v1.3.0

• @lowdefy/modules-mongodb-support: ### Minor Changes

• #314 d8fb717 Thanks @SamTolmay! - support: the webhook can tell Pelican who your app's active users are. Pelican reads which user ids used an app from its request logs, which name users only by id, and now asks the app for their details with a signed users.lookup event naming up to 200 user ids. The webhook answers { users: [{ id, email, name }] } with the email and name from the user record of each id that is a member of your app (your pinned organisation, or any organisation under tenant). Anyone else is left out, and nothing else is shared.

  It is off by default. Turning it on shares the email and name of the members Pelican asks about:

  # modules/support/vars.yaml
  user_lookup: true

  Left off, the event answers 404, "This app does not share user details". A malformed lookup answers 422.

  Webhook events the module does not know now answer 404 "Unknown event", where they used to answer the 400 a bad ticket delivery gets. Ticket, test and release.* deliveries answer as before. Nothing to change in your app unless you want the lookup on.

• @lowdefy/modules-mongodb-user-account: ### Patch Changes

• #315 e494429 Thanks @SamTolmay! - A banned user who tries to sign in is now told their access was removed. Before, the login page had no message for a ban: a sign-in link landed on "Something went wrong while signing you in", and a correct emailed code toasted "That code is wrong or has expired", so the person kept retrying. A sign-in link or password sign-in now shows the "You don't have access to this app" wall with "Your access to this app has been removed. Contact an administrator if you think this is a mistake." A correct emailed code for a banned user, or for one with no access to the app, toasts the matching message in place of the wrong-code one. A sign-in link reaches the wall once Lowdefy redirects a refused magic-link sign-in to the error page.