v0.3.0 — Who uploaded what again?

2026-10-04.

Everything, entry by entry: https://github.com/danileau/prettypleaseprint/blob/v0.3.0/CHANGELOG.md

v0.2.0 — priorities, a catalogue, an API, and no object store

Six weeks of the app being used: what people asked for, what broke, and one piece of infrastructure removed.

This is not a drop-in upgrade from v0.1.0. Read "Upgrading" before changing PPP_TAG.

What is new

• Owner-managed materials and colours at /admin/catalog, with solid, gradient and "whatever" swatches. Contributed by @amirdadgari.
• A print request has a priority (low, medium, high). The owner's queue lists the urgent ones first.
• Print an old request again, with the form open so the material, colour, quantity and settings can change first.
• Withdraw your own request before it reaches the bed, a /history view of finished prints, and optional print settings on a request.
• A feature-request track (/frr): file one, and the owner triages it like a print.
• Owner-managed benefits (the "what's in it for you" options).
• A JSON API, an OpenAPI document and a console at /docs, with bearer tokens.
• Models up to 250 MB, a plain Download button, and Open in PrusaSlicer.
• The audit page is a dashboard: what is being refused, where work piles up, what to buy.
• A Cloudflare Tunnel overlay for deployments without a stable public address.

What changed underneath

• The object store is gone. Model files are plain files in $DATA_ROOT/uploads. One container, one credential pair and two SDK packages fewer.
• Sessions last twenty idle minutes, and handing out access asks for the password or passkey again.
• Done ends the flow; a finished ticket leaves the board.

Security

• An invited address could be registered without its invite link. Fixed: an account opens only by redeeming the link. If an invitee ever found their link already used, look at that account.
• The admin plugin's HTTP surface is closed, redirect targets are decided by a URL parser, and the dependency advisories found by the daily scan are patched (next, nodemailer, Better Auth 1.7.7).

Upgrading from v0.1.0

1. Snapshot the data directory.
2. Move the models out of MinIO first: stop the stack, run the one-shot ppp-storage-migrate container, read its verification. The commands are in Moving the models onto the filesystem. Do not copy MinIO's directory by hand; most files live inside its metadata and would be lost.
3. Deploy with PPP_TAG=v0.2.0. Eleven database migrations run by themselves.

There is no rolling back to v0.1.0 afterwards except from the snapshot. The images are linux/amd64. Behind Cloudflare, Rocket Loader must be off, and the edge caps uploads at 100 MB. The S3_* variables are no longer read.

Verified

Ten suites, nine of them against the built container image: registration and sign-in, upload, the queue, feature requests, benefits, the catalogue, the JSON API, WebAuthn in a real browser, and 122 OWASP-mapped probes.

Everything, entry by entry, is in the changelog.

v0.1.0 — invite-only 3D print requests, self-hostable

The first release worth naming. Everything the design handoff asked for is built, and the deployment path has been walked end to end on real hardware.

What it does

• Invite-only registration. No public sign-up; a User row cannot exist without a pending invitation, enforced in a single hook every authentication method goes through.
• Username and password sign-in, with passkeys as an optional and stronger second method. Passwords are ≥10 characters and refused if they appear in a known breach corpus.
• Upload → board → story. .stl and .3mf validated against their bytes rather than their filename, measured for a bounding box, stored in object storage and never in the web root.
• The admin queue and status flow — Requested → Accepted → Printing → Done → Delivery, forwards only, one step at a time. Or Declined, with a reason.
• A conversation per ticket, and the real geometry rendered in the browser.
• Access control you can undo — invitations withdrawn before acceptance, access revoked after, which signs the person out everywhere while keeping their history.
• An append-only audit trail of everything that changes who can get in or what happens to someone's model.

Deploying it

PPP_TAG=v0.1.0

Published, signed and scanned container images; the host needs no source tree and no toolchain. scripts/deploy-wizard.sh lists what is published, cosign-verifies before swapping, health-checks after, and rolls back on its own if the new image does not come good.

Mail is genuinely optional — nothing in the running system needs it. The admin bootstraps from a one-use link the migrator prints; there is deliberately no ADMIN_PASSWORD.

See the README to get started, and docs/deployment.md for a real deployment.

Verified

Six suites, all running in CI against the built container image rather than a dev server: registration and sign-in, upload and board, the admin queue, the upload validator against hostile fixtures, WebAuthn ceremonies in a real browser, and OWASP-mapped security probes.

Assessed against the OWASP Top 10 (2021) with SAST, SCA and DAST — see docs/security-audit.md, including the residual risk knowingly accepted.

Licence

AGPL-3.0-or-later. Modify it and serve it to others, and those users get your source.