v0.4.2-alpha

v0.4.2-alpha

Warning

Alpha build — not production ready. APIs and configuration may change without notice.
Do not use in production until a stable release is announced.

Features

• Secure cookies — The ovlt_session cookie now includes the Secure flag automatically when ENVIRONMENT=production, restricting it to HTTPS-only transport. In development the flag is omitted so http://localhost keeps working without any change to the workflow.

• Configurable connection pool — Two new env vars control the PostgreSQL pool size: DATABASE_MAX_CONNECTIONS (default 20) and DATABASE_MIN_CONNECTIONS (default 2). Pool options now also explicitly set connect timeout (10s), acquire timeout (10s), idle timeout (10min), and max lifetime (30min).

• Dev mode — Set OVLT_DEV_MODE=1 to skip manual bootstrap configuration during local development. The server auto-generates OVLT_ADMIN_KEY and pre-fills bootstrap_admin_email / bootstrap_admin_password with safe defaults so the first cargo run just works. Dev mode is blocked if ENVIRONMENT=production — the server exits with an explicit error to prevent accidental exposure.

• First-run credentials box — On the very first startup in development, the server now prints a styled summary to stderr with the generated tenant slug, tenant ID, admin email, password, and admin key, plus a ready-to-run curl command to test the login endpoint immediately.

Security

• Parameterized SQL in tenant transactions — begin_tenant_txn now uses Statement::from_sql_and_values with a bound parameter for the set_config('app.tenant_id', $1, true) call instead of string interpolation, eliminating any SQL injection surface on tenant ID resolution.

Documentation

• configuration.md updated with entries for DATABASE_MAX_CONNECTIONS, DATABASE_MIN_CONNECTIONS, and OVLT_DEV_MODE.
• getting-started.md updated to reflect the dev mode workflow and the first-run credential output.
• api-reference.md minor corrections.

Full Changelog: v0.4.1-alpha...v0.4.2-alpha