Emily
released this
2026-11-04 21:55:38 +01:00
| 6 commits to main since this release
Universal Gaming Backend 1.4.0
SMTP TLS fix
- Fixes
error:0A00010B:SSL routines:tls_validate_record_header:wrong version number.
- TLS mode is inferred from the port: 465 = implicit TLS; 25/587/2525 = STARTTLS.
SMTP_SECURE=true on a STARTTLS port is corrected automatically with a warning.- New optional
SMTP_REQUIRE_TLS override.
- Startup logs the effective SMTP mode without credentials.
Password reset
- New
POST /api/v1/auth/forgot-password and POST /api/v1/auth/reset-password.
- Only accounts with an assigned and confirmed e-mail can reset a password.
- Forgot-password always returns HTTP 202 to prevent account enumeration.
- One-time tokens are stored as SHA-256 hashes and expire after 30 minutes by default (
PASSWORD_RESET_TTL_MINUTES).
- Resetting a password increments
auth_version, invalidating every existing session.
- New
APP_PUBLIC_URL controls the app reset link (/account?reset=…).
Database
- PostgreSQL migration version 2 adds
auth_version and password-reset token columns.
- Applied automatically by
./update.sh or node src/migrate.js.
Upgrade
- Deploy with
./update.sh; it takes a pre-update pg_dump backup and applies migration 2.
- Existing accounts, scores and chess matches are preserved.
Downloads