ARKIV-V

v2.3.0

Added

• Redis Streams migration — album creation notifications now use XADD instead of PUBLISH for reliable delivery
• LazyRedis connection resilience with socket timeouts, exponential backoff retry, and health checks

v2.2.1

Fixed

• Added /healthz endpoint for Kubernetes probes (prevents rate limit 429 errors)

v2.2.0

Added

• Photo comments — flat text comments visible in lightbox with real-time updates
• Comment count badges on album grid (hidden when zero, live-updated)
• Comment input with character counter and Ctrl+Enter submit
• Comment deletion (own comments or admin) with audit logging
• Rate limiting on comment endpoints (60/min list, 20/min create, 10/min delete)
• Input sanitization for comments (null bytes, control characters, length validation)

Changed

• Upload button enlarged from small to default size on album page

Fixed

• Added error handling with rollback on comment database operations

v2.1.4

Added

• Rate limiting on like, unlike, delete, and auth endpoints (Flask-Limiter with Redis storage)
• ProxyFix middleware for correct client IP behind reverse proxy
• Custom 429 error page with JSON support for API endpoints

Changed

• Likers list in lightbox updates immediately on like/unlike without page refresh
• Moved photo liker queries to db_helpers module, eliminating cross-blueprint import risk
• Extracted shared renderLikersList function to reduce JS code duplication
• Removed user_id from likers API response (data minimization)

Fixed

• Unlike error response now includes success field for consistent API contract

v2.1.3

Fixed

• Likers list in lightbox now updates immediately on like/unlike without page refresh

v2.1.2

Fixed

• Fixed missing album card and hero images caused by wrapper divs removing CSS grid auto-blockification of anchor elements

v2.1.1

Fixed

• Fixed bento grid layout on frontpage broken by card wrapper divs

v2.1.0

Security

• Replaced pickle with JSON session serialization (RCE mitigation)
• Removed SVG from allowed uploads (stored XSS mitigation)
• Hardened session cookies with SameSite=Lax and Secure flag
• Restricted logout to POST only (CSRF mitigation)
• Session ID regenerated after OAuth login (session fixation mitigation)
• Added upload file size limit (500 MB)

Added

• Test suite with 76 tests and CI quality gate (ruff + pytest)
• Error pages (404, 500) with custom templates
• Keyboard accessibility for photo grid (Enter/Space to open lightbox)
• Skip-to-content link and ARIA labels throughout

Changed

• Refactored monolithic app.py (1,709 lines) into 5 blueprints with app factory pattern
• Extracted ~700 lines of inline JavaScript into 5 external modules
• Extracted inline styles into CSS component classes
• Added foreign key constraints on user_id columns with SET NULL/CASCADE behavior
• Dropped redundant likes photo_id index

Fixed

• Fixed N+1 query on tags page with single GROUP BY
• Fixed like/unlike race condition with IntegrityError handling
• Fixed is_valid_image accepting AVI files as valid images (RIFF/WebP false positive)
• Fixed OAuth callback crash when user denies authorization
• Added error handling to unlike_photo endpoint

Improved

• Probabilistic session cleanup (1% of requests) instead of every request
• Deduplicated thumbnail query into db_helpers module
• MinIO presigned URLs for image serving instead of hardcoded internal endpoint

v2.0.19

Fixed

• Navigation links now properly centered when logged in

v2.0.18

Fixed

• Added top margin to tags page header
• Navigation buttons now stay right-aligned on login screen

v2.0.17

Fixed

• Navigation links no longer visible when not logged in

v2.0.16

Fixed

• Increased spacing between Tags page heading and table

Improved

• Rebranded app to ARKIV-V
• Login page subtitle now reads "Sekretessbelagt material. Verifiera din identitet."

v2.0.15

Fixed

• Restored tag management page styling broken by album grid redesign

Improved

• Renamed archive CSS classes to tag-table for clarity

v2.0.14

Fixed

• New album button now works correctly (was broken by script loading order)

Improved

• Album list redesigned as a visual card grid with prominent cover images
• Album cards show cover image, name, tag, and date with text overlay
• Responsive layout: 4 columns on desktop, fluid down to 1 on mobile
• Admin delete button on album cards (appears on hover)

v2.0.13

Improved

• Removed table headings from album list for a cleaner look

v2.0.12

Fixed

• Tag dropdown search filtering now correctly hides non-matching tags

v2.0.11

Fixed

• Tag dropdown search filtering now works correctly
• Page layout no longer collapses when filtering by tag with few results
• Page content now properly fills available width (was shrink-wrapped by flex layout)

Improved

• Page content width increased from 1200px to 1400px

v2.0.10

Improved

• Tag filter redesigned as a searchable dropdown with keyboard navigation
• Section heading now shows the active tag name when filtering
• Hero CTA updated from 'View operation' to 'View album'
• Tags sorted newest-first instead of alphabetically

Fixed

• Tag color values now validated server-side

v2.0.9

Improved

• Escape key now closes search modal when input is focused

v2.0.8

Improved

• Search results now scroll to follow keyboard navigation

v2.0.7

Improved

• Centered navigation links in top bar
• Album thumbnails now shown in search results
• Right-aligned tags in archive list

v2.0.6

Improved

• Tags management page now sorted by newest first
• Footer now sticks to bottom of viewport on short pages

Fixed

• Fixed section heading spacing above archive list

v2.0.5

Fixed

• Fixed toast notifications reappearing on every page load (session pop/clear not marking session as modified)

v2.0.4

Improved

• Improved archive list layout: wider tag column, removed empty column, better section heading spacing

v2.0.3

Fixed

• Fixed role check passing role objects instead of role IDs, blocking login for users with required role

v2.0.2

Fixed

• Fixed login and CSRF token failures caused by session modifications not being persisted
• Fixed long tag names displaying in all-caps
• Fixed tag filter pills not being centered
• Fixed empty thumbnail boxes appearing in search results
• Fixed double 'v' prefix in version display
• Added spacing above tag filter bar

v2.0.1

Fixed

• Fixed login page crash caused by icon macro import evaluating layout template code

v2.0.0

Added

• Complete frontend redesign with M90 camouflage military theme and dark/light mode
• New photo lightbox, upload drawer, search modal, and keyboard shortcuts
• CSRF protection and OAuth2 state parameter for secure login flow

Changed

• Authorization hardening — album modification and image serving now require ownership or admin
• Error messages sanitized to prevent information leakage

v1.4.3

Fixed

• Fixed hardcoded Discord role IDs

v1.4.2

Fixed

• Fixed missing positional arguments error in Discord OAuth callback due to bot_token parameter not being passed to helper functions
• Fixed missing bot_token parameter in admin user hydration endpoint

v1.4.1

Added

• Added @require_login and @require_admin route decorators to eliminate repetitive authorization checks
• Added database performance indexes for albums table (created_at, archived, tag_id)
• Added bulk database query optimization to prevent N+1 queries in album and photo views
• Added helper modules: constants.py, db_helpers.py, discord_helpers.py, file_utils.py

Changed

• Refactored app.py by extracting 150+ lines of reusable code into dedicated helper modules
• Improved database query performance with bulk fetching for thumbnails, tags, and photo likers
• Extracted magic numbers and strings to constants.py for better maintainability

Fixed

• Fixed inconsistent use of hardcoded rate limit value by using MAX_RETRY_AFTER_SECONDS constant

v1.4.0

Added

• Added role-based access control - users must have the role specified by DISCORD_REQUIRED_ROLE_ID to access the site

Changed

• Moved ADMIN_ROLE_ID from hardcoded constant to DISCORD_ADMIN_ROLE_ID environment variable for easier configuration

v1.3.2

Fixed

• Fixed dark mode styling for filter and sort controls on album page

v1.3.1

Fixed

• Fixed missing database migrations in Docker builds by ensuring migrations are committed to git before building

v1.3.0

Added

• Added client-side file metadata extraction to capture filesystem timestamps during upload
• Added taken date display in photo modal when metadata exists

v1.2.3

Added

• Added sliding toggle switch to show/hide archived albums on main index page

Changed

• Merged archive and album views into unified index page with toggle
• Filtering by tag now automatically activates show archived toggle
• Archive toggle now preserves tag filter state when toggling

Fixed

• Fixed white flash when navigating pages in dark mode

Removed

• Removed separate /archive route and dedicated archive page

v1.2.2

Changed

• Archive creation date input now uses date picker instead of datetime picker
• Archive creation dates default to 19:00 UTC when only date is specified

Fixed

• Added libffi-dev to Docker dependencies to fix build errors
• Fixed setuptools deprecation warning by adding license metadata

v1.2.1

Changed

• Updated Python version from 3.13 to 3.14

v1.2.0

Added

• Added archive system for albums
• Added dedicated /archive page showing only archived albums
• Added archive/unarchive button (📦/📂) on album page
• Added archive navigation link in header
• Added ability to set custom creation dates when creating archived albums
• Added tag system for organizing albums
• Added /tags page for managing tags
• Added ability to create, edit, and delete tags with custom colors
• Added tag filtering on index and archive pages
• Added tag badges to album displays

Changed

• Main index now only shows non-archived albums
• Archived albums skip Redis notifications when created

v1.1.4

Changes

• Added mime-type tracking to the database

Fixes

• Now the mime-type isn't static

v1.1.3

Changes

• Updated session lifespan to 60 days

v1.1.2

Changes

• Moved deployment to kubernetes cluster

v1.1.1

Changed

• Only use images for thumbnails
• Increased video indicator size

v1.1.0

Added

• Added ability to upload videos

v1.0.0

Changed

• With the full release, the backing database is moved from sqlite to mysql for better scalability and stability

v0.5.3

Added

• Added listing of who liked any given photo
• Added administrator actions that are hidden from non-admins

v0.5.2

Added

• Added share button on photos, can be triggered by pressing s in the modal
• Added changelog, can be triggered by pressing the notepad icon

Fixed

• Fixed an issue where keyboard shortcuts would trigger even if a user was not logged in