Open Chronology Files

Passkeys, better titles and previews for shared links, IndexNow, and a round of sign-in and account hardening.

Added

• Passkeys (#372, [#402], [#409]). Add a passkey on the Account page to use as a second factor, or to sign in with it alone. PASSKEY_SIGN_IN=false keeps passkeys as a second factor only. A password reset removes an account's passkeys and keeps two-factor authentication on, so recovery codes or an authenticator app still answer it.
• Titles and previews for shared links (#390, [#399]). Pages have descriptive titles, and shared timelines get a preview image.
• IndexNow (#389, [#401]). Set INDEXNOW_KEY to tell Bing, Yandex and other engines within minutes which public timelines and profiles changed.
• Desktop sign-in approval shows the request (#407). The approval page shows when the request was made, from which address and program, and asks you to type its code. Approving it sends you an email.
• Release from directory (#406). Administrators can move an account that signs in through LDAP to a password of its own; the person gets a reset link.

Changed

• Sign-in after failed attempts (#410). Repeated failures for a username now ask for a human-verification check instead of locking the account. Password checks are queued, so a burst of sign-ins waits instead of overloading the server. PASSWORD_HASH_CONCURRENCY sets how many run at once.
• Two-factor answers are limited per account (#406): ten wrong answers in 15 minutes pause them for a while, and the owner is emailed.
• API keys act only as their own account (#404). A key never has administrator powers, and changing your password, two-factor settings or passkeys revokes your keys.
• Directory accounts stay under the directory (#406). An LDAP account can't set a password or link another sign-in.
• Idle sessions end even with a page left open (#411).
• Per-address limits behind the built-in web server use each client's own address (#405). Servers behind a reverse proxy should still set TRUST_PROXY=1.
• "Timelines" in a timeline's breadcrumb goes back to the list you opened it from, or to the timeline browser (#412).
• Timeline descriptions render their Markdown (#398, [#400]).

Fixed

• Pull request change lists show durations that move with the moments they're anchored to (#395, [#397]).
• The docs match the code in a dozen places (#392, [#396]).

Upgrading

Install the new package and run openchronology-migrate as usual. It adds tables for passkeys and columns for desktop sign-in requests. The new settings INDEXNOW_KEY, PASSKEY_SIGN_IN and PASSWORD_HASH_CONCURRENCY are optional. API keys no longer act with administrator powers, so any scripts that used one for administration need a session instead.