api-v1.4.0

[1.4.0] - 2026-07-27

Added

• Custom roles and permission-based access control — The API now supports custom roles — each can be named, granted a specific set of permissions, and given its own members. Access to every protected part of the API is now fully driven by a permission engine and a security classifier. Role changes require an MFA confirmation and are written to an audit record. (PR #100)

Changed

• ⚠ BREAKING: Tier level is now categorized by ordinals — Endpoints for access management now emit access role ordinals. Clients consuming the field will require a configuration update. (PR #100)

Security

• Role changes now take effect immediately — When a user's role changes, their existing sessions lose the old level of access straight away and the old cache is immediately invalidated at the infrastructure level. (PR #100)

api-v1.3.1

[1.3.1] - 2026-07-25

Security

• Administration is now driven by full classification of user roles & permissions — Every administrative section of the API is now protected by a role classifier and by verification of the user's individual permissions. Permissions are now also enforced on the web application's end. An invalid role ordinal is rejected and the request is refused at the API level.

api-v1.3.0

[1.3.0] - 2026-07-17

Added

• Administrative API configuration — A new administrative interface to read and edit configuration entries; every change is audited and immediately invalidates the client cache.
• Scoped collaborator access to password management — Invited collaborators can now be granted access limited strictly to managing their own project's passwords. Full management access requires per-request approval and is always audited.
• Contact form policy and validation — The site's central configuration now drives the contact form and strictly enforces its validation rules.

Changed

• Faster site-config revalidation — The configuration endpoint now returns a strong ETag and honours If-None-Match, so clients refresh from their local cache instead of re-downloading the configuration.

v0.10.1

[0.10.1] - 2026-07-04

Added

• Clearer status page — proxy icon and localized monitor labels — Added a dedicated proxy glyph and localized monitor-name qualifiers (Primary / Secondary / Tertiary / Reverse) on the status page, so duplicate services like two firewalls read distinctly. (PR #72)

Fixed

• Human-verification no longer needs a page refresh — The Cloudflare Turnstile verification widget now automatically retries when it fails to mint a token (for example after the page has been idle), so forms recover on their own without a manual refresh.

v0.10.0

[0.10.0] - 2026-06-26

ℹ️ Note: Self-service password reset arrives + a polish pass across the authentication flow.

Added

• Self-service password reset — You can now request a secure reset link by email, then choose a new password. Also, a new two-factor step for accounts that have 2FA enabled.

Changed

• Clearer email resend with a countdown — Resending a password-reset or account-activation email now confirms it was sent and shows a live countdown before you can request another.
• Refined and consistent auth screens — A new consistent layout for the whole authentication flow is now live in production.

api-v1.2.0

[1.2.0] - 2026-06-25

Added

• Public site configuration — Apps can now fetch feature flags and the announcement banner anonymously and cache the result.
• Policy and form rules — Sections with forms can now read the current validation requirements and also verify the form before it's submitted.

Changed

• Email confirmation returns the confirmed address — Verified email address action now returns the same address in the success response, making it easier for the user to check.
• Consistent lockout signal during password reset — The two-factor step during password reset now reports a locked account using the same machine-readable code as sign-in.
• Clearer form errors — Registration now returns structured, de-duplicated field-level error codes, so validation can pinpoint the exact field.

Fixed

• Better name handling — Names now accept curly/iOS apostrophes, nicknames are canonicalized consistently, and the configured name character set is enforced on registration.
• Accurate validation error codes in API docs — The API documentation now describes validation error codes as HTTP 400 instead of 422.

api-v1.1.0

[1.1.0] - 2026-06-22

Added

• Reliable account emails — Account emails — address confirmation, two-factor codes, and password-reset messages — are now delivered reliably, with automatic handling of bounced or rejected addresses.
• Self-service password reset — You can now reset a forgotten password from the sign-in screen through a secure email link. Accounts with two-factor authentication are asked to confirm their second factor during the reset.
• Two-factor authentication — Added optional two-factor authentication using an authenticator app, with single-use recovery codes for backup access.

Changed

• Clearer authentication responses — Authentication responses now use a consistent set of machine-readable codes, so apps can present clearer, more specific messages.
• Build metadata in the API documentation — The API's OpenAPI document now reports the release version and build date.

Security

• Hardened session handling — Signed-in sessions are more secure: refresh tokens now rotate automatically, with detection of reused tokens.
• Stronger sign-in protection — Sign-in and account-recovery flows are now protected against automated abuse, and accounts are temporarily locked after repeated failed sign-in attempts.

v0.9.14

[0.9.14] - 2026-06-19

ℹ️ Note: A big rolling update: friendly "Coming soon" sections, time-display preferences, a redesigned changelog, a clearer status page, a refreshed look, and security hardening.

Added

• Friendly pages for sections that aren't live yet — Pages with status now follow a global site routing convention with its dedicated landing page.
• Choose how dates and times are shown — A new setting lets you pick your time zone and switch between 12/24-hour clocks. Automated selection based on browser has been added as well.

Changed

• A richer changelog — Release cards now show contributors with avatars, collapsible summaries, links to the source signature of the specific commit and smoother animations.
• A refreshed look across the site — A site-wide visual polish brings a new teal gradient to the navigation bar and other sections. Refined dropdown menus, smoother hover effects, and small layout cleanups throughout.
• A clearer service-status page — The status page now shows a per-service icon and real service name, an at-a-glance count of monitored services, an "Online" label on each, and clearer handling of services that are newly added and have no data.

Fixed

• Assorted display fixes — Small fixes including a centered status indicator in the footer on iOS, better responsive labels on the status page, and a more accurate Czech translation for the "down" status.
• Fixed forms that could fail to submit — Resolved an issue where some form submissions could result in failed action before they were processed.

Security

• Stronger sign-in and session security — Authentication system hardening with automatic session control and strict login policy. Added MFA support and authentication with social networks.

api-v1.0.0

[1.0.0] - 2026-06-16

Added

• API added to changelog — The first stable release of the official API, which is the core for the system infrastructure, is now part of the changelog pipeline.

v0.9.13

[0.9.13] - 2026-06-08

ℹ️ Note: Welcome to the new Changelog — every release is now published automatically from GitHub.

Added

• Official launch of the Changelog section — A fully automated release pipeline with a window into GitHub. Entries now carry an author, notes, a publisher, and a general summary.