v0.8.1

Fixes

• Groups that only the login app asserts now admit mesh users. On a Spot with both mesh identity and delegated login, a restricted site whose allowlist names a group the mesh does not know (such as a platform-wide group, a team or a group) refused every viewer with 403, because the mesh identity was used and sign-in never started. Such a viewer now goes to sign-in, like an anonymous visitor: page loads redirect to the login app and other requests answer 401. Viewers the allowlist admits by their mesh identity still open the site without signing in, and refused signed-in or forward-auth viewers still get 403. #30
• A deploy refused after authorization (a bundle without index.html, preserve_access=require with no stored policy, or a site type conflict) no longer moves the site to the top of sort=updated listings or advances its content generation. #28

Images

docker pull ghcr.io/melonamin/spot-api:0.8.1
docker pull ghcr.io/melonamin/spot-caddy:0.8.1

See the changelog for the full list of changes.