Releases: madjeek-web/eventflow
Releases · madjeek-web/eventflow
EventFlow v1.0.0 - Initial release
Changelog
All notable changes to EventFlow are documented in this file.
The format follows Keep a Changelog. This project adheres to Semantic Versioning.
[1.0.0] - 2026-02-01
Added
- Full event management platform : listing, detail, creation, deletion
- User authentication with bcrypt password hashing (cost factor 12)
- JWT session tokens stored in HTTP-only, Secure, SameSite=Strict cookies
- Next.js Middleware for server-side route protection before rendering
- Zod validation schemas on all API route request bodies
- Rate limiting on the login endpoint (10 attempts per 15-minute window per IP)
- Password hashing migration script (
scripts/hash-passwords.js) - Logout endpoint (
POST /api/logout) that clears the session cookie server-side - React Context and custom hook architecture for all data domains
useEventsFilteredhook with memoized category, keyword, and date filtersuseEvent(id)hook with memoized single-event lookup- shadcn/ui component library integration (Button, Card, Badge, Input, Select, Switch, etc.)
- Auto-generated JSDoc API documentation (
npm run docs) - GitHub Actions CI workflow (lint and build checks on every push and pull request)
- GitHub Issue templates (bug report, feature request)
- GitHub Pull Request template
SECURITY.mdwith responsible disclosure processCONTRIBUTING.mdwith branching, code style, and commit conventionsCODE_OF_CONDUCT.mddocs/architecture.mdwith design decisions and database migration guidedocs/api.mdwith full REST endpoint reference.env.exampledocumenting all environment variablesLICENSE(MIT)
Security
- Passwords are hashed with bcrypt before being written to the data store
- Passwords are never returned in any API response
- JWT tokens are server-side only (HTTP-only cookie, inaccessible to JavaScript)
- All protected routes are guarded in middleware before the route handler runs
- API error responses do not expose internal file paths or stack traces
- Login is rate-limited per IP address