You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
server: Dito.js handles logins and sessions itself instead of through koa-passport. app.passport is removed, and ctx.req.user and custom Passport strategies are gone. Existing sessions stay valid.
server:UserMixin.login() is now authenticate(), which reads the credentials only from the request body and resolves to their user without logging them in.
server:UserMixin.sessionQuery() is internal: apps set sessionScope instead.
server:UsersController needs app.session, and 'post confirm-access' when it routes patch, put or other actions that need confirmed access, else its setup throws.
server:UsersController only treats users of its own model class as logged in, not users of its subclasses.
server: Changing a user's password ends their other sessions. When users change their own password, the session of the request stays logged in.
server:post, patch and put of UsersController reject hash, and patch and put need confirmed access of a user of the controller's model class to set passwords or change usernames, also of other users. Without a login, they answer 401, without confirmed access 403 with confirmationRequired, and the admin asks the user to confirm.
server: The session cookie defaults to sameSite: 'lax'.
server: Session models need an expiresAt column, see Upgrading to 5.x.
server: Unused assets are released every hour instead of after writes of asset data.
server:assets.cleanupTimeThreshold and danglingTimeThreshold are renamed to deleteUnusedAfter and deleteUnsavedAfter, and the timeThreshold option of app.releaseUnusedAssets() to olderThan. Unknown asset options and invalid durations throw on startup.
server: Actions that a subclass redefines keep the authorize of the inherited action unless they set their own, and a subclass's actions object ranks above it. This can open as well as close access.
server: The app always listens to its 'error' events, also before start(), and log.errors: false only stops logging them. With it, nothing logs request errors, Koa's fallback included.
admin: Dialogs validate their data on submit, like forms.
admin: The width setting of dialogs is the width of their content, without their padding, and takes any CSS length besides pixel numbers. It defaults to '35em', slightly wider than the 480 pixels before.
admin:@simplewebauthn/browser and lean-qr are required peer dependencies.
admin: Single list views scroll their table between the list header and the buttons, instead of the whole view. Scope buttons no longer shrink their labels, and scroll in their own row when they don't fit.
server: Dito.js uses objection 4.2, see Objection 4 for the changes that come with it.
New
server, admin: Logins with passkeys, through PasskeyService, see Passkeys.
server, admin: Two-factor authentication with TOTP, through TotpService, see Two-factor authentication.
server, admin: Password resets by email, with app.authentication.passwordReset, see Password reset.
server, admin: Security changes need confirmed access, from a recent login or 'post confirm-access', see Confirmed access.
server: Users change their own password through 'post password' of UsersController.
server, admin: The admin offers password changes, passkeys, TOTP and password resets when the users controller at api.users in the server's config.admin.api routes them, and requests them under their action names below api.users.path, e.g. users/passkey-login.
server:CredentialMixin and CredentialModel store the passkeys and TOTP of all user models in one table.
server:app.name names the app for passkey managers and authenticator apps.
server: Authorize functions are called with their controller as this.
server: Services configured as true in config.services are set up with their defaults.
server: Started apps delete expired records every hour, through app.deleteExpiredRecords() and Model.deleteExpiredRecords(): expired sessions, unused assets and the records of models that override it. config.app.deleteExpiredRecordsEvery sets the interval, and dito db:delete_expired_records runs it once.
admin:settings.minDuration keeps dialogs visible for a minimum time.
admin: The empty option of lists shows a text while a list has no items.
admin:context.reload() reloads the items of the list or object that a component is in.
Fixes
admin: The admin fits phone windows: the page can't be widened or panned, the overlay menu closes from its title bar, wide tables, scopes and header tabs scroll, and dialogs fit the window.
admin: Password managers no longer offer to sign in on edit forms, and fill in the password dialogs of the logged-in user, which pass them the username.
server: Empty PATCH requests to existing members answer with the unchanged member instead of 404.
server: Logins with unknown usernames take as long as wrong passwords, and usernames and passwords that aren't strings answer like wrong ones.
server:super calls work in actions in the options form, e.g. { handler, parameters }, instead of throwing.
admin: Dialog buttons that are wider than their components stay off the dialog's edges.
admin: Failed logins show the message of the server's response.
admin: Errors of context.request() carry the status of their response.
admin: Lists outside of routes, e.g. in dialogs, keep their scope, page, order and filters to themselves instead of using the route's.
server: Inserts of several models at once handle the asset files of all of them, where models after the first were skipped when the first had no asset data.
