v0.7.0

Changelog

• a2517e0: Admin API: a user search is at most 254 characters (@fernandezvara)
• f354911: Admin API: the configuration view, user search and a user's sessions (@fernandezvara)
• 333ef57: Admin UI: API keys, secrets and the audit trail (@fernandezvara)
• e76f14b: Admin UI: Playwright end-to-end tests with axe, CSP and origin guards (@fernandezvara)
• 454948d: Admin UI: built into the image and the release, CI, and the example stack (@fernandezvara)
• 6d4b734: Admin UI: functions, invocation history, logs, jobs and manual invoke (@fernandezvara)
• d7232f5: Admin UI: screenshots made by the Playwright suite (@fernandezvara)
• f06dd72: Admin UI: serve embedded assets at /_ui/ with a strict CSP (@fernandezvara)
• ef6770b: Admin UI: sign-in redirects stay in the realm; a memory-only session ends with the page (@fernandezvara)
• 248a4ec: Admin UI: the CSP requires Trusted Types for scripts (@fernandezvara)
• 424b343: Admin UI: the Vue application with sign-in, session and idle timeout (@fernandezvara)
• 25bdbc1: Admin UI: the data browser and schema forms (@fernandezvara)
• dc7e379: Admin UI: the read-only configuration view (@fernandezvara)
• 4dae687: Admin UI: the schema form and the query builder (@fernandezvara)
• 7cb39af: Admin UI: use vue-i18n 11 everywhere (@fernandezvara)
• 9610396: Admin UI: users, roles, sessions and invitations (@fernandezvara)
• 6f445ac: Admin data route: documents past the rules, with audited writes (@fernandezvara)
• 296d563: BACKD_ADMIN_API switches the admin API off per instance; the production reference splits public and internal (@fernandezvara)
• fabed95: Build(deps): bump the actions group with 4 updates (@dependabot[bot])
• 92079e3: Build(deps-dev): bump @types/node in /clients/js in the js group (@dependabot[bot])
• 5926ab6: Dependabot: watch the admin UI's npm dependencies (@fernandezvara)
• 5347128: Design: admin UI (@fernandezvara)
• 93eef4c: Design: admin UI names the JavaScript client backd-js (@fernandezvara)
• 38d7d26: Docs: the Admin UI guide (@fernandezvara)
• ef4d32a: Docs: the Admin UI guide covers functions (@fernandezvara)
• 184249b: Docs: the Admin UI guide covers keys, secrets and audit (@fernandezvara)
• a90d9e6: Docs: the Admin UI guide covers the configuration view (@fernandezvara)
• e4e3522: Docs: the Admin UI guide covers the data browser (@fernandezvara)
• bc237fa: Docs: the Admin UI guide covers users and invitations (@fernandezvara)
• cb2fac4: Docs: the admin UI's security review as prose, without the findings table (@fernandezvara)
• 2f276df: Docs: the admin UI's security review, hardening checklist entry and screenshots (@fernandezvara)
• 18dad0e: JS client: admin.data(database, collection) for the admin data route (@fernandezvara)
• 0e5aa85: JS client: the jobs listing filters by origin and shows origin and email kind (@fernandezvara)
• 3409ebf: JS client: whoami, config, user search and user sessions for the admin UI (@fernandezvara)
• 9d1ca6a: Merge pull request #101 from fernandezvara/release-v0.6.0 (@fernandezvara)
• dc6550e: Merge pull request #118 from fernandezvara/design-admin-ui (@fernandezvara)
• 8919600: Merge pull request #119 from fernandezvara/admin-ui-server (@fernandezvara)
• 370f731: Merge pull request #120 from fernandezvara/107-admin-ui-foundation (@fernandezvara)
• d07c016: Merge pull request #121 from fernandezvara/108-admin-ui-users (@fernandezvara)
• d4607ae: Merge pull request #122 from fernandezvara/109-admin-ui-keys-secrets-audit (@fernandezvara)
• e863769: Merge pull request #123 from fernandezvara/110-admin-ui-functions (@fernandezvara)
• d480b9b: Merge pull request #124 from fernandezvara/111-admin-ui-data (@fernandezvara)
• 080df4d: Merge pull request #125 from fernandezvara/112-admin-ui-data-browser (@fernandezvara)
• da71b58: Merge pull request #126 from fernandezvara/113-admin-ui-security-review (@fernandezvara)
• 67e5bfc: Merge pull request #128 from fernandezvara/dependabot/npm_and_yarn/clients/js/js-155033dc32 (@fernandezvara)
• bf65acc: Merge pull request #129 from fernandezvara/dependabot/github_actions/actions-ca5533c2d9 (@fernandezvara)
• 0eb2db6: Merge pull request #131 from fernandezvara/fix-signup-timing-test (@fernandezvara)
• f23eed5: Merge pull request #132 from fernandezvara/release-v0.7.0-prep (@fernandezvara)
• 625b9ea: Merge pull request #133 from fernandezvara/fix-release-admin-ui-tarball (@fernandezvara)
• e24bec5: Read-only admin level: admin: read, admin.read_access and whoami (@fernandezvara)
• 6af9b29: Release prep for v0.6.0: versions, upgrade notes (@fernandezvara)
• 07e079f: Release prep for v0.7.0: versions, upgrade notes (@fernandezvara)
• 805a0b0: Release: pack the admin UI outside the checkout (@fernandezvara)
• 2ffc24b: Test sign-up's timing property by counting hashes, not by timing it (@fernandezvara)
• f88678e: backd-js 0.5.0 (@fernandezvara)
• cd548bd: backd-js 0.6.0 (@fernandezvara)
• 0f1e6cf: design decided (@fernandezvara)
• e12105f: whoami lists the configuration among the areas a read-only administrator reads (@fernandezvara)

Container images: docker pull ghcr.io/fernandezvara/backd:v0.7.0 and ghcr.io/fernandezvara/backd-executor:v0.7.0 (linux/amd64 and linux/arm64), signed with cosign (keyless) and published with their SBOM and provenance.
Verify downloads against checksums.txt; each archive has an SPDX SBOM (*.sbom.json).