Release v0.6.0
This commit is contained in:
thakares committed
1 parent
7069ca9db7
commit
f49698bb5c
75 files changed
+11199
-7508
No files matched your search
+1
-1
@@ -1,6 +1,6 @@
|
||||
# BZOD Administrator Guide
|
||||
|
||||
Version: v0.5.3
|
||||
Version: v0.6.0
|
||||
|
||||
---
|
||||
|
||||
|
||||
+22
-5
@@ -1,6 +1,6 @@
|
||||
# BZOD Architecture Guide
|
||||
|
||||
Version: v0.5.3
|
||||
Version: v0.6.0
|
||||
|
||||
---
|
||||
|
||||
@@ -89,7 +89,22 @@ Responsible for:
|
||||
Major modules:
|
||||
|
||||
```text
|
||||
admin.rs
|
||||
admin/ (modular feature directory)
|
||||
auth.rs (authentication and session handling)
|
||||
dashboard.rs (dashboard rendering)
|
||||
urls.rs (URL management handlers)
|
||||
pages.rs (landing page management handlers)
|
||||
analytics.rs (analytics and export handlers)
|
||||
settings.rs (settings and configuration handlers)
|
||||
users.rs (user management handlers)
|
||||
sessions.rs (session administration)
|
||||
quotas.rs (quota management)
|
||||
health.rs (health diagnostics)
|
||||
backups.rs (backup and restore handlers)
|
||||
api_keys.rs (API key management)
|
||||
audit.rs (audit log handlers)
|
||||
moderation.rs (content moderation handlers)
|
||||
mod.rs (module exports and shared helpers)
|
||||
api.rs
|
||||
pages.rs
|
||||
redirect.rs
|
||||
@@ -339,9 +354,11 @@ Locate owner database
|
||||
↓
|
||||
Resolve URL
|
||||
↓
|
||||
Validate destination
|
||||
↓
|
||||
Record analytics
|
||||
↓
|
||||
302 Redirect
|
||||
301 Redirect (with safe Location header construction)
|
||||
```
|
||||
|
||||
---
|
||||
@@ -590,7 +607,7 @@ Coverage includes:
|
||||
* Upgrade validation
|
||||
* Multi-user isolation
|
||||
|
||||
v0.5.0 includes more than 90 automated tests.
|
||||
The project includes comprehensive automated test coverage spanning unit, integration, security, and end-to-end tests.
|
||||
|
||||
---
|
||||
|
||||
@@ -635,7 +652,7 @@ Planned for future releases:
|
||||
|
||||
# Summary
|
||||
|
||||
BZOD v0.5.0 is built around a simple principle:
|
||||
BZOD is built around a simple principle:
|
||||
|
||||
> Keep deployment simple, keep data local, keep users isolated, and keep recovery easy.
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Backup & Restore Guide
|
||||
|
||||
Version: v0.5.3
|
||||
Version: v0.6.0
|
||||
Applies To: BZOD Multi-User Platform
|
||||
|
||||
---
|
||||
|
||||
@@ -6,6 +6,77 @@ The format is based on Keep a Changelog and this project follows Semantic Versio
|
||||
|
||||
---
|
||||
|
||||
# v0.6.0 — Legacy Restore Compatibility & Version Reporting
|
||||
|
||||
- **Legacy Backup Restore**: Full backward-compatible restore support for `legacy_flat_backup` archives into the current multi-tenant database architecture
|
||||
- **CLI Version Reporting**: Added `--version` / `-V` flags derived from Cargo package metadata
|
||||
- **Deploy Script**: Removed obsolete `init-db` command; database creation and migration now handled by `bzod serve`
|
||||
- **Version Verification**: Deploy script now verifies installed binary version matches requested version
|
||||
|
||||
# v0.5.3 — Architecture Refinement & Redirect Hardening
|
||||
|
||||
---
|
||||
|
||||
## Changed
|
||||
|
||||
### Architecture
|
||||
|
||||
* Eliminated the monolithic `admin.rs` handler file
|
||||
* Reorganized admin functionality into focused feature modules under `src/web/admin/`
|
||||
* Separated authentication, dashboard, URLs, pages, analytics, settings, users, sessions, quotas, health, backups, API keys, audit, and moderation into dedicated modules
|
||||
* Extracted shared authentication and authorization helpers
|
||||
* Extracted common export and helper functionality
|
||||
|
||||
### Redirect Handling
|
||||
|
||||
* Removed panic-prone `HeaderValue::from_str(...).unwrap()` pattern from the redirect path
|
||||
* Added destination URL validation (scheme validation, control character rejection)
|
||||
* Added safe HTTP Location header construction
|
||||
* Improved database error logging with structured fields
|
||||
* Reduced unnecessary database mutex lock acquisitions on the redirect hot path
|
||||
* Removed synchronous expiration writes from the redirect hot path
|
||||
|
||||
---
|
||||
|
||||
## Improved
|
||||
|
||||
* Database lock scoping across admin handlers
|
||||
* Error handling consistency and observability
|
||||
* Handler decomposition for oversized functions
|
||||
* Reduced duplicated handler logic across admin operations
|
||||
|
||||
---
|
||||
|
||||
## Verified
|
||||
|
||||
* Root landing page (GET /) confirmed as intentional route serving www/index.html
|
||||
* Release binary built successfully
|
||||
* Runtime smoke tests passed (GET /, GET /login, GET /admin/login all return HTTP 200)
|
||||
* SQLite WAL mode and foreign-key enforcement initialized successfully
|
||||
* All existing migrations reported as up to date
|
||||
* Comprehensive automated test suite passed, including:
|
||||
* Authentication and migration tests
|
||||
* Redirect security tests
|
||||
* Root landing page test
|
||||
* Backup and restore tests
|
||||
* Business workflow tests
|
||||
* Security tests
|
||||
* Slug namespace, registry, and transfer tests
|
||||
* User management and isolation tests
|
||||
* WAL recovery tests
|
||||
* HTTP end-to-end tests
|
||||
|
||||
---
|
||||
|
||||
## Notes
|
||||
|
||||
* This release is an internal architecture and quality improvement
|
||||
* No new user-facing features were introduced
|
||||
* Existing API and route behavior was preserved
|
||||
* Existing redirect security and tenant isolation behavior was preserved
|
||||
|
||||
---
|
||||
|
||||
# v0.5.1 - General Availability (GA)
|
||||
|
||||
Release Date: 2026-06-20
|
||||
|
||||
+1
-1
@@ -2,7 +2,7 @@
|
||||
|
||||
BZOD includes a comprehensive command-line interface for server administration, backups, migrations, diagnostics, validation, and multi-user management.
|
||||
|
||||
The current command list for BZOD v0.5.3 is:
|
||||
The current command list for BZOD v0.6.0 is:
|
||||
|
||||
```text
|
||||
$ bzod --help
|
||||
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
# BZOD v0.5.1 vs Self-Hosted URL Management Platforms
|
||||
# BZOD v0.6.0 vs Self-Hosted URL Management Platforms
|
||||
|
||||
BZOD is a modern, privacy-focused, self-hosted URL Management Platform written in Rust and developed as part of the NX9 Platform.
|
||||
|
||||
|
||||
+1
-1
@@ -2,7 +2,7 @@
|
||||
|
||||
# BZOD Database Architecture
|
||||
|
||||
BZOD v0.5.1 uses SQLite exclusively.
|
||||
BZOD v0.6.0 uses SQLite exclusively.
|
||||
|
||||
Rather than using a single monolithic database, BZOD separates data into administrative and tenant-specific databases. This architecture improves security, isolation, backup flexibility, disaster recovery, and scalability.
|
||||
|
||||
|
||||
+3
-3
@@ -1,6 +1,6 @@
|
||||
# BZOD Installation Guide
|
||||
|
||||
Version: v0.5.1
|
||||
Version: v0.6.0
|
||||
|
||||
---
|
||||
|
||||
@@ -183,13 +183,13 @@ sudo pacman -S \
|
||||
Example:
|
||||
|
||||
```bash
|
||||
wget https://example.com/bzod-v0.5.0-linux-amd64.tar.gz
|
||||
wget https://example.com/bzod-v0.6.0-linux-amd64.tar.gz
|
||||
```
|
||||
|
||||
Extract:
|
||||
|
||||
```bash
|
||||
tar -xzf bzod-v0.5.0-linux-amd64.tar.gz
|
||||
tar -xzf bzod-v0.6.0-linux-amd64.tar.gz
|
||||
```
|
||||
|
||||
Install:
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
# BZOD Multi-User Architecture Guide
|
||||
|
||||
Version: v0.5.1
|
||||
Version: v0.6.0
|
||||
|
||||
---
|
||||
|
||||
|
||||
@@ -1,3 +1,132 @@
|
||||
# BZOD v0.6.0 — Legacy Restore Compatibility & Version Reporting
|
||||
|
||||
Release Date: 2026-08-09
|
||||
|
||||
## Highlights
|
||||
|
||||
- **Legacy Backup Restore Compatibility**: Backups created with the web admin "Download Backup" feature (`legacy_flat_backup` format) can now be correctly restored into the current multi-tenant database architecture. Previously, these restores failed with "no such table: users" because the restore validator ran against the empty legacy `users.db` before layout normalization.
|
||||
|
||||
- **CLI Version Reporting**: `bzod --version` and `bzod -V` now report the application version derived from Cargo.toml package metadata, ensuring the reported version cannot diverge from the build.
|
||||
|
||||
- **Deploy Script Modernization**: Removed the obsolete `init-db` command from the deployment script. Database creation and schema migration are now handled automatically by `bzod serve`. The deploy script now verifies the installed binary version using `--version`.
|
||||
|
||||
## Breaking Changes
|
||||
|
||||
None.
|
||||
|
||||
# BZOD v0.5.3 — Architecture Refinement & Redirect Hardening
|
||||
|
||||
BZOD v0.5.3 is an internal quality and maintainability release focused on architectural refinement, redirect handler hardening, and comprehensive verification.
|
||||
|
||||
No new user-facing features are introduced. Existing API contracts, route behavior, authentication, and tenant isolation are fully preserved.
|
||||
|
||||
---
|
||||
|
||||
# Highlights
|
||||
|
||||
## Modular Admin Architecture
|
||||
|
||||
The former monolithic admin handler file was eliminated and replaced with a focused module directory at `src/web/admin/`.
|
||||
|
||||
Feature modules:
|
||||
|
||||
* `auth.rs` — authentication and session handling
|
||||
* `dashboard.rs` — dashboard rendering
|
||||
* `urls.rs` — URL management handlers
|
||||
* `pages.rs` — landing page management handlers
|
||||
* `analytics.rs` — analytics and export handlers
|
||||
* `settings.rs` — settings and configuration handlers
|
||||
* `users.rs` — user management handlers
|
||||
* `sessions.rs` — session administration
|
||||
* `quotas.rs` — quota management
|
||||
* `health.rs` — health diagnostics
|
||||
* `backups.rs` — backup and restore handlers
|
||||
* `api_keys.rs` — API key management
|
||||
* `audit.rs` — audit log handlers
|
||||
* `moderation.rs` — content moderation handlers
|
||||
|
||||
Benefits:
|
||||
|
||||
* Improved code organization and navigability
|
||||
* Reduced coupling between feature areas
|
||||
* Improved database lock scoping
|
||||
* Reduced duplicated handler logic
|
||||
* Better error handling consistency and observability
|
||||
* Simplified future extension
|
||||
|
||||
---
|
||||
|
||||
## Redirect Handler Hardening
|
||||
|
||||
The public redirect path (`GET /:code`) was hardened against invalid HTTP Location header values.
|
||||
|
||||
Changes:
|
||||
|
||||
* Removed the panic-prone `HeaderValue::from_str(...).unwrap()` pattern
|
||||
* Added destination URL validation (scheme enforcement, control character rejection)
|
||||
* Added safe Location header construction that handles malformed values gracefully
|
||||
* Improved database error logging with structured fields
|
||||
* Reduced unnecessary database mutex lock acquisitions
|
||||
* Removed synchronous expiration writes from the redirect hot path
|
||||
|
||||
Existing redirect security and tenant isolation behavior was preserved.
|
||||
|
||||
---
|
||||
|
||||
## Root Landing Page Verification
|
||||
|
||||
* Confirmed `GET /` as an intentional application route serving `www/index.html`
|
||||
* Resolved a runtime path-resolution issue affecting static landing-page resolution
|
||||
* Verified `GET /` returns HTTP 200
|
||||
* Verified `GET /login` returns HTTP 200
|
||||
* Verified `GET /admin/login` returns HTTP 200
|
||||
|
||||
---
|
||||
|
||||
# Testing & Validation
|
||||
|
||||
BZOD v0.5.3 passed:
|
||||
|
||||
* Release build (`cargo build --release`)
|
||||
* Comprehensive automated test suite, including:
|
||||
* Authentication and migration tests
|
||||
* Redirect security tests
|
||||
* Root landing page test
|
||||
* Backup and restore tests
|
||||
* Business workflow tests
|
||||
* Security tests
|
||||
* Slug namespace, registry, and transfer tests
|
||||
* User management and isolation tests
|
||||
* WAL recovery tests
|
||||
* HTTP end-to-end tests
|
||||
* Runtime smoke tests against the release binary
|
||||
* SQLite WAL mode and foreign-key enforcement initialization
|
||||
* Database migration verification (all migrations up to date)
|
||||
|
||||
---
|
||||
|
||||
# Compatibility
|
||||
|
||||
* No breaking changes
|
||||
* No API changes
|
||||
* No route changes
|
||||
* No database schema changes
|
||||
* No configuration changes
|
||||
* Direct upgrade from v0.5.1 with no migration required
|
||||
|
||||
---
|
||||
|
||||
# Repository
|
||||
|
||||
* Clean source tree established
|
||||
* Build artifacts, temporary reports, and IDE metadata removed
|
||||
* Existing BZOD Git history preserved
|
||||
* Refactoring baseline merged with existing history
|
||||
|
||||
---
|
||||
|
||||
---
|
||||
|
||||
# BZOD v0.5.1 — Namespace Integrity & Platform Hardening
|
||||
|
||||
**Release Date:** 2026-06-20
|
||||
|
||||
+27
-4
@@ -1,6 +1,6 @@
|
||||
# BZOD Security Guide
|
||||
|
||||
Version: v0.5.1
|
||||
Version: v0.6.0
|
||||
|
||||
---
|
||||
|
||||
@@ -16,7 +16,7 @@ BZOD is designed as a self-hosted URL shortener and landing page platform with a
|
||||
* Disaster recovery
|
||||
* Operational simplicity
|
||||
|
||||
This document describes the security architecture, threat model, authentication mechanisms, authorization controls, and operational security recommendations for BZOD v0.5.0.
|
||||
This document describes the security architecture, threat model, authentication mechanisms, authorization controls, and operational security recommendations for BZOD v0.6.0.
|
||||
|
||||
---
|
||||
|
||||
@@ -432,6 +432,27 @@ for:
|
||||
|
||||
---
|
||||
|
||||
# Redirect Security
|
||||
|
||||
The redirect handler validates destination URLs before constructing HTTP Location headers.
|
||||
|
||||
Protections include:
|
||||
|
||||
* URL scheme validation (only http and https destinations are permitted)
|
||||
* Control character rejection
|
||||
* CRLF injection prevention
|
||||
* Safe Location header construction (no panics on malformed values)
|
||||
|
||||
Invalid redirect destinations return:
|
||||
|
||||
```http
|
||||
500 Internal Server Error
|
||||
```
|
||||
|
||||
with structured server-side logging. Full destination values are not exposed to clients.
|
||||
|
||||
---
|
||||
|
||||
# Audit Logging
|
||||
|
||||
Security-sensitive actions are logged.
|
||||
@@ -599,7 +620,7 @@ If compromise is suspected:
|
||||
|
||||
# Security Testing
|
||||
|
||||
BZOD v0.5.0 includes tests covering:
|
||||
BZOD v0.6.0 includes tests covering:
|
||||
|
||||
* Authentication
|
||||
* Authorization
|
||||
@@ -610,6 +631,8 @@ BZOD v0.5.0 includes tests covering:
|
||||
* Upgrade migrations
|
||||
* Backup integrity
|
||||
* Disaster recovery
|
||||
* Redirect destination validation
|
||||
* HTTP Location header safety
|
||||
|
||||
These tests are executed during CI and release validation.
|
||||
|
||||
@@ -642,7 +665,7 @@ These may be addressed in future releases.
|
||||
|
||||
# Summary
|
||||
|
||||
BZOD v0.5.0 provides:
|
||||
BZOD v0.6.0 provides:
|
||||
|
||||
* Centralized authentication
|
||||
* Secure session management
|
||||
|
||||
@@ -325,6 +325,38 @@ and:
|
||||
|
||||
for final landing page render.
|
||||
|
||||
Root landing page:
|
||||
|
||||
```text
|
||||
GET /
|
||||
```
|
||||
|
||||
must serve the static landing page.
|
||||
|
||||
Expected:
|
||||
|
||||
```http
|
||||
200 OK
|
||||
Content-Type: text/html
|
||||
```
|
||||
|
||||
Redirect security:
|
||||
|
||||
Redirect destinations are validated against:
|
||||
|
||||
* Invalid URL schemes
|
||||
* CRLF injection attempts
|
||||
* Control character injection
|
||||
* Malformed HTTP Location header values
|
||||
|
||||
Invalid destinations must return:
|
||||
|
||||
```http
|
||||
500 Internal Server Error
|
||||
```
|
||||
|
||||
and must not panic or produce malformed HTTP responses.
|
||||
|
||||
---
|
||||
|
||||
# 12. Backup Validation
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
# Upgrade Guide
|
||||
|
||||
Version: v0.5.1
|
||||
Version: v0.6.0
|
||||
|
||||
This document describes the upgrade process for existing BZOD deployments upgrading to BZOD v0.5.1.
|
||||
|
||||
|
||||
Reference in new issue
Block a user