The requirement list still opens only while the new-password field
is focused. After blur, unmet rules stay visible as field text, and
Save can be pressed to return focus to that field.
Empty inbound tokens were gated on the WebUI page hostname / client IP,
so a remote panel visit blocked clearing the token even when the
listener was 127.0.0.1. Trust the bind host as well: loopback listeners
are not reachable from outside, while 0.0.0.0 still requires a local
WebUI session.
WebUI access was a single shared password. This adds optional
Authenticator TOTP as a second factor, with one-time recovery codes
and SSH as the last-resort disable path.
Login stays two HTTP posts with no pending token: a correct password
and enabled 2FA without a second factor returns { needsTotp: true };
the client then resubmits { password, totp } or { password, recoveryCode }.
The TOTP secret is wrapped with a password-derived AES-256-GCM key.
Eight XXXX-XXXX recovery codes are stored as SHA-256 hashes and each
code is consumed once. Enabling or disabling 2FA invalidates other
sessions; disabling still requires password plus TOTP or a recovery
code. SNOWLUMA_DEV_MODE hides the feature.
The login page uses a dedicated second-factor screen (Interior OTP
cells for the 6-digit code; the same cell UI for recovery codes,
grouped as XXXX-XXXX). Settings expose enroll/confirm/disable and
one-time recovery-code display.
Fixes#351
Keep forward nodes out of ordinary message parameters and expose a node-only root builder for forward send and upload actions.
Lock nested forward content to one valid shape, clear stale form values when switching actions, and add regression coverage for the capability rules.
Keep background account discovery passive and distinguish an identified account from a ready session.
Update the process dialog and regression coverage so recovery waits for authoritative readiness before exposing the account as online.
Use safer defaults for newly created service endpoints and guide operators toward suitable access credentials without disrupting existing deployments.
Apply the same policy at the save boundary, retain deliberate local-only setups and external client compatibility, and add regression coverage for editing, recovery, and trusted access paths.
Use a local-only default while preserving saved operator choices and keeping broader network access available from the settings panel.
Treat enabled encrypted transport as a startup requirement and present a dismissible notice when remote browser access is not protected.
Bound unauthenticated sign-in requests and require active sessions for browser-served account images.
Keep live updates authenticated without exposing session material in request URLs, and apply conservative response protections without restricting existing WebUI assets.
Expose onboarding replay and page crash testing from a dedicated settings page.\n\nKeep replay actions isolated from persisted consent and password state.
Combine agreement consent and password setup into one ordered first-run flow.
Allow future steps to declare skip policy while honoring unattended deployment requirements.
Use consistent delayed placeholders across data-backed console surfaces.
Avoid flashing loading UI for fast local responses while keeping slower transitions stable.
Keep failures visible and prevent gated content from opening on incomplete checks.
Use consistent field labels, validation, and strength guidance in both password-change flows.
Show requirements only while the new-password field is active and surface validation failures clearly.
Keep confirmations in dialogs while showing clear progress and results for long-running actions.
Auto-close completed notices, preserve important outcomes across reloads, and avoid noise from routine edits.
Require explicit acknowledgement whenever operators enable TRACE and keep its active state visible until they restore normal logging.\n\nAdd an authenticated browser download for the complete retained logging snapshot, including runtime context and clear privacy guidance, while preserving the existing filtered-view export and memory-only TRACE boundary.\n\nCover the transition, snapshot, formatting, download, and client contracts with focused regression tests.
Expose the per-account login history backfill switch in General settings and keep missing or legacy configuration disabled by default.
Document that changes apply on the next login, historical messages are stored locally without event replay or read-state changes, and fixed safety limits govern roster scanning, selected sessions, page size, request spacing, and retries.
Add WebUI normalization coverage so the optional setting survives save and restore without silently inheriting an enabled value. Refs #280.
Enforce a global log quota with configurable retention and observable degradation. Add authenticated storage reporting and safe cleanup controls to the settings UI. Protect active stream transfers and isolate parallel test resources.
Keep per-widget configuration when persisted overview layouts are migrated against the current widget catalogue. Account shortcuts, notes, links, filters, and other configurable widgets now retain their saved values after a page reload.
Add a WebUI Vitest entry point and regression coverage for restoring an account widget with saved configuration.
Fixes#243.
DrSmoothl