v0.10.1

Fixes only: sign-in attempt limits that hold under concurrent requests, key rotation that no longer undoes a concurrent edit, inquiries that stay anonymised, and calendar-import and session-log corrections.

Upgrading

Run ./prod.py update. There are no migrations, and prod.py and docker-compose.prod.yml only change their version string.

The hourly retention pass now also anonymises Onboarded inquiries that have no linked client once they are older than 180 days. To see what the first run will change, run ./prod.py manage tidy_inquiries first.

Highlights

• Security: sign-in attempt limits hold under concurrent requests. Requests sent together could each read a failure count below the limit and each get a guess. Attempts against one account are now counted one at a time.
• Key rotation could undo an edit (#559). A note saved while encryption rotate was running was overwritten with its older content. It is now left as saved.
• Anonymised inquiries stay anonymised (#558). Their personal fields are read-only. Deleting a client by any path now anonymises the inquiry they came from. An inquiry can no longer be converted into a client twice, or after it was anonymised.
• Calendar approval queue. "Create new invoice" makes one invoice per batch instead of one per event. Events that could not be imported stay in the queue, and the queue lists why.
• Session log input. A non-numeric duration no longer causes a server error. Editing the log of an already-billed session no longer changes its duration.
• Admin bulk actions Mark as sent and Mark as cancelled now clear a stale payment date (#557).
• Hardening. Media rewrites are atomic, and one practice's calendar error no longer stops the other practices from syncing. Operator commands guard real installations: seed_sample_data asks before seeding a live installation, and setup_practice --no-input refuses once a practice exists. check_bank_duplicates no longer prints IBANs. Admin badges escape their translated text.

Full changelog: docs/CHANGELOG.md