Skip to content

version 15

Latest
Latest

Choose a tag to compare

View all tags
@jean-io jean-io released this 23 Oct 08:48
· 0 commits to coding since this release
v15
df5e464

moncycle.app v15

⚠️ Back up your database before upgrading from v14. The migration cannot be undone: it renames tables, drops columns, and merges or deletes accounts whose addresses differ only by case. If it fails half way, the only way back is to restore the backup.

mariadb-dump --single-transaction DATABASE_NAME > moncycle_v14_backup.sql

Try the migration on a copy first, then read docs/upgrading.md.

New

  • Settings page replacing the account page.
  • Local-first web client: offline writes, one-call sync (timeline_sync?since=).
  • Typed keywords (sensation, observation) with a management panel: rename, retype, merge, move to comment, delete.
  • Day form: last-change timestamp, keywords coloured by stamp, comment without medical data.
  • Method selector: cervical mucus self-observation or FertilityCare, optional temperature. "Billings" removed.
  • Cycle e-mail: optional, PDF + CSV + NFP attached, up to 5 extra addresses.
  • Exports (PDF, CSV, NFP, raw data) and NFP import updated for keywords.
  • Sign-up: password and e-mail verification link, nickname instead of name, adults only, mandatory terms box.
  • No password sent by e-mail; reset and address change by link.
  • Sessions and access tokens: list, name, scope (read-only / read-write), expiry, revoke.
  • Password change can log out other devices; account deletion asks for the 2FA code.
  • Argon2id for all password hashes (bcrypt upgraded at sign-in).
  • Preferred language on the account (EN, FR, ES, DE, IT, PL, PT).
  • New terms of service and privacy policy; acceptance stored in terms_accepted_at.
  • Docs: new README, docs/, AGENT.md, OpenAPI with examples.

Breaking

  • API moved to /api/v2/; old addresses return 404.
  • Every write is a POST (no PUT/PATCH); DELETE has no body; JSON only.
  • Unknown fields and parameters are refused with 400 validation_failed.
  • stat.php metric names are in English.
  • v14 sensation text becomes keywords of type "à définir"; they are written into the day comment in NFP, CSV and PDF exports until typed.
  • Tables and columns renamed to English; email1 / email2 become login_email / notification_emails.
  • Hand-written config.php needs the new settings from config.exemple.php.

Operations

  • Database upgraded automatically at start (script/auto_upgrade.php); APP_VERSION must match schema_version.
  • MAINTENANCE_MODE, DEMO_ENABLED, CAPTCHA_SECRET (32+ chars), TRUSTED_PROXIES, WEB_APP_ORIGINS, COOKIE_SAMESITE, NEWS_URL, TERMS_OF_SERVICE_URL, REQUEST_BODY_MAX_BYTES, LOGIN_* settings.
  • cron.php: --dry-run, partial actions; unverified accounts erased after ACCOUNT_UNVERIFIED_DELETE_DAYS.
  • App log with no personal content (docs/logs.md).
  • script/terms_notice.php mails users about the new terms.
  • Image: prod by default, PHP built-in server removed.

Security

  • CSP script-src 'self', CSRF origin check, signed captcha, per-IP and per-account throttling.
  • Session tokens hashed in the database.

Migration

  • Login addresses lowercased. Accounts differing only by case are merged, or the weaker one is deleted if both hold a day on the same date. Lines marked REVIEW in the output need a check.
  • Existing accounts are marked as verified.

License

AGPL-3.0-or-later, Tech 4 Fertility.

Assets 2
Loading