v0.5.0

Changelog

• 84e42ff: API key scopes in the command line, the JavaScript client and the docs (@fernandezvara)
• 1356f9e: API key scopes: grants, enforcement on every route, admin API (@fernandezvara)
• 7452ba7: Added tests for datetime field type (@fernandezvara)
• d9049c6: Admin user list: one page from the database, with a cursor (@fernandezvara)
• ba12461: CI replays the tutorial against a stack built from the checkout (@fernandezvara)
• fe1bf79: Cursors: the position condition, its encoding and the MongoDB paging (@fernandezvara)
• 4d7ffac: Dates stored as BSON Dates through the whole API (@fernandezvara)
• 534db38: Design: tutorial — the Shelf team asset library (@fernandezvara)
• f253429: Docs: dates stored as BSON Dates; rule fixtures with date fields (@fernandezvara)
• 37f4b15: Docs: the landing page and examples show v0.4.0 (@fernandezvara)
• 3a6bdf9: Idempotency-Key on document creates and batches (@fernandezvara)
• 43a6384: JavaScript client: after and next_cursor; iterate follows the cursor (@fernandezvara)
• 9cdbbc2: List: after and next_cursor (@fernandezvara)
• c38ee22: Login throttle: serialize the password checks of an account across instances (@fernandezvara)
• 8349f7e: Merge pull request #84 from fernandezvara/docs-landing-v0.4.0 (@fernandezvara)
• b705bb0: Merge pull request #85 from fernandezvara/31-cursor-pagination (@fernandezvara)
• a717c82: Merge pull request #86 from fernandezvara/29-52-28-hardening (@fernandezvara)
• b0ed905: Merge pull request #87 from fernandezvara/25-32-compose-names-rules-test (@fernandezvara)
• 1c1d3bb: Merge pull request #88 from fernandezvara/27-api-key-scopes (@fernandezvara)
• c7e8441: Merge pull request #89 from fernandezvara/35-cookie-token-mode (@fernandezvara)
• 38a8881: Merge pull request #90 from fernandezvara/42-bson-dates (@fernandezvara)
• 0bbee05: Merge pull request #92 from fernandezvara/40-idempotency-creates (@fernandezvara)
• 7b7dfbd: Merge pull request #93 from fernandezvara/91-tutorial (@fernandezvara)
• b5a6eef: Merge pull request #94 from fernandezvara/fix-ci-shelf-tests (@fernandezvara)
• 46ebd5d: Merge pull request #96 from fernandezvara/release-v0.5.0 (@fernandezvara)
• be31888: Pages: allow publishing the docs by hand between releases (@fernandezvara)
• c50c548: Queries compare date-stored fields as dates (@fernandezvara)
• 5817561: Release prep for v0.5.0: versions, upgrade notes, template CI tests the rules (@fernandezvara)
• c4678b8: Schema: x-backd-store: date stores a date-time field as a BSON Date (@fernandezvara)
• 2f04c57: Session cookies in the JavaScript client and the docs (@fernandezvara)
• a466db5: Session cookies: an HttpOnly cookie instead of a token for browser apps (@fernandezvara)
• cef7a8c: Shelf app: real view switching — nav was outside Alpine scope (@fernandezvara)
• 046a4f3: Shelf app: say who published an asset when published_by is there (@fernandezvara)
• c164e23: Shelf ch10: email — templates, hosted pages, a delivery function (@fernandezvara)
• 6921d62: Shelf ch11: the import webhook — the internet calls you (@fernandezvara)
• 9e7e467: Shelf ch12: running it — audit feed, API keys, the checklist (@fernandezvara)
• 5d33c66: Shelf ch1: the realm, assets and shares collections, the starter stack and a live gallery (@fernandezvara)
• a61ecf1: Shelf ch2: members — auth on, demo roles, sessions, account page (@fernandezvara)
• 396744e: Shelf ch3: rules and conflict-free edits (@fernandezvara)
• 68e4418: Shelf ch4: invitations close the door (@fernandezvara)
• 4f1b228: Shelf ch5: functions — publish, share, share-open (@fernandezvara)
• 0263675: Shelf ch6: preview — the network allowlist (@fernandezvara)
• e95b93e: Shelf ch7: an optional step showing a schema change (@fernandezvara)
• 365d8c7: Shelf ch7: notify — an internal function and the call graph (@fernandezvara)
• 61fbcab: Shelf ch8: digest — an async job with retry (@fernandezvara)
• 35c760e: Shelf ch9: schedules — digest daily, cleanup nightly (@fernandezvara)
• 71172d9: Shelf docs: chapters 3 and 4 match a real run (@fernandezvara)
• 6c5e86c: Shelf docs: close the gaps found reviewing the tutorial end to end (@fernandezvara)
• d491b2c: Shelf docs: fix chapter links, legacy callouts; link check skips downloads (@fernandezvara)
• 7cda606: Shelf docs: overview (stack, conventions, troubleshooting), chapter gaps, a summary and where next (@fernandezvara)
• 6623453: Shelf docs: per-chapter realm.yaml, and the first accounts in chapter 2 (@fernandezvara)
• 06f8a14: Shelf docs: watch the clock, secret_missing, name the API key (@fernandezvara)
• 4726294: Shelf: curators read every draft; a Review view; import records the event first (@fernandezvara)
• fa774ea: Shelf: functions-build image, API key client name, tour and chapters 5-12 match a real run (@fernandezvara)
• c2b88f3: Shelf: static app snapshot (PicoCSS + vendored Alpine) (@fernandezvara)
• ded2247: Shelf: the gallery works in a realm with auth disabled; chapter 1 matches a real run (@fernandezvara)
• 30ac87b: Shelf: tour.js + make shelf-tour — the tutorial's regression test (@fernandezvara)
• 732e3e8: Shelf: wire the tutorial into the docs and examples index (@fernandezvara)
• b46c448: Shorter sessions for users who hold an admin role (@fernandezvara)
• e44f7d9: Test harness knows the shelf's curator role and 16+ character strings (@fernandezvara)
• 4db3256: Test stacks have their own compose project names; the JS integration run tears down (@fernandezvara)
• f211ba6: TestWatch waits for Watch to return before the temp dir is removed (@fernandezvara)
• 9a6ef8d: Tutorial: fetch-the-files shortcode, functions-testing download, chapter load test (@fernandezvara)
• b75c1c9: backd rules test: tests for access rules, without a database (@fernandezvara)
• 5ab0ade: backd-js 0.3.0 (@fernandezvara)
• 0a07ae2: backd-js 0.4.0 (@fernandezvara)
• e455651: shelf-tour-ci: remove the root-owned .build folders from a container (@fernandezvara)
• 9a50c29: storage.Match: evaluate a filter in memory with MongoDB's semantics (@fernandezvara)

Container images: docker pull ghcr.io/fernandezvara/backd:v0.5.0 and ghcr.io/fernandezvara/backd-executor:v0.5.0 (linux/amd64 and linux/arm64), signed with cosign (keyless) and published with their SBOM and provenance.
Verify downloads against checksums.txt; each archive has an SPDX SBOM (*.sbom.json).