3.19.0 (2026-02-25)
New Features
- add granular user permissions (balance, subscription, promo_group, referral, send_offer) (60c4fe2)
- add per-channel disable settings and fix CHANNEL_REQUIRED_FOR_ALL bug (3642462)
- add RBAC + ABAC permission system for admin cabinet (3fee54f)
- add resource_type and request body to audit log entries (388fc7e)
- allow editing system roles (f6b6e22)
- capture query params in audit log details for all requests (bea9da9)
Bug Fixes
- address RBAC review findings (CRITICAL + HIGH) (1646f04)
- align RBAC route prefixes with frontend API paths (5a7dd3f)
- always include details in successful audit log entries (3dc0b93)
- extract real client IP from X-Forwarded-For/X-Real-IP headers (af6686c)
- grant legacy config-based admins full RBAC access (8893fc1)
- improve campaign notifications and ticket media in admin topics (a594a0f)
- RBAC API response format fixes and audit log user info (4598c27)
- RBAC audit log action filter and legacy admin level (c1da8a4)
- restore subscription_url and crypto_link after panel sync (26efb15)
- specify foreign_keys on User.admin_roles_rel to resolve ambiguous join (bc7d061)
- stack promo group + promo offer discounts in bot (matching cabinet) (628997f)