Enhancements
Login security (#112)
- Added persistent login rate limiting by source IP and username, including trusted-proxy handling and administrative unlock support.
- Added TOTP two-factor authentication with verified enrolment, replay protection, password-protected binding changes, and CLI recovery; enable it from Admins → shield icon.
- Password or username changes now invalidate existing panel sessions and authenticated WebSocket connections.
Upgrade notes: sessions created before this release require one fresh login. Database backups now include TOTP secrets and should be protected like password hashes.
Fixes
-
Corrected the TOTP authenticator issuer from s-ui to 2s-ui.
-
Restored newline-separated values in route and DNS rules while preserving commas inside regular expressions (#116, #118).
-
Prevented idle client maintenance rounds from overwriting unsaved panel edits, while keeping live client data refreshed (#117, #118).
Chores
- Updated Vue, Vite, ESLint, TypeScript ESLint, and Node.js type definitions (#111).
Full Changelog: v1.7.0...v1.7.1