v0.5.0
Changed
- Breaking: require member authentication for every instance, remove
FLUXMAIL_AUTH=none, revoke legacy API keys during migration, and require a backup to return to an older version; back up the data directory and claim the instance before reconnecting clients (#58) - Breaking: replace the
AccountfieldsownerId,sharingMode,sharedMemberIds, andmemberIdwithownerMemberId,sharedWithAll, andgrantedMemberIds; update API clients to use the new fields (#58) - Breaking: make the CLI use named local or remote instances for administration, and require a logged-in local session before starting stdio MCP (#58)
- Record CLI, MCP, and REST operations with one anonymous telemetry schema that excludes arguments, request data, identifiers, and error messages (#55)
Added
- Add password login, member sessions, enrollment and reset flows, member status controls, scoped API keys, mailbox access grants, and append-only security audits (#58)
- Add instance setup, login, logout, instance switching, session management, and member administration commands to the CLI (#58)
- Add member and session authentication, self-service mailbox and API key management, and administrative member and audit operations to the REST API (#58)
- Use Fluxmail's built-in Desktop Google OAuth app for local Gmail connections while keeping custom clients available for local and hosted setups (#56)
Fixed
- Keep the Google OAuth client that issued each stored Gmail refresh token so existing accounts continue to refresh after an app configuration change (#60)
- Serialize shared database migrations, stored configuration writes, and encryption key creation to protect concurrent Fluxmail processes (#59)
Full Changelog: v0.4.1...v0.5.0