v1.1.0-beta.013 - chore: comprehensive security hardening and job configurability
🔒 Security & Privacy
- Prevented keyHash from leaking to the frontend in both User and Admin API key routes by implementing strict select statements and object destructuring.
- Added pushover_token, telegram_bot_token, and apprise_url to the SENSITIVE_KEYS array to ensure they are masked when sent to the browser.
- Implemented secure masking for CustomHeader values and DiscordWebhook URLs in the configuration GET route, with safe restoration logic in the POST route to satisfy Prisma constraints.
- Updated the Test Connection endpoints to securely unmask and utilize real credentials from the database for Pushover, Telegram, Apprise, Custom Headers, and Discord Webhooks.
- Sanitized Apprise URLs in system logs to strip out and protect inline basic authentication credentials.
- Hardened the impersonation API route to strictly block session token transmission over unencrypted HTTP connections, adding an ALLOW_INSECURE_IMPERSONATION environment variable for opt-in LAN usage.
✨ Features & Enhancements
- Refactored the AuditLogger to fetch and log the human-readable username rather than the raw database userId in the rotating text logs.
- Made the Watched Folder Sync and System Health Check background jobs fully configurable via database settings instead of hardcoding them to 15-minute intervals.
- Added corresponding management cards and state logic to the Scheduled Jobs UI for the new customizable intervals.
🐛 Bug Fixes & UI Adjustments
- Whitelisted the /api/admin/update-check route in middleware.ts to eliminate 401 Unauthorized log spam caused by the automated health checker.
- Changed the input fields for Pushover, Telegram, Apprise, and Webhooks to type=password in the settings UI for visual consistency.
- Removed the display of plaintext Discord Webhook URLs from the integration cards.
- Relocated the Advanced Download Rules section to sit directly beneath the Enable Direct Downloads toggle in the File Hosters settings tab for better organizational flow.