Skip to content

v0.2.0

Choose a tag to compare

View all tags
@andprov andprov released this 27 Oct 20:49
· 11 commits to main since this release
v0.2.0
d0a19b7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

An account must now be activated before its settings can be changed or the account deleted. The web app already worked this way; the API now enforces it as well.

⚠️ Breaking: activation required for account changes

These endpoints now return 403 with code access_denied for an account that is not activated:

  • PATCH /api/users/me/password
  • PATCH /api/users/me/email
  • PATCH /api/users/me/locale
  • PATCH /api/users/me/time-format
  • DELETE /api/users/me

Before this change they worked for any signed-in user. Projects and timers already required activation.

A user who is not activated can still:

  • load their profile with GET /api/users/me
  • activate the account, request a new code and check the resend cooldown
  • list and revoke sessions, and sign out

API clients that let users change settings or delete the account before activation need to handle the new 403.

Internal

  • The activation check moved from the adapters layer into the application layer.
  • Use cases for creating a project, starting a timer and adding a manual time entry now take the user id as a separate parameter instead of inside the request DTO with the rest of the data.

No database migrations.

Full Changelog: v0.1.12...v0.2.0

Assets 5
Loading