DiscVault v26.6.9

DiscVault v26.6.9

DiscVault v26.6.9 promotes the complete beta train since v26.5.0. This release
strengthens local password onboarding and MFA alongside passkeys, turns the
administration area into a set of focused and accessible workspaces, and adds a
privacy-bounded MovieVault fallback for unresolved release details.

Highlights

• Clearer authentication on every deployment. Passkeys are offered only
  when the configured relying-party host and HTTPS origin match the browser,
  while safely detected local installations retain a guided Legacy
  Authentication path for password onboarding, TOTP, and recovery.
• Focused administration workflows. Users, groups, roles, operations, and
  plugins now use responsive subtabs, keyboard navigation, clearer status
  feedback, and task-oriented views.
• Safer MovieVault release-detail fallback. DiscVault can resolve missing
  release, technical, barcode, and box-set details through a bounded
  server-side bridge without forwarding account, collection, or client
  identity.

Authentication and account security

• Passkey onboarding, login, and management now require a valid configured
  relying party and matching HTTPS origin. DiscVault explains invalid host or
  origin configuration while preserving the existing localhost development
  exception.
  (#328,
  e353602;
  #331,
  2e1a753)
• First-owner setup supports password-only onboarding on verified loopback or
  private-network addresses when no valid relying party is configured. The
  owner remains pending until recovery codes are acknowledged, and concurrent
  bootstrap attempts are rejected.
  (#331,
  2e1a753)
• Account settings now provide current-password-protected TOTP enrollment and
  recovery-code confirmation. MFA challenges accept authenticator codes only;
  recovery remains a separate action from the initial sign-in screen.
  (#333,
  83d7e50;
  #335,
  1d97389;
  #338,
  32701d3)
• Local onboarding and sign-in use simpler method-neutral guidance and no
  longer show redundant passkey or password-risk prompts when the safe local
  password path applies.
  (#334,
  05fc39b;
  #335,
  1d97389)

Administration and roles

• Users and Groups are separated into Settings / Create, Users, and Groups
  views. Roles provide dedicated Overview, Roles, Permissions, and Simulator
  views while preserving Basic and Advanced RBAC behavior.
  (#326,
  dd16b38)
• Custom-role editing now follows a Details, Permissions, and Review & Save
  wizard. System roles use the same workflow in read-only mode, permission
  groups are accessible accordions, and immutable role keys are generated with
  collision-safe suffixes.
  (#327,
  5154ff2;
  #330,
  f476f33)
• The top-level Admin area uses responsive icon navigation with permission
  filtering, tab-panel semantics, arrow-key control, and a mobile scroller that
  keeps the active section visible.
  (#332,
  ef199d9)
• Operations is organized into collection health, duplicate detection, feature
  readiness, policy, and activity sections with live status indicators.
  Plugins is organized into Overview, Installed, Packages, and Activity with
  compact type, status, and search filters.
  (#341,
  992c3a6;
  #342,
  a9d1ac7)
• Admin subtabs now share the Preferences-style layout, active accent color,
  and narrow-screen behavior across Users, Roles, Operations, and Plugins.
  (#343,
  0bbcbea)

MovieVault release details

• The MovieVault v2 context includes a bounded anonymous
  release-technical-1 POST/poll bridge for unresolved release, technical,
  barcode, and box-set data. PWA, Android, and iOS barcode clients reuse the
  same server-side result path.
• Redirects, oversized or unknown responses, and invalid provider contracts
  fail closed. Polling is capped, and requests do not forward authentication,
  cookies, instance identity, contribution credentials, collection context,
  client IP, or browser headers.
  (#337,
  f59ff60;
  #340,
  b874db1)

Upgrade notes

• WebAuthn deployments should use the public HTTPS origin and matching
  RP_ID/RP_ORIGIN. Opening DiscVault through a different hostname or IP
  intentionally disables passkey actions.
• Existing Legacy Authentication users can continue signing in with passwords.
  Recovery codes are entered from the dedicated recovery action rather than
  the authenticator-code challenge.
• The MovieVault fallback remains local-first and is used only when the
  matching MovieVault integration requests unresolved release details.
• No new database migration is required for this release.
• User-facing changes include complete translations across all 29 supported
  locales.

Full changelog: v26.5.0...v26.6.9