From 99d6572a3d2e50958c88f7692281bbb9ed5330d6 Mon Sep 17 00:00:00 2001 From: Adrian Bonpin Date: Thu, 28 May 2026 00:18:20 +0800 Subject: [PATCH] chore: bump version to 2026.2.2, add changelog and update news (Task 7) --- CHANGELOG.md | 15 ++++++++ content/updates/2026-05-27-v2026.2.2.md | 20 ++++++++++ lib/__tests__/version-bump.test.ts | 49 +++++++++++++++++++++++++ lib/api/__tests__/openapi-fixes.test.ts | 2 +- lib/api/app.ts | 4 +- package.json | 2 +- 6 files changed, 88 insertions(+), 4 deletions(-) create mode 100644 content/updates/2026-05-27-v2026.2.2.md create mode 100644 lib/__tests__/version-bump.test.ts diff --git a/CHANGELOG.md b/CHANGELOG.md index df6bf07..af0be63 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,21 @@ All notable changes to DeckyVault will be documented in this file. +## [2026.2.2] - 2026-05-27 + +### Added +- **Sign-up domain restriction for deckyvault.xyz:** new account creation with `@deckyvault.xyz` email addresses is now blocked in production. This prevents unauthorized use of the brand domain. The restriction is lifted in development builds. +- **Branded email placeholder:** all auth forms (sign-up, login, forgot password) on web and mobile now use `you@deckyvault.xyz` as the default placeholder instead of the generic `you@example.com` + +### Changed +- Server-side domain enforcement ensures the `@deckyvault.xyz` block cannot be bypassed by direct API calls or social login flows +- Existing `@deckyvault.xyz` account holders can still log in, use password reset, and receive OTPs + +### Technical +- Added `lib/auth/domain-block.ts` shared domain validation helper +- Added Elysia middleware in `lib/api/app.ts` for server-side sign-up domain enforcement +- Added Zod `.refine()` on `signupSchema` for client-side domain validation + ## [2026.2.1] - 2026-05-25 ### Fixed diff --git a/content/updates/2026-05-27-v2026.2.2.md b/content/updates/2026-05-27-v2026.2.2.md new file mode 100644 index 0000000..3633161 --- /dev/null +++ b/content/updates/2026-05-27-v2026.2.2.md @@ -0,0 +1,20 @@ +--- +title: "Domain Restriction & Branded Placeholder — Sign-Up Protection" +date: "2026-05-27" +version: "2026.2.2" +summary: "Blocked sign-ups using @deckyvault.xyz email addresses in production and updated all auth form email placeholders to use the DeckyVault domain." +--- + +### Domain Protection for Sign-Ups + +New accounts can no longer be created with `@deckyvault.xyz` email addresses in production. This prevents unauthorized use of the DeckyVault brand domain — the domain owner is the only one who should be creating accounts with those addresses. + +The restriction applies to all sign-up methods: email/password, one-time code (OTP), and social login via Google or Discord. + +**What's NOT affected:** +- Existing `@deckyvault.xyz` accounts continue to work normally — login, password reset, and OTP sign-in are all functional +- Development builds still allow `@deckyvault.xyz` sign-ups for testing + +### Branded Placeholder Text + +All email input fields across web and mobile now show `you@deckyvault.xyz` as the default placeholder, replacing the generic `you@example.com`. This appears in the sign-up, login, and forgot password forms. \ No newline at end of file diff --git a/lib/__tests__/version-bump.test.ts b/lib/__tests__/version-bump.test.ts new file mode 100644 index 0000000..9a5c913 --- /dev/null +++ b/lib/__tests__/version-bump.test.ts @@ -0,0 +1,49 @@ +import { describe, it, expect } from "vitest" +import fs from "node:fs" +import path from "node:path" + +describe("version bump to 2026.2.2", () => { + const cwd = process.cwd() + + it("package.json version is 2026.2.2", () => { + const pkg = JSON.parse( + fs.readFileSync(path.join(cwd, "package.json"), "utf8"), + ) + expect(pkg.version).toBe("2026.2.2") + }) + + it("OpenAPI spec version is 2026.2.2", () => { + const apiContent = fs.readFileSync( + path.join(cwd, "lib", "api", "app.ts"), + "utf8", + ) + expect(apiContent).toContain('version: "2026.2.2"') + }) + + it("CHANGELOG.md contains [2026.2.2] entry", () => { + const changelog = fs.readFileSync( + path.join(cwd, "CHANGELOG.md"), + "utf8", + ) + expect(changelog).toContain("## [2026.2.2]") + expect(changelog).toContain("### Added") + expect(changelog).toContain("@deckyvault.xyz") + }) + + it("content/updates/2026-05-27-v2026.2.2.md exists with valid frontmatter", () => { + const updatePath = path.join( + cwd, + "content", + "updates", + "2026-05-27-v2026.2.2.md", + ) + expect(fs.existsSync(updatePath)).toBe(true) + + const content = fs.readFileSync(updatePath, "utf8") + expect(content.startsWith("---")).toBe(true) + expect(content).toContain('title:') + expect(content).toContain('date: "2026-05-27"') + expect(content).toContain('version: "2026.2.2"') + expect(content).toContain('summary:') + }) +}) \ No newline at end of file diff --git a/lib/api/__tests__/openapi-fixes.test.ts b/lib/api/__tests__/openapi-fixes.test.ts index b4f3862..0aa6d93 100644 --- a/lib/api/__tests__/openapi-fixes.test.ts +++ b/lib/api/__tests__/openapi-fixes.test.ts @@ -4,7 +4,7 @@ describe("API version", () => { it("matches package.json version", () => { const pkg = require("../../../package.json") const expectedVersion = pkg.version - expect(expectedVersion).toBe("2026.2.1") + expect(expectedVersion).toBe("2026.2.2") }) }) diff --git a/lib/api/app.ts b/lib/api/app.ts index b607529..ead20c5 100644 --- a/lib/api/app.ts +++ b/lib/api/app.ts @@ -79,7 +79,7 @@ export const app = new Elysia({ prefix: "/api" }) documentation: { info: { title: "DeckyVault API", - version: "2026.2.1", + version: "2026.2.2", description: "API for DeckyVault — Steam Deck game compatibility, performance reports, and community features.", }, @@ -275,7 +275,7 @@ export const app = new Elysia({ prefix: "/api" }) .use(rateLimit("default")) .get("/", () => ({ name: "DeckyVault API", - version: "2026.2.1", + version: "2026.2.2", })) export type App = typeof app diff --git a/package.json b/package.json index ab6d513..8ded1e8 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "deckyvault", - "version": "2026.2.1", + "version": "2026.2.2", "private": true, "scripts": { "dev": "next dev --experimental-https --webpack",