3.0.0

Features

• Added internal API token rotation support via POST /api-token/rotate.
• Online Redis records now consistently track modifiedAt, preserving createdAt and refreshing modifiedAt on updates.

Bug fixes and security fixes

• Fixed FCM token update error handling so Redis scan failures now return 500 Internal Server Error instead of being silently ignored.
• Removed apiToken from online-state GET responses and tightened token handling across logs, debug output, and comparisons.
• Removed committed Rocket secret keys; deployments must provide ROCKET_SECRET_KEY.
• Strengthened request validation for UUID path parameters and POST /fcmtoken input.
• Reduced information leakage by returning uniform 404 Not found responses for missing or corrupt Redis records.
• Reworked FCM token lookup to avoid loading full Redis records unnecessarily.

Idiomatic Rust improvements

• Cleaned up Rust style across models, handlers, and Redis helpers.
• Reduced unnecessary allocations, cloning, panics, and repeated environment reads while keeping the external JSON API unchanged.

Tests

• Updated integration coverage for online-state GET responses after removing apiToken from the response body.

2.0.3

Chores

• fix: restore un-hardened image to prevent issues

2.0.2

Chores:

• use the hardened golang docker image

2.0.1

Bugfixes

• show also debug messages in console

Chores

• update deps and actions

2.0.0

Features

• controllers and sensors can be mixed (now you can have a controller device able to receive commands, but also to send sensor data, like a thermostat)
• controller devices can have multiple controller features
• power outage sensor have a standard structure with a features array (called online)

Chores

• update deps
• update CI

1.1.0

feat: release

Signed-off-by: Stefano Cappa <stefano.cappa.ks89@gmail.com>

1.0.0

First release