@qwickapps/server 1.6.0 → 1.7.0

package/CHANGELOG.md

@@ -5,6 +5,94 @@ All notable changes to @qwickapps/server will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.7.0] - 2026-01-11
+
+### Added
+
+- **Tenants Plugin**: Multi-tenant data isolation and organization management (#824, #825, #834, #811, #812)
+  - Core types: `Tenant`, `TenantMembership`, `TenantWithMembership`, `TenantStore`
+  - Tenant types: `user` (single-user), `organization`, `group`, `department`
+  - PostgreSQL store: Auto-creates tables with foreign keys and CASCADE delete
+  - Auto-membership: Owner automatically added as member on tenant creation
+  - Global roles: `owner`, `admin`, `member`, `viewer` (consistent across tenants)
+  - REST API: 10 endpoints for CRUD, search, and membership management
+  - Membership UPSERT: `ON CONFLICT DO UPDATE` for role changes
+  - Helper functions: `getTenantStore()`, `postgresTenantStore()`
+  - Search support: Filter by type, owner, query with pagination and sorting
+  - Health check: Tenant store availability monitoring
+  - UI Components: TenantsManagementPage, TenantCard, TenantFormDialog, MemberListDialog, MemberInviteDialog, MemberRoleDialog
+  - Management features: Create/edit tenants, add/remove members, change roles, search and filter
+  - Statistics dashboard: Total tenants by type with visual indicators
+  - **Plugin Composition**: Auto-tenant creation on user signup (#834)
+    - Users plugin detects tenants plugin via registry
+    - Auto-creates personal tenant for new users
+    - Graceful degradation: Works independently or together
+    - Loose coupling: No forced dependencies between plugins
+  - **Testing**: Comprehensive test coverage (#810, #811, #812)
+    - 60 unit tests: Store operations and plugin lifecycle
+    - 11 integration tests: Full workflows, multi-user scenarios, tenant switching
+    - 20 E2E tests: UI interactions, filtering, search, member management
+  - **Demo Integration**: In-memory store for demo-gateway.ts
+    - Pre-populated with 4 demo tenants
+    - Full TenantStore implementation
+    - Added to control panel at /cpanel/tenants
+
+### Fixed
+
+- **TypeScript Configuration**: Removed restrictive `rootDir` setting to enable tsx compatibility
+  - tsx can now run TypeScript files directly without build step
+  - Updated path alias `@qwickapps/server/ui` to resolve to source files instead of built files
+  - No breaking changes for external consumers (package.json exports unchanged)
+  - Enables faster development workflow with direct TypeScript execution
+
+## [1.6.1] - 2026-01-09
+
+### Added
+
+- **Seed Management UI**: Database seed script management with real-time execution monitoring (#702)
+  - Seed discovery: Auto-discover `seed-*.mjs` scripts in configured scripts directory
+  - Real-time execution: Stream stdout/stderr via Server-Sent Events (SSE)
+  - Execution history: Track seed runs with status, duration, and output (requires PostgreSQL)
+  - Security: Path traversal prevention, concurrent execution blocking, minimal environment isolation
+  - API endpoints: `/api/maintenance/seeds/discover`, `/api/maintenance/seeds/execute`, `/api/maintenance/seeds/history`
+  - Startup cleanup: Automatically marks orphaned 'running' executions as failed on server restart
+  - Process isolation: Child processes spawned with `process.execPath` for reliable node binary resolution
+
+- **Preferences UI**: User preferences management page with JSON editor (#592)
+  - PreferencesPage component with real-time JSON validation and syntax highlighting
+  - Client-side nesting depth validation (max 10 levels)
+  - Size limit indicator with color coding (100KB max)
+  - Actions: Save, Reset to Defaults, Format JSON
+  - Preferences API methods: `getPreferences()`, `updatePreferences()`, `deletePreferences()`
+  - Exported `MAX_PREFERENCES_SIZE` and `MAX_NESTING_DEPTH` constants from backend types
+  - Plugin registry integration: backend registers UI page via `registry.addPage()`
+
+- **API Keys Phase 2: Scope-Based Authorization** (#573)
+  - Plugin-declared scopes: Plugins can now declare scopes via `scopes` property
+  - QwickBrain declares `qwickbrain:read` and `qwickbrain:execute` scopes
+  - Automatic scope registration: API Keys plugin auto-registers scopes when plugins start
+  - Plugin scope store: PostgreSQL storage for plugin-declared scopes with caching
+  - Usage log store: Partitioned tables track all API key requests with 30-day intervals
+  - GET `/cpanel/api/auth/scopes` endpoint - List all available scopes grouped by plugin
+  - GET `/cpanel/api/auth/keys/:id/usage` endpoint - Usage logs with query filters and statistics
+  - Usage logging middleware: Async, non-blocking request logging using setImmediate
+  - Scope format: `plugin-id:action` (e.g., `qwickbrain:execute`)
+  - Backwards compatibility: Legacy scopes (`read`, `write`, `admin`) auto-convert to `system:*`
+  - System scopes seeded: `system:read`, `system:write`, `system:admin`
+  - Usage statistics: Calls by status code, calls by endpoint, total calls, last used timestamp
+
+## [1.6.1] - 2026-01-06
+
+### Fixed
+
+- **Plugin Route Prefixes** - Auto-detect and fix duplicate slug prefixes in plugin routes (#746)
+  - Added runtime auto-fix in plugin-registry.ts to detect duplicate slug in route paths
+  - Auto-normalizes paths to prevent double-prefixing (e.g., `/api/users/users` → `/api/users`)
+  - Logs warning with fix instructions when duplicate detected
+  - Added pre-commit hook to catch duplicate slug patterns before commit
+  - Fixed authkeaper plugin configurations (users, bans, entitlements, auth0-settings)
+  - Prevents 404 errors caused by double-prefixed routes
+
 ## [1.6.0] - 2025-12-25
 
 ### Added
@@ -18,6 +106,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- **Frontend API Paths** - Fixed UI calling incorrect API endpoints
+  - Updated logs API paths: `/api/logs` → `/api/logs/logs`, `/api/logs/sources` → `/api/logs/logs/sources`
+  - Updated users API paths: `/api/users` → `/api/users/users` and all related endpoints
+  - Fixes "Logs request failed" error on logs page
+  - Fixes users page indefinite loading issue
+  - Aligns frontend paths with plugin slug prefixing (introduced in v1.6.0)
 - **Route Registration** - Fixed plugin routes not being accessible
   - Plugin routes now correctly register on the router instead of app
   - Routes are properly mounted at `/cpanel/api/*` endpoints
@@ -27,6 +121,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Control panel now correctly bypasses SuperTokens authentication
   - Basic auth guard works properly for admin access
 
+### Removed
+
+- **QwickBrain Plugin** - Removed redundant `qwickbrain-tailscale` health check
+  - Removed health check that required tailscale CLI inside Docker container
+  - Removed `tailscaleStatus` field from `QwickBrainConnectionStatus` interface
+  - Removed `checkTailscaleStatus()` function
+  - Existing `tailscale` and `qwickbrain-connection` health checks provide sufficient monitoring
+
 ## [1.5.2] - 2025-12-21
 
 ### Fixed