Speakr v0.10.18-alpha

In this release, password sign-in is locked per account and client address after repeated wrong passwords, chat on incognito recordings works again, an incognito recording is kept through a page reload, and the API specification lists only the operations a scoped token may call.

Security

• Login lock (discussion #529). Wrong passwords on the sign-in page are counted for each account and client address. After login_max_failed_attempts wrong passwords (default 5) from one address for one account, password sign-in for that account from that address is refused for login_lockout_minutes (default 15), even with the correct password. Sign-ins from other addresses are not affected, so an account cannot be locked for everyone by guessing from one address. The sign-in page shows the same message as for a wrong password. Setting the attempt count to 0 turns the lock off. IPv6 addresses are counted by their /64 network.
• A locked account has a lock icon in User Management, and Unlock login in the Edit User dialog ends every lock on the account. A correct password before the limit resets the count, and a new password set by an administrator or through a reset email ends the lock. SSO sign-in is not affected.
• Behind a reverse proxy, the client address is read from the proxy's X-Forwarded-For header, as for the existing per-address limit. Setting TRUSTED_PROXIES keeps clients that connect to Speakr directly from choosing their own address.

Changed

• API specification per token (#526). When /api/v1/openapi.json is fetched with a scoped token, it lists only the operations that token may call, so tool servers built from it, Open WebUI among them, offer only those tools. Full tokens and signed-in browser sessions still receive every operation.

Fixed

• Chat on incognito recordings (#527). Every question returned an error since v0.10.11. The question is now answered from the transcript, participants and notes sent by the browser, and nothing is saved.
• Incognito recordings across a reload (#528). A page reload deleted the incognito recording. It now stays in the sidebar until the tab is closed or the prompt to switch away is accepted.

Upgrading

Pull the new image and start as usual. At startup, the login_failure table and the settings login_max_failed_attempts and login_lockout_minutes are created. No existing data is changed.

• Without a reverse proxy: set TRUSTED_PROXY_HOPS=0 so that the login lock counts the real connection address.
• Open WebUI users with a scoped token: the tool list is shorter after the update, by design.

Full Changelog: v0.10.17-alpha...v0.10.18-alpha