feat: 1.5.0 prep — API v1 cutover, LICENSE, CHANGELOG, CI

- Remove legacy /api/ mount; all routes now under /api/v1/ only - Update path matchers (CSRF excludes, public routes, audit log, rate limits) - Move standalone routes (/api/network/ips, /api/docs, /api/docs/spec) to v1 - Update openapi.yaml (110 paths), CA pages, and 4 lingering frontend files - Add LICENSE (proprietary EULA), CHANGELOG.md (Keep a Changelog format) - Add .gitea/workflows/ci.yml (test+lint and security audit jobs) - Fix 9 pre-existing no-empty lint errors so CI starts green - Drop ad-hoc scratch reports and *.bak files from repo root All 739 jest tests pass. Lint is clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-17 11:38:45 -07:00
parent cd8ccaba2b
commit d36705bd90
18 changed files with 663 additions and 252 deletions
@@ -0,0 +1,220 @@
+# Changelog
+
+All notable changes to DashCaddy are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [1.5.0] - 2026-05-17
+
+### Changed (BREAKING)
+- API routes now mounted exclusively under `/api/v1/`. The legacy un-versioned
+  `/api/` mount has been removed. Frontend, OpenAPI spec, DashCA pages, and
+  all internal path matchers (CSRF exclusions, auth public routes, audit log,
+  rate-limit mounts) updated accordingly. **Existing integrations that hit
+  `/api/...` directly must update to `/api/v1/...`.** Held at minor bump
+  (1.5.0) rather than major (2.0.0) — DashCaddy is still pre-1.0-API-stable.
+
+### Added
+- `LICENSE` (proprietary EULA) at repo root.
+- `CHANGELOG.md` (this file) — Keep a Changelog format.
+- Gitea Actions workflow ([.gitea/workflows/ci.yml](.gitea/workflows/ci.yml))
+  that runs `npm test` (with coverage) and `npm run lint` on every push to
+  `main`/`master` and on PRs, plus a `security` job running `npm audit` and
+  the security-focused test subset.
+
+### Fixed
+- 9 pre-existing `no-empty` ESLint errors in `backup-manager.js` and
+  `routes/backups.js` (intentional ignore-failure catches now annotated).
+
+### Removed
+- Stale files at repo root: `*.bak`, `server-old.js`, and ad-hoc
+  deployment/migration/test reports (`DEPLOYMENT-SUCCESS.md`,
+  `FINAL-DEPLOYMENT-REPORT.md`, `DESLOPIFICATION-ROADMAP.md`,
+  `error-handling-*.md`, `WHAT-IS-DASHCADDY.md`, etc.). Already gitignored —
+  disk-only cleanup.
+
+---
+
+## [1.4.10] - 2026-05-17
+
+### Fixed
+- `release.sh` now stages build-rewritten files (`sw.js`, `index.html`) so
+  they're included in the published tarball.
+
+## [1.4.9] - 2026-05-17
+
+### Fixed
+- Container-logs feature was misusing `wireModal`, which short-circuited the
+  rest of `features.js` and broke unrelated dashboard features.
+
+## [1.4.8] - 2026-05-17
+
+### Fixed
+- CSP hash now computed on LF-normalized `index.html` so Windows and Linux
+  builds produce identical hashes.
+
+## [1.4.7] - 2026-05-17
+
+### Fixed
+- Dashboard unbroken: corrected bundle order, closed dangling IIFE, removed
+  duplicate `const` declaration.
+
+## [1.4.6] - 2026-05-17
+
+### Fixed
+- `sw.js` cache tag now derived from bundle content hash, so service worker
+  invalidates correctly when bundle content changes.
+
+## [1.4.5] - 2026-05-17
+
+### Fixed
+- Frontend deploy routed through the host-side updater (matches the API
+  container's own update path).
+
+## [1.4.4] - 2026-05-16
+
+### Fixed
+- `notify` endpoint exempted from CSRF (it's called by the host-side updater,
+  not the browser).
+- `release.sh` JSON parsing made portable (no longer assumes GNU `jq`
+  semantics on every host).
+
+## [1.4.3] - 2026-05-16
+
+### Added
+- Seamless release flow: push-notify endpoint, VERSION file copy into
+  release tarball, robust SSH mirror handling on port 22022.
+
+## [1.4.2] - 2026-05-16
+## [1.4.1] - 2026-05-16
+
+### Changed
+- Version bump only — packaging plumbing for the 1.4.x release line.
+
+## [1.4.0] - 2026-05-06
+
+### Added
+- `scripts/release.sh` — one-command release cutting and publishing.
+
+---
+
+## [1.3.1] - 2026-05-06
+
+### Fixed
+- Installer: added `src/` directory to the deploy manifest; dropped
+  `MakeDirectory=yes` from the systemd updater path unit.
+- Self-updater: copies `src/`, replaces `routes/` in place instead of
+  nesting it inside the existing tree.
+
+## [1.3.0] - 2026-05-06
+
+### Added
+- Self-updater supports `DASHCADDY_API_SOURCE_DIR` env override for
+  non-standard deploy layouts.
+
+### Fixed
+- Self-updater now clears *all* pending history entries, not just one.
+
+---
+
+## [1.2.0] - 2026-05-14
+
+### Added
+- Container Log Viewer with streaming, search, and download.
+- Service filter, batch operations across multiple services, and snapshot
+  capture.
+- Auto CSP hash updates during build.
+- Dashboard version button and self-update UI wiring.
+- Release policy checks and dashboard version verification.
+
+### Changed
+- All routine `console.log` calls gated behind `window.DASHCADDY_DEBUG`
+  flag for quieter production output.
+- All `console.error` calls routed through `ErrorHandler` for consistent
+  tracking.
+
+### Fixed
+- Updater no longer triggers a false-positive "update available" loop
+  when commit hash is unknown.
+
+---
+
+## [1.1.5] - 2026-03-23
+
+### Added
+- Pylon health relay for remote service health checks (with relay
+  fallback on `/probe/:id`).
+- Host-side auto-updater for zero-touch API container rebuilds.
+
+### Fixed
+- Service edit preserves service ID on subdomain change; accepts
+  `localhost` as a valid IP.
+- Taxi theme accent color now distinct from text.
+- Prevents encryption key conflicts; adds license backup on rotation.
+
+## [1.1.1] - 2026-03-23
+
+### Fixed
+- Service edit, CSRF token stability, and license restore.
+
+---
+
+## [1.0.x] - 2026-03-05 → 2026-03-22
+
+Initial release line. Highlights from work between v1.0 and v1.1:
+
+### Added
+- Cross-platform path support (Windows + Linux deployments).
+- Subdirectory routing mode for public-domain deployments.
+- Auto-update system for DashCaddy instances.
+- Batched status endpoint (frontend performance).
+- Install-wide onboarding tour (no longer per-browser).
+- Daily log digest and Docker hygiene/maintenance.
+- Unified backup/restore v2.0 with full state capture.
+- DNS uptime bars and fully-dynamic DNS server config.
+
+### Changed
+- Phase 1-3 refactor: extracted config/context/utils into `src/`, split
+  monolithic `server.js`, standardized all 25+ route files with explicit
+  dependency injection.
+- Unified error handling system (throw-based, migrated 25 route files).
+- ESLint + Prettier baseline with auto-fixes.
+
+### Security
+- 7 critical + 16 high/medium API security bugs fixed.
+- 7 frontend security vulnerabilities fixed (4 critical, 3 high).
+- Logger sanitization to prevent log injection.
+
+### Tests
+- Comprehensive test suite reaching 80%+ coverage threshold.
+- `docker-security` test suite (41 tests).
+- `auth-manager` and `credential-manager` test suites.
+
+## [1.0.0] - 2026-03-05
+
+Initial release of DashCaddy. Unified dashboard for Docker container
+management, Caddy reverse proxy configuration, DNS automation, and SSL
+certificate provisioning.
+
+[Unreleased]: ../../compare/v1.5.0...HEAD
+[1.5.0]: ../../compare/v1.4.10...v1.5.0
+[1.4.10]: ../../compare/v1.4.9...v1.4.10
+[1.4.9]: ../../compare/v1.4.8...v1.4.9
+[1.4.8]: ../../compare/v1.4.7...v1.4.8
+[1.4.7]: ../../compare/v1.4.6...v1.4.7
+[1.4.6]: ../../compare/v1.4.5...v1.4.6
+[1.4.5]: ../../compare/v1.4.4...v1.4.5
+[1.4.4]: ../../compare/v1.4.3...v1.4.4
+[1.4.3]: ../../compare/v1.4.2...v1.4.3
+[1.4.2]: ../../compare/v1.4.1...v1.4.2
+[1.4.1]: ../../compare/v1.4.0...v1.4.1
+[1.4.0]: ../../compare/v1.3.1...v1.4.0
+[1.3.1]: ../../compare/v1.3.0...v1.3.1
+[1.3.0]: ../../compare/v1.2.0...v1.3.0
+[1.2.0]: ../../compare/v1.1.5...v1.2.0
+[1.1.5]: ../../compare/v1.1.1...v1.1.5
+[1.1.1]: ../../compare/v1.0.0...v1.1.1
+[1.0.0]: ../../releases/tag/v1.0.0