Changelog

All notable changes to Generous.nz are recorded here, grouped by version. Every deployed build has a version number, a git tag, and an entry below.

Versioning scheme

Versions follow MAJOR.MINOR.PATCH:

0.x — pre-launch. Minor bumps mark a completed build phase or major feature set; patches are bug fixes on the current build.
1.0.0 — first public launch.
1.x+ — post-launch: minor = new features, patch = fixes, major = breaking changes or significant re-architecture.

Each version is tagged in git (v0.2.0) and the current version is kept in package.json. See docs/version-control.md for how to cut a release.

Fix passkey provider startup.

The Auth.js WebAuthn provider refused to start without experimental.enableWebAuthn, which surfaced as a "server configuration" error on /api/auth/providers. The flag is now set, so the passkey 2FA provider loads correctly (v0.9.41's runtime fix).

Account tab (change password + two-factor login with passkeys, including Heylogin).

New Account item at the bottom of the dashboard sidebar, available to every signed-in user, with two sections:
- Change password — verify the current password, set a new one. Social (Google/Apple) accounts without a password can set their first one here.
- Two-factor login (passkeys) — add and remove passkeys. Works with Heylogin, Windows Hello, Touch ID, Face ID and hardware security keys.
Passkey sign-in after your password: users with a passkey enrolled now complete two steps — password, then a passkey confirmation. The password alone can no longer create a session for those accounts.
New Authenticator database model (migration 0030_passkeys) via the Auth.js built-in passkey provider; no third-party auth service required.
Admin recovery tool on the Users page: "Remove passkeys" clears all 2FA credentials for an account if someone loses their device.
Audit log entries for password changes and passkey add/remove.

Login flow now checks the password first (/api/auth/login-step1) and only then issues a short-lived, single-use passkey challenge, so a passkey can never be used as the only credential.
Dependencies: @simplewebauthn/browser and @simplewebauthn/server (the peer packages the Auth.js passkey provider uses).

Rate limiting on password verification and password-change endpoints.
WebAuthn challenges are single-use, expire after five minutes, and are bound to the password-verified user.

Fix "client-side exception" from stale cached assets after deploys.

The service worker cache version was bumped so every visitor's browser drops old cached pages/scripts after this update. Stale HTML from an older build could reference JS files the new build removed, which caused the "Application error: a client-side exception" screen after rapid deploys.
The service worker no longer caches error responses, so a brief 500 during a deploy can't become a broken cached page.

Account-aware dashboard overview.

Approved wholesalers now land on a business-focused overview instead of the fundraiser dashboard: paid-to-you total, orders/units, catalogue product count, awaiting-fulfilment count, a 30-day sales chart, their wholesale tool links and their most popular products.
Fundraisers keep the existing fundraising overview unchanged.

Split dashboard menus for fundraisers and wholesalers.

Approved wholesalers now see their own sidebar menu: Catalogue products, Orders to fulfil, Analytics & export, Billing and Voucher sales — with the fundraiser menu (New fundraiser, New listing, My listings) hidden.
Fundraisers no longer see the wholesale menu (Wholesale catalogue adding stays approval-only on the server, so this is a UX change on top of the existing API guard).
Staff still see the full admin section regardless of account type.

Active sidebar highlighting.

The dashboard/admin side menu now highlights the page you're on with a solid green pill. Sub-pages stay highlighted (e.g. editing a specific email template keeps "Email templates" active), and the active state is announced to screen readers.

Wholesaler application: business location and applicant IP.

The wholesaler application form now asks for the business city (required) and region/state, alongside the existing country selector.
The applicant's IP address is recorded on the application (stored at first submission; the audit log also captures IP, city and region).
Admin → Wholesaler applications now shows the full business location and the applicant's IP on each row, so international and suspicious applications are easy to spot.
Schema: businessCity, businessRegion and signupIp on WholesalerProfile (migration 0029_wholesaler_location_ip).

Moderation queue previews.

Pending products in Admin → Moderation now show a full preview inline: photo, price, condition, stock, expiry, description, fulfilment options, pickup/shipping details, wholesale cost and commission, who listed it and on which campaign (with a link to the campaign page) — so moderators can review the item without leaving the page.
Pending fundraisers now show their cover photo and story text alongside the Approve/Reject/Dismiss actions.