CHANGELOG.md

Rama main · réplica de lectura del repositorio original.

# Changelog

All notable changes to AE NetScope will be documented in this file.

## Unreleased

### Added

- Added a dedicated MCP page for managing integration tokens and finding client setup guidance, with navigation limited to accounts that can read inventory.

### Security

- Updated the transitive development dependency `source-map-js` to a patched release.

## v0.3.1-alpha - 2026-10-01

### Security

- Created decrypted backup output and temporary plaintext files with owner-only permissions from the moment they are opened, including when the process umask permits access to other local users.
- Created the initial administrator password file with owner-only permissions before committing the account, rejected existing files or symlinks, and removed a newly created credential file if setup fails.
- Cleared user-management and audit caches when the signed-in account or its permissions change, and ignored late responses from the previous session to prevent cross-account data from appearing in the browser.
- Updated the transitive development dependency `brace-expansion` to a patched release.

### Changed

- Advanced the development version to the 0.3.1 prerelease channel. Version 0.3.0 remains the latest stable release.

### Verified

- Added regression tests for private backup and bootstrap files, account switching, late responses, and permission changes.
- Confirmed the fixes against the existing container runtime contract used by the official TrueNAS SCALE catalog; no catalog definition or database migration changed.

## v0.3.0 - 2026-09-29

### Added

- Added an optional MCP gateway with 15 inventory tools over stdio and Streamable HTTP for search, device details, dashboard totals, passive quality checks, and inventory creation or editing.
- Added named, expiring and revocable read-only or read/write integration tokens in Settings, with password verification, hash-only storage, and enforcement of the owner's current permissions.
- Added SQL-filtered, paginated inventory search and migration `0012_integration_tokens` for token storage.
- Added English and Spanish integration settings and gateway setup documentation.

### Fixed

- Preserved browser cookie authentication and CSRF protection when proxies forward Basic, Digest or unrelated Bearer credentials; recognized integration tokens retain their scope and cannot fall back to browser cookies.
- Fixed audit log search returning no results when matching text inside audit messages, which are stored encrypted and cannot be matched by a database `LIKE`.
- Fixed the device list and device responses reporting an arbitrary interface address when a device has more than one interface.
- Fixed a network CIDR change silently leaving assigned IP addresses outside the new range; the change is now rejected while those addresses remain assigned.
- Fixed the maintenance-mode middleware wrapping the downstream request in its own error handler, so application errors no longer re-enter its fallback path.
- Fixed the automatic update route substituting the untrimmed release tag into the configured command after validating the trimmed value, and rejecting a supplied blank tag instead of launching the command with an unsubstituted placeholder.

### Security

- Restricted integration tokens to inventory reads and permitted writes, excluding deletion, exports, restores, administration and token management.
- Updated the transitive development dependency `undici` to a patched release.
- Updated the transitive `browserslist` dependency to a patched release that fixes unbounded cache growth and an untrusted custom-stats prototype write.

### Changed

- Moved version 0.3.0 to the stable release channel while retaining the project's early-preview deployment guidance.
- Updated the web runtime and tooling dependencies, including React, i18next, react-i18next, Lucide, Recharts, Vite, Vitest, ESLint, typescript-eslint, Testing Library, jsdom, and the Node type definitions.
- Raised the API dependency floors for FastAPI, Starlette, SQLAlchemy, Alembic, Uvicorn, Redis, psycopg, cryptography, pydantic-settings, pwdlib, aiosqlite, setuptools, Dramatiq, and the development toolchain.
- Held TypeScript on the 6.x line because typescript-eslint does not yet support TypeScript 7.
- Removed the unused browser-side GitHub releases request, which the API content security policy blocks through `connect-src 'self'`.
- Cached the derived field-encryption key so reading a list of records no longer runs one key derivation per encrypted value.

### Verified

- Added MCP protocol, token authorization and proxy-session regression coverage.
- Validated the official TrueNAS catalog runtime contract in isolated containers, including migration from schema 0011, encrypted inventory preservation, browser and token access, restart persistence and custom runtime IDs; validation on a physical TrueNAS appliance remains outstanding.
- Verified the complete API and web test suites, lint checks, frontend production build, SQLite migration upgrade and check, dependency audits, secret scan, tracked-artifact check, and release metadata alignment.
- Added regression coverage for encrypted audit search, stable device primary addressing, network CIDR changes that would strand IP addresses, and maintenance-mode error handling.

## v0.2.0-alpha.1 - 2026-08-21

### Fixed

- Fixed the Hardware view silently hiding physical assets whose imported or API-created device types use English, mixed case, aliases, or custom labels.
- Fixed browser password managers treating the global navigation search as a credential username field when opening Settings.

### Changed

- Classified hardware through normalized physical-device aliases and populated asset metadata while continuing to exclude virtual machines and containers.
- Added explicit search, password, passkey-name, and one-time-code autocomplete semantics to account security controls.

### Verified

- Added regression coverage for localized, aliased, mixed-case, custom, and virtual device classifications.
- Verified the complete API and web test suites, lint checks, frontend production build, dependency audits, secret scan, tracked-artifact check, coverage thresholds, and release metadata alignment.

## v0.2.0-alpha - 2026-08-12

### Security

- Added authenticated application-level encryption for sensitive inventory details, session metadata, audit messages, audit IP addresses, persisted restore backups, and PostgreSQL pre-migration dumps.
- Added independent data and backup encryption keys with controlled fallback-key rotation and a recovery CLI for encrypted backups.
- Added absolute and idle session expiration, bounded activity updates, and broader session revocation after identity, password, MFA, role, lock, and account-status changes.
- Added constant-cost password verification for unknown, inactive, and locked accounts and HMAC-protected Redis rate-limit identifiers.
- Added startup rejection for placeholder managed-deployment secrets, unauthenticated Redis, and fail-open rate limiting, plus an explicit warning for HTTP-only managed deployments without secure cookies.
- Added cross-site mutation rejection, stricter CORS and browser security headers, non-cacheable API responses, hidden managed-deployment OpenAPI schemas, minimal public liveness output, and hidden SQL query parameters.
- Hardened the Compose stack with a read-only application filesystem, temporary writable memory, dropped capabilities, process limits, no-new-privileges, Redis protected mode, and PostgreSQL SCRAM initialization.
- Removed unnecessary build utilities from the runtime container and suppressed the Uvicorn server header.
- Prevented plaintext values beginning with the encrypted-value marker from bypassing field encryption or blocking key migration.
- Added bounded, coalesced, negatively cached, and rate-limited GitHub metadata requests to prevent unauthenticated request amplification.
- Applied request-body limits to JSON-bearing `DELETE` endpoints, including TOTP removal.
- Separated administrator self-service recovery from user management and required current-password verification before passkey deletion.
- Added account lockout accounting for invalid TOTP attempts, atomic TOTP replay prevention, and atomic single-use WebAuthn challenges.
- Added audit events for initial setup, logout, and failed passkey authentication without recording submitted credentials.
- Updated the transitive `nanoid` dependency to a patched release.

### Changed

- Added reversible Alembic migrations for session activity tracking and encrypted-field storage, including safe decryption before schema downgrade.
- Preserved TrueNAS HTTP compatibility while making Redis rate limiting fail closed by default in managed deployments.
- Preserved upgrades for existing TrueNAS installations with non-placeholder internal passwords of any historical length and custom runtime UIDs that cannot write to `/app/backups`.
- Updated deployment, key-rotation, backup-recovery, and host-encryption guidance.
- Replaced CSP-incompatible dynamic progress styles with native progress elements.

### Verified

- Added regression tests for key rotation, tamper detection, encrypted database storage, encrypted backup recovery, session idling, runtime configuration, cross-site requests, migration upgrades, and encrypted downgrades.
- Added regression tests for ciphertext-prefix handling, bounded `DELETE` bodies, GitHub request coalescing, administrator self-recovery boundaries, TOTP lockout and replay, passkey verification, single-use WebAuthn challenges, and authentication audit events.
- Validated a production image against isolated PostgreSQL 18 and Redis 8 containers, including real migrations, encrypted values at rest, backup decryption, hidden OpenAPI, and minimal health output.
- Validated the TrueNAS runtime contract with UID/GID 568, PostgreSQL 18.4, Valkey 9.1.1, HTTP cookies, omitted dedicated encryption keys, and migration to the current schema head.

## v0.1.9-alpha - 2026-08-05

### Changed

- Improved user administration so rapid user switching cannot display stale session data and edits to the signed-in account update the application header immediately.
- Improved Health, administrative settings, and Updates so failed or overlapping requests cannot leave stale success states or overwrite newer results.
- Improved release selection to use semantic version ordering instead of relying on the order returned by GitHub.
- Hardened language, regional-preference, and interface-setting persistence when browser storage is unavailable or blocked.
- Added consistent visible keyboard focus styles across search, select, form, and action controls.
- Raised automated API and frontend coverage requirements and expanded regression coverage for API clients, bootstrap behavior, users, settings, updates, date/time handling, and WebAuthn helpers.
- Updated release and TrueNAS submission checklists to reflect the MIT license and the English-first localization model.

### Security

- Updated `cryptography`, `undici`, and `brace-expansion` to patched compatible releases.
- Added dependency-audit verification after the security updates.

### Fixed

- Fixed stale sessions appearing after switching quickly between users.
- Fixed stale signed-in identity after an administrator edits their own account.
- Fixed Health displaying a previous Ready state after a refresh failure.
- Fixed Settings failures and stuck saving states when `localStorage` is blocked.
- Fixed one failed administrative endpoint discarding valid results from the other settings endpoints.
- Fixed competing update and release-history requests overwriting newer responses.

### Verified

- API suite passes with `99` tests and at least `85%` coverage.
- Web suite passes with `121` tests and at least `85%` statements, functions, and lines coverage.
- API and web lint, frontend build, dependency audits, release metadata validation, and repository hygiene checks pass.

## v0.1.8-alpha - 2026-07-20

### Added

- Added passive inventory-quality checks with documentation scoring, categorized findings, relationship summaries, and navigation to affected records.
- Added an About page with project, creator, company, license, repository, support, and installed-version information.
- Added repository statistics, system health, installed-version visibility, update state, and improved notifications to the top bar.
- Added regional preferences for time zone, date format, and 12/24-hour display.
- Added account-session management, TOTP authentication, WebAuthn/passkey support, maintenance mode, and update-attempt history.
- Added richer user-management details, editable account identity and roles, activation controls, MFA/passkey visibility, session counts, and individual session revocation.
- Added release-history and changelog browsing to the Updates view.
- Added an administrative search-engine visibility policy backed by dynamic `robots.txt`, `X-Robots-Tag`, and HTML robots metadata.
- Added Alembic migrations `0006` through `0008` for regional/security settings, language capacity alignment, and the search-indexing policy.
- Added regression tests for account security, maintenance behavior, user administration, updates, repository information, About, quality checks, notifications, and crawler policy behavior.

### Changed

- Expanded English and Spanish translation coverage across inventory, administration, support, quality, updates, and account workflows.
- Improved Settings organization with browser-local interface preferences and permission-gated administrative controls.
- Improved the Users view for repeated administrative work and clearer high-risk account actions.
- Improved the Updates view with cached GitHub release data and graceful behavior when GitHub is temporarily unavailable.
- Improved footer and top-bar navigation while keeping version and project information visible without obstructing the workspace.
- Updated all project, API, web, Docker, Compose, release, and staged TrueNAS image markers to `0.1.8-alpha`.

### Security

- Kept search-engine indexing blocked by default and fail-closed if the policy cannot be loaded.
- Added encrypted TOTP secret storage and CSRF-protected account-security operations.
- Added cache controls and permission checks around administrative, session, and user-management responses.
- Kept TrueNAS-managed installations on their platform update path and limited in-app automatic updates to explicitly configured Docker deployments.
- Updated `brace-expansion`, `postcss`, and `nanoid` to patched releases after dependency security advisories.

### Fixed

- Fixed long activity text and management controls that could overlap or lose clarity at narrower widths.
- Fixed stale installed-version references across runtime metadata, tests, container tags, documentation, and staged TrueNAS metadata.
- Fixed the active document robots directive so it changes immediately after an administrator updates the crawler policy.

### Verified

- API suite passes with `96` tests.
- Web suite passes with `102` tests.
- Ruff, ESLint, the production web build, Alembic upgrade/check, release metadata validation, and local crawler-policy checks pass.
- npm and Python dependency audits report no known vulnerabilities.

## v0.1.7-alpha - 2026-07-12

### Added

- Added atomic initial-setup ownership state and an installation-token requirement for fresh non-local deployments.
- Added HMAC-SHA256 protection for persisted session and CSRF token hashes with transparent migration of legacy hashes.
- Added bounded retention for expired sessions, revoked sessions, audit history, and pre-migration PostgreSQL backups.
- Added request-body enforcement that counts streamed bytes even when `Content-Length` is absent.
- Added PostgreSQL migration validation to CI in addition to SQLite migration tests.
- Added security regression coverage for setup protection, export authorization, cache controls, legacy sessions, retention, request limits, SQLite foreign keys, and migration state.
- Added the first internationalization milestone using `i18next` and `react-i18next`.
- Added canonical English and Spanish locale files with automatic locale discovery.
- Added manual language selection in Settings with immediate preview and account persistence.
- Added `preferred_language` to user accounts through a non-destructive Alembic migration and a CSRF-protected preference endpoint.
- Added translation validation for key parity, empty values, interpolation variables, English fallback, UTF-8 integrity, mojibake, control characters, and suspicious invisible characters.
- Added an upgrade test proving that the language migration preserves existing users and assigns English as their initial preference.
- Added per-dependency latency, total diagnostic duration, and stable translatable message codes to the detailed health endpoint.
- Added a more useful System status view with healthy-check counts, degraded dependency emphasis, runtime endpoints, retry handling, and optional 30-second auto-refresh.

### Changed

- Added a dedicated `inventory:export` permission for admins and operators; viewers remain read-only without bulk export access.
- Built PostgreSQL URLs from structured connection components so reserved characters in passwords remain valid.
- Enabled SQLite foreign-key enforcement to match production referential-integrity behavior.
- Restricted detailed database and Redis health diagnostics to authenticated users and kept public readiness failures minimal.
- Added explicit request, note, and description size limits plus `no-store` caching rules for sensitive API responses.
- Made Argon2id explicit in code and removed unused configuration flags that implied unsupported cryptographic behavior.
- Changed startup backups to run only before pending migrations, use restrictive permissions, and enforce retention.
- Updated all project, API, web, Docker, Compose, release, and TrueNAS image markers to `0.1.7-alpha`.
- Made English the primary, default, canonical, and fallback interface language.
- Migrated initial setup, login, navigation, topbar menus, global search, footer, loading states, and Settings to translation keys.
- Migrated System status and dependency health messages to the English/Spanish translation system.
- Made user language preferences follow authenticated accounts across sessions and devices while retaining browser-local fallback behavior.
- Documented the translation contribution workflow and the current incremental translation scope.

### Fixed

- Decoupled browser-local settings from account language persistence so local preferences still save when the API is unavailable.
- Restored the persisted account language when a remote language update fails, preventing selector, interface, and storage state from diverging.
- Aligned frontend, API, database, and migration locale-code capacity at 64 characters for community-provided locale files.
- Made readiness depend only on required health checks so optional integrations cannot incorrectly degrade the application.
- Corrected active public and TrueNAS checklists that still referenced the project's former license model.
- Corrected the GHCR workflow OCI description so published images identify AE NetScope as open source software.
- Strengthened fallback tests so they verify a genuinely missing translation key, not only an unsupported locale.

### Verified

- API and web test suites pass.
- Translation-specific tests pass.
- Ruff, ESLint, the production web build, Alembic upgrade/check, dependency audit, secret scan, and tracked-artifact checks pass.

## v0.1.6-alpha - 2026-07-07

### Added

- Added a dedicated passive Topology view with expandable subnet cards, VLAN context, linked devices, linked IP records, unassigned-IP visibility, and navigation into the real inventory records.
- Added Dashboard and Topology frontend tests for summary rendering, empty states, navigation callbacks, and expand/collapse behavior.
- Added version-alignment tests across `VERSION`, root `package.json`, `web/package.json`, and `api/pyproject.toml`.
- Added cached GitHub release checks for `/api/version/updates`, including graceful fallback when GitHub cannot be reached.
- Added Docker and TrueNAS smoke checklists to the README.
- Added CI migration validation with Alembic `upgrade head` and `alembic check`.

### Changed

- Updated all project version markers to `0.1.6-alpha`.
- Improved Dashboard recent-activity layout so long audit entries do not overlap.
- Improved the subnet map into a more useful topology workflow while keeping it passive.
- Hardened automatic Docker update execution by validating release tags and running commands without shell execution.
- Made CI coverage artifacts and test summaries more tolerant when a failing step prevents report files from being generated.
- Documented safer Docker update behavior and warned against destructive `docker compose down -v` usage.
- Kept TrueNAS installs on the TrueNAS-managed update path instead of in-app automatic updates.

### Fixed

- Fixed version/update tests that previously treated the installed release as a future update candidate.
- Fixed session-refresh behavior for Docker/TrueNAS HTTP installs by keeping secure-cookie behavior environment-aware.
- Fixed CSV export hardening for spreadsheet-formula values.
- Fixed permission/session hardening around forced password changes and password-change session revocation.

### Verified

- API test suite passes.
- Web test suite passes.
- Frontend production build passes.
- Web and API coverage runs pass.
- Secret scan, tracked-artifact check, npm audit, pip-audit, Ruff, ESLint, and Alembic checks pass.

## v0.1.5-alpha - 2026-06-29

### Added

- Added a dedicated Profile view for account email changes, password-change access, role visibility, and active permission review.
- Added keyboard-friendly global search behavior with `Ctrl K`, `Escape`, arrow navigation, and `Enter` selection.
- Added search coverage for hardware metadata, technical notes, audit events, users, and app sections.

### Changed

- Unified backups, JSON restore, and CSV exports into a single Datos workflow.
- Removed the duplicate Respaldos frontend view in favor of the unified Datos section.
- Updated dashboard links so recent devices and audit entries open the specific target context.
- Simplified Settings so it only handles local interface preferences and the Early Public Preview notice.
- Kept version/release checks in the dedicated Actualizaciones view.
- Reworked user-management row actions into a compact actions menu.
- Improved the footer so Documentation opens the public README and Support opens the internal support page.

### Verified

- Frontend production build passes.
- Frontend test suite passes.

## v0.1.4-alpha - 2026-06-25

### Added

- Redis password support through `REDIS_PASSWORD` for production and TrueNAS deployments.
- Initial TrueNAS Apps community package staging under `truenas/ix-dev/community/ae-netscope`.
- TrueNAS app metadata, questions, image values, Docker Compose template, generated library compatibility, and basic test values.

### Changed

- Updated local production compose to run Redis with password authentication.
- Updated GHCR image references and internal project version to `0.1.4-alpha`.
- Updated TrueNAS packaging to target AE NetScope `v0.1.4-alpha`.
- Updated TrueNAS submission checklist with current packaging and validation status.

### Verified

- API test suite passes.
- TrueNAS app YAML validates statically.
- TrueNAS render path was validated in the official validation container for the staged app package.

### Status

- Early public preview.
- Not production ready.
- Intended for TrueNAS, homelab, review, and controlled non-sensitive trial environments.

## v0.1.3-alpha - 2026-06-25

### Added

- Initial production container packaging with Dockerfile, compose stack, PostgreSQL, Redis, startup migrations, OCI labels, configurable non-root UID/GID, and one-port API/web serving.
- Static web serving from FastAPI for container deployments, including SPA fallback routing.
- PostgreSQL 18 compatible compose volume layout.
- Alembic sync migrations through `psycopg` for production PostgreSQL migration runs.
- API test coverage for the production static web mount.
- README production container preview instructions for local compose validation and GHCR image building.

### Changed

- Updated vulnerable web and API dependency ranges so release hardening audits pass cleanly.
- Production cookie and HSTS defaults remain secure by default while allowing explicit environment overrides for controlled HTTP container previews.
- Isolated Redis/rate-limit behavior in API tests so local Redis state cannot cause flaky 429 responses.
- Updated TrueNAS checklist with verified container, PostgreSQL, Redis, healthcheck, migration, and persistence progress.

### Verified

- Docker image builds successfully.
- `docker compose up --build` starts AE NetScope, PostgreSQL, and Redis.
- `/api/health/live`, `/api/health/status`, `/api/version`, and the web UI respond through the container.
- PostgreSQL data persists after container restart.

### Status

- Early public preview.
- Container path is now validated locally.
- Not production ready.
- Intended for homelab, review, and controlled non-sensitive trial environments.

## v0.1.2-alpha - 2026-06-15

### Added

- Source-available proprietary license alignment across public project documentation.
- Import preview for JSON inventory backups before replacing current data.
- Stronger backup validation for duplicate records and broken VLAN, network, interface, device, IP, and service references.
- Automatic pre-restore backup returned by the API and downloaded from the web UI.
- Production hardening with security headers, production-secure cookies, HSTS controls, and import size limits.
- Dedicated update page with installed version, latest GitHub release, status, release link, and upgrade checklist.
- Alembic migration tests for single-head history and clean upgrade to `head`.
- README production guidance for backup/restore policy and SQLite local to PostgreSQL production migration.

### Changed

- Documentation and release materials aligned with the source-available proprietary license.

### Status

- Early public preview.
- Potentially usable for controlled testing with non-sensitive data.
- Not production ready.
- Intended for homelab, review, and limited trial environments.

## v0.1.1-alpha - 2026-06-03

### Added

- Internal version source, API version endpoint, installed-version display, and GitHub release update check.
- System status view with API, database, Redis, environment, release channel, and last-check details.
- Account email change flow with current-password confirmation and audit logging.

### Status

- Early public preview.
- Not production ready.
- Intended for testing, feedback, and controlled non-sensitive environments only.

## v0.1.0-alpha - 2026-06-03

### Added

- Initial public alpha of AE NetScope.
- FastAPI backend with session authentication, CSRF protection, roles, permissions, audit events, health checks, Redis-backed rate limiting, and setup flow for the first admin.
- React/Vite frontend with dashboard, login, user management, roles and permissions, settings, support, backups, technical notes, and inventory views.
- LAN inventory management for devices, IPs/MACs, subnets, VLANs, services, and hardware metadata.
- JSON/CSV export and JSON restore for inventory backups.
- Test coverage for API and frontend, CI workflow, coverage reports, dependency audits, secret scanning, and tracked-artifact checks.
- Public project documents: README, license, contributing guide, code of conduct, security policy, support policy, issue templates, and pull request template.

### Status

- Early public preview.
- Not production ready.
- Intended for testing, feedback, and controlled non-sensitive environments only.