⚙️ Release 1.0.4 – Warranty Claims with Documents, Void Status & Paperless Security
Version 1.0.4 is a feature and hardening release. Claims grow up: they can now carry documents end-to-end. Warranties can be marked void when their conditions are broken. And a full access-control pass over the Paperless-ngx integration closes two responsibly disclosed security issues, alongside a stored-XSS fix in the Paperless browser.
📝 Warranty Claims & Documents (#148)
- Claims can now carry documents — approval or rejection letters, photos of the defect, repair invoices, and similar evidence.
- Each claim shows a Documents section in the claims view: attach a file directly, or upload it to Paperless-ngx and link it, then view or remove it from the same place.
- Access follows the warranty's other documents: owner and admins only, never shared through global view.
- Deleting a claim or its warranty removes the attached local files from disk; Paperless documents are unlinked, never deleted from Paperless.
🚫 Void Warranty Status (#250)
- A warranty can be manually marked void — physical damage, unauthorized repairs, broken seals — without deleting the item or changing its expiration date.
- Voided warranties stay visible with a purple Void status, a matching filter, and their own count card on the status dashboard.
- They are excluded from the Total Value card, active/expired/expiring counts, expiration timelines, and expiry notification emails. Voiding is reversible.
🔒 Security
- Paperless-ngx document access control (GHSA-fv62-3hrm-gf83 / GHSA-3h89-rqfj-5674): Warracker connects to Paperless with one shared API token, and any signed-in user could list every document in the instance, link another user's document to their own warranty or claim, and download it — the link itself was treated as proof of ownership. Warracker now tracks which user owns each Paperless document (recorded on upload or first link; existing links backfilled by migration). Search is scoped per user, linking someone else's document is rejected everywhere (warranty create/update, search-and-link, claim documents), downloads follow ownership plus the usual global-view rules, the Paperless debug endpoints are admin-only, and claim document metadata is no longer shown to global-view readers. Reported by 0xnu11ptr, and by Brandon Tarr (VulnCheck).
- Stored XSS via Paperless document titles: the Paperless document browser rendered titles, correspondents, and tag names without escaping, so a crafted document title executed in the browser of anyone who opened it — admins included. These fields are now HTML-escaped.
- Known default JWT secret removed from the compose files: both shipped compose files defaulted
SECRET_KEYto a fixed value printed in this public repository — an install that never set its own key signed login tokens with a secret anyone could read. The default is now empty, which activates the backend's generate-and-persist behavior.
📄 Paperless-ngx
- Document titles use the product name (#147): uploads are now titled " - Invoice", " - Manual", or " - Claim document" instead of "Warracker invoice - ".
- Browse/link fixed for non-admin users: the Paperless sections of the warranty forms were hidden from non-admins because the enabled flag was read from an admin-only endpoint. A new signed-in status endpoint exposes only the flag — never the Paperless URL or token.
🔑 OIDC
- Skip the login screen in OIDC-only mode (#186): a new admin setting (or
OIDC_SKIP_LOGIN_SCREEN) sends users straight to the identity provider. If the provider returns an error, the login screen reappears with the error — the redirect never loops. - First OIDC user now becomes owner (PR #254): the first OIDC sign-in previously granted admin but not owner; startup recovery and admin-group sync could also leave an instance ownerless or demote the owner. All three paths now keep a proper owner.
📊 Dashboard
- Total Value card fixed: since 1.0.3 it silently dropped every warranty with no currency recorded (older entries, imports). Those now count as your default currency; warranties in a different explicit currency are still excluded, as intended. The card's tooltip explains the calculation (all 20 locales).
🌐 Localization
- All 20 new 1.0.4 interface strings are translated into the 19 non-English locales (machine translation — native review welcome), including corrections to the void status wording in 14 locales where it read as "empty" instead of "voided".
🔧 Dependencies & Runtime
- flask-cors 4.0.2 → 6.0.5, fixing four published CORS policy-bypass vulnerabilities (CVE-2024-6221, CVE-2024-6866, CVE-2024-6839, CVE-2024-6844).
- Authlib 1.9.1, PyJWT 2.15.1, setuptools 84.0.0.
- The Docker base image moves from Python 3.13 to Python 3.15 (Debian 13 slim).
🧪 Project
- A test suite and CI now run on every pull request and push to main (36 tests covering the Paperless security rules, file access control, statistics, and validation), so the 1.0.3/1.0.4 security fixes stay fixed.
- The wiki launched: full user guide, configuration, backup/restore, reverse proxy (including Cloudflare Tunnel), troubleshooting with error numbers, per-page contents, and a roadmap.
- Claim documents UI: the Attach button now sizes to its content (it previously stretched across the documents section) and wraps correctly on mobile.
Upgrading: back up (database + uploads volume), pull the new image, recreate the container. Migrations (claim documents table, void column, Paperless ownership) run automatically on startup. If you run the shipped compose files and never set SECRET_KEY, this release changes your key handling: a random key is generated and persisted on first start, which signs out existing sessions once — your data is unaffected.
📸 Screenshots
Status dashboard — every warranty state at a glance (Void included):
Claim documents — files attached to a claim, local or in Paperless-ngx:
