# Changelog

All notable changes to Observer Lite are documented in this file.

The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
Observer Lite uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

---

## [Unreleased]

### Added
- Initial public release of Observer Lite
- HTTP/HEAD/POST monitor types with flexible status code DSL (`2xx`, `!5xx`, `200|404`)
- Response body matching: `contains`, `equals`, `not_equals`
- Response time warning threshold per monitor
- Configurable retry before alerting (`retry_count` + `retry_interval_seconds`)
- Ping (ICMP) monitor type via system `ping` binary
- SSL certificate validity and expiry monitoring
- Heartbeat (push-based) monitor type with grace period
- Maintenance windows with optional cron recurrence
- APScheduler-backed job scheduler persisted to SQLite (survives container restarts)
- Incident state machine: open on N consecutive failures, close on recovery
- Recovery notifications with downtime duration
- Email notifications via async SMTP (aiosmtplib)
- Telegram notifications via Bot API
- Per-monitor notification channel assignment (`on_down`, `on_recovery`, `on_ssl_warn` flags)
- Multi-user system with roles: `superadmin`, `admin`, `viewer`
- Per-monitor user assignment with individual alert opt-in
- Monitor groups for organisational grouping
- API keys with prefix `obs_`, SHA-256 stored, optional expiry
- Audit log for all write operations
- Admin-configurable data retention (default 90 days), enforced by a nightly cleanup job
- Daily SSL expiry scan job
- Server-Sent Events (SSE) real-time dashboard updates
- JSON import/export for monitor configurations
- Stats API: uptime %, average response time, total incidents (configurable time window)
- 90-day uptime bar visualisation
- Response time chart (uPlot, ~40 KB)
- Dark-mode Vue 3 frontend (Tailwind CSS, no CDN dependencies)
- Single Docker image: multi-stage build, embedded SQLite, `VOLUME ["/data"]`
- Forced password change for the default `admin` account on first login
- `slowapi` rate limiting on login (5/min/IP) and heartbeat (1/10 s/token)
- SMTP and Telegram credentials encrypted at rest (Fernet / AES-128-CBC)
- SECURITY.md, CONTRIBUTING.md, and this CHANGELOG

---

## [0.2.3] — 2026-09-27

### Fixed
- Treat timestamps read from SQLite as UTC so a heartbeat monitor can be marked down after the grace period, and incident duration is recorded when a monitor recovers.

## [0.2.2] — 2026-09-27

### Security
- Scope monitor list and detail reads so viewers only see monitors they created or are assigned to. Unassigned monitors return not found.
- Omit `heartbeat_token` from monitor responses unless the caller is an admin or the monitor creator. Reported by zeroninetoo.
- Serve built frontend files from a fixed map so a request path cannot leave the static directory.
- Replace `python-jose` with PyJWT and raise locked dependencies past the open Dependabot advisories.

## [0.2.0] — 2026-05-06
### Added
- Feature: Added multi-select monitor assignment on Group creation/edit form.
- Feature: Added silent notification configuration option for Telegram channels.

### Fixed
- Bugfix: Allow clearing optional fields (like Response Body Match) on Monitor edit.

## [0.1.0] — 2026-05-05

Initial release. See [Unreleased] for the full feature list — all items above ship in 0.1.0.

[Unreleased]: https://github.com/cagatayuresin/observer-lite/compare/v0.2.3...HEAD
[0.2.3]: https://github.com/cagatayuresin/observer-lite/compare/v0.2.2...v0.2.3
[0.2.2]: https://github.com/cagatayuresin/observer-lite/compare/v0.2.0...v0.2.2
[0.2.0]: https://github.com/cagatayuresin/observer-lite/compare/v0.1.0...v0.2.0
[0.1.0]: https://github.com/cagatayuresin/observer-lite/releases/tag/v0.1.0