Skip to content

v0.4.7 — overview, locale, requirements runtime, and export hardening

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 30 Jun 13:41
v0.4.7
a1c706e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[0.4.7] - 2026-06-30

Security

  • Rate-limit admin export endpoints: PII export 5/h, attendees/reports export 10/h per user per route (global across events)

Added

  • Bulk Send tickets on the attendees list: POST .../attendees/bulk-resend with target unsent (default, purpose: initial with atomic claim) or all (resend, max 500 per request); rate limit 3 requests per 10 minutes per admin; response reports provider-accepted (queued), skipped, and failed counts; confirmation modal in admin SPA; audit via mail_bulk_resend in attendee action log
  • CSV import preview: first 20 valid rows returned as sampleRows with attributeFieldLabels; admin Import page shows a scrollable "Data preview" table before commit (dynamic optional columns + event custom attributes)
  • Requirements v2 (admin): Tabler icon picker on event items (EventItem.icon); contents metadata (type, required, options); ops-config flags allow_manual_lookup and auto_advance_on_valid (defaults true)
  • Check-in runtime: enforces allow_manual_lookup (403 on lookup API; UI hides manual lookup and blocks short-query lookup); auto_advance_on_valid clears scan state after VALID admission; GET /api/checkin/ops-config; item icons on AttendeeCard (Tabler)
  • Contents metadata runtime: enforce type/select/boolean/required/options on attendee create and patch; type-aware admin fields; required markers and formatted values on check-in item detail
  • CSV import: dynamic event-item attribute columns (source_field slugs) validated and stored in custom_data; template includes configured fields; export-style label headers accepted on re-import
  • Per-user preferred locale (User.preferred_locale) with date-format picker on Account page; admin SPA date displays respect the stored locale via module-level locale store
  • Per-event IANA timezone on events — create/settings/wizard picker, reports/exports/mail preview use event timezone
  • Event overview dashboard at /admin/events/:id/overview with admission rate, email delivery stats, event countdown, and dedicated GET /api/admin/events/:eventId/overview endpoint

Fixed

  • Event settings PATCH: audit_failed 500 uses { error } shape
  • Communication template editor: cursor restored after inserting placeholders into subject/body fields
  • Event overview: auto-refresh stats every 30s during event
  • CSV import: ignore source_field slugs that collide with standard import columns (email, company, etc.); event item contents API and admin form reject those reserved slugs on save
  • CSV import: validate merged custom_data at commit (including overwrite with existing attributes); return 400 when event attribute config has conflicting select options
  • Settings tabs preserve in-progress panel state (drafts, filters) when switching tabs without eager-loading every panel on first visit

Changed

  • Settings: replace mixed SPA/SSR horizontal tabs with four grouped in-app tabs (General, Security, Archiving, Identity); OIDC and Cloudflare Access remain server-rendered manage links
  • Admin timestamp display clarity: event operational times use event timezone with abbreviation; admin/system times (audit log, mail deliveries, sessions, archived_at) always show UTC with label
  • client-ip / healthz rate-limit helpers import resolveTrustProxy from lightweight env-flags module (avoids flaky CI load of @admitto/auth barrel → @admitto/tickets → Prisma singleton)
  • Shared @admitto/shared locale whitelist (SUPPORTED_LOCALE_TAGS) used by API validation and Account picker; invalid DB values sanitized on read
  • Audit log date filters use UTC calendar-day bounds (aligned with UTC table display)
  • Existing events migrated to UTC — update timezone in Event Settings after deploy
  • Known limitation: Account page TOTP enrollment still shows an otpauth:// URI string (HTML /mfa/enroll shows QR; SPA QR deferred to v0.5)

Deploy

  • Container image: ghcr.io/solarssk/admitto:0.4.7 (rolling :0.4)
  • Migrations apply automatically on container start (with pre-migration backup when pending). No manual migrate deploy.

Full changelog

Assets 3
Loading