Skip to content

v1.2.0 — Recovery Flows, TOTP, and Admin Controls

Choose a tag to compare

View all tags
@feskolech feskolech released this 22 Mar 14:21
· 6 commits to main since this release
v1.2.0
a1b2411

This release expands account security, admin controls, and notification capabilities across the project.

Highlights

  • Added admin audit trail with categorized security, auth, and Steam events
  • Added webhook notifications with generic and Discord webhook targets
  • Added registration policies including open, disabled, domain allowlist, and invite-only modes
  • Added invite code management in the admin panel
  • Added authenticator app (TOTP) setup and login verification
  • Added break-glass recovery codes for account recovery and 2FA reset
  • Added usernameless passkey login while keeping email-first passkey fallback
  • Added recovery-aware login UI and improved Telegram login UX
  • Removed the unused Steam user ID field from settings and schema
  • Improved bot-to-backend proxy handling for Telegram login in production

Notes

  • Existing databases are upgraded automatically on backend startup
  • Recovery code regeneration requires sensitive password re-authentication
  • Using a recovery code resets configured 2FA and removes registered passkeys for that user
  • Usernameless passkey login depends on discoverable passkeys supported by the device/browser
  • Production backend and frontend were rebuilt and verified after these changes

Verification

  • Backend lint passed
  • Backend test suite passed
  • Frontend lint passed
  • Frontend tests passed
  • Frontend production build passed

Full Changelog: v1.1.0...v1.2.0

Assets 2
Loading