Cloud-City-Computing/c2 v0.11.0

Cloud Codex 0.11.0

on GitHub

The account-security release. Upgrading from 0.10.0 applies two migrations with npm run migrate. The first one refuses to run on an install that already holds a double link; see Migration in CHANGELOG.md.

Run it

git clone https://github.com/Cloud-City-Computing/c2.git
cd c2
cp .env.example .env    # fill in DB and admin credentials; SMTP is optional
docker compose -f docker-compose-release.yml up

That pulls ghcr.io/cloud-city-computing/cloud-codex:0.11.0.

Security

• Google sign-in no longer links an account that has two-factor authentication on (GHSA-6q9j-5qr9-7f2p, medium).
  • Signing in with Google for an existing account's email used to link the two and sign in, without asking for that account's second factor.
  • Links made before this release are kept. The advisory and docs/troubleshooting.md say how to review them.
• The boot admin sync no longer promotes an existing account (GHSA-w8q3-r34w-3pjh, medium).
  • Before this release, a member who took the administrator's former name or email became the administrator at the next restart.
  • The sync now refuses and logs one line instead.
• Changing an account's email or password needs its current password, and signs every device out.
  • Before this release, a session alone could change both, and a password change kept the session.
  • An account without a password confirms an email change with a code sent to its current address.
• One sign-in account per provider per user. Google no longer attaches a second Google account to a user, and a database key now enforces the rule for every provider.

Also in this release

• An identity seam. Every sign-in method now resolves through it.
• AUTH_PROVIDERS. It chooses the sign-in methods an instance offers, and a bad value stops the boot.
• Fixed: the account menu's Update Info always failed.
• Clearer GitHub link messages. The account page now shows the outcome of every link attempt.
• A live-MySQL integration test project runs inside the required CI job.

Known gaps

• On an SELinux-enforcing host (Fedora, RHEL), a fresh install from this tag's compose file gets no schema. It fails with "Table 'c2.users' doesn't exist" because init.sql is mounted without a relabel. main fixes this. On this tag, change the init.sql mount line in docker-compose-release.yml to end in :ro,z before the first up. If you already started, run docker compose -f docker-compose-release.yml down -v and then up. That down -v destroys the database, which on a fresh install is empty.
• linux/amd64 only.
• Sessions are still one per user until the planned per-sign-in sessions land, so a new sign-in joins the existing session.
• Documents edited only over the collaborative WebSocket have a stale html_content until an explicit save.

Full detail in CHANGELOG.md.