Changelog

All notable changes to Generous.nz are recorded here, grouped by version. Every deployed build has a version number, a git tag, and an entry below.

Versioning scheme

Versions follow MAJOR.MINOR.PATCH:

0.x — pre-launch. Minor bumps mark a completed build phase or major feature set; patches are bug fixes on the current build.
1.0.0 — first public launch.
1.x+ — post-launch: minor = new features, patch = fixes, major = breaking changes or significant re-architecture.

Each version is tagged in git (v0.2.0) and the current version is kept in package.json. See docs/version-control.md for how to cut a release.

Clearer Stripe Connect setup error.

When Stripe refuses to create connected accounts because the platform profile / Connect questionnaire isn't complete, the site now says exactly that (admins see the full explanation; other users see "payments aren't available yet") instead of the generic "couldn't start onboarding" message. The underlying fix is completing the questionnaire in the Stripe dashboard.

Password generator on signup and reset pages.

Generate a strong password button on the create-account page (and the reset-password page): one click fills the password field with a cryptographically random 18-character password containing upper/lowercase letters, digits and symbols (no confusing lookalike characters).
The generated password is shown for copying, with Copy and New password buttons, so people can save it in their password manager before finishing signup.

Password reset flow.

Forgot password? link on the sign-in page, leading to a "reset your password" page that emails a one-time reset link (expires after 1 hour).
The reset link opens a "choose a new password" page with confirmation; successful resets update the password hash and revoke all other outstanding reset links.
Security: tokens are random 64-character values stored only as SHA-256 hashes (a database leak can't be used to reset accounts), are single-use, and the request endpoint never reveals whether an email is registered. Rate-limited per IP and per email; all activity is audit-logged.
New editable password-reset email template (Admin → Email templates) with {{name}} and {{reset_url}} shortcodes.
Schema: PasswordResetToken model (migration 0028_password_reset).

Editable email templates with shortcodes.

Every email template (all 19 types, including the new voucher-sold, wholesaler-fee-invoice, commission and platform-fee emails) can now be edited from Admin → Email templates → Edit: subject, HTML body and footer, with save, draft preview, reset-to-default and test-send.
Each editor page shows the template's shortcode reference — clickable {{placeholders}} (e.g. {{donor_name}}, {{campaign_url}}, {{voucher_codes}}) that insert at your cursor. Shortcodes are replaced with live values when the email is sent.
Custom templates are stored in the database (survive deployments) and apply automatically to real sends: donation/order receipts, campaign updates, refunds, disputes, moderation, wholesale fulfilment, vouchers, invoices, direct-debit notices, commission and platform-fee emails.
Templates that have been customised show a "Customised" badge on the list page; resetting always restores the built-in default.

Every transactional send now declares its template type and live variables so custom versions apply consistently across all flows.
Test sends and previews cover all 19 templates and honour custom versions.

Email log admin area.

Every email the platform sends (receipts, invoices, notifications) is now recorded in the database — recipient, subject, provider (SMTP / Resend / dev log), delivery status and the error message when a send fails.
New Admin → Email log page with a live search box (recipient or subject), a status filter (sent / failed / logged) and summary counts.
Schema: EmailLog model (migration 0027_email_log). Entries start from the first send after this build deploys; older emails are not backfilled.

SMTP email support (MXroute-ready).

Emails can now be sent via SMTP (e.g. MXroute) using SMTP_HOST / SMTP_PORT / SMTP_SECURE / SMTP_USER / SMTP_PASS. SMTP takes priority when configured; Resend remains the alternative; without either, emails still log to the server console (dev mode).
nodemailer added and externalised for the server runtime.

Two webhook destinations supported (platform + connected accounts).

The payment webhook now accepts two signing secrets (STRIPE_WEBHOOK_SECRET + STRIPE_WEBHOOK_SECRET_2, or a comma-separated list), so Stripe's two-scope webhook setup works: one destination for platform events, one for connected-account (seller) events, both pointing at the same URL.
docs/stripe-setup.md updated with the exact two-destination setup and which events belong on each scope.

Businesses get a clear "Connect Stripe" prompt.

The wholesale dashboard now shows a Connect your payout account call-to-action whenever a business hasn't connected Stripe — both while their application is under review and once approved. Previously the button only existed on the main dashboard, so businesses could miss the step.