v0.1.14

Security

• Installs with admins but no owner left the first run setup open, so anyone who could reach the server could make themselves owner. This affects every earlier version; many installs end up in this state when admins come from ADMIN_EMAILS. Please upgrade. (#42, thanks @TangoKilo3)

Added

• When ADMIN_EMAILS is set, the setup page only accepts one of those emails.

Fixed

• Two owners changing each other's role at the same time could leave the install with no owner.
• Repeated or concurrent team invites no longer send duplicate emails or audit entries.

Changed

• An install with admins but no owner promotes one at startup: the first one listed in ADMIN_EMAILS, otherwise the earliest admin. The log says who.
• An ADMIN_EMAILS user who signs in while there is no owner becomes owner.
• setup_complete is no longer returned or accepted by /admin/settings.
• GET /setup/status answers 500 on a database error instead of needed: true.

Upgrade notes

• No migrations. Rolling back to v0.1.13 works.

• Can't upgrade right away? Check with curl https://your-host/api/v1/setup/status. If it says "needed":true, make yourself owner:

  UPDATE users SET role = 'owner', updated_at = now() WHERE email = 'you@example.com';

Full Changelog: v0.1.13...v0.1.14