Release v1.2.0

🔐 Security-Focused Update

• JWT Refresh Token Support
  Implemented support for refresh tokens with persistent storage in the database, enabling safer long-term authentication and token renewal flows.

• Stronger Password Change Flow
  Password changes now require the current password and an active session. Additionally, changing the password revokes all existing sessions across all devices, enhancing account security.

• Session Tracking and Management
  Each login session now stores the user's IP address and device information. A new endpoint allows users to view all active sessions and revoke any specific session—or all sessions at once—for complete session control.

• UUID Migration
  All primary keys across entities have been migrated from numeric IDs to UUIDs, improving database security and consistency.

• User Status Enum
  Replaced the active boolean with a status enum to support more detailed account states: pending_verification (coming soon), active, deletion_requested, and locked.

• Brute Force Protection
  Introduced progressive delays after failed login attempts based on IP and device fingerprinting, limiting brute-force attacks without blocking legitimate users too early.

• Forgot Password Flow
  Added a new endpoint to request a password reset via email. Users receive a secure token to set a new password, allowing recovery even without an active session.

Full Changelog: v1.0.0...v1.2.0

Release v1.1.0

🚀 Highlights

• Collaborative Fundboxes
  Implemented the logic for collaborative fundboxes, allowing users to create fundboxes where they can invite others to contribute. The FundBox owner can add or remove collaborators. The functionality includes a brand new invitation system, where users can manage who participates in the fundbox and contribute to a common goal.

• Improved Token Management
  Introduced a tokenVersion strategy to invalidate previous JWT tokens on new login, ensuring that only the most recent token remains valid. This enhances security by preventing reuse of older tokens, even without persisting session data.

• Improved JWT Authentication
  Refined JWT exception handling by returning a 401 Unauthorized error when an attempt is made to access a protected resource without a token, replacing the previous generic 403 Forbidden.

• Performance Improvements & Refactoring
  Various optimizations and code refactoring for better performance and maintainability.

Release v1.0.1

🚀 Highlights

• Account Reactivation Fix
  Fixed an issue where deactivated accounts were being reactivated before credential validation during login.

Note: This didn't allow unauthorized access, but could undo a pending account deletion.

• Rate Limiting
  Implemented request throttling to mitigate abuse and brute-force attempts.

• JWT Exception Handling
  Added proper handling and custom JSON responses for expired or malformed JWT tokens.

Release v1.0.0

🚀 Highlights

• Authentication with JWT
  Sign up, login, logout, and profile editing secured with token-based authentication.

• FundBox Management
  Create, edit, delete, list (with pagination), and view details of goal-based investment boxes, including balance calculation.

• Deposit Management
  Create, edit (via PUT with partial updates), delete, list (with pagination and optional filtering by transaction type), and view deposit summaries.

• Deposit-to-FundBox Linking
  Deposits can be linked to specific fund boxes, with automatic balance computation based on transaction type.

• Global Error Handling
  Consistent error responses in JSON format, with code, title, and description.

🔒 Security

• JWT token-based session control.

• Active user validation before any operation.

• Ownership verification to prevent unauthorized data access.