Release 0.12.2

Updates postcss from 8.5.6 to 8.5.14

Release 0.12.1

• Fixing upload procedure to make it async
• Increasing nginx upload limits for FTP

Release 0.12.0

Adding support for folders in devices tree view

Release 0.11.4

Updates python-multipart from 0.0.22 to 0.0.26

0.11.3: Bump cryptography in the pip group across 1 directory (#69)

Updates cryptography from 46.0.6 to 46.0.7

Release 0.11.2

Updates vite from 7.3.1 to 7.3.2

Release 0.11.1

Updates cryptography from 46.0.5 to 46.0.6

Release 0.11.0

Highlights

• Implemented TOTP two-factor authentication with remembered-device support and backup code handling.
• Added SSH host fingerprint probing, trust confirmation, and pinned-fingerprint validation for SFTP and terminal sessions.
• FTPS certificate thumbprint validation and improved FTPS error handling.
• WebSocket ticketing for terminal authentication and enhanced session/cookie handling.

Security & breaking changes

• Startup now enforces a non-default SECRET_KEY and non-default ADMIN_PASSWORD in non-development environments.
• Trusted-proxy checks are used to determine secure cookie handling and correct client IP extraction behind proxies — verify your proxy configuration when upgrading.

New features

• Full TOTP 2FA implementation in backend and UI, including:
  • Versioned encrypted storage for TOTP secrets and migration of legacy plaintext secrets.
  • Backup code hashing and depletion warnings.
  • Endpoints to manage 2FA setup, reset, and status.
  • UI updates and documentation for enabling and managing 2FA.
• Remember-device option for login flows with tests and README updates.
• WebSocket ticket-based authentication for terminals.

Improvements

• Session and authentication: cookie-based authorization handling, session storage for token expiry, and ticket-based WebSocket flows.
• SSH/FTPS trust UX: FingerprintTrustModal component and UI integration in FileManager and FtpFileManager.
• Connection resilience: frontend connection monitoring and session recovery.
• Rate limiting: authentication and 2FA endpoints now have rate limiting with tests.
• Tests: large suite of unit and integration tests added or improved across auth, 2FA, SSH/SFTP, FTPS, terminal, and audit logging.

Bug fixes

• Preserve exception context when FTP session opening fails.
• Normalize device fingerprint fields on update.
• Misc test readability and CI workflow tweaks.

Upgrade notes

• If you run behind a proxy, verify trusted-proxy settings so secure cookies and client IP auditing behave as expected.
• Ensure SECRET_KEY and ADMIN_PASSWORD are set to secure, non-default values in production.
• Review FTPS and SSH host fingerprint settings if you relied on permissive defaults previously.

Release 0.10.0

Highlights

• New: Configuration export & import endpoints (backend) plus UI components to export/import app configuration.
• UI: SSH and SFTP badges added to DeviceList and FileManager to make connection types clearer.
• UX: Focused-tab highlighting in the dashboard for better tab visibility.
• Tests: Added tests for API routes that require authentication and new UI tests (dashboard tab highlighting).
• Docs/Guidelines: Test coverage guideline updated to emphasize 100% coverage on all code.
• Backend: Refactor of config export/import endpoints to improve error handling and response structure.

Changes

• Features
  • Configuration export/import endpoints added (backend) with matching UI components for export and import.
  • DeviceList and FileManager show SSH and SFTP badges indicating connection types.
  • Dashboard tab highlighting when a tab is focused (visual improvement).
• Improvements
  • Improved error handling and normalized response structure for config export/import endpoints.
  • Test guidance updated to require 100% coverage for new/changed code.
• Tests
  • New tests asserting API routes correctly require authentication.
  • UI tests added for Dashboard tab highlighting; updated tests for components affected by badges.
• Maintenance
  • Several branch merges and small test/coverage updates.

Release 0.9.1

Error handling

• FTP/SFTP permission errors now return 502 Bad Gateway instead of 401 Unauthorized.
  (Update permission error handling to return 502 instead of 401 for FTP and SFTP sessions – c3da528)

New functionality

• Introduced an FTP session manager as part of the backend.

Test coverage improvements

• Added a slew of direct‑call unit tests covering handler/service logic for:
  • audit (test_audit_direct.py)
  • auth (test_auth_direct.py)
  • SSH (test_ssh_direct.py)
  • SFTP (test_sftp_service.py etc.)
  • FTP (new session manager and handler tests)
  • terminal (terminal.py handlers)
• Added lifespan tests verifying directory creation and proper shutdown logging.
• Fixed a failing 401 assertion in existing tests (merge #48).
• General test‑coverage enhancements (merge #46).

Bug fixes

• SSH‑related bug resolved (merge #45).

These changes are largely internal, focused on robustness and test coverage, with the key user‑facing behaviour change being the updated error code for permission failures in FTP/SFTP sessions.