Changelog

Every release, newest first. The version you are running is shown at the bottom of the app's Settings page.

v0.7.3

07/24/2026
  • Auth0's auto-created global client ("All Applications" - it carries the tenant-wide classic login page config, it is not a real application) is now skipped in Terraform export with an honest reason, like Okta's system apps.

v0.7.2

07/24/2026
  • Auth0 types now use the DASHBOARD's names: Applications (was Clients), APIs (was Resource Servers).
  • New Auth0 type: Application Grants (the M2M application-to-API authorizations) - exported as auth0_client_grant with import blocks; the application reference rewrites to a Terraform expression when the application is in the same bundle. Click Refresh on an existing Auth0 tenant to pull them.

v0.7.1

07/24/2026
  • Auth0 connect fixed: the form now asks for the M2M application's Client ID and Client Secret (the adapter mints its own short-lived Management API tokens from them) instead of a single token field that never matched how Auth0 authenticates. Okta and Authentik keep the token field; the Base URL placeholder now follows the selected provider.

v0.7.0

07/24/2026
  • In-app documentation: seven topics (getting started, connecting a tenant, the refresh model, Terraform export, licensing, users/roles/MFA, deployment and backups) under the Docs button, with a topic sidebar. The same docs publish to tfsmith.com/docs.

v0.6.4

07/23/2026
  • Settings and Profile readability: sections are clearly separated with dividers and breathing room, and the panel is wider.

v0.6.3

07/23/2026
  • Connect now shows what it is doing: the button disables, a spinner appears, and a note explains the first pull can take a minute on a large tenant. Double-clicking Connect no longer creates the tenant twice.

v0.6.2

07/23/2026
  • Email addresses are now settable after account creation: your own in Profile, anyone's via Set email in Settings > Users. (First-run setup never asked for one, so reset links and expiry warnings had no address to go to.)

v0.6.1

07/23/2026
  • Tenants section in Settings: remove a tenant (typed-name confirm; deletes the stored export; never touches the provider). The backend route existed since 0.3.0 - the button did not.

v0.6.0

07/23/2026
  • Roles: admin and user. Users browse, export, and Refresh, and manage their own profile; admins get Settings, user management, license, and tenant add/remove. Role picker on create/invite, role change per user, and the last active administrator can never be demoted or disabled.
  • Email (SMTP) settings: your own mail server, password encrypted at rest, test-send button. TFsmith never sends anything anywhere else.
  • User invites: create an account by emailing a set-your-password link (expires in 72 hours).
  • Forgot password: reset links from the sign-in screen (2-hour links, no account enumeration). Admin reset in Settings still works without email.
  • License expiry warnings: admins with an email on file get a heads-up at 14/7/3/1 days before expiry; renewals reset the schedule.

v0.5.0

07/23/2026
  • Users and admin: create users (within the license cap - Individual is a single user, Business is unlimited), disable/enable, admin password reset. The last active account can never be disabled.
  • Profile for every user: change password, enroll TOTP MFA with an inline QR code (secret stored encrypted with the master key), disable with a current code. Login is MFA-aware.
  • Security settings: require-MFA toggle (unenrolled users are sent to Profile to enroll on next load) and session length (1-365 days).
  • Audit log viewer in Settings: who did what, when (viewer-local time).
  • Settings gear moved into the sidebar footer next to the theme toggle.

v0.4.0

07/23/2026
  • The refresh model: the provider is pulled automatically exactly once, when a tenant is added. After that only the Refresh button pulls - page loads never touch the provider API. The export is persisted to the data volume encrypted with the tenant's data key, so it survives restarts and every user of the install shares the last refresh (ten users cost the same API calls as one).
  • "Last refreshed Today, 7/23/2026, 9:41 PM" next to the Refresh button (viewer-local time; Yesterday and bare-date forms; an amber note past a week: "Over a week since the last refresh - the tenant may have changed.").
  • Tenants connected before this version show "No data pulled yet" - one Refresh click and they are current.

v0.3.0

07/23/2026
  • Phase 2: the product works end to end. Connect a tenant with a READ-ONLY admin API token (validated against the provider before storing; envelope encrypted at rest exactly like IdPVault). Browse resource types with live counts and type badges (OIDC/SAML/SWA...), click any object for its Terraform block + import block (Copy / Download .tf, with the full note set), or export a bundle zip (per-type .tf, provider.tf, variables.tf, import.tf, coverage README). Live provider fetch with a short in-memory cache; plaintext config never touches the database.
  • Daily license check-in (2:15 UTC) plus a boot refresh - renewals and added tenants now apply automatically, closing the Phase 1 gap.
  • Tenant cap enforced from the signed license payload (2 included, add more at tfsmith.com/manage).
  • Provider adapters lifted from IdPVault v1.3.0 (okta/auth0/authentik export paths + adaptive rate limiting).

v0.2.0

07/23/2026
  • Phase 1: first-run admin wizard, scrypt + DB-session sign-in, and the LICENSE GATE - no free tier; without a valid license only the License screen is reachable, with a purchase link to tfsmith.com, the install id, and an offline license file upload. TFSM activation keys activate against license.keltech.ai (only the key and install id are ever sent); offline entitlement files verify with zero network calls. Deactivate releases the license for another install. Headless bootstrap via TFSMITH_ADMIN_USER / TFSMITH_ADMIN_PASSWORD.

v0.1.0

07/23/2026
  • Phase 0 skeleton: FastAPI app boots against Postgres, owns its schema (settings, users, session_tokens, tenants, audit_log), serves /healthz.
  • Terraform engine, provider schemas, crypto, license verification, and activation client lifted from IdPVault v1.3.0 (TFSM key prefix, TFsmith User-Agent). Not yet wired to routes.
  • Docker image + entrypoint (first-boot key generation, PUID/PGID, drops root), CI (tests gate every build; :dev from dev, :latest from main).