Skip to content

v0.6.60

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Aug 07:10
· 233 commits to main since this release
v0.6.60
4e0fc5f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.6.60 ~ "Closes an authentication bypass, and clears a run of API 500s"

Highlights

A security fix and a broad sweep of public API defects surfaced by running the official Postman collection against a live stack. Several endpoints answered 500 where a 404 or 422 belonged, and a few were unreachable entirely.

Security

  • Closed a verify-code authentication bypass in the driver flow. Please upgrade.
  • The non-production verification-code bypass is now scoped to explicitly designated review accounts, so a bypass code alone is not enough — the identity has to be on the allowlist too.

Bug Fixes

  • Driver register-device was unreachable on both driver routes. Laravel never injects a class-typed parameter that declares a default, so the injected request was always null.
  • Geofence driver history asked for a UUID the API never issues. It now resolves the driver by the public id callers actually hold.
  • /from-qr returned a 500, and the QR code's content is now published in debug mode so the flow can be exercised.
  • Fuel reports could not be created without a location, and could not be updated.
  • A sensor could not be created at all — last_position had no default.
  • Customer signup with a place failed — the Place location now defaults.
  • Unknown onboard organization answers 404 instead of 500.
  • Duplicate part SKU and fuel transaction answer 422 instead of 500.
  • Restored the vehicle maintenance schedule workflows.

Testing

  • Coverage restored to 100% across the QR, geofence, driver auth, customer request and navigator changes.

Continuous Integration

  • The server, Ember and Postman workflows now run on dev-v* release branches.
  • The contract run tests this branch's API code rather than the published package.

Need help?

What's Changed

  • ci: fix the Postman contract and track the latest release automatically by @roncodes in #288
  • fix(api): answer 404 instead of 500 for an unknown onboard organization by @roncodes in #290
  • fix(api): return 422 instead of 500 on duplicate part SKU and fuel transaction id by @roncodes in #291
  • fix(drivers): close verify-code authentication bypass by @roncodes in #292
  • fix(customers): default a Place location so signup with a place works by @roncodes in #293
  • feat(customers): add a non-production verification-code bypass by @roncodes in #294
  • ci(postman): test this branch's API code, and unpin the contract workflow by @roncodes in #296
  • ci(release): tag automatically when a dev-v* branch merges to main by @roncodes in #297
  • v0.6.60 by @roncodes in #295

Full Changelog: v0.6.59...v0.6.60

Contributors

roncodes
Assets 2
Loading