Skip to content

Release v0.5.1 - Auth & Activity Reliability

Choose a tag to compare

View all tags
@m-schwarzinger m-schwarzinger released this 11 May 22:57
· 108 commits to development since this release
0.5.1
2654d1a

Release Date: 2026-05-12

What's New in UpservX v0.5.1

This maintenance release focuses on security hardening, activity visibility, and operational reliability. Authentication was migrated away from persisted Basic credentials to signed expiring session tokens, activity/status tracking was expanded in the sidebar, and several polling and auth edge cases were fixed.

Highlights

Secure Session Authentication

  • Added signed session tokens via lib/session_tokens.py (HMAC-SHA256)
  • Session tokens carry expiry and are validated by middleware
  • Login and 2FA completion now return session_token and set cookie-based session state
  • Cookie fallback is treated as Bearer token in middleware

CLI Auth Modernization

  • CLI login now uses POST /auth/login
  • CLI stores username + session token (no persisted Basic credentials)
  • CLI API client now uses Bearer token model

Activity & Progress UX Improvements

  • New sidebar activity bell above theme switcher
  • Activity overlay expanded and layered above other UI
  • Activity feed filtered to notification-eligible events only
  • Added status timeline for latest backup/replication state changes
  • Running items show progress bars; completed/failed items are retained in recent list
  • Recent status list no longer clears on transient fetch errors
  • Progress polling for activity/status endpoints standardized to 10 seconds
  • Completed/failed backup and replication jobs are no longer polled continuously

VPN Settings Path Standardization

  • OpenVPN profiles are now stored and read from /etc/upservx/vpn only
  • Legacy handler-local VPN path usage removed
  • Docs updated to point to handlers/settings.py and /etc/upservx/vpn

Frontend Auth Conflict Fix

  • Removed browser-stored Authorization header injection from getAuthHeaders()
  • Prevents stale token override of valid session-cookie auth
  • Fixes intermittent 401 responses on endpoints such as /vm-networks and /metrics

Upgrade Notes

  • Existing users should log in again once after upgrade so all clients use the new session-token flow.
  • If browser sessions behave inconsistently after upgrade, perform one fresh login to refresh cookie/session state.
  • No database migration required for this release.
Assets 2
Loading