0.4.0

Security

• Changing an affiliate's password now signs out every session they had
  before, so a hijacked affiliate account can no longer keep changing its
  payout details after a reset.
• If you run Supaffi behind your own reverse proxy, update its config from
  the README. The previous example let visitors fake their address, which
  switched off the login and signup limits.

Added

• Sales through Stripe Payment Links, buy buttons and pricing tables earn
  commissions. The tracking script is all you add. A link that already
  carries your own client reference is left alone.

Fixed

• Mark paid says when a payout was already marked paid, instead of looking
  like it worked.
• Buy links follow the latest affiliate click, even on a page opened before
  it.

0.3.4

Changed

• The affiliate signup page and dashboard no longer assume you sell
  subscriptions. The second signup tile reads "Earn on" (every payment, a
  number of months, or the first payment only), and the terms line says
  "of every payment" instead of "forever".

Fixed

• Customers who bought once are no longer counted as "still paying" on the
  affiliate dashboard or the Affiliates page. Only referred subscribers count,
  and the affiliate's Referrals card appears once they have one.

0.3.3

Fixed

• Affiliates land on their dashboard after logging in or signing up. Before,
  they were sent back to the login page, though the login had worked.

0.3.2

Changed

• Your affiliate address now opens the signup of your first open program,
  instead of the login. Share it as your affiliate link. Other programs keep
  their own signup links, and the copy buttons give the right one for each.
  A logged in affiliate goes straight to their dashboard, and the login page
  links to the signup.
• Onboarding no longer asks for a program name. The first program is named
  after the product, and the step is called Commission.
• Open Cloudflare in onboarding lands on the product's DNS records instead of
  the list of domains.

0.3.1

Security

• Update soon. This release moves Next.js and several other packages past
  known security flaws, some of them rated critical.
• The image no longer ships the build and test tools or npm, which removes
  most of the other flaws scanners reported in it.

Changed

• A new Payouts page lists what you owe, one row per affiliate and currency,
  with their payout details ready to copy and a Mark paid button. Past payouts
  are grouped by payment. The Commissions page no longer holds this list.
• Affiliates pick a payout method from a list and enter one value. Details
  saved before this release keep working.
• A program with Public signup turned off shows an invite only page instead
  of the signup form.
• Forms keep what you typed when a submit is refused. The website field
  accepts a bare domain.
• The tracking check counts a click from the past week as proof the script
  is installed.

0.3.0

Changed

• Supaffi no longer sends email, and setup no longer asks for a Resend key or
  a sending domain. Affiliates sign up with an email and a password and log in
  with them.
• Affiliates who signed up before this release have no password yet. Open each
  one in Affiliates, press Create password link and send them the link. It
  works once, for 3 days. The same link resets a forgotten password.
• The stored Resend keys are deleted on upgrade.

Fixed

• Your login page no longer answers on a product's affiliate domain. Opening
  that domain's address on its own goes to the affiliate login.

0.2.7

Security

• Replace your Stripe key once: open Settings, press Replace on the Stripe key
  row and create the new key from the button there. Check that Disputes and
  Checkout Sessions are set to Read. Supaffi uses Disputes to hold a commission
  while its sale is disputed, and Checkout Sessions to take the tax off a
  one-time sale. Until you replace it, a disputed commission stays held, and a
  one-time sale retries for about two days before it stops earning.
• Each program now has a Public signup switch. Turn it off for a tier you move
  affiliates into yourself. Before, anyone who guessed a program's signup
  address could join it.

Fixed

• Two customers on the same office or mobile network each get their own
  referral. Before, they could share one, and the second sale could earn the
  affiliate nothing.

• A Stripe outage while a sale is recorded retries the sale instead of
  skipping its refund, dispute and card checks. A dispute holds its commission
  while it retries.

• No Stripe error text reaches the server log or a failed event's stored
  error, only its type and code.

• A commission waits while its sale is disputed. It goes back to normal if you
  win the dispute and is cancelled if you lose it before paying.

• A dispute that reaches Supaffi before its sale is applied when the sale is
  recorded.

• You can confirm a self referral from any of its commissions, whatever its
  status.

• A renewal earns only on the subscription the affiliate referred and the
  products bought through the referral. One-off charges, manual invoices, a
  switch to another Stripe product and money you mark as paid outside Stripe
  earn nothing.

• Cancelling and subscribing again, or changing plan through a new checkout,
  no longer starts the commission duration over. Each referral gets one.

• Setting supaffi to false on the invoice, subscription or customer now
  excludes a sale at checkout and on every renewal. Set it before the customer
  pays. A sale Supaffi cannot check earns nothing and is noted in the server
  log.

• A subscription's first payment earns only on what the customer paid, like a
  renewal. Before, credit balance on a first purchase still earned, which the
  0.2.4 notes did not say.

• A one-time sale earns on the price before tax, including tax inside the
  price. If Stripe does not say how much tax it held, it earns nothing and is
  noted in the server log.

• A refund or lost chargeback on a one-time sale with a post-purchase invoice
  now lowers or cancels its commission.

Changed

• A paid commission is final. A refund or lost chargeback after you paid
  changes nothing, and nothing is taken off the affiliate's next payout.
• Mark paid records exactly the commissions and amounts you saw. Ones you
  cancelled in the meantime are skipped, and the page says how many. A page
  open for more than an hour has to be shown again first, so a refund that
  landed meanwhile is not recorded as paid.
• One-off items sold with a subscription, such as a setup fee, no longer earn.

0.2.3

Added

• Every figure on the overview says how it compares with the period before,
  in green, red or grey.
• A top affiliates card on the owner's overview, with a bar under each name
  showing how close they are to the leader.

Changed

• The timeframe is chosen once, at the top of the overview, and every figure,
  the chart and the top affiliates follow it.
• The owner's Signups figure is gone. It counted affiliates joining, which read
  like customers. Revenue takes its place.
• What needs your attention is a set of cards you can open, and a commission
  flagged as a possible self referral stands out in red.
• Amounts are written with their currency symbol and thousands separators,
  and every total leads with the currency the chart is drawn in.
• The chart's bars and line animate in again whenever the timeframe changes.
• A tighter, even margin around the sidebar and the content, one corner
  rounding everywhere, and reworked product and account menus. The account
  menu now shows the version and whether an update is available.
• Both dashboards stack and scroll properly on phones and tablets.

0.2.2

Added

• A chart on both dashboards: the clicks affiliates sent, over the money those
  clicks turned into. The owner's bars are the sale with the commission drawn
  on top of what they keep, so one bar says both what came in and what it
  cost. Eight windows to choose from, by the hour for a single day and by the
  month for a year, kept in the address so a reload and a shared link land on
  the same view.
• A currency switcher, for the rare product that sells in more than one. Money
  is never added across currencies, so the bars draw one and the tooltip lists
  the rest.
• A command that fills an instance with demo traffic, for looking at the
  dashboards before a product has any.

Changed

• Setting up is six steps instead of nine. The webhook screen is gone: the key
  is made from a link that already grants what is needed, and saving it creates
  the endpoint. The two Resend screens are one, because both halves are done in
  the same browser tab in one sitting. The rail no longer counts the install and
  the account as steps, which only made the flow look longer than it is.
• Setup screens appear at once and fill their lights in behind you. Pressing
  Continue used to hold the button down for a few seconds, with nothing on
  screen to say why.
• Both dashboards sit on a grounded sidebar with the content floating above it,
  and every card has real depth rather than a hairline on white.
• The address proposed for a new product is now go. rather than affiliates.,
  which is shorter in every affiliate link and stops the login emails going out
  from affiliates@affiliates.yoursite.com.
• What can be paid is a list rather than a row of buttons, so an affiliate owed
  in two currencies reads as two payouts rather than a duplicate.

Fixed

• A tick on the setup rail now means the check passed. Walking past a step used
  to be enough to mark it done, so a deleted record and a sending domain that
  was never added both read as finished.
• The certificate check no longer fails on hosts that cannot route a request
  from the server back to its own address. The site was reachable from
  anywhere on the internet and the instance alone could not see it.
• Voided commissions and refund adjustments no longer count as sales, which
  could leave a day showing a sale with no money against it.
• Checks against Stripe and Resend give up rather than hanging, so a screen
  cannot be left saying "checking" until it is reloaded.
• Every check that runs now writes a line to the log, with how long the outside
  world took to answer. A self-hosted instance had no way to see any of it.

v0.2.0

Full Changelog: v0.1.1...v0.2.0