@fleetless/contracts 5.3.0-next.1 → 6.0.0-next.2

package/CHANGELOG.md

@@ -11,39 +11,114 @@ version.
 
 ### Added
 
-- **`feedbackRequest` and `feedbackResponse`** (`FeedbackRequest`,
-  `FeedbackResponse`) for the new `POST /api/feedback`: a developer's
-  message to the people who build Fleetless, `{ kind, message, page }` with
-  `kind` one of `FEEDBACK_KINDS` (`idea`, `problem`, `question`, `other`), a
-  trimmed message of at most `FEEDBACK_MESSAGE_MAX` (5000) characters and
-  the console path it was sent from. The route answers `202` with
-  `{ id, mail }`: the message is stored before any mail is tried, so `mail`
-  (`sent`, `failed`, `not_configured`) never means it was lost. Rate
-  limited to 10 per developer per hour. Published as the artifacts
-  `feedback-request` and `feedback-response`.
-- **`jobActor.name`**: the person's display name when the job started,
-  required and nullable — `null` for a server key, a person without a name
-  and runs recorded before this version; show `label` then. `jobActor`
-  stays non-strict, so a consumer on 5.2.0 strips the new key rather than
-  refusing the run. Changes the artifacts `job-actor`, `job-run` and
-  `job-run-list-response`.
-- **`roleRenameRequest`, `roleDeleteQuery` and `roleInUseDetails`**
-  (`RoleRenameRequest`, `RoleDeleteQuery`, `RoleInUseDetails`) for the new
-  `PATCH` and `DELETE /api/apps/:id/roles/:roleId`: rename a role
-  (`409 role_name_taken` on a clash), or delete it, moving its app users,
-  pending invitations and default-role status to `move_to`. Without
-  `move_to` a held role answers `409 role_in_use` with
-  `{ users, invitations, is_default }`; the app's only role answers
-  `409 last_role`. The three codes join `ERROR_CODES`. `role.builtin` no
-  longer says built-in roles cannot be renamed or deleted, and the create
-  route's note now states the 60-character limit `role.name` always had.
-  Published as the artifacts `role-rename-request`, `role-delete-query`
-  and `role-in-use-details`.
-- **`auditQuery.target_id`**: only the events about one target — for a
-  robot also those that name it in `details.robot_id`, so a robot's log
-  includes what was started on it. A string, since target ids are not all
-  uuids. `GET /api/audit/export` takes it too. Changes the artifact
-  `audit-query`.
+- **App sign-in methods, two-factor policy, hosted pages and look.**
+  `appAuthConfig` gains `sign_in_methods` (`appSignInMethods`: `password`
+  and/or `email_code`, at least one; default password only), `two_factor`
+  (`appTwoFactorPolicy`: `off`, `optional`, `required`; default `off`),
+  `app_url` (`appHomeUrl`), `hosted_accent` (`hostedAccent`, `#rrggbb`
+  lowercase), and the read-only `hosted_logo_url` and `hosted_pages`
+  (`appHostedPages`) — the Fleetless-hosted page each unset URL falls back
+  to. New slices `PUT /api/apps/:id/auth-config/sign-in`
+  (`putAppAuthSignInRequest`) and `…/look` (`putAppAuthLookRequest`), and
+  the logo as a raw PNG or SVG body at `PUT` and `DELETE
+  /api/apps/:id/auth-config/logo` (`HOSTED_LOGO_TYPES`,
+  `HOSTED_LOGO_MAX_BYTES`, 100 KB).
+- **App-user two-factor state and reset.** `appUser.two_factor` (`enabled`,
+  `enabled_at`, `recovery_codes_left`), and `DELETE
+  /api/apps/:id/users/:userId/two-factor` resets it and ends the user's
+  sessions.
+- **Email-code sign-in for app users.** `POST /api/client/login/code`
+  (`clientLoginCodeRequest`, a `202` decoy for every address) mails six
+  digits valid ten minutes; `POST /api/client/login/code/verify`
+  (`clientLoginCodeVerifyRequest`) spends them. The mail kind `login_code`
+  joins `mailTemplateKind`, with its default template and the variables
+  `code` and `expires_in_minutes`.
+- **TOTP two-factor for app users.** `clientSignInResult`, the union of
+  `sessionTokens` and `twoFactorChallenge`, is what every sign-in step
+  answers. `POST /api/client/two-factor/verify`
+  (`clientTwoFactorVerifyRequest`), `…/setup` (`clientTwoFactorSetupRequest`,
+  answering `twoFactorSetupResponse`), `…/setup/confirm`
+  (`clientTwoFactorSetupConfirmRequest`, answering
+  `clientTwoFactorSetupConfirmResponse`: ten recovery codes and the
+  session), and `DELETE /api/client/two-factor`
+  (`clientTwoFactorDisableRequest`). Shared by both identity spaces:
+  `loginCode`, `totpCode`, `recoveryCode` and `recoveryCodesList`.
+- **Developer sign-in by emailed code and passkey, with second factors.**
+  The portal steps for `/console/oauth` and `/mcp/oauth` —
+  `developerSignInRoutes(prefix)`: code, second step, recovery code,
+  passkey, and the setup when the org requires two-factor — and console
+  sign-up by email, code (`POST /console/oauth/signup/code`) and
+  organization. A developer manages their own passkeys, authenticator and
+  recovery codes at `GET /api/auth/two-factor` (`developerTwoFactor`),
+  `/api/auth/passkeys` (`webauthnOptionsResponse`, `createPasskeyRequest`,
+  `createPasskeyResponse`, `renamePasskeyRequest`, `developerPasskey`),
+  `/api/auth/totp` (`totpConfirmRequest`, `totpConfirmResponse`) and `POST
+  /api/auth/recovery-codes` (`recoveryCodesResponse`).
+- **An org can require two-factor.** `org.require_two_factor`, set by owners
+  through `PATCH /api/org`; `fleetlessUser.two_factor` reports each member's
+  factors, and `DELETE /api/org/users/:id/two-factor` lets an owner reset a
+  member's.
+- **The hosted app pages** under `/app/:appIdentifier` on the auth portal,
+  nineteen internal HTML routes: the MCP sign-in, the two-factor steps, the
+  invitation, reset, verification, forgot-password and sign-up pages, and
+  the app's logo.
+- **Error codes `invalid_code`** (details `invalidCodeDetails`:
+  `attempts_left`) **and `method_not_allowed`.**
+
+### Changed
+
+- **Nothing is refused for a missing app URL.** An unset `invite_url`,
+  `verify_url`, `reset_url` or `mcp_login_url` falls back to the hosted
+  page: mailed invitations, self-registration, resets and MCP sign-in work
+  before an app has pages of its own, and the per-app MCP authorize no
+  longer answers `409 target_state_conflict` for a missing
+  `mcp_login_url`.
+- **Every app-user sign-in step answers `clientSignInResult`.** `POST
+  /api/client/login`, `…/verify-email`, `…/password/reset/confirm` and
+  `…/invitations/accept` answer a `twoFactorChallenge` instead of tokens
+  when the person has an authenticator or the app requires one. `POST
+  /api/client/oidc/exchange` still answers tokens: the identity provider
+  owns that sign-in.
+- **`clientRegisterRequest.password` and
+  `clientAcceptInvitationRequest.password` are optional**: required while
+  the app's password method is on, refused while it is off.
+- **`mcp_login_url` moved from the `mcp` slice to the `urls` slice**, which
+  also takes `app_url`; `putAppAuthMcpRequest` is `mcp_enabled` alone.
+- `clientProviderListResponse` gains `sign_in_methods`, `clientIdentity`
+  gains `two_factor_enabled`, `patchOrgRequest` takes `name` and
+  `require_two_factor`, both optional and at least one, and
+  `acceptTeamInviteRequest` takes an optional `display_name` and no
+  password. The default invitation mail no longer asks the invitee to
+  choose a password.
+- **`appInvitation.accept_url` is never `null`**: an app with no
+  `invite_url` gets the hosted invitation page's link.
+- **`appMailTemplateListResponse.templates` holds up to four** (was three),
+  with `login_code`.
+- **The portal's identify step mails a sign-in code** (`POST
+  /console/oauth/identify`, `POST /mcp/oauth/identify`) instead of handing
+  back a password step, and answers the same for every address.
+- **A password reset and a password change are refused with `403
+  method_not_allowed`** while the app has the password method off — `POST
+  /api/client/password/reset`, `…/password/reset/confirm`,
+  `…/password/change` and the developer's `POST
+  /api/apps/:id/users/:userId/reset-password`.
+
+### Removed
+
+- **The developer password; this is why the release is a major.** The
+  schemas `developerLoginRequest`, `passwordResetRequest`,
+  `passwordResetConfirm`, `signUpRequest` and `signUpResponse`, and the
+  routes `POST /api/auth/signup`, `POST /api/auth/password/change`, `POST
+  /api/auth/password/reset`, `POST /api/auth/password/reset/confirm`, `GET
+  /reset-password`, `GET /reset-password/:token`, `POST
+  /console/oauth/login` and `POST /mcp/oauth/login`. Fleetless users sign
+  in by emailed code or passkey; the portal sign-up is the one way to
+  create an organisation. `passwordChangeRequest` stays, for `POST
+  /api/client/password/change`. The newly required fields above
+  (`appUser.two_factor`, `org.require_two_factor`,
+  `fleetlessUser.two_factor`, `clientIdentity.two_factor_enabled`,
+  `clientProviderListResponse.sign_in_methods`) and the narrowed `mcp`
+  slice break existing readers as well.
 
 ## [5.2.0] — 2026-09-30