s3proxy-rs UI v0.6.4

Added

• Added a Bucket routing workflow that creates server-generated virtual S3
  identities, displays credentials once, and continues directly to mapping
  creation using a credential-ID-only handoff.
• Added recovery for failed session revocation that blocks sign-in and protected
  routes until the browser verifies revocation or a retry succeeds.
• Added repository-local Spec Kit skills for specification, clarification,
  planning, task generation, implementation, analysis, and Git integration.
• Added desktop and mobile browser coverage for credential handoff, mapping
  updates, failed logout recovery, and release security boundaries.
• Added an application-level React error boundary with a reload recovery path
  for unexpected rendering failures.
• Added centralized, sanitized API error interception with request method and
  path context while preserving component-owned retry and recovery behavior.
• Added focused unit coverage for routing, API failures, shared controls, and
  administration workflows across identities, backends, bucket mappings,
  policies, IAM roles, temporary credentials, operations, and the shell.
• Added TypeScript and Vue 3 coding guidelines, including required component,
  template, and Pinia integration tests.
• Added React Testing Library, jsdom, Vue Test Utils, and matching Vue 3 compiler
  dependencies for component testing.

Changed

• Restricted credential-to-mapping return URLs to a single allowlisted
  credential_id parameter and authoritative enabled virtual identities.
• Made mapping edits preserve immutable aliases and owners while submitting only
  reviewed mutable fields with current concurrency metadata.
• Isolated pending revocation state per browser tab and sanitized recovery
  failures before presenting retry actions.
• Enforced whole-source unit coverage in CI with minimum 75 percent thresholds
  for statements, branches, functions, and lines.
• Expanded CI to run coverage instead of import-only unit execution and ignore
  generated coverage artifacts.
• Updated release documentation for release-branch and manual workflow dispatch
  procedures.
• Updated endpoint example validation to reject unsafe ASCII control characters
  without relying on a control-character regular expression.

Fixed

• Rejected malformed, whitespace-only, UUID-invalid, and non-virtual generated
  credential responses before disclosure or mapping handoff.
• Cleared one-time credential plaintext synchronously before navigation and kept
  generated access and secret keys out of query caches and request payloads.
• Improved session-expiry routing, role-dialog validation, identity-policy error
  recovery, and application error-boundary handling.
• Removed duplicate global API alerts that conflicted with contextual component
  errors and remained visible after successful retries.
• Isolated API client mocks and browser globals between tests to prevent order-
  dependent failures.
• Increased the unit-test timeout for instrumented component tests so coverage
  execution remains stable in CI.

Security

• Added browser assertions that generated credentials do not remain in URLs,
  local storage, session storage, the DOM after acknowledgement, or outbound
  request URLs and bodies.
• Prevented access to protected content while session revocation is unresolved,
  including across reloads and direct navigation attempts.

Deployment

• Removed a disabled UI NetworkPolicy before deployment verification so stale
  policy state cannot affect rollout health checks.
• Excluded repository metadata, environment files, coverage output, and Docker
  build definitions from the runtime image build context.

Published artifacts

• Static UI package: s3proxy-rs-ui-v0.6.4.tar.gz
• Container image: ghcr.io/cloudinfraz/s3proxy-rs-ui@sha256:70b97f4ffb6598b7dc9621353d12c0510ac89ddce6594ead18bae6bad7e1b6ef
• SPDX SBOM and SHA-256 checksums attached to this release