Skip to content

Ridu v0.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Sep 06:12
v0.4.0
6fb625f

Ridu 0.4.0 adds a SvelteKit integration and explicit session-token authentication for frontends hosted separately from the CMS. It also improves multiselect fields, reduces admin syntax-highlighting overhead, and expands the authentication, SDK and hook documentation. The CMS still builds into one Go binary with its static admin embedded.

Try Ridu

Install Go 1.25.13 or newer, Node.js 24 and Bun 1.4.0, then run:

bun create ridu@0.4.0 my-ridu-app
cd my-ridu-app
bun install
bun run dev

Choose SQLite for a local trial without a separate database service. The generated README covers first-user setup, development and deployment. Run bun run build to build the application; apply its committed migrations and provide persistent database/upload storage before starting the production binary. See the quickstart and deployment guide.

What changed

  • New @riducms/sveltekit package provides a request-scoped server client, a browser client shared through Svelte context, reactive session state, and synchronization between tabs. Browsers can call Ridu on another domain without relying on third-party cookies.
  • The SDK groups account operations under client.auth, supports cookie or explicit token transport, and includes memoryTokenStore() for scripts and server processes. Session verification distinguishes invalid credentials from server outages.
  • Short-lived upload grants let authenticated frontends display private images without putting a session token in the image URL. Delivery rechecks session validity and current read access; revocation and rotation invalidate existing grants.
  • Multiselect menus exclude selected options, clear search text after selection, and keep keyboard navigation aligned with filtered results.
  • Admin code highlighting uses Twinkleplop in place of Shiki.
  • Expanded examples explain field and collection hooks, response transforms, typed data access, session ownership, and SvelteKit integration.

Breaking changes and upgrading from 0.3.x

Update the Go module, project-local CLI, all framework npm packages and official plugins together to 0.4.0. Regenerate application contracts and rebuild the admin and Go binary. Do not mix Ridu release versions.

Authentication and SDK

  • Replace top-level SDK auth methods with client.auth methods. For example, client.login("users", credentials) becomes client.auth.login({ collection: "users", ...credentials }), and client.session() becomes client.auth.getSession(). The latter returns null when there is no valid session. Configure auth.collection to omit the collection on individual calls.
  • Replace refreshSession() with auth.rotate() and /api/auth/refresh with /api/auth/rotate. Rotation replaces the token without extending the session; do not invoke it automatically from concurrent tabs or server renders.
  • Go auth hooks BeforeRefresh and AfterRefresh become BeforeRotate and AfterRotate. Use AuthOperationRotate; session-management access checks use AuthOperationSession.
  • Custom authentication stores must implement FindSessionByID. New session IDs use canonical UUID spelling consistently across adapters.
  • Explicit invalid Authorization: Session or API-key credentials now return invalid_credential instead of falling back to an ambient cookie. Token-mode clients must clear only the rejected token, preserving newer logins and ordinary authorization failures.

The framework admin continues to use its HttpOnly cookie. The optional SvelteKit integration deliberately uses a frontend-domain cookie readable by that application's scripts so direct browser requests can send the token to Ridu. Review the SvelteKit guide and its security trade-off before choosing this transport. Session snapshots are safe to render; session tokens are not.

Data and deployment

This release does not introduce a new database migration format or rewrite historical migration artifacts. Back up database and upload storage together, regenerate with the coordinated version, review the resulting application migration plan, and rehearse startup against a restored copy. Custom store implementations need the new session lookup method; official adapters include it.

SQLite remains qualified for a local file on one host. PostgreSQL supports the networked, multi-replica operating model. MongoDB retains its documented authenticated replica-set, TLS and release-qualification limits. The optional SvelteKit frontend has its own deployment; it does not add a JavaScript runtime to the Ridu CMS binary.

Scope

Ridu remains pre-1.0. This release improves the documented workflows and does not claim complete Payload parity or complete UnoCSS removal. See the feature status for the supported scope.

Assets 23
Loading