BUS Core v1.2.0 — Claimed Owner Security, Recovery, Permissions, and Finance CSV Export

This release is a major step forward for BUS Core as a local-first operating layer for small maker shops.

BUS Core now supports a full claimed-owner security model, local user accounts, role-based permissions, recovery-code based owner recovery, session lifecycle hardening, audit visibility, and finance CSV export.

The goal of this release is simple: keep BUS Core easy to run locally, while giving real shop owners a safer path to use it with actual business data and controlled helper/operator workflows.

Headline changes

Claimed Owner Security

BUS Core now supports two operating modes:

• Unclaimed local mode
• Existing local-first behavior remains intact.
• No account setup is forced.

• BUS Core can still be used immediately after launch.

• Claimed mode

• The first owner can secure the install.
• Login is required after claiming.
• Legacy /session/token access no longer bypasses claimed mode.
• DB-backed authenticated sessions are required.
• Users, roles, permissions, sessions, and audit visibility become available.

This preserves the original low-friction local workflow while adding a real owner-controlled security model.

User Accounts, Roles, and Permissions

This release adds DB-backed users, roles, sessions, and permissions.

New management capabilities include:

• Create users
• Assign roles
• Enable or disable users
• Reset user passwords
• Revoke sessions
• View audit events
• Protect the last enabled owner from accidental lockout

Implemented permission areas include:

• Inventory
• Recipes
• Manufacturing
• Contacts/vendors
• Finance
• Logs
• Settings
• Backup/export/restore
• Users
• Sessions
• Audit
• System/admin actions

Route-level permission checks now protect covered backend API surfaces. UI visibility is convenience only; backend permissions remain the source of truth.

Owner Recovery and Recovery Code Regeneration

Owner recovery is now implemented end-to-end.

This includes:

• Recovery codes generated during owner setup
• Recovery codes shown once
• Recovery-code hashes stored instead of plaintext
• Account recovery from the login screen
• Generic recovery errors to prevent username/code enumeration
• One-time burn semantics for used recovery codes
• Recovery attempt rate limiting
• auth.recovery_used audit events
• Security-page recovery-code regeneration
• Regeneration invalidates old unused recovery codes
• New recovery codes are displayed once and cleared after confirmation

This closes the practical lockout gap for claimed installs.

Session Lifecycle Hardening

Claimed-mode sessions now have explicit lifecycle controls:

• Revoked sessions are rejected
• Expired sessions are rejected
• Idle sessions are rejected
• Maximum session age is enforced
• Last-seen timestamps are touched on a controlled interval
• Logout clears the auth session cookie
• Password reset and recovery flows revoke active sessions where appropriate

This reduces stale-session risk while keeping the local-first experience practical.

Finance CSV Export

BUS Core now includes finance CSV export.

This is a major workflow improvement because it gives users usable business records outside the app:

• Spreadsheet-friendly finance data
• Accountant-friendly exports
• Tax/prep support
• Business review support
• Less risk of BUS Core feeling like a data trap

This release moves BUS Core closer to being a practical small-shop business operations layer, not just an inventory tracker.

Security Management UI

The UI now includes:

• Claimed-mode login screen
• Owner setup flow
• Recovery code display
• Forgot-password / recovery flow
• Logout
• Current user display
• Security page
• User management
• Role assignment
• Session visibility and revocation
• Audit event visibility
• Recovery-code regeneration

The UI does not store passwords, recovery codes, raw session tokens, or permission authority in localStorage/sessionStorage.

OpenAPI and Developer Hygiene

This release also cleans up API hygiene:

• Fixed duplicate OpenAPI operation ID warning
• Added OpenAPI duplicate-operation regression coverage
• Kept /openapi.json generation healthy
• Updated route/security/governance documentation
• Strengthened UI contract audit coverage

Validation

This release candidate was validated with:

• Full auth test suite
• Route guard consistency tests
• UI router/security tests
• OpenAPI hygiene test
• CORS loopback policy test
• JavaScript syntax checks
• UI contract audit
• Version governance validation
• Change-trace validation
• Governance check script
• Bandit security scan

Bandit reported no Medium or High findings in the new recovery/session paths.

A full smoke flow was also run successfully, including journal recreation, backup/export cleanup, integrity checks, and test-data cleanup.

Manual validation highlights

Manual testing confirmed:

• Fresh/live DB startup still works
• Unclaimed mode still works
• Owner claim works
• Recovery codes display once
• Claimed mode persists after restart
• Login gate appears after restart
• Logout works
• Wrong login attempts fail safely
• Correct login works
• /session/token no longer bypasses claimed mode
• Owner Security screen loads
• Users, roles, sessions, and audit load
• User creation works
• Last owner cannot be disabled
• Last owner cannot be stripped of owner role
• Permission denials return 403
• Recovery UI exists from the login screen
• Recovery-code regeneration exists from Security

Notes

This is still local-first software. BUS Core does not introduce cloud identity, SaaS accounts, or external auth services in this release.

Unclaimed mode remains available for users who want the simple local workflow. Claimed mode is available when an owner wants login, users, permissions, recovery, and audit controls.

Known follow-up polish

Some UI polish remains for future releases:

• Improve Security page layout
• Replace role multi-selects with clearer checkboxes
• Improve audit detail formatting
• Add stronger warnings around assigning/removing Owner role
• Continue refining beta workflows around real shop usage

These are polish items, not blockers for the core security and export capabilities introduced here.