Skip to content

Commit 35fa517

Browse files
cedricalfonsicedricalfonsi
committed
Merge branch 'feature/PB-47506_52-Publish-production-API' into 'master'
PB-47506 Publish production API (v5.8.0) See merge request passbolt/passbolt-ce-api!488
2 parents b38de85 + caa970b commit 35fa517

File tree

175 files changed

+10756
-4642
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

175 files changed

+10756
-4642
lines changed

‎CHANGELOG.md‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,106 @@
22
All notable changes to this project will be documented in this file.
33
This project adheres to [Semantic Versioning](http://semver.org/).
44

5+
## [5.8.0] - 2025-12-22
6+
### Added
7+
- PB-46972 As an administrator I can create a new custom role
8+
- PB-46973 As an administrator I can update a custom role
9+
- PB-46968 As an administrator I can soft delete custom roles
10+
- PB-46971 As an administrator I can list roles including deleted ones via filter
11+
- PB-47169 As a user I receive an email notification when my role is changed
12+
- PB-47345 As an administrator I receive an email notification when a role is created or updated
13+
- PB-46975 As an administrator I can list RBACs including Actions
14+
- PB-46976 As an administrator I can update RBACs for Actions
15+
- PB-47006 As a logged-in user my role is fetched on every request to reflect role changes immediately
16+
- PB-47083 As a user with appropriate RBAC permissions I can create groups
17+
- PB-47196 As an administrator I can run the healthcheck command in POSIX mode
18+
- PB-47274 As an administrator I can run a command to populate created_by and modified_by fields in secrets
19+
- PB-47275 As an administrator I can run a command to populate secret revisions for existing secrets
20+
21+
### Fixed
22+
- PB-46374 As first admin I should not receive emails regarding encrypted metadata enablement during the first setup
23+
- PB-46613 Fix web installer not working in HTTP when not in secure context
24+
- PB-46640 Fix warnings in mfa_user_settings_reset_self.php email template
25+
- PB-46645 Optimize action logs purge command dry run query
26+
- PB-46913 Fix MfaUserSettingsDisableCommand to support case sensitive username comparison
27+
- PB-46935 Fix 500 error on /metadata/session-keys/{uuid}.json endpoint when the request is sent twice
28+
- PB-47236 Reduce the PHP memory load of the V570PopulateSecretRevisionsForExistingSecrets migration
29+
30+
### Security
31+
- PB-46890 Upgrade js-yaml dependency (Medium severity)
32+
33+
### Maintenance
34+
- PB-45979 Add CACHE_CAKETRANSLATIONS_CLASSNAME environment variable for _cake_translations_ cache config
35+
- PB-46388 Fix PHPUnit 11 deprecations
36+
37+
## [5.8.0-test.3] - 2025-12-17
38+
### Fixed
39+
- PB-47625 As an administrator I cannot recreate a role deleted previously
40+
41+
## [5.8.0-test.2] - 2025-12-12
42+
### Added
43+
- PB-46972 As an administrator I can create a new custom role
44+
- PB-46973 As an administrator I can update a custom role
45+
- PB-46968 As an administrator I can soft delete custom roles
46+
- PB-46971 As an administrator I can list roles including deleted ones via filter
47+
- PB-47169 As a user I receive an email notification when my role is changed
48+
- PB-47345 As an administrator I receive an email notification when a role is created or updated
49+
- PB-46975 As an administrator I can list RBACs including Actions
50+
- PB-46976 As an administrator I can update RBACs for Actions
51+
- PB-47006 As a logged-in user my role is fetched on every request to reflect role changes immediately
52+
- PB-47083 As a user with appropriate RBAC permissions I can create groups
53+
- PB-47196 As an administrator I can run the healthcheck command in POSIX mode
54+
- PB-47274 As an administrator I can run a command to populate created_by and modified_by fields in secrets
55+
- PB-47275 As an administrator I can run a command to populate secret revisions for existing secrets
56+
57+
### Fixed
58+
- PB-46374 As first admin I should not receive emails regarding encrypted metadata enablement during the first setup
59+
- PB-46613 Fix web installer not working in HTTP when not in secure context
60+
- PB-46640 Fix warnings in mfa_user_settings_reset_self.php email template
61+
- PB-46645 Optimize action logs purge command dry run query
62+
- PB-46913 Fix MfaUserSettingsDisableCommand to support case sensitive username comparison
63+
- PB-46935 Fix 500 error on /metadata/session-keys/{uuid}.json endpoint when the request is sent twice
64+
- PB-47236 Reduce the PHP memory load of the V570PopulateSecretRevisionsForExistingSecrets migration
65+
66+
### Security
67+
- PB-46890 Upgrade js-yaml dependency (Medium severity)
68+
69+
### Maintenance
70+
- PB-45979 Add CACHE_CAKETRANSLATIONS_CLASSNAME environment variable for _cake_translations_ cache config
71+
- PB-46388 Fix PHPUnit 11 deprecations
72+
73+
## [5.8.0-test.1] - 2025-12-11
74+
### Added
75+
- PB-46972 As an administrator I can create a new custom role
76+
- PB-46973 As an administrator I can update a custom role
77+
- PB-46968 As an administrator I can soft delete custom roles
78+
- PB-46971 As an administrator I can list roles including deleted ones via filter
79+
- PB-47169 As a user I receive an email notification when my role is changed
80+
- PB-47345 As an administrator I receive an email notification when a role is created or updated
81+
- PB-46975 As an administrator I can list RBACs including Actions
82+
- PB-46976 As an administrator I can update RBACs for Actions
83+
- PB-47006 As a logged-in user my role is fetched on every request to reflect role changes immediately
84+
- PB-47083 As a user with appropriate RBAC permissions I can create groups
85+
- PB-47196 As an administrator I can run the healthcheck command in POSIX mode
86+
- PB-47274 As an administrator I can run a command to populate created_by and modified_by fields in secrets
87+
- PB-47275 As an administrator I can run a command to populate secret revisions for existing secrets
88+
89+
### Fixed
90+
- PB-46374 As first admin I should not receive emails regarding encrypted metadata enablement during the first setup
91+
- PB-46613 Fix web installer not working in HTTP when not in secure context
92+
- PB-46640 Fix warnings in mfa_user_settings_reset_self.php email template
93+
- PB-46645 Optimize action logs purge command dry run query
94+
- PB-46913 Fix MfaUserSettingsDisableCommand to support case sensitive username comparison
95+
- PB-46935 Fix 500 error on /metadata/session-keys/{uuid}.json endpoint when the request is sent twice
96+
- PB-47236 Reduce the PHP memory load of the V570PopulateSecretRevisionsForExistingSecrets migration
97+
98+
### Security
99+
- PB-46890 Upgrade js-yaml dependency (Medium severity)
100+
101+
### Maintenance
102+
- PB-45979 Add CACHE_CAKETRANSLATIONS_CLASSNAME environment variable for _cake_translations_ cache config
103+
- PB-46388 Fix PHPUnit 11 deprecations
104+
5105
## [5.7.2] - 2025-11-17
6106
### Fixed
7107
- PB-46826 As an administrator running the cleanup task, the server metadata private key entry should not be deleted

‎RELEASE_NOTES.md‎

Lines changed: 58 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,62 @@
1-
Release song: https://youtu.be/t12nOxmB278
1+
Release song: https://www.youtube.com/watch?v=F5uXomY94w8
22

3-
Passbolt 5.7.2 fixes an issue introduced in v5.7.0 that affected the health check when it was run after the cleanup command.
4-
The bug caused the server metadata private key to be incorrectly deleted, resulting in health check failures.
5-
This has now been resolved, and the cleanup process works as expected.
3+
Passbolt 5.8.0 introduces dynamic role management, allowing organizations to define additional roles that better align with internal policies, compliance requirements, and operational needs. This release also adds drag & drop user assignment to groups, simplifying day-to-day user and group management.
64

7-
We thank the community again for reporting this issue!
5+
**Warning**: Ensure that all users have updated their browser extension to at least version 5.8 before assigning new roles. Otherwise, they will not be able to connect to Passbolt.
6+
7+
## Dynamic role management
8+
9+
As was already the case with the default User role, Passbolt allows administrators to restrict what users can do by limiting access to specific capabilities. With version 5.8, this model is extended beyond the default Admin and User roles, making it possible to create additional roles and assign them to users for more granular control.
10+
11+
Dynamic roles also enable the delegation of administrative responsibilities. Rather than granting full administrative access, administrators can now assign selected capabilities to custom roles and distribute operational tasks across multiple users. Initial support covers group creation, as well as handling account recovery requests in Passbolt Pro.
12+
13+
At this stage, dynamic role management comes with a defined scope and set of constraints.
14+
15+
- The default Admin and User roles keep fixed names and cannot be renamed or deleted.
16+
- As before, the User role can be restricted, but it cannot be assigned delegated administrative responsibilities.
17+
- The Admin role, by contrast, always retains access to all capabilities and cannot be restricted.
18+
- Custom roles are currently limited to two per instance and support a first set of administrative capabilities.
19+
20+
This scope will be expanded progressively as additional needs and use cases are identified by the community.
21+
22+
## Drag & drop users to groups
23+
24+
Managing group membership often requires repetitive actions when working with large teams or frequently changing group structures. With Passbolt 5.8, administrators can now add users to a group by dragging them directly onto it from the Users & Groups workspace. This removes the need to open and edit each group individually and makes day-to-day group management faster and more fluid.
25+
26+
## Miscellaneous improvements
27+
28+
As usual, this release includes fixes and smaller improvements intended to improve the overall experience. For the full list of changes, please refer to the changelog.
29+
30+
Many thanks to everyone who provided feedback and helped refine these features.
31+
32+
## [5.8.0] - 2025-12-22
33+
### Added
34+
- PB-46972 As an administrator I can create a new custom role
35+
- PB-46973 As an administrator I can update a custom role
36+
- PB-46968 As an administrator I can soft delete custom roles
37+
- PB-46971 As an administrator I can list roles including deleted ones via filter
38+
- PB-47169 As a user I receive an email notification when my role is changed
39+
- PB-47345 As an administrator I receive an email notification when a role is created or updated
40+
- PB-46975 As an administrator I can list RBACs including Actions
41+
- PB-46976 As an administrator I can update RBACs for Actions
42+
- PB-47006 As a logged-in user my role is fetched on every request to reflect role changes immediately
43+
- PB-47083 As a user with appropriate RBAC permissions I can create groups
44+
- PB-47196 As an administrator I can run the healthcheck command in POSIX mode
45+
- PB-47274 As an administrator I can run a command to populate created_by and modified_by fields in secrets
46+
- PB-47275 As an administrator I can run a command to populate secret revisions for existing secrets
847

9-
## [5.7.2] - 2025-11-17
1048
### Fixed
11-
- PB-46826 As an administrator running the cleanup task, the server metadata private key entry should not be deleted
49+
- PB-46374 As first admin I should not receive emails regarding encrypted metadata enablement during the first setup
50+
- PB-46613 Fix web installer not working in HTTP when not in secure context
51+
- PB-46640 Fix warnings in mfa_user_settings_reset_self.php email template
52+
- PB-46645 Optimize action logs purge command dry run query
53+
- PB-46913 Fix MfaUserSettingsDisableCommand to support case sensitive username comparison
54+
- PB-46935 Fix 500 error on /metadata/session-keys/{uuid}.json endpoint when the request is sent twice
55+
- PB-47236 Reduce the PHP memory load of the V570PopulateSecretRevisionsForExistingSecrets migration
56+
57+
### Security
58+
- PB-46890 Upgrade js-yaml dependency (Medium severity)
59+
60+
### Maintenance
61+
- PB-45979 Add CACHE_CAKETRANSLATIONS_CLASSNAME environment variable for _cake_translations_ cache config
62+
- PB-46388 Fix PHPUnit 11 deprecations

‎config/Migrations/20251127112629_V580AddDeletedToRoles.php‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
<?php
2+
declare(strict_types=1);
3+
/**
4+
* Passbolt ~ Open source password manager for teams
5+
* Copyright (c) Passbolt SA (https://www.passbolt.com)
6+
*
7+
* Licensed under GNU Affero General Public License version 3 of the or any later version.
8+
* For full copyright and license information, please see the LICENSE.txt
9+
* Redistributions of files must retain the above copyright notice.
10+
*
11+
* @copyright Copyright (c) Passbolt SA (https://www.passbolt.com)
12+
* @license https://opensource.org/licenses/AGPL-3.0 AGPL License
13+
* @link https://www.passbolt.com Passbolt(tm)
14+
* @since 5.8.0
15+
*/
16+
17+
use Migrations\AbstractMigration;
18+
19+
class V580AddDeletedToRoles extends AbstractMigration
20+
{
21+
/**
22+
* Change Method.
23+
*
24+
* More information on this method is available here:
25+
* https://book.cakephp.org/migrations/4/en/migrations.html#the-change-method
26+
*
27+
* @return void
28+
*/
29+
public function change(): void
30+
{
31+
$this
32+
->table('roles')
33+
->addColumn('deleted', 'datetime', [
34+
'default' => null,
35+
'limit' => null,
36+
'null' => true,
37+
'after' => 'description',
38+
])
39+
->save();
40+
}
41+
}

‎config/Migrations/20251127142638_V580InsertRbacsControlledActions.php‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
<?php
2+
declare(strict_types=1);
3+
/**
4+
* Passbolt ~ Open source password manager for teams
5+
* Copyright (c) Passbolt SA (https://www.passbolt.com)
6+
*
7+
* Licensed under GNU Affero General Public License version 3 of the or any later version.
8+
* For full copyright and license information, please see the LICENSE.txt
9+
* Redistributions of files must retain the above copyright notice.
10+
*
11+
* @copyright Copyright (c) Passbolt SA (https://www.passbolt.com)
12+
* @license https://opensource.org/licenses/AGPL-3.0 AGPL License
13+
* @link https://www.passbolt.com Passbolt(tm)
14+
* @since 5.8.0
15+
*/
16+
17+
use Cake\Log\Log;
18+
use Migrations\AbstractMigration;
19+
use Passbolt\Rbacs\Service\Actions\RbacsControlledActionsInsertService;
20+
21+
class V580InsertRbacsControlledActions extends AbstractMigration
22+
{
23+
/**
24+
* Change Method.
25+
*
26+
* More information on this method is available here:
27+
* https://book.cakephp.org/migrations/4/en/migrations.html#the-change-method
28+
*
29+
* @return void
30+
*/
31+
public function change(): void
32+
{
33+
try {
34+
(new RbacsControlledActionsInsertService())->insertRbacsControlledActions();
35+
} catch (Throwable $e) {
36+
$msg = 'There was an error in V580InsertRbacsControlledActions.';
37+
$msg .= ' ' . $e->getMessage();
38+
Log::error($msg);
39+
}
40+
}
41+
}

‎config/Migrations/20251128071117_V580AddByFieldsToRoles.php‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
<?php
2+
declare(strict_types=1);
3+
/**
4+
* Passbolt ~ Open source password manager for teams
5+
* Copyright (c) Passbolt SA (https://www.passbolt.com)
6+
*
7+
* Licensed under GNU Affero General Public License version 3 of the or any later version.
8+
* For full copyright and license information, please see the LICENSE.txt
9+
* Redistributions of files must retain the above copyright notice.
10+
*
11+
* @copyright Copyright (c) Passbolt SA (https://www.passbolt.com)
12+
* @license https://opensource.org/licenses/AGPL-3.0 AGPL License
13+
* @link https://www.passbolt.com Passbolt(tm)
14+
* @since 5.8.0
15+
*/
16+
17+
use Migrations\AbstractMigration;
18+
19+
class V580AddByFieldsToRoles extends AbstractMigration
20+
{
21+
/**
22+
* Change Method.
23+
*
24+
* More information on this method is available here:
25+
* https://book.cakephp.org/migrations/4/en/migrations.html#the-change-method
26+
*
27+
* @return void
28+
*/
29+
public function change(): void
30+
{
31+
$this
32+
->table('roles')
33+
->addColumn('created_by', 'uuid', [
34+
'default' => null,
35+
'null' => true,
36+
'encoding' => 'ascii',
37+
'collation' => 'ascii_general_ci', // required for FK, needs to be same as reference table (i.e. users)
38+
'after' => 'deleted',
39+
])
40+
->addColumn('modified_by', 'uuid', [
41+
'default' => null,
42+
'null' => true,
43+
'encoding' => 'ascii',
44+
'collation' => 'ascii_general_ci', // required for FK, needs to be same as reference table (i.e. users)
45+
'after' => 'created_by',
46+
])
47+
->addColumn('deleted_by', 'uuid', [
48+
'default' => null,
49+
'null' => true,
50+
'encoding' => 'ascii',
51+
'collation' => 'ascii_general_ci', // required for FK, needs to be same as reference table (i.e. users)
52+
'after' => 'modified_by',
53+
])
54+
->save();
55+
}
56+
}

‎config/Migrations/20251203112523_V580InsertRbacsForActions.php‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
<?php
2+
declare(strict_types=1);
3+
/**
4+
* Passbolt ~ Open source password manager for teams
5+
* Copyright (c) Passbolt SA (https://www.passbolt.com)
6+
*
7+
* Licensed under GNU Affero General Public License version 3 of the or any later version.
8+
* For full copyright and license information, please see the LICENSE.txt
9+
* Redistributions of files must retain the above copyright notice.
10+
*
11+
* @copyright Copyright (c) Passbolt SA (https://www.passbolt.com)
12+
* @license https://opensource.org/licenses/AGPL-3.0 AGPL License
13+
* @link https://www.passbolt.com Passbolt(tm)
14+
* @since 5.8.0
15+
*/
16+
17+
use Cake\Log\Log;
18+
use Migrations\AbstractMigration;
19+
use Passbolt\Rbacs\Service\Actions\RbacsControlledActionsInsertService;
20+
use Passbolt\Rbacs\Service\Rbacs\InsertRbacsForActionsService;
21+
22+
class V580InsertRbacsForActions extends AbstractMigration
23+
{
24+
/**
25+
* Change Method.
26+
*
27+
* More information on this method is available here:
28+
* https://book.cakephp.org/migrations/4/en/migrations.html#the-change-method
29+
*
30+
* @return void
31+
*/
32+
public function change(): void
33+
{
34+
try {
35+
(new InsertRbacsForActionsService())->add([
36+
// actions to add
37+
RbacsControlledActionsInsertService::NAME_GROUPS_ADD,
38+
RbacsControlledActionsInsertService::NAME_ACCOUNT_RECOVERY_REQUESTS_INDEX,
39+
RbacsControlledActionsInsertService::NAME_ACCOUNT_RECOVERY_REQUESTS_VIEW,
40+
RbacsControlledActionsInsertService::NAME_ACCOUNT_RECOVERY_RESPONSES_CREATE,
41+
]);
42+
} catch (Throwable $e) {
43+
$msg = 'There was an error in V580InsertRbacsForActions.';
44+
$msg .= ' ' . $e->getMessage();
45+
Log::error($msg);
46+
}
47+
}
48+
}

0 commit comments

Comments
 (0)