE_SIGN_UP closes self-service sign-up by email and SSO; admins
    keep creating accounts, the sign-up link is hidden and /signup shows a
    closed notice.
  • Heavy document operations are limited to 2 concurrent and 30 per minute
    per user, so one account cannot exhaust memory with PDFs.
  • Request bodies are capped at 25 MiB in Bun.serve, covering routes
    outside the oRPC limits such as /api/auth.

Touch and mobile

  • Phones sign by tapping the stamp into place, keep swipe scrolling on the
    pages and dock the sign button under the PDF.
  • The library, page editor and upload dialogs work by touch: visible
    checkboxes, 44px actions and tap wording.
  • Content and fixed bars stay clear of the notch on landscape phones.
  • Home: a wider signing desk, a drop sheet fitted to phones, and the
    certificates and library side by side under it on narrow layouts.

Typography and UI copy

  • The remaining hand-built type classes (admin, comments, documents, the
    mobile menu, metadata, filters and checkbox captions) now use Text
    roles and tones.
  • The sign-in and sign-up cards are titled with a display h1.
  • Numbers stay bound to their units and middle dots to the fact before
    them, so narrow columns wrap between facts.
  • Names are quoted with «» and trail off with a single … in UI copy.
  • Footer and cron placeholder text reach AA contrast; the authenticator
    code field is centered.

Docs

  • README, site and stack docs cover DISABLE_SIGN_UP, two-step
    verification and its recovery, and the new request and operation limits.
  • DESIGN describes tap-to-place signing, the docked signing bar, the touch
    layouts, bound numerals and Spanish quote and ellipsis marks.
  • OpenSpec: harden-auth-and-request-limits done and its change files
    removed.
Assets 2
Loading