v0.4.5 — API Key Webhooks — October 17, 2026
- Adds per-key HTTPS webhook destinations and signed `mail.send.accepted` events.
- Uses one-time HMAC signing secrets encrypted with AES-GCM at rest.
- Requires the v0.4.5 database migration and `LUCION_MAIL_WEBHOOK_ENCRYPTION_KEY` server secret.
- Delivery is asynchronous, metadata-only, and best-effort without retries.
v0.4.3 — Lucion Global Admin & Identity Roles — October 15, 2026
- Adds an Identity-protected `/admin` page for Lucion Global shared-mailbox and API-key administration.
- Enforces organization-scoped Owner, Admin, Manager, Member, and Guest roles on the server.
- Uses the consented organizations scope, trusted OIDC discovery metadata, and Authorization Code with PKCE S256.
- Requires the stable Lucion Global organization ID as a server-side Cloudflare Pages secret; no database migration or client secret is required.
v0.4.2 — Account Audit Log & Security Activity — October 14, 2026
- Records successful sign-ins and account changes to API keys, sender identity, addresses, and routing.
- Attributes mutations to the verified Identity subject and scopes access to the authorized mailbox.
- Excludes mail content, credentials, and request IP addresses.
- Requires the account activity database migration before deployment.
v0.4.0 — API Key Safety & Release Clarity — October 14, 2026
API-key safety
- Keeps 30 days as the default, including for requests that omit the expiry field.
- Requires an explicit confirmation in the interface and the server request before a non-expiring key can be created.
- Shows the last authenticated-use time and IP to the signed-in account owner.
- Requires the additive `last_used_ip` migration, applied in production before this release deployed.
Release history and security notes
- Corrects the v0.3.9 release entry, adds the missing v0.0.4 preview summary, and flags v0.3.5 migration/Identity prerequisites as action required.
- Documents that inbound spam/phishing filtering, reporting, sender allow/block lists, and attachment malware scanning are unavailable.
v0.3.9 — Lucion Global Employee Mail and Shared Mailbox API — October 14, 2026
Added verified employee company-address linking, organization-member access to shared mailboxes, and company API keys bound to one shared mailbox. Domain, alias, and API-key management remain administrator-only.
v0.3.8 — FilePond Attachments & Broader File Types — October 14, 2026
Added FilePond attachment selection and broader file-type validation. Inbound attachments remain metadata-only and files are not malware-scanned.