v0.109.0

What's Changed

• fix(admin): add skeleton loader to invite-user Org select by @Shreyag02 in #1735
• fix(orgusers): support case-insensitive name filtering by @Shreyag02 in #1723
• fix(webhooks): surface form validation errors and reset add-webhook drawer state by @Shreyag02 in #1736
• fix: remove unused user and org relations from app/pat schema by @whoAbhishekSah in #1741
• refactor(group): resolve org from the group instead of the request by @AmanGIT07 in #1739
• fix(products): redirect unknown product id to list instead of dangling URL by @Shreyag02 in #1742
• fix(invitation): auto-delete expired invitations on a schedule by @whoAbhishekSah in #1744
• fix(users): resolve user detail via frontierService.getUser instead of searchUsers by @Shreyag02 in #1743
• fix(admin): fix Org Security loading state UI by @Shreyag02 in #1738
• refactor(admin): use AlertDialog for destructive confirmation dialogs by @Shreyag02 in #1752
• fix(users): default user detail to Security tab via index redirect by @Shreyag02 in #1755
• fix(sdk): use searchOrganizationInvoices and value-based debounce by @rohanchkrabrty in #1748
• fix: wait for HTTP server drain during graceful shutdown by @AmanGIT07 in #1745
• fix: add graceful shutdown to UI server by @AmanGIT07 in #1747
• chore: bump apsara to 1.1.0 and remove unused sdk/react folder by @rohanchkrabrty in #1760
• fix: wait for background goroutines during shutdown by @AmanGIT07 in #1756
• feat: make the shutdown grace period configurable by @AmanGIT07 in #1758
• fix: auth OIDC button styles by @rohanchkrabrty in #1759
• fix: drop orgId from group RPCs by @rohanchkrabrty in #1757
• refactor(webhooks): make admin webhooks view-only, remove write actions by @Shreyag02 in #1754

Full Changelog: v0.108.1...v0.109.0

Changelog

• af5fda3 feat: make the shutdown grace period configurable (#1758)
• 7d10e3e fix(admin): add skeleton loader to invite-user Org select (#1735)
• cd6b070 fix(admin): fix Org Security loading state UI (#1738)
• 9339bb2 fix(invitation): auto-delete expired invitations on a schedule (#1744)
• 961da8a fix(orgusers): support case-insensitive name filtering (#1723)
• 4d34103 fix(products): redirect unknown product id to list instead of dangling URL (#1742)
• abe099f fix(sdk): use searchOrganizationInvoices and value-based debounce (#1748)
• dab6e85 fix(users): default user detail to Security tab via index redirect (#1755)
• ff27bf5 fix(users): resolve user detail via frontierService.getUser instead of searchUsers (#1743)
• b763d0a fix(webhooks): surface form validation errors and reset add-webhook drawer state (#1736)
• afc1be7 fix: add graceful shutdown to UI server (#1747)
• a41e92d fix: auth OIDC button styles (#1759)
• ab3fce9 fix: drop orgId from group RPCs (#1757)
• 545ee21 fix: remove unused user and org relations from app/pat schema (#1741)
• ba080b5 fix: wait for HTTP server drain during graceful shutdown (#1745)
• d43bcfb fix: wait for background goroutines during shutdown (#1756)
• 390b967 refactor(admin): use AlertDialog for destructive confirmation dialogs (#1752)
• 8ad9342 refactor(group): resolve org from the group instead of the request (#1739)
• da6059c refactor(webhooks): make admin webhooks view-only, remove write actions (#1754)

v0.108.1

Changelog

• f46911c feat(image-upload): add button to clear uploaded image (#1725)
• 7384a11 feat: simplify admin create-workspace form (#1733)
• 4a8d725 fix(admin): use blue IAM mark as favicon (#1729)
• 854c122 fix(billing): advance credit overdraft invoice window past last invoiced range (#1730)
• 46c7170 fix: remove duplicated word in users listing preference description (#1727)

v0.108.0

Changelog

• ed17ed9 feat(auth): enforce per-endpoint credential restrictions and make the auth chain order-independent (#1718)
• cc4e300 feat: manage platform users via GitOps (relation-level grants, bootstrap superuser SA, reconcile CLI) (#1719)
• 655d4df fix(pat): clear expiry-alert metadata on PAT regeneration (#1724)

v0.107.2

Changelog

• 1e95e03 fix(admin): open billing portal in same tab to reflect edits on return (#1722)

v0.107.1

What's Changed

• fix(authz): allow platform superusers to delete/read policies on deleted resources by @whoAbhishekSah in #1716
• feat(invite): make org dropdown searchable and show title instead of name by @Shreyag02 in #1712
• feat(billing): audit customer portal session creation by @rohilsurana in #1714
• feat(admin): open stripe customer portal from billing section by @rohilsurana in #1715
• feat: update pat terminology by @rohanchkrabrty in #1721

New Contributors

• @Shreyag02 made their first contribution in #1712

Full Changelog: v0.107.0...v0.107.1

v0.107.0

What's Changed

• fix(rql): emit groupBy columns as quoted identifiers by @AmanGIT07 in #1691
• fix(admin): surface API error message in toasts by @paanSinghCoder in #1653
• fix(permission): clean up leftover access in SpiceDB when a permission is deleted by @whoAbhishekSah in #1685
• fix(prospect): classify RQL helper errors as InvalidArgument by @AmanGIT07 in #1692
• test(user): assert session rejected on next request after user disable by @AmanGIT07 in #1695
• docs(postgres): document direct-policy semantics of user search aggregates by @rohilsurana in #1699
• refactor(deleter): delegate org removal cascade to membership by @rohilsurana in #1696
• refactor(serviceuser): list org service users via membership policies by @rohilsurana in #1694
• chore: update Org role titles for brevity by @whoAbhishekSah in #1705
• feat: scope and preselect PAT org role in create dialog by @rohanchkrabrty in #1704
• fix(billing): guard syncJob lifecycle with a dedicated mutex by @AmanGIT07 in #1706
• feat: add customisable button slots to service account views by @rohanchkrabrty in #1707

Full Changelog: v0.106.1...v0.107.0

Changelog

• 6dc16f9 feat: add customisable button slots to service account views (#1707)
• 9f793c1 feat: scope and preselect PAT org role in create dialog (#1704)
• 2851160 fix(admin): surface API error message in toasts (#1653)
• adbb040 fix(billing): guard syncJob lifecycle with a dedicated mutex (#1706)
• 2834886 fix(permission): clean up leftover access in SpiceDB when a permission is deleted (#1685)
• ff78984 fix(prospect): classify RQL helper errors as InvalidArgument (#1692)
• 54e8269 fix(rql): emit groupBy columns as quoted identifiers (#1691)
• a2bd97a refactor(deleter): delegate org removal cascade to membership (#1696)
• 36ed818 refactor(serviceuser): list org service users via membership policies (#1694)

v0.106.1

What's Changed

• docs(authz): document disable vs delete semantics by @whoAbhishekSah in #1688
• fix(bootstrap): reconcile predefined roles instead of add-only migrate by @whoAbhishekSah in #1687
• chore: remove unused pkg/debounce by @whoAbhishekSah in #1690
• docs(web): add getting-started README for frontier/web by @paanSinghCoder in #1673
• fix(invitation): remove user relation on invitation delete by @whoAbhishekSah in #1678
• fix(role): reject deletion of a role still in use by policies by @whoAbhishekSah in #1683
• refactor(api): pass real errors in CodeInternal instead of generic sentinel by @rohilsurana in #1689
• chore: remove unsued assign-role component file by @rsbh in #1684

Full Changelog: v0.106.0...v0.106.1

v0.106.0

What's Changed

• fix(deleter): cascade PAT cleanup on user delete by @AmanGIT07 in #1672
• perf(admin): lazy-load route pages by @paanSinghCoder in #1666
• fix(docker): run containers as non-root user and update alpine to 3.21 by @rohilsurana in #1674
• chore: upgrade Go from 1.24.4 to 1.26.4 to fix 32 stdlib vulnerabilities by @rohilsurana in #1679
• fix(api): remove duplicate request_id and method from logger attrs by @rohilsurana in #1681
• fix(admin): invoice amount filter units, org URL error, search focus by @rohanchkrabrty in #1676
• fix(api): wrap billing org-lookup errors in proper connect codes by @rohilsurana in #1682
• fix(auth): require Bearer/Basic scheme and route exclusively by @AmanGIT07 in #1677
• fix(api): add error sanitizer interceptor and fix billing response codes by @rohilsurana in #1680

Full Changelog: v0.105.0...v0.106.0

v0.105.0

What's Changed

• fix(api): dedupe access_pairs and map invalid-id/unknown-perm to 4xx by @AmanGIT07 in #1657
• fix(group): resolve PAT to user before owner wiring on group create by @AmanGIT07 in #1658
• fix: IAM Design fixes by @rohanchkrabrty in #1663
• fix: admin organization issues and form validations by @rohanchkrabrty in #1664
• feat(membership): accept PAT principals; add SetPATAllProjectsRole by @AmanGIT07 in #1665
• fix: handle in/notin operators in token search filters by @rohilsurana in #1656
• fix: PAT expiry handling, date filters, and settings view borders by @rohanchkrabrty in #1671
• chore: remove legacy SDK views and fix admin issues by @rohanchkrabrty in #1675

Full Changelog: v0.104.1...v0.105.0

v0.104.2

Changelog

• c312696 refactor(organization): batch joinable orgs fetch, extract helper (#1652)