v1.2.0

Admin roles (RBAC) enforcement

Added

• Admin roles are enforced across every /admin/* route. Each role — SUPER_ADMIN, OPERATOR, ANALYST — gets a fixed capability set from a single deny-by-default map. Summarized:
  • ANALYST — read-only (all GET/list/stats/count/estimate/preview), except gift-card code export, plus read-only AI tools.
  • OPERATOR — everything ANALYST has, plus writes to members, campaigns, coupons (and coupon-code reveal), segments, badges, tiers, rewards, notification templates, and gift-card terms.
  • SUPER_ADMIN — everything OPERATOR has, plus webhooks, gift-card financial operations and code reveal, coalition, and program settings. (#32)
• @loyaltyos/permissions — the shared role/permission model consumed by both the API and the admin UI, so the two cannot drift.
• AI companion filtered by role — ANALYST is offered read-only tools only; OPERATOR and SUPER_ADMIN see the full set.
• admin:create CLI — provision an admin with a role (pnpm --filter @loyaltyos/api admin:create --email --role --program).
• Audit log records denied requests as ACCESS_DENIED, capturing the role, method, and route.

Security

• Gift card codes are only revealed to SUPER_ADMIN. OPERATOR/ANALYST see the last four characters only (server-side masking) and cannot export batch codes; the export route now requires the giftcards.codes.reveal permission.
• Coupon codes are masked for ANALYST. SUPER_ADMIN and OPERATOR see full codes (coupons.codes.reveal); ANALYST sees only the last four characters in the list, detail, and stats endpoints.
• Coalition credentials are write-only. GET and PUT /admin/coalition/config no longer return encryptedCredentials; they return hasCredentials instead.
• Admin routes no longer trust X-Program-Id. The program is always taken from the authenticated session or API key, removing the header-based tenant-switch fallback.

Changed

• The seed now creates operator@loyaltyos.dev (OPERATOR) and analyst@loyaltyos.dev (ANALYST) alongside the super admin.

Breaking changes

• Admin permissions are enforced by role. Admins that are not SUPER_ADMIN lose access to gift-card financial operations, batch code export, coalition, program settings, and webhooks.
• ANALYST sessions are read-only on non-admin routes too (e.g. POST /events, POST /members return 403).
• Coupon codes are masked for ANALYST.

Upgrade notes

⚠️ Review every admin's role before upgrading. The default role is OPERATOR: admins who are not SUPER_ADMIN lose access to gift-card financial operations, code export, coalition, program settings and webhooks.

-- list admins and their roles
SELECT id, email, role FROM "AdminUser" ORDER BY role, email;
-- promote an admin
UPDATE "AdminUser" SET role = 'SUPER_ADMIN' WHERE email = 'admin@example.com';

Alternatively, create a new admin with a role: pnpm --filter @loyaltyos/api admin:create --email <email> --role SUPER_ADMIN --program <programId>.

Upgrading from v1.0.x? Apply the v1.1.0 upgrade notes first (security release, GHSA-98hf-vcvp-p8j6).

Known limitations

• MCP server: its admin tools call routes that do not exist in the API (#48).
• Points ledger concurrency fixes from #29 are not included in this release.

Docker Images

• ghcr.io/jvillatox/loyaltyos-api:v1.2.0
• ghcr.io/jvillatox/loyaltyos-admin:v1.2.0
• ghcr.io/jvillatox/loyaltyos-portal:v1.2.0

Deploy

helm repo add loyaltyos https://jvillatox.github.io/loyaltyos/helm
helm upgrade --install loyaltyos loyaltyos/loyaltyos --version v1.2.0

loyaltyos-1.2.0

LoyaltyOS — Open source customer loyalty platform with native coalition support

v1.1.0

[1.1.0] - 2026-10-18

Security release. All deployments of v1.0.x should upgrade. See advisory GHSA-98hf-vcvp-p8j6.

Security

• Admin routes now require an admin session (deny-by-default). API keys — including SERVER-scope keys — no longer grant access to /admin/*.
• API keys can no longer switch tenants via X-Program-Id; a mismatched header returns 403.
• Admin UI authenticates with the session cookie only. Earlier builds embedded an API key (dev-key, SERVER-scope in the seed) in the public admin bundle.
• Production boot guard: the API refuses to start while the seeded dev-key is active.
• /metrics is token-gated via METRICS_TOKEN.
• AI companion tools run with the operator's admin session, not a shared API key.
• Member actions are recorded as MEMBER (previously ADMIN_USER) in the audit log.

Added

• Admin AI Companion (off by default, AI_COMPANION_ENABLED): read-only tools run directly; any mutating tool requires a server-side, single-use confirmation.
• Gift cards: batch generation, redemption, terms templates, admin UI, CSV/XLSX export.
• i18n: admin (es-MX/en-US), portal, widget, API errors and notifications.

Fixed

• The API Docker image now boots. Images published for v1.0.x built but failed at startup.
• Member magic-link login no longer returns 500.
• Admin session persists across page reloads.
• Docker builds for admin and portal (missing workspace dependencies).

Changed

• API is bundled with esbuild; base image node:22-alpine; CI on Node 22 (Node 20 is EOL).

Breaking changes

• API keys no longer access /admin/*.
• X-Program-Id different from the key's program → 403.
• /metrics requires METRICS_TOKEN (returns 404 in production when unset).
• GIFTCARD_HMAC_SECRET is required in production.
• VITE_API_KEY and VITE_PROGRAM_ID were removed from the admin build.

Upgrade notes

1. Run database migrations (prisma migrate deploy): adds MEMBER to AuditActorType.
2. Set GIFTCARD_HMAC_SECRET and (to scrape metrics) METRICS_TOKEN; configure Prometheus to send Authorization: Bearer <METRICS_TOKEN>.
3. Deactivate or rotate the dev-key API key if it exists, and rotate any key that was used in an admin build.
4. Rebuild the admin UI without VITE_API_KEY / VITE_PROGRAM_ID.
5. Review the audit log for /admin/* actions performed by API_KEY actors (see the advisory).

Known limitations

• Admin roles are not enforced yet (SUPER_ADMIN / OPERATOR / ANALYST): every admin has the same permissions (#32).
• MCP server: its admin tools call routes that do not exist in the API and do not work in this release (#48).
• Points ledger concurrency fixes from #29 are not included in this release.

loyaltyos-1.1.0

LoyaltyOS — Open source customer loyalty platform with native coalition support

v1.0.1

Changes

• fix: remove continue-on-error from npm publish, bump widget to 1.0.1 (9f8c6b0)

Docker Images

• ghcr.io/jvillatox/loyaltyos-api:v1.0.1
• ghcr.io/jvillatox/loyaltyos-admin:v1.0.1
• ghcr.io/jvillatox/loyaltyos-portal:v1.0.1

Deploy

helm repo add loyaltyos https://jvillatox.github.io/loyaltyos
helm upgrade --install loyaltyos loyaltyos/loyaltyos --version v1.0.1

Full Changelog: v1.0.0...v1.0.1

v1.0.0

Changes

• fix(ci): delete stale chart-releaser tag before publishing (535dbb9)
• fix(ci): use fetch instead of ls-remote for gh-pages check (94060a5)
• fix(ci): configure git before creating gh-pages branch (efb1c05)
• fix(ci): create gh-pages branch before chart-releaser for first release (69fc216)
• fix(ci): add helm repo and dependency update before chart-releaser (2a1e9e3)
• chore(helm): add kubeVersion constraint to Chart.yaml (d327ac4)
• fix(ci): make npm publish job non-blocking for v1.0.0 release (583fba0)
• fix(ci): fix release body generation and make npm publish optional (9af520c)
• fix(ci): pin Helm version to v3.17.0 in release workflow (fbefb14)
• fix(ci): seed database before running tests in CI (3263cb8)
• fix(api): manually load .env in db.ts for CI compatibility (6fb681f)
• fix(ci): write .env via env var expansion + add db.ts debug logging (50c53a3)
• fix(ci): create .env file before vitest tests in CI (ba8aae1)
• fix(ci): explicitly set DATABASE_URL env on test step (43f326c)
• chore(ci): add env diagnostic before test step (92bdb71)
• fix(prisma): add native binary target for CI runner compatibility (5a4b293)
• fix(ci): add prisma generate step before TypeScript build in CI (93e68bb)
• fix(ci): use double dash passthrough for vitest --coverage flag through turbo (04b74f7)
• fix(ci): remove hardcoded pnpm version to resolve conflict with packageManager field (6b55ef1)
• chore: prepare v1.0.0 retag with phase-5 hardening (1b372e6)
• ci: postgres matrix 14/15/16, codecov, and smoke workflow rename (baa8d9c)
• feat(widget): publish @loyaltyos/widget to npm via release workflow (a8b3037)
• ci(release): publish helm chart to gh-pages and tag images latest (5c66b38)
• ci: add release, codeql, e2e workflows, dependabot, CODEOWNERS, issue/PR templates, and build job (02e23d3)
• feat(telemetry): loyaltyos_* business metrics, active members job, and observability dashboard (2021ab4)
• fix(admin): equalize login timing to prevent email enumeration via response latency (30018c2)
• feat(auth): admin login with argon2id, lucia sessions, and admin dashboard wiring (9cc21bd)

Docker Images

• ghcr.io/jvillatox/loyaltyos-api:v1.0.0
• ghcr.io/jvillatox/loyaltyos-admin:v1.0.0
• ghcr.io/jvillatox/loyaltyos-portal:v1.0.0

Deploy

helm repo add loyaltyos https://jvillatox.github.io/loyaltyos
helm upgrade --install loyaltyos loyaltyos/loyaltyos --version v1.0.0

Full Changelog: v0.3.0-phase3...v1.0.0

v0.3.0 — Phase 3: Gamification

Customer Portal · Loyalty Widget · Badges + Tiers · Rewards Catalog · Multi-channel Notifications (SMTP/SMS/Push/Webhook) · Magic-link Auth · Compliance-ready Audit Log. See CHANGELOG.md for full list.