FormLogic v0.1.18

Before you update

• This one update runs under the old updater. v0.1.17's updater deletes anything in the web root and api/ that isn't in the package, so copy out your own files first if you have any: a .user.ini, a robots.txt, another folder, api/.env.backup-*. From this release on, an update removes only files a release shipped.
• Add the scheduled jobs you don't have yet. backup-accounts.php was in no install guide, and it runs the nightly backups, the recycle-bin purge, upload cleanup, record retention and the webhook log prune. native-record-dispatch.php, flow-outcome-dispatch.php and artifact-sweep.php were also missing from some lists. INSTALL.txt, the wizard and DEPLOYMENT.md now name the same ten jobs. Run them as the web server's user.
• Set DATA_ENCRYPTION_KEY, and keep a copy off the server. It now encrypts two-factor and webhook secrets and hosted app records. A site with no key keeps working and the Doctor says so. Without the key, whatever it encrypted can't be read. See docs/DATA_ENCRYPTION.md.
• Administrators need two-factor. Outside development an administrator has to have it on to reach the admin tools (ADMIN_MFA_REQUIRED=false turns this off). Every admin write now also asks for the password again.
• Manual installs: check APP_ENV. The old INSTALL.txt didn't mention it, so a hand-made .env copied from the example ran in development, which shows errors to visitors and treats any domain claim as proven. Set APP_ENV=production and APP_DEBUG=false.
• If you have a custom domain connected, set APP_URL before you update. Put this site's own address in api/.env, for example APP_URL=https://forms.example.com. Members now sign in on the main site instead of on the domain, and without APP_URL the domain doesn't know where that is: members of a members-only app get a sign-in form that refuses them. Public apps on a domain keep working. The install wizard doesn't write this setting, so a site set up with the wizard needs the line added by hand, and connecting a new domain is refused until it's there.
• nginx sites: update the /screen-host.html block from formlogic/README.md if you want custom screens in embeds. The old block is safe but leaves them blank. Apache's rules come with the release.
• Scripts calling the API. A submission by anyone but the form's owner now returns the record's id, status and timestamps, not the stored record. A wrong password or code when turning off two-factor, regenerating recovery codes or resetting an admin's two-factor is now 403, not 401. Report routes are limited to 120 a minute per user.
• Reserved addresses. OFFICIAL_EMAIL and DEMO_EMAIL (official@formlogic.local and demo@formlogic.local by default) can no longer be registered. bin/bootstrap-admin.php now needs ADMIN_BOOTSTRAP_PASSWORD to promote an address that already has an account, and replaces that account's password and two-factor.
• FormLogic Backups, a new OAIY plugin, needs PRIVATE_FORMS=true and DATA_NODES=true on the server. It works with OAIY v0.1.11 as it is. Install the zip for your system from this release in OAIY's Plugins tab. The Windows zip is attached here, and a Mac zip may follow. There's no Linux zip, because OAIY gives a plugin on Linux no display to ask you with.

What's new

• FormLogic Backups for OAIY. Keep sealed copies of your apps and forms on your own computer, on a schedule, in a folder you choose, and restore them. Set it up from Settings through the computer's existing OAIY link.
• Apps on their own domain. A SoftN app can run full screen on a connected domain. Nobody signs in on the domain itself: members sign in on FormLogic and the domain receives a one-time code. Attachments open there too.
• Stored data is encrypted. Secrets and hosted app records are encrypted at rest under DATA_ENCRYPTION_KEY, nightly backups can be sealed to a key you hold, and a Settings download can have a passphrase.
• Custom screens in embeds. A form with a custom screen now shows on a customer's own page, where it used to be blank.
• Backups carry more. Flow storage, hosted apps and private forms come back with a restore.

What's fixed

Public forms

• A visitor whose answer was refused, or never reached the server, was told "Thank you", and the owner received nothing. They now see the reason, and their answer stays in the browser only for forms that really are device-only.
• Embedded forms no longer fail on a return visit, and no longer crash when third-party storage is blocked.
• A rule's pattern now gives the same verdict in the browser and on the server. A date pattern with an escaped slash used to refuse every answer on the server.
• Submitting during an upload waits for it, instead of dropping the file.

Your work

• Two tabs, a second device or an AI client can no longer silently overwrite a form's fields: the later save is refused and says so.
• Device-only forms survive a session ending, and are named in the sign-out warning. Moving a form from the cloud to the device and back can no longer wipe its fields.
• The flow editor saves when you leave, and asks if that fails.
• A backup with a private form in it can be restored, and large forms and archives come back from the recycle bin. A restore can no longer damage a private form that's in the bin.
• Exports can't leave out committed rows. A CSV export cut off at its limit says so.
• Retention now reaches forms that have gone quiet, webhook logs no longer keep answers for good, and a script setting status spam no longer destroys the submission.
• A long offline queue on the desktop app is sent in pieces instead of failing as a whole.

Apps and their members

• One app can't walk a member's requests into another app or into their account, and a flow carries a member's session only into its own app.
• Apps stay apart on a server's workers and budgets, and the runtime sandboxes itself.
• What a member saves in an app stays through a session ending, a rename and a second tab.
• Nobody can take a deleted app's data, and it goes when the app is gone for good.
• A hosted action stops at its first failed operation and says why.

OAIY

• OAIY stays connected: a new tab asks for no new code, and the token moves to the account by itself.
• The Desktop control opens its menu again when OAIY is connected, with its services and plugins.

Accounts and access

• A crafted OAuth redirect could turn a stolen code into an account-wide API key.
• Anyone could keep any account locked out of password sign-in from one address. A reset link now ends a lockout.
• A public report could show fields outside the ones the form's owner chose to show, and one crafted answer could tie up a server core.
• Records no longer reach app members through a report's labels, through a form taken out of the app, or through queued connector events. An app can't use the viewer's own OAIY, AI or device without asking.
• An administrator acting for an account can't open a way to its records, and a session alone can't take over two-factor.
• Audit rows are no longer lost for OAuth clients, and member changes are recorded.

Running a site

• Updates keep your own files, check for disk space first, keep the newest three code snapshots, and ask before installing an older version. bin/upgrade.php --rollback=<id> puts the code back if an update is killed part way.
• Scheduled jobs keep working on a server with a second site or a second user, and fail loudly if they can't start.
• Relay streams and frames have limits per account, and a busy app no longer blocks its own update.
• A site set up with the wizard gets the index a long forms list needs, and API key hashes are unique there too. Both are added by themselves on update.

Templates

• OHS & QMS: Action Items and Corrective Actions can be created. This applies to new installs; an installed copy keeps its fields.

Tested with

SoftN v0.0.30 (ZIPP v0.0.32) and OAIY v0.1.11.