mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-18 06:23:18 +00:00
Anso
32a7d53b2b
* feat: add RBAC viewer accounts, atomic deployments, and fleet-wide backups (Pro) Introduces three Pro-tier features: - RBAC: Multi-user system with admin/viewer roles, user management UI, automatic migration from single-admin credentials, viewer restrictions across the entire UI (read-only editor, hidden action buttons) - Atomic Deployments: Pre-deploy file backup to .sencho-backup/, automatic rollback on health probe failure, manual rollback button, health probes added to stack updates, webhook-triggered deploys use atomic rollback - Fleet-Wide Backups: Point-in-time snapshots of compose files across all nodes (local + remote), stored centrally in SQLite, per-stack restore with optional redeploy, graceful handling of offline nodes * fix(settings): use correct ProGate prop name in UsersSection * fix(settings): remove unused isPro prop from UsersSection * fix(auth): fetch user info after login and setup so isAdmin is set correctly * feat(pricing): revise pricing strategy and enforce variant-based seat limits Raise Personal Pro from $49/yr to $69/yr with 3 viewer seats (up from 1). Add $15/mo billing option for Team Pro. Mark lifetime pricing as a 90-day early-adopter offer. Store Lemon Squeezy variant_name on activation/validation and enforce seat limits server-side per variant. * feat(licensing): add Lemon Squeezy checkout, webhook, and billing portal integration Server-side checkout URL generation (POST /api/checkout) with admin email pre-fill and instance_id custom data. HMAC-SHA256 verified webhook endpoint (POST /api/webhooks/lemonsqueezy) handling order, subscription, and payment lifecycle events for automatic license activation. Customer billing portal link stored from webhook events and exposed via GET /api/billing/portal. In-app checkout buttons in Settings with manual license key fallback. * fix(licensing): exempt Lemon Squeezy webhook from auth middleware The catch-all auth middleware on /api/* was blocking the public webhook endpoint. Added /webhooks/lemonsqueezy to the exemption list alongside /auth/* and /webhooks/:id/trigger. * feat(pricing): update pricing to final live rates Personal Pro: $7.99/month, $69.99/year, $249 lifetime. Team Pro: $49.99/month, $499.99/year, $1,499 lifetime. Added personal_monthly checkout variant across backend, frontend, and website. * refactor(licensing): remove server-side checkout/webhook for self-hosted model Sencho is self-hosted — each user runs their own instance, so there is no central server to receive webhooks or hold the store API key. Replaced in-app checkout buttons with a "View Pricing" redirect to sencho.io and kept manual license key activation as the primary flow. - Delete LemonSqueezyService (checkout, webhook, HMAC verification) - Remove POST /api/checkout, GET /api/billing/portal, POST /api/webhooks/lemonsqueezy - Remove raw body parser and auth exemption for webhook route - Remove all LEMONSQUEEZY_* env vars from .env.example - Replace checkout buttons in SettingsModal with single "View Pricing" button - Simplify LicenseContext checkout to open sencho.io pricing page - Update licensing docs to reflect website-based purchase flow * chore: normalize em-dashes to hyphens across codebase (linter) * chore: remove accidentally tracked directories from index
64 lines
2.1 KiB
Markdown
64 lines
2.1 KiB
Markdown
# Manual Steps Required
|
|
|
|
These actions could not be performed automatically and need to be done manually in the GitHub UI.
|
|
|
|
## 1. Branch Protection Rules for `main`
|
|
|
|
Go to **Settings > Branches > Add branch ruleset** for `main`:
|
|
|
|
- [x] Require a pull request before merging
|
|
- Required approvals: 0 (solo dev - you merge your own PRs after CI passes)
|
|
- Dismiss stale reviews when new commits are pushed: ON
|
|
- [x] Require status checks to pass before merging
|
|
- Add these job names: `Backend (Build, Test, Lint)`, `Frontend (Build, Lint)`, `Docker Build & Scan`, `E2E Tests (Playwright)`
|
|
- [x] Require conversation resolution before merging
|
|
- [x] Do not allow bypassing the above settings (even you must go through PRs)
|
|
- [x] Do not allow deletions
|
|
- [ ] Require signed commits (optional - future improvement)
|
|
|
|
## 2. Repository Settings
|
|
|
|
Go to **Settings > General > Pull Requests**:
|
|
- [x] Check **"Automatically delete head branches"**
|
|
- [x] Set **squash merge** as default merge strategy
|
|
|
|
## 3. Security Settings
|
|
|
|
Go to **Settings > Code security and analysis**:
|
|
- [x] Enable **Dependabot alerts**
|
|
- [x] Enable **Dependabot security updates**
|
|
- [x] Enable **Secret scanning**
|
|
- [x] Enable **Secret scanning push protection**
|
|
- [x] Enable **Private vulnerability reporting**
|
|
|
|
## 4. Default Branch
|
|
|
|
Verify that `main` is set as the default branch:
|
|
- Go to **Settings > Branches > Default branch**
|
|
- Should already be `main`
|
|
|
|
## 5. Delete `develop` Branch (When Ready)
|
|
|
|
The `develop` branch has 1 unmerged commit (`37f751c docs: refresh screenshots`).
|
|
|
|
**Before deleting**, decide whether to:
|
|
- Cherry-pick that commit to main via a PR, OR
|
|
- Let it go (it's just a screenshot refresh)
|
|
|
|
Then delete via: **Branches page > delete `develop`**
|
|
|
|
Also clean up stale feature branches that have been merged:
|
|
- `chore/refresh-screenshots`
|
|
- `fix/editor-loading`
|
|
- `fix/release-please-config`
|
|
- `feat/automated-versioning`
|
|
- `fix/docker-publish-tag-trigger`
|
|
- `feat/arm64-docker-build`
|
|
- `chore/migrate-to-docs-json`
|
|
- `fix/sync-docs-rsync-excludes-git`
|
|
- `fix/ci-docs-jobs`, `fix/ci-docs-jobs-v2`
|
|
|
|
## 6. Delete This File
|
|
|
|
Once all manual steps are complete, delete `MANUAL_STEPS.md` from the repo.
|