Changelog

Every release, newest first. The version you are running is shown at the bottom of the app's Settings page.

v0.7.0

07/24/2026
  • In-app documentation: seven topics (getting started, connecting a tenant, the refresh model, Terraform export, licensing, users/roles/MFA, deployment and backups) under the Docs button, with a topic sidebar. The same docs publish to tfsmith.com/docs.

v0.6.4

07/23/2026
  • Settings and Profile readability: sections are clearly separated with dividers and breathing room, and the panel is wider.

v0.6.3

07/23/2026
  • Connect now shows what it is doing: the button disables, a spinner appears, and a note explains the first pull can take a minute on a large tenant. Double-clicking Connect no longer creates the tenant twice.

v0.6.2

07/23/2026
  • Email addresses are now settable after account creation: your own in Profile, anyone's via Set email in Settings > Users. (First-run setup never asked for one, so reset links and expiry warnings had no address to go to.)

v0.6.1

07/23/2026
  • Tenants section in Settings: remove a tenant (typed-name confirm; deletes the stored export; never touches the provider). The backend route existed since 0.3.0 - the button did not.

v0.6.0

07/23/2026
  • Roles: admin and user. Users browse, export, and Refresh, and manage their own profile; admins get Settings, user management, license, and tenant add/remove. Role picker on create/invite, role change per user, and the last active administrator can never be demoted or disabled.
  • Email (SMTP) settings: your own mail server, password encrypted at rest, test-send button. TFsmith never sends anything anywhere else.
  • User invites: create an account by emailing a set-your-password link (expires in 72 hours).
  • Forgot password: reset links from the sign-in screen (2-hour links, no account enumeration). Admin reset in Settings still works without email.
  • License expiry warnings: admins with an email on file get a heads-up at 14/7/3/1 days before expiry; renewals reset the schedule.

v0.5.0

07/23/2026
  • Users and admin: create users (within the license cap - Individual is a single user, Business is unlimited), disable/enable, admin password reset. The last active account can never be disabled.
  • Profile for every user: change password, enroll TOTP MFA with an inline QR code (secret stored encrypted with the master key), disable with a current code. Login is MFA-aware.
  • Security settings: require-MFA toggle (unenrolled users are sent to Profile to enroll on next load) and session length (1-365 days).
  • Audit log viewer in Settings: who did what, when (viewer-local time).
  • Settings gear moved into the sidebar footer next to the theme toggle.

v0.4.0

07/23/2026
  • The refresh model: the provider is pulled automatically exactly once, when a tenant is added. After that only the Refresh button pulls - page loads never touch the provider API. The export is persisted to the data volume encrypted with the tenant's data key, so it survives restarts and every user of the install shares the last refresh (ten users cost the same API calls as one).
  • "Last refreshed Today, 7/23/2026, 9:41 PM" next to the Refresh button (viewer-local time; Yesterday and bare-date forms; an amber note past a week: "Over a week since the last refresh - the tenant may have changed.").
  • Tenants connected before this version show "No data pulled yet" - one Refresh click and they are current.

v0.3.0

07/23/2026
  • Phase 2: the product works end to end. Connect a tenant with a READ-ONLY admin API token (validated against the provider before storing; envelope encrypted at rest exactly like IdPVault). Browse resource types with live counts and type badges (OIDC/SAML/SWA...), click any object for its Terraform block + import block (Copy / Download .tf, with the full note set), or export a bundle zip (per-type .tf, provider.tf, variables.tf, import.tf, coverage README). Live provider fetch with a short in-memory cache; plaintext config never touches the database.
  • Daily license check-in (2:15 UTC) plus a boot refresh - renewals and added tenants now apply automatically, closing the Phase 1 gap.
  • Tenant cap enforced from the signed license payload (2 included, add more at tfsmith.com/manage).
  • Provider adapters lifted from IdPVault v1.3.0 (okta/auth0/authentik export paths + adaptive rate limiting).

v0.2.0

07/23/2026
  • Phase 1: first-run admin wizard, scrypt + DB-session sign-in, and the LICENSE GATE - no free tier; without a valid license only the License screen is reachable, with a purchase link to tfsmith.com, the install id, and an offline license file upload. TFSM activation keys activate against license.keltech.ai (only the key and install id are ever sent); offline entitlement files verify with zero network calls. Deactivate releases the license for another install. Headless bootstrap via TFSMITH_ADMIN_USER / TFSMITH_ADMIN_PASSWORD.

v0.1.0

07/23/2026
  • Phase 0 skeleton: FastAPI app boots against Postgres, owns its schema (settings, users, session_tokens, tenants, audit_log), serves /healthz.
  • Terraform engine, provider schemas, crypto, license verification, and activation client lifted from IdPVault v1.3.0 (TFSM key prefix, TFsmith User-Agent). Not yet wired to routes.
  • Docker image + entrypoint (first-boot key generation, PUID/PGID, drops root), CI (tests gate every build; :dev from dev, :latest from main).