FluxTuner 1.0.2

FluxTuner 1.0.2

FluxTuner 1.0.2 adds a safer password change request flow for private Web/server deployments.

Added

• Added Web password change requests for private server deployments.
• Added a public “Forgot password?” flow where non-admin users choose a new password that only becomes active after administrator approval.
• Added admin UI actions to approve or reject pending password change requests.

Changed

• Non-admin users with a pending password change request are prevented from logging in with the old password until the request is resolved.
• Active sessions for non-admin users are revoked when a password change request is created.
• Standardized visible Web timestamps as YYYY-MM-DD HH:mm in the user's local browser time.

Security

• Password change requests store only password hashes, never plaintext passwords.
• Public password change requests use a generic response to avoid revealing whether an account exists.
• Administrator accounts are not blocked through the public password change request flow; admin recovery remains a CLI/manual operation.

Release quality

• Added a local make gate release check covering formatting, linting, tests, mypy, JavaScript syntax, Bandit and pip-audit --local.

Notes

This release includes a database schema update for Web password change requests. Existing users, profiles, favorites, playlists and history are preserved.