Changelog

**Webhooks can't reach internal addresses; sign-up doesn't reveal which

emails have accounts; staff-only pages are staff-only on the server; bad

API input is a 400, not a 500.**

Security

• Webhook targets must be public addresses (SSRF). A webhook URL that resolves to loopback, private (10/8, 172.16/12, 192.168/16, fc00::/7), link-local (incl. the cloud metadata service at 169.254.169.254), CGNAT, reserved or multicast addresses — directly, through DNS, or via IPv4-mapped / 6to4 / NAT64 IPv6 or decimal/hex IP spellings — is refused when the webhook is saved (Settings → Webhooks and POST /api/v1/webhooks/ → 400) and again on every delivery. Each request connects to the exact IP that passed the check (DNS rebinding can't redirect it), keeps the host name for the Host header and TLS verification, and redirects are never followed (a 3xx is logged as a failed delivery). Blocked deliveries are logged as failed with the reason, shown in the delivery log; no connection is made. New check: apps/api/url_safety.py. WEBHOOK_ALLOW_PRIVATE_TARGETS=true lets a development machine target a local receiver (metadata addresses stay blocked). **Existing webhooks that point at private or local hosts stop delivering** — each attempt is logged as "Blocked".
• Registration no longer reveals whether an email has an account. A taken address gets the same "Check your email" page as a new one, and its owner is emailed "someone tried to sign up with your address — sign in or reset your password". New accounts are no longer signed in straight after the form: the verification link signs them in (or sign in with your password and use “Resend”). Taken usernames are still reported. Password reset was already neutral.
• Staff-only pages are enforced on the server, not just hidden. The CRM, eCommerce and SaaS dashboards, the charts showcase, the onboarding wizard and the forms, widgets, datatable, API-docs and maps showcase pages were hidden from non-staff in the sidebar and command palette but opened for any signed-in account by URL. They now answer like the other staff-only pages: anonymous → login, non-staff → 403. The views use the sidebar's own requires_staff flag through NavItemAccessMixin / @nav_access_required (apps/core/navigation.py), so the menu and the server can't disagree. The marketing pages and the coming-soon, maintenance and 503 pages stay public by design; Overview and Analytics stay open to every account.

Fixed

• API writes validate before saving. POST /api/v1/products/ without category_id (or with an unknown one) returned 500; so did a negative stock, a second product with the same name (empty slug; slugs are now generated from the name), {"name": null} on `PATCH /api/v1/customers/<id>/`, and over-long values on PostgreSQL. These are now 400 {"detail": "field: message"}; invalid status values and malformed customer emails, which were stored silently, are refused the same way. Anything the database still refuses maps to a 400.

Docs

• Webhook deliveries are one attempt per event — a 5-second synchronous POST, no automatic retries, every attempt in the delivery log. The API docs used to promise "retries with exponential backoff", which never existed. To add retries, run dispatch_webhook() from a task queue. Stated on the API docs page, Settings → Webhooks, the OpenAPI description and the README.
• Unit-test counts refreshed (1401).

If you've built on these surfaces: point any local/private webhook at a

public URL (or set WEBHOOK_ALLOW_PRIVATE_TARGETS=true in development

only), note that sign-up now lands on /accounts/register/done/

without signing the user in, and give is_staff to any account that

should keep the staff-only dashboards and showcase pages. No migrations.

**Permission checks follow the organization, the role and the account in

question; one-time secrets stay out of the session.**

Changed

• **Organization settings and member management check your role in that organization.** /orgs/<slug>/settings/, invite, change-role, remove and cancel-invitation used the role from whichever organization was active in the session. They now use your membership in the organization named in the URL (HasRoleMixin reads self.membership when the view sets org_from_url = True). Non-members get a 404, the same as an unknown slug. Views that act on the active organization are unchanged.
• Only owners can grant the owner role (by role change or invitation), and the last owner can't step down without naming another.
• Changing orders and products is for staff. Everyone signed in can still browse Orders and Products; creating, editing and the bulk actions (mark paid / shipped, cancel, publish, archive) need is_staff, like Customers, Invoices and "Generate invoice" already did. The buttons are hidden for others. TableView.bulk_actions_allowed() is the new hook. API: creating/deleting products and changing/deleting orders need a staff-owned key; reading still works with any key.
• Team and customer avatars are served to signed-in users only. /media/avatars/ and /media/customers/ (MEDIA_LOGIN_PREFIXES) need a session and are sent Cache-Control: private; product images and org logos (MEDIA_PUBLIC_PREFIXES) stay public. The nginx recipe now proxies those two prefixes to Django — update your vhost if you copied it.
• **New API keys, webhook secrets and 2FA recovery codes are shown in the response that creates them** (marked no-store) instead of being kept in the database-backed session until the next page view. Recovery codes now appear on the setup page right after verifying.
• Webhooks: target URLs must be http(s); invoice.* events can be subscribed to — and are delivered to — active staff accounts only.
• /__health/ returns status only. Failed checks show {"ok": false}; the error and traceback go to the server log.
• /__metrics/ can require a token. Set METRICS_TOKEN and have the scraper send Authorization: Bearer <token>; check --deploy warns when metrics are on without one. /__metrics/ now answers as documented (the old /__metrics/metrics path still works).

If you've built on these surfaces: give staff (is_staff) to accounts

that manage orders, products or invoice webhooks, and reload nginx after

updating the vhost.

• Docs: unit-test counts refreshed (1225).

**Privacy tightening: people's contact details and the activity log are

shown only to the roles that manage them.**

Changed

• Activity timeline is staff-only. The sidebar already hid it from non-staff; /activity/ (and its CSV/XLSX/PDF export) now enforces the same rule with StaffRequiredMixin — others get 403. It still shows a summary only (who, what, which record, when); event metadata is never rendered or exported.
• Activity and audit metadata never store credentials. record() and record_audit() run metadata through apps.core.redaction.redact(), which replaces the value of any credential-like key (password, token, secret, api_key, recovery_codes, env_vars, …) with "[redacted]". Nothing in Apex logged such values; this keeps it that way as you wire new events. No migration needed.
• Team directory shows other members' emails to staff only. Everyone can still browse /people/ (names, titles, roles, projects); email addresses — and searching by email — are for staff, plus your own. Customer names on profile project cards are staff-only, like the Customers page.
• Customer emails on Orders and the dashboard are staff-only. The Orders table and the dashboard's Recent orders card show the customer's name to everyone and the email to staff (same rule as Customers).
• API: Customers and Invoices need a staff key. /api/v1/customers/ and /api/v1/invoices/ now require a key owned by a staff account (403 otherwise), matching their dashboard pages. Keys owned by a deactivated account (or one pending deletion) stop working (401). Notifications, webhooks, products and orders are unchanged.
• **Pending organization invitations are listed for owners and admins only.** Members, billing and viewers still see the member list.

If you've built on these surfaces: give staff (is_staff) to accounts

that need customer contact details, the activity timeline or the

Customers/Invoices API.

• Docs: unit-test counts refreshed (1155).

The loose ends from 0.20.0/0.20.1.

Fixed

• Spanish catalog complete for everything that's marked for translation — 159/159 msgids (was 34, with 118 untranslated/fuzzy after a makemessages sweep): every sidebar group and nav label, the themed admin (index, changelist, change form, delete flows, history, login, password pages), the login/demo-credentials/OAuth strings, and the password-change pages. Fuzzy mismatches like *Show counts → "Galería"* and *User → "Usuarios"* are gone. What's *not* wrapped in {% trans %} (most feature templates) still renders English — that's a separate, larger job.
• Deploy recipes no longer install the dev group on servers. deploy.sh, the systemd unit, the Render blueprint and every doc snippet now use uv sync --no-dev and uv run --no-sync — a bare uv run re-syncs the venv with the *dev* group (pytest, playwright, ruff) at every service start, silently undoing --no-dev. The hourly demo-reset cron wrapper (deploy/scripts/reset_demo_cron.sh) is now in the repo. The README's production snippet ran gunicorn/WSGI (no WebSockets); it now shows Daphne like every other recipe.
• compilemessages scoped with --ignore .venv --ignore node_modules in the Dockerfile, CI and Makefile — it was walking the whole tree and recompiling Django's and every package's catalogs into site-packages.
• Realtime fan-out helpers are event-loop-safe. push_notification / push_unread_count used async_to_sync unconditionally, which asgiref refuses inside a thread that already runs a loop (an async view, or the E2E harness seeding under Playwright — the `notify(): realtime fan-out failed` ERROR on every E2E run). They now schedule the send on the running loop in that case. Test added.
• Docs: unit-test counts refreshed (1078).

Known

• django-prometheus (opt-in metrics extra) still has no stable release allowing Django 6.1 — the 2.6.0.dev4 pin stays.

**Bugs the E2E suite had been pointing at, plus the last 0.20.0

follow-ups.** The 11 "stale" Playwright failures turned out to be a mix

of stale assertions and four real product bugs; all fixed, and the suite

is green.

Fixed

• Every inline onclick / onchange / onsubmit handler was dead. The site's nonce-based CSP has no 'unsafe-inline', so browsers silently ignored all 20 of them: the language picker did nothing, every delete confirmation was skipped (invoice void/delete, task, file, folder, kanban card, event, org member, payment method — one click went straight through), the toast demo buttons and the offline page's "Try again" did nothing. Replaced by CSP-safe data-confirm, data-autosubmit and data-reload attributes with one delegated listener each in static/js/app.js (works for HTMX-swapped markup too); the toast showcase uses Alpine x-on:click. Nothing inline remains.
• MultiSelect widget rendered no chip labels and no options — the template embedded raw JSON (|safe) inside double-quoted x-text / x-for attributes, so the attribute ended at the first " and Alpine threw Unexpected token ';' (the forms gallery's console error). The options now live in the Alpine state (labelFor(), filteredOptions()).
• Widget JSON was attribute-unsafe. json_dumps and the *_json widget payloads were mark_safe'd into x-data='…', so a label with an apostrophe (customer "O'Brien", org "Rock 'n' Roll") ended the attribute early — a broken widget at best, attribute injection at worst. They're now autoescaped (the browser decodes entities after delimiting the attribute, so Alpine still gets valid JSON). Regression test added.
• Uploads had no home and 404'd. MEDIA_ROOT / MEDIA_URL were never set, so avatars, product images, org logos and customer avatars were written to the project root and referenced as /avatars/x.png — a broken image everywhere. Now MEDIA_ROOT = media/, `MEDIA_URL = /media/, and apps.core.media.serve_media` serves **only the public prefixes** (avatars/ customers/ products/ org_logos/, path-normalised before the check) with a day of caching; the Files app's private user_files/ 404s there and keeps streaming through its permission-checked view. The nginx recipe aliases media/ and denies /media/user_files/; the Docker image pre-creates an apex-owned /app/media so the compose volume is writable. Existing installs: mkdir media && mv avatars customers products org_logos user_files media/ (the demo host reseeds hourly, nothing to do there).
• Maps showcase showed no markers — the view pre-dumped the locations to JSON and the template ran them through json_script again, so JSON.parse returned a string and data.forEach threw.
• Themed admin: CSP blocked its dark-mode pre-paint script because templates/admin/base.html used {{ request.csp_nonce }} — that attribute doesn't exist (Django's CSP context processor exposes csp_nonce), so the tag rendered nonce="". Fixed, plus the two settings comments that pointed people at the wrong name.
• <html lang> was hard-coded en — now follows the active language.
• Command palette ranking: label matches now rank above keyword matches (typing "ord" put *eCommerce* — which merely lists "orders" as a keyword — above *Orders*, and Enter opened the wrong page).
• Table search fires on input, not keyup — paste, browser autofill and dictation never emit keyup, so they never searched.
• Scatter chart axis labels no longer print 10.000000000000002.
• Django 6.1 deprecations cleared (RemovedInDjango70Warning count in the suite: 3 → 0): email settings migrated to MAILERS (env-var names unchanged — EMAIL_BACKEND, EMAIL_HOST, … still configure it; SMTP options are only passed to an SMTP backend), the deprecated fail_silently=True dropped in favour of the existing try/except, and the bare select_related() on the customer detail removed.
• E2E suite is green. Rewrote the 11 stale tests against current behaviour: seeded counts drifted (130 customers, not 100), to_have_url(lambda) and page.goto()-on-download are no longer valid Playwright, the mail recipient is a Combobox not a <select>, the archive flash message names the customer, "Tablero" was never in the sidebar (the es catalog translates *Overview → Resumen*), and the palette test parked the mouse over the list (hover selects).
• .env.example no longer suggests DATABASE_URL=sqlite:// (prod has no such scheme; dev ignores the variable) or a DEBUG env var (not read).
• The in-app docs changelog page had stopped at 0.18.2; it now covers 0.18.3 → 0.20.1.

Added

• apps/core/tests/test_media.py (public/private prefixes, traversal), attribute-safety regression test in apps/core/widgets/tests, MAILERS tests in apps/core/tests/test_prod_settings.py.

Known

• Spanish catalog covers ~34 strings from the i18n phase; sidebar group labels and most later pages fall back to English. Content work, tracked separately.
• E2E seeding logs notify(): realtime fan-out failed (asgiref refuses async_to_sync inside Playwright's event loop) — harness-only noise; production dispatch is unaffected (WebSocket checks pass).

**Everything to latest: Django 6.1, ApexCharts 6, Alpine 3.16, HTMX 2.0.10,

Tailwind 4.3, Node 24, Postgres 18.** Verified with the full unit suite

(1,066 tests incl. new admin-page coverage), the Playwright E2E suite

(67/78 — the 11 failures are identical on 0.19.1, i.e. stale tests, not

regressions), a crawl of every nav page A/B'd before/after (same 45

charts / 75 series render, JS errors 70 → 6, all six pre-existing),

pixel-diffed themed-admin screenshots on Django 6.0.4 vs 6.1, and a

fresh-clone Docker build + compose boot on the new base images.

Changed — Python (59 packages in the lock; direct deps below)

| Package | 0.19.1 | 0.20.0 |

|---|---|---|

| django | 6.0.4 | 6.1 |

| django-ninja | 1.6.2 | 1.6.3 |

| daphne | 4.2.1 | 4.2.3 |

| weasyprint | 68.1 | 69.0 |

| pillow | 12.2.0 | 12.3.0 |

| qrcode | 7.4.2 (was capped ~=7.4) | 8.2 |

| pyotp | 2.9.0 (was capped ~=2.9) | 2.10.0 |

| gunicorn | 25.3.0 | 26.0.0 |

| requests | 2.33.1 | 2.34.2 |

| python-dotenv | 1.2.2 | 1.2.3 |

| sentry-sdk (sentry extra) | 2.58.0 | 2.68.0 |

| mssql-django (mssql extra) | 1.7.1 | 1.8.0 |

| django-prometheus (metrics extra) | 2.4.0 | 2.6.0.dev4 — see note |

| pytest / pytest-django / pytest-asyncio | 9.0.3 / 4.12 / 1.3 | 9.1.1 / 4.14 / 1.4 |

| pytest-playwright / playwright | 0.7.2 / 1.59 | 0.9.0 / 1.62 |

| ruff | 0.15.12 | 0.16.3 |

Already at latest, unchanged: whitenoise 6.12, psycopg 3.3.4, channels

4.3.2, channels-redis 4.3, authlib 1.7.2, openpyxl 3.1.5, factory-boy

3.3.3, pyodbc 5.3. pyproject.toml floors were raised to the versions

above (django>=6.1,<6.2, qrcode>=8.2, pyotp>=2.10, …).

Django 6.1 notes. The themed admin (25 template overrides) needed no

changes: upstream reformatted its admin JS and added CSP-nonce plumbing,

but the DOM the theme styles is unchanged — confirmed by pixel-diffing

index / changelist / change-form / delete pages against 6.0.4. The one

visible upstream change is the empty-choice label in selects, now

"- Select an option -" instead of "---------". Django 6.1 also introduces

RemovedInDjango70Warnings that touch three spots in this codebase —

select_related() with no arguments (apps/customers/views.py), the

fail_silently mail argument (apps/notifications/dispatch.py), and the

EMAIL_BACKEND setting (superseded by MAILERS). All still work through

6.x; they're follow-ups before Django 7.0 (Dec 2027).

django-prometheus caveat. Its latest stable (2.5.0) caps

Django<6.1. Rather than hold Django back for an opt-in extra, the

metrics extra pins the maintainers' 2.6.0.dev4 pre-release (which

allows <6.2); it passes the metrics tests. Switch to >=2.6 when 2.6.0

final ships.

Changed — front-end

• ApexCharts 3.54.1 → 6.10.0 (CDN pin + SRI). Every chart on /, /charts/, the four dashboards and /pages/widgets/ renders identically (screenshot-compared), theme toggling re-renders correctly, tooltips work. No changes to static/js/charts.js were needed.
• Alpine.js 3.14.1 → 3.16.2, htmx 2.0.3 → 2.0.10 (CDN pins + SRI, in both base.html and the admin base.html).
• Tailwind CSS / @tailwindcss/cli 4.2.4 → 4.3.3; rebuilt app.css.
• EasyMDE 2.20.0 → 2.21.0, re-vendored via npm run vendor:easymde.

Changed — toolchain / images

• GitHub Actions: checkout v4→v7, setup-node v4→v7, upload-artifact v4→v7, astral-sh/setup-uv v3→v10.0.1 (exact tag — setup-uv stopped publishing floating majors after v7); CI Node 20→24 (Node 20 has been end-of-life since April 2026 — the runners were warning about it).
• Dockerfile CSS stage node:20-slim → node:24-slim. Runtime stays on python:3.13-slim (3.13 remains the documented recommendation; 3.14 is supported and a one-line change).
• docker-compose postgres:16-alpine → postgres:18-alpine. Postgres 18 moved PGDATA and its VOLUME to /var/lib/postgresql, so the named volume mounts there now. **A pg_data volume created by the old 16 stack is incompatible** — run docker compose down -v once (demo data reseeds on boot).
• Docs: getting-started.md no longer claims Python 3.14 is unsupported (stale since 0.19.x); Node 22+ noted where Node 20+ was.

Fixed

• pwa.js loaded after Alpine, so x-data="apexInstallPrompt()" on the install banner threw apexInstallPrompt is not defined (plus a follow-on visible is not defined) on every dashboard page — 64 JS errors across the 39 nav pages, and a PWA install banner that could never show. Moved before Alpine alongside shell.js, which already carried the comment explaining why. Errors on the crawl: 70 → 6, the remaining six being pre-existing and unrelated (see below).

• E2E suite throttled itself into 30-second timeouts. LoginThrottleMiddleware counts every POST to /accounts/login/ (10 per username per 5 minutes) in the process-local cache, nearly every E2E test signs in as demo, and nothing reset the cache between tests — so from the 11th login onward the server answered 429 and each later test timed out waiting for the post-login redirect. That is exactly the 29-timeout failure CI's Playwright job showed. tests/e2e/conftest.py now clears the cache around every test.

Added

• apps/core/tests/test_admin_pages.py — walks every registered ModelAdmin (changelist, search, add, change, history, delete-confirm) plus index / login / password-change / jsi18n on a seeded DB. Cheap insurance for the themed admin against future Django bumps.

Known, not addressed here (pre-existing)

Surfaced by the crawl, unrelated to the upgrade: a `SyntaxError:

Unexpected token ';' in an inline script on /pages/forms/`;

data.forEach is not a function on /pages/maps/; one CSP

inline-script violation on admin change forms; the scatter chart's

y-axis printing 10.000000000000002.

Docker build + local compose fixes. A customer building the image on

Windows/WSL (GitHub issue #2) hit a chain of problems that turned out to

affect every fresh clone, not just Windows: the image never built, and

had it built, the compose stack would have redirected every request to

https://. All fixed and verified end-to-end from a pristine

git archive (build → docker compose up → login → PWA manifest → icons

→ i18n → healthcheck).

Fixed

• docker build failed at collectstatic with ImproperlyConfigured: DATABASE_URL environment variable is required. apex.settings.prod fails loud without DATABASE_URL by design, but the build step only supplied SECRET_KEY. The step now exports throwaway build-only values (neither compilemessages nor collectstatic opens a DB connection). Broken since the Dockerfile was introduced (0.10.x).
• compilemessages was failing silently in the image (|| true masked a KeyError: 'SECRET_KEY'). Now runs with the same build env and fails loud. (No user-visible impact so far because locale/es/…/django.mo is tracked, but edited .po files would never have been recompiled.)
• **static/icons/* and static/css/vendor/easymde.css were not in git.** .gitignore had static/* with only js/ whitelisted, so a fresh clone lacked the favicon/PWA icons and the EasyMDE stylesheet — and under the manifest static-files storage a missing {% static %} entry is a hard 500 on every page (base.html links icons/icon.svg), plus /manifest.webmanifest and the forms gallery. .gitignore now ignores only the Tailwind build output static/css/app.css; the icons (17 KB) and vendored CSS are committed. The R2 zip already contained them (built from a working tree), which is why customers on the download never saw this — only clones did.
• docker-compose.yml was stale relative to the image: it ran gunicorn (WSGI — no /ws/ WebSockets) on :8000 while the image listens with Daphne on $PORT=8080 and health-checks that port, so the container was permanently unhealthy and realtime features were dead. Compose now mirrors the image CMD (migrate → Daphne on $PORT) plus seed_demo, and maps 8000:8080.
• Plain-HTTP compose stack 301'd every request to https://. SECURE_SSL_REDIRECT / SESSION_COOKIE_SECURE / CSRF_COOKIE_SECURE were hard-coded True in prod.py. They're now env-driven and still default to True — set SECURE_SSL_REDIRECT=False only when deliberately serving plain HTTP with no TLS proxy in front (compose does this for you). The cookie flags follow the redirect flag unless set individually, because a Secure cookie over plain HTTP is dropped by the browser and login loops silently. Nine new tests in apps/core/tests/test_prod_settings.py.
• **uv run was re-syncing the venv at build *and* at every container start**, pulling the *dev* dependency group (playwright 45 MB, ruff, pytest, faker…) into the production image and needing network at boot. The image now sets UV_NO_SYNC=1, puts /app/.venv/bin on PATH, and invokes python / daphne directly.
• Push-notification opt-in registered /static/sw.js — a stale, untracked Phase-13 scaffold that a fresh clone doesn't have. It now registers the real worker at /sw.js (scope /), the one pwa.js already installs. The stale file is removed.
• 0.19.0 crashed at boot on any --no-dev install — authlib's Django client hard-imports requests, which was never declared and only reached dev environments transitively via pytest-playwright. The Docker image (and any customer running uv sync --no-dev in prod) died with ModuleNotFoundError: No module named 'requests' before serving a request; the VPS/Render recipes survived only because they install the dev group. Same story one layer down: seed_demo / reset_demo build their data from the factory-boy factories the tests use, so the seeder died with No module named 'factory' in the image. requests>=2.32 and factory-boy>=3.3 (+12 MB for Faker) are now declared runtime dependencies, and a new CI job (prod-imports) installs exactly what the Dockerfile does, boots the prod settings, and imports every runtime module under apps/ + apex/ (scripts/check_prod_imports.py) so this class of bug can't recur.
• CI lint (ruff check) was red on an extraneous f prefix in scripts/generate_pwa_icons.py. Fixed; its docstring now says the icons are committed.

Changed

• Dockerfile runs as the non-root apex user from uv sync onward (COPY --chown, venv born apex-owned) instead of a trailing chown -R /app — that walk was duplicating the entire site-packages tree into a second image layer.
• Compose sets DEMO_MODE=True (login-page demo-credentials banner) and the console email backend so verification links show up in docker compose logs. Dropped the DEBUG env (prod settings ignore it).
• .env.example documents SECURE_SSL_REDIRECT; README Quick-start Option A explains when to set it; .dockerignore excludes .ruff_cache/.

OAuth social login. Added optional "Continue with Google / GitHub"

to the login screen, layered on top of the existing Django auth rather

than replacing it. Ships dormant — the provider buttons appear only once

the corresponding client IDs are configured, so default deployments are

unchanged. Built on Authlib (a thin OAuth client); the themed login,

registration, email-verify, and 2FA flows stay exactly as they were.

Added

• "Continue with Google / GitHub" buttons on the login page, gated by configuration. Set OAUTH_GOOGLE_CLIENT_ID / OAUTH_GOOGLE_CLIENT_SECRET and/or OAUTH_GITHUB_CLIENT_ID / OAUTH_GITHUB_CLIENT_SECRET to enable a provider; with no IDs set, the UI is identical to before.
• SocialAccount model (provider, provider_uid, email, extra, timestamps; unique on (provider, provider_uid)) linking a provider identity to a User. Registered in the themed admin. Migration 0006.
• Unified signup policy via ACCOUNT_SIGNUP_MODE (open / allowlist / closed) governing both password registration and OAuth self-signup, with ACCOUNT_SIGNUP_ALLOWED_DOMAINS and ACCOUNT_DEFAULT_ROLE. Default open preserves today's behavior. closed hides the "Create account" link and rejects both flows.
• OAuth views/URLs — accounts/oauth/<provider>/start/ and …/callback/. The callback exchanges the code, requires a provider-verified email (anti-takeover), then links an existing account / self-registers per policy, reuses the existing 2FA challenge handoff, and never 500s on a provider error (it toasts and returns to login). OAuth-created users are is_staff=False, email-verified, with an unusable password — staff areas stay gated by StaffRequiredMixin.

Security

• Social login only ever links or creates on a provider-verified email (GitHub verified-primary, Google OIDC email_verified), preventing account takeover via an unverified address. next redirects are validated against open redirects.

Email-verification reliability. A customer hit a hard failure

registering on a fresh deploy: the production settings never read the

email environment variables, so Django fell back to SMTP on localhost

and the verification send raised mid-registration. Fixed at the root,

with defense-in-depth so a mail misconfiguration can never 500 sign-up

again.

Fixed

• Production email is now wired from the environment. apex/settings/prod.py reads EMAIL_HOST, EMAIL_PORT, EMAIL_HOST_USER, EMAIL_HOST_PASSWORD, EMAIL_USE_TLS, EMAIL_USE_SSL, EMAIL_TIMEOUT, DEFAULT_FROM_EMAIL, and SERVER_EMAIL. These were documented in .env.example but never read by the settings module, so prod silently used the localhost:25 default. A 10s EMAIL_TIMEOUT keeps a wrong host from hanging the request.
• Registration no longer errors when email can't be sent. A new safe_send_verify_email() wraps the send, logs the traceback, and returns a status. RegisterView still creates and logs in the account, then shows a warning prompting the user to resend; the resend view reports a clear error instead of raising.

Changed

• README accuracy. Corrected the stack header (Django 6.0, Python 3.12–3.14) and added an explicit note that auth is Django's built-in django.contrib.auth + pyotp TOTP (no django-allauth dependency). Expanded the production env-var table with the full email settings and a "configure email before first registration" callout.

Tests

• Added coverage for the mail-failure paths (registration succeeds with a warning; resend reports an error). Accounts suite: 142 passing.

Admin prominence + slimmer distribution. Two same-day refinements

on top of yesterday's 0.18.1.

Added

• Header chip linking to /admin/ for staff users — a 36×36 shield-icon button sits between the theme toggle and the user menu, visible on every page. One click from anywhere in the app to the themed Django admin. The "Administration" sidebar entry under Account stays in place so the command palette still finds it.

Changed

• Pruned 42 unused screenshots (~3.6 MB) — 19 stale root PNGs superseded by other variants (billing-cancel, notifications, kanban-dark, mail-thread, etc.) plus the entire screenshots/responsive/ subfolder (24 mobile/tablet artifacts generated by scripts/capture_responsive.py for spot-checking during development but not consumed by README, CHANGELOG, or any template). Working screenshots/ is now 36 files / 5.1 MB, all actually referenced. The capture script stays so anyone can regenerate later. Distribution zip drops from ~9.6 MB to ~6 MB.

First-customer polish. Three small but visible fixes reported within

hours of shipping 0.18.0 — bundled here as a same-day patch.

Added

• "Administration" sidebar entry under the Account group, linking directly to /admin/. Uses the shield icon (consistent with the admin breadcrumb), requires_staff=True, and keyword aliases (admin, django admin, permissions, groups, …) so the command palette finds it. Makes the themed /admin/ discoverable instead of hidden behind URL knowledge.

Fixed

• screenshots/ was excluded from the distribution zip, so the bundled README.md's inline image links 404'd when the package was extracted locally. Re-included so README.md renders with all the marketing screenshots. Zip grew from ~1.4MB to ~9.5MB — worth it for the polished first impression.
• Demo user was is_staff=True only, so visitors logging into the themed /admin/ saw zero models (Django requires per-model permissions, which a bare staff user lacks). Promoted to is_superuser=True in seed_demo so the demo showcases the full themed admin. Safe because the hourly reset_demo cron flushes + reseeds, reverting any visitor changes — including password or permission edits on the demo user itself. Already fixed on the live preview server in 0.18.0; this entry covers the distribution zip finally including the change.
• Clock icon missing on SplitDateTime time-picker triggers. CSS mask selector targeted .time-icon, but Django actually emits .clock-icon (the .date-icon for the calendar trigger was already correct). Renamed so the Lucide clock glyph paints.
• Changelist primary column rendered centered + bold. Django outputs the first column as <th scope="row">, and browsers default <th> to center-aligned bold. Forced left-align + normal weight so it matches the data columns.
• Sortable column headers showed empty/broken controls. Django's multi-column sort UI (.sortoptions → .sortremove, .sortpriority, .toggle) paints its icons from a sprite in admin CSS we don't load, so they rendered as blank anchors. Styled them as intentional controls: Lucide × for remove-from-sort, a pill priority badge, and chevron-up/down direction toggles, all via mask-image + currentColor.

Apex-themed Django Admin. Django's /admin/ is now fully re-skinned

to match the rest of Apex — same sidebar, header, dark mode, command

palette, toast notifications, OKLCh color tokens. Drop-in apex.admin

package gives existing admins the theme automatically and adds a

ModelAdmin base class for opt-in extras.

Added

• apex.admin package — drop-in ModelAdmin, TabularInline, StackedInline base classes. Use them in place of admin.ModelAdmin to get Apex-specific knobs: - show_in_dashboard = True — surfaces a stat card on /admin/ with a Lucide icon, live count, and "View all" / "Add" actions. - apex_icon = "package" — Lucide icon name (see apps/core/templatetags/apex.py::ICONS) shown on the dashboard card and app-index list. - hide_readonly_on_add = True — auto-hides empty readonly metadata fields on add forms (e.g. created_at: - placeholders).
• Themed admin templates (~20 files in templates/admin/): - Chrome — base.html / base_site.html wrap every admin page in the Apex shell (sidebar + header + breadcrumbs + command palette + toast container). Dark-mode bootstrap matches the project base layout. - Auth — themed login (/admin/login/ reuses layouts/auth.html), password change (per-user + self-service), password change done, logged-out. - Index — opt-in stat cards via show_in_dashboard, themed apps & models grid with Lucide icons, recent actions feed. - CRUD — change list with empty states, change form with proper label/input grid alignment, delete confirmation, history page. - Popups — related-object add/edit (?_popup=1) skip the shell, use a sticky save bar, and auto-hide empty metadata rows. - Errors — themed 404 / 500 pages.
• Themed widgets (templates/admin/widgets/ + scoped CSS): - Foreign key wrapper — Lucide edit / + / trash / eye icons replace the stock PNG buttons. - Select2 autocomplete — Apex-tinted dropdown, themed search input, multi-select chips, dropdown shadow + border-radius. - M2M filter_horizontal — bordered cards on both sides, themed filter inputs, Lucide arrow chips, "Choose all" / "Remove all" footer buttons. - SplitDateTime — colon-free Date / Time labels. - Calendar popup — Lucide chevron nav, themed day cells, today highlight, themed action row. - Date/time shortcuts — "Today" / "Now" chips next to date fields with Lucide calendar / clock icons. - File input — themed "Choose File" button with hover state. - Image preview — ImageField with existing value renders a bordered thumbnail card above the change controls (works project-wide, not just admin).
• Scoped admin CSS (static_src/css/admin.css, ~1000 lines) — every rule under .apex-admin so the theme never leaks outside /admin/. Reuses Apex's OKLCh tokens (--background, --foreground, --primary, etc.) so dark mode works for free.
• apex_admin templatetag library — walks admin.site._registry to build the dashboard cards and respects per-model view permissions.
• field.label_tag|cut:":" everywhere via overridden admin/includes/fieldset.html — strips the trailing-colon convention from form labels (Name: → Name).
• Required-field asterisk — small destructive-coloured * suffix on <label class="required"> (rendered by Django for required form fields).

Changed

• apex.admin registered in INSTALLED_APPS ABOVE django.contrib.admin so the project template loader picks up templates/admin/ overrides.
• Sample admins (customers, orders, invoices, products) migrated to apex.admin.ModelAdmin and opt into show_in_dashboard with sensible Lucide icons.
• Order admin gains autocomplete_fields = ("customer",) to exercise the themed Select2 dropdown.
• Six new Lucide icons added to apps/core/templatetags/apex.py::ICONS: shield, shield-off, arrow-right, chevron-left, edit-3, box — used by the admin chrome and widget overrides.

Compatibility

• Stock admin.ModelAdmin registrations still work — they pick up the theme via template overrides automatically. apex.admin.ModelAdmin is the hook for the new conveniences (dashboard cards, icons, hide_readonly_on_add); switching is purely opt-in.
• All 1034 unit tests pass unchanged.
• Third-party admin extensions (django-import-export, django-reversion, django-modeltranslation, django-mptt, etc.) ship their own admin templates and need targeted styling on top of the Apex theme when used.

Python 3.14 support + AI-assistant onboarding docs.

Changed

• requires-python opened to <3.15 so Python 3.14 (released 2025-10) installs cleanly. Django 6.0 supports 3.12–3.14; Python 3.13 remains the recommended dev version.
• Bumped whitenoise floor to >=6.12 and pytest-django to >=4.12 to pick up versions that classify Django 6.0 explicitly. No code changes required — full test suite (1034 unit tests) green.

Added

• AGENTS.md, .cursor/rules/project.mdc, .github/copilot-instructions.md — onboarding docs for AI coding assistants. AGENTS.md follows the agents.md convention (Aider, Cline, Codex, Continue); the others target Cursor and Copilot respectively. Cover architecture, conventions, the TableView datatable system, Channels dispatch, Ninja API, organization scoping, mixin catalog, recipes, anti-patterns, and the seed_demo data manifest. Claude Code reads CLAUDE.md, which stays gitignored (local-only) by existing convention.

Microsoft SQL Server support. Apex now officially supports SQL Server

2017+ as a production database alongside Postgres. Postgres remains the

default — SQL Server is opt-in.

Added

• mssql optional dependency group in pyproject.toml. Install with uv sync --extra mssql to pull Microsoft's official [mssql-django](https://github.com/microsoft/mssql-django) backend plus pyodbc. Customers who don't need SQL Server pay no install cost.
• mssql:// / sqlserver:// schemes in apex/settings/prod.py's DATABASE_URL parser. Auto-detects the scheme and wires the right engine + ODBC driver options. Query params ?driver= and ?trust_server_certificate=yes let you target an older ODBC driver or skip cert validation against a self-signed local instance.
• apex/settings/mssql.py — local-dev settings module pre-wired for SQL Server, configurable via MSSQL_HOST, MSSQL_PORT, MSSQL_DB, MSSQL_USER, MSSQL_PASSWORD, MSSQL_DRIVER env vars. Mirrors the pattern of apex.settings.dev (SQLite) but talks to SQL Server.
• README "SQL Server" section with full setup recipe: install the ODBC driver, install the extra, set DATABASE_URL, migrate. Includes a docker-based local SQL Server recipe for testing before deploy.

Changed

• .env.example now lists mssql:// as one of the supported DATABASE_URL schemes.
• Production environment variables table in the README marks DATABASE_URL as accepting either postgres:// or mssql://.

Compatibility

• Requires SQL Server 2017 or newer (matches mssql-django's baseline; JSONField requires 2016+ which is covered).
• Requires Microsoft ODBC Driver 18 at the OS level. Driver 17 still works via ?driver=ODBC+Driver+17+for+SQL+Server.
• Tested against SQL Server 2022 running in the official mcr.microsoft.com/mssql/server:2022-latest Docker image.

Phase 14 — Realtime via Django Channels. Apex now ships an ASGI

WebSocket layer that pushes notifications and presence updates to

every connected tab without HTTP polling. Dev needs zero infra (the

in-memory channel layer); production upgrades to Redis with a single

env var.

Added — Infra

• Channels 4 + Daphne added as dependencies. Daphne replaces gunicorn's runserver in dev so WebSocket upgrades work natively.
• apex/asgi.py routes HTTP through Django and WebSocket through the realtime app's URL router, wrapped in AuthMiddlewareStack so consumers see scope["user"] populated from the session cookie, and AllowedHostsOriginValidator so cross-origin sockets are rejected at the perimeter.
• CHANNEL_LAYERS defaults to InMemoryChannelLayer (dev/test). prod.py upgrades to channels_redis.core.RedisChannelLayer when REDIS_URL is set; install with uv sync --extra realtime to pick up the optional channels-redis dep.

Added — Consumers

• NotificationConsumer (/ws/notifications/) — per-user fan-out channel (notify.user.<id>). Receives notify.message (new row) and notify.count (unread badge bump) events from the layer. Anonymous connects close with code 4401 so the client stops retrying.
• PresenceConsumer (/ws/presence/) — global presence channel. Tracks per-process connection set; broadcasts a count + the joined/left username on every transition.
• Both built on AsyncJsonWebsocketConsumer so consumers can await ORM lookups via database_sync_to_async.

Added — Server-side dispatch hooks

• apps/realtime/dispatch.push_notification(user_id, payload) and push_unread_count(user_id, count) — sync wrappers around channel_layer.group_send for use from any view, signal, or management command. No-op if no layer is configured.
• apps.notifications.dispatch.notify() now fans out to the layer after every Notification.objects.create() — every existing notification source (orders, invoices, mail, chat, mentions, realtime test) becomes live with no per-call wiring.

Added — Client

• static/js/realtime.js exposes apexNotifyStream() and apexPresence() Alpine factories. WebSocket auto-reconnects with exponential backoff (cap 30s); 4401 close is honored as "anonymous, stop trying". apexNotifyStream re-renders the bell badge inline AND triggers an HTMX refresh so the dropdown body stays in sync.
• Header presence pill — green pulse + count of online users, shown only when count > 0 so first paint stays clean.
• Bell badge rendered with data-bell-badge so the realtime client can update the count without a DOM rebuild.

Added — Demo surface

• /realtime/ — opens both sockets, shows the live count, and ships a "Fire test notification" button that POSTs to /realtime/fire/. Open in two tabs — both update instantly.
• Sidebar entry under Apps; palette-searchable via the realtime, websocket, presence, live, channels keywords.

Tests

• 16 new tests: 8 async consumer tests using WebsocketCommunicator (anonymous reject, accept, group fan-out, per-user isolation, presence count + join/leave broadcast), 4 sync dispatch tests (helper drains, end-to-end notify→layer fan-out, no-layer no-op), 4 view tests (demo render, anon redirect, fire-test creates Notification, GET rejected). Total now 1000.
• New dev dep: pytest-asyncio (strict mode; opt-in per test via @pytest.mark.asyncio, no impact on existing sync tests).

Notes

• Single-process scaling stays trivial. Multi-process needs Redis or the layer's broadcasts are per-worker. The presence count is per-process by design — fine for the demo, swap to a Redis ZSET if you need cluster-wide accuracy.
• Chat broadcast and Kanban broadcast are intentionally NOT wired yet — the foundation is in place, follow-up commits can subscribe those views to the layer without further infra changes.
• WebRTC, voice/video, and message-history search are explicitly out of scope.

Phase 16 — Organizations + RBAC. Apex is now multi-tenant. Users

belong to one or more organizations; one is "active" per session and

drives any model that opts into org scoping. Roles

(owner > admin > billing > member > viewer) gate sensitive actions

through a small mixin layer.

Added — Models

• Organization — name, auto-generated slug (with collision suffixing), optional logo, plan choice (free / pro / enterprise), created_by, timestamps.
• Membership — joins User × Organization with a role, unique on (user, org), indexed for fast lookup.
• Invitation — email + role + opaque secrets.token_urlsafe(32) token, 14-day TTL, accepted_at timestamp. Idempotent accept() creates the Membership and tolerates double-redeem.

Added — Request middleware

• OrganizationMiddleware resolves request.organization, request.memberships, request.organization_role for every authenticated request. Precedence: session-stored slug → first membership alphabetically → None. Failures are swallowed so a tenant lookup never breaks the request.
• set_active_organization(request, org) helper for views that switch tenants; refuses non-members.

Added — View mixins

• OrgRequiredMixin — bounces to /orgs/ when no active org.
• HasRoleMixin — enforces a minimum role (raises 403 otherwise).
• OrgScopedMixin — opt-in queryset filter for any list view whose model has an organization FK. Existing apps aren't migrated yet — this ships ready for incremental rollout.

Added — UI surfaces

• /orgs/ — list of memberships with switch / settings actions + create-new form (owner role auto-assigned).
• /orgs/<slug>/settings/ — name + plan editor with an owner-only Danger Zone delete confirmation.
• /orgs/<slug>/members/ — member roster with inline role change + remove buttons (admin/owner only). Pending invitations panel with expiry countdown and cancel action.
• /invitations/<token>/ — public accept page, handles unauthenticated, wrong-account, expired, already-accepted, and happy-path states.
• Header org switcher — auth-only dropdown showing all memberships, role label, active checkmark, and a "Manage organizations" link.
• Sidebar entry — Organizations under the Account group.

Added — Demo data

• seed_demo now creates 3 sample orgs (Apex Demo Co. / Side Project / Acme Holdings) with the demo user as owner of each, three teammate memberships on the primary org (admin / member / billing), plus one pending invitation so every UI state is covered.

Tests

• 46 new unit tests across models (slug + initials + role rank + invitation TTL/idempotency), middleware (anonymous / no-membership / session override / non-member rejection), view mixins (OrgRequired redirect, HasRole 403/200, OrgScoped filter + none-fallback), and view flows (list/create/switch/settings/ members/invite/role-change/remove/cancel/accept). Total now 984.

Notes

• Per-org permission *matrix* (Role + Permission tables, editable per org) is intentionally deferred — hardcoded role checks via role_at_least() are clean enough to swap to a matrix later without view rewrites.
• Org-scoping every existing model (Customer, Invoice, Order, …) is also deferred. The OrgScopedMixin ships ready for incremental rollout — apply per app as schema migrates to add the FK.
• Invitation links surface in the UI toast (no email backend wired yet); the workflow is fully testable end-to-end without SMTP.

Phase 18 — Marketing polish. Adds the public surfaces a buyer actually

checks before buying: a real changelog page, a Now/Next/Later roadmap,

a side-by-side comparison table, a one-page showcase index, plus full

SEO meta tags + sitemap.xml + robots.txt.

Added — Marketing pages

• /landing/changelog/ — renders CHANGELOG.md directly with per-release anchors (link with #v0-13-0). Custom-built tiny markdown parser (no extra dep) covering H3 / lists / inline code / bold / links — that's all the changelog uses.
• /landing/roadmap/ — public Now / Next / Later board sourced from RoadmapView.NOW / .NEXT / .LATER. Hand-curated so we can edit it without a deploy via PR; admin model can come later.
• /landing/compare/ — Apex vs hand-rolled vs typical premium template, grouped into Foundation / UI surfaces / Integrations / Operations sections.
• /landing/showcase/ — one-page index of every demo surface, organized into 8 cards (Dashboards, Components, Forms, Datatable, Charts, Productivity, API, Pages).

Added — SEO

• **<meta name="description">, og:title, og:description, og:image, og:url, og:type** — every marketing page; per-page override blocks ({% block og_title %}, etc.).
• Twitter card (twitter:card, twitter:title, twitter:description).
• <link rel="canonical"> auto-derived from request URL.
• JSON-LD SoftwareApplication block (overridable per page).
• /sitemap.xml — Django sitemaps for all 11 marketing routes. No django.contrib.sites dep — uses RequestSite so SITE_ID isn't required.
• /robots.txt — allows /landing/, /blog/, /help/; disallows /admin/, /api/, /accounts/, /settings/.

Updated

• Marketing footer — gains a Resources column linking to Showcase, Compare, Changelog, Roadmap. Old Legal column folded into Company.

Tests

• 20 new unit tests across the changelog parser, page renders, SEO meta presence, sitemap structure, robots.txt rules. Total now 938.

Notes

• The changelog renderer is a hand-rolled markdown subset, not a full CommonMark parser. If we start needing tables, fenced code, or footnotes inside the changelog, swap to the markdown package (one-line view change).
• The roadmap data lives in code so PRs trigger CI; an admin-editable RoadmapItem model is a fine follow-up if non-engineers need to edit it.

Phase 17 — Settings depth. Promotes /settings/ from "profile +

password + 2FA + appearance" to enterprise-tier completeness with

device sessions, API token management, webhook subscriptions, audit

log, GDPR-style data export, and confirmable account deletion.

Added — Models

• SessionMetadata (sidecar for django.contrib.sessions.Session) — tracks user, user_agent, ip_address, last_seen_at per active session so the Sessions pane can list "iPhone · Safari · 192.0.2.1 · last seen 2 minutes ago".
• AuditEvent — append-only per-user security log (sign-in, sign-out, login_failed, password_changed, two_factor_enabled, api_key_created, session_revoked, data_export_requested, account_deletion_requested / canceled).
• User.pending_deletion_at — soft-delete flag with 30-day grace period before hard delete.

Added — Settings panes

• Active sessions (/settings/sessions/) — list devices currently signed in, "sign out other sessions" button, per-row sign-out.
• API tokens (/settings/api-tokens/) — UI for the Phase 15 APIKey model. Create with a name, raw key revealed exactly once via a copy-to-clipboard banner, revoke any time.
• Webhooks (/settings/webhooks/) — list / create / delete UI for the Phase 15 Webhook model. Event picker grid, secret revealed once on create, recent-deliveries log surfaces success/failure + response codes.
• Audit log (/settings/audit-log/) — last 200 security events with type-specific iconography.
• Export your data (/settings/data-export/) — synchronous ZIP build containing user.json + notifications.json + audit_events.json + api_keys.json (no secrets) + webhooks.json + README.
• Delete account (/settings/account-deletion/) — typed-confirm flow ("delete my account"), immediate sign-out + is_active=False, cancellable from the same page during the grace period.

Added — Middleware + signals

• SessionMetadataMiddleware — populates SessionMetadata on every authenticated request. Throttled to one DB write per minute per session via a session-stored timestamp.
• apps.accounts.signals — registers handlers for user_logged_in, user_logged_out, user_login_failed that record matching AuditEvent rows. Failed logins for unknown usernames are dropped (we don't leak username existence via the audit trail).
• record_audit(user, kind, request=...) — convenience helper for views that perform security-relevant actions; pulls IP + user-agent from the request when present.

Added — Management commands

• process_pending_deletions — hard-deletes users whose pending_deletion_at + grace-days has elapsed. --grace-days N override + --dry-run flag.
• cleanup_session_metadata — drops SessionMetadata rows whose underlying Session is gone. Pair with Django's clearsessions in nightly cron.

Updated

• Settings layout nav — reorganized into 4 sections (Account / Security / Integrations / Privacy) so the new panes have a home. Notification preferences (Phase 13) gets a link from Integrations.

Tests

• 32 new unit tests covering each pane + audit signals (login + login failed wired automatically) + both management commands. Total now 918.

Notes

• The data export is generated synchronously — fine at demo scale. For large accounts, swap to a Celery task that emails a download link when ready.
• Account deletion is a *soft* delete during the grace period (is_active=False blocks login but data is intact). The process_pending_deletions command performs the actual hard delete after the grace window — run it nightly in cron.

Phase 15 — Django Ninja API. Production-quality REST API over the core

domain models with bearer-token auth, cursor pagination, signed

outbound webhooks, and auto-generated OpenAPI/Swagger docs.

Added — App + dependency

• apps/api/ new app + django-ninja>=1.3 runtime dep.
• /api/v1/ mounted in apex/urls.py. Swagger UI at /api/v1/docs, raw OpenAPI schema at /api/v1/openapi.json.

Added — Models

• APIKey — per-user bearer token. Raw value shown exactly once on creation; only SHA-256 hash + non-secret prefix stored (Stripe / GitHub convention). Optional expires_at, manual revoke(), auto-tracks last_used_at.
• Webhook — outbound subscription owned by a user with url, events (comma-joined), and a server-generated secret for HMAC signing.
• WebhookDelivery — per-attempt audit log (status, response code, body, timestamp).

Added — Endpoints (CRUD + filter + cursor pagination)

| Resource | Operations |

|---|---|

| /customers/ | list (q, status filter) · create · retrieve · patch · delete (soft) |

| /products/ | list (q, status, category filter) · create · retrieve · delete |

| /orders/ | list (status, customer filter) · retrieve · patch status · delete |

| /invoices/ | list (status, customer filter) · retrieve · send · pay · void |

| /notifications/ | list (category, unread, archived filter) · mark read · mark all read · archive — scoped to authed user |

| /webhooks/ | list · create (returns secret once) · retrieve · delete — scoped to authed user |

All list endpoints use cursor pagination via ?cursor=<id>&limit=<N>

(default 25, max 100). All endpoints require `Authorization: Bearer

apex_<token>`.

Added — Webhook dispatch

• apps.api.dispatch.dispatch_webhook(event, data) — best-effort POST to every active subscriber whose events includes the name. Signs body with HMAC-SHA256, sends X-Apex-Signature: sha256=<hex> + X-Apex-Event: <name> + canonical JSON encoding (sorted keys, no whitespace) so signatures reproduce.
• Wired into Invoice transitions: mark_sent / mark_paid / mark_void each fire invoice.{sent,paid,void} events.
• Invoice.transition_to(target) — convenience dispatcher used by the API endpoints.

Added — Management command

• python manage.py create_api_key <username> --name "label" — creates an APIKey and prints the raw token once (with a curl example for immediate use).

Added — Auth

• KeyAuth Ninja security class — looks up the bearer token in APIKey, attaches the matched key + owner to the request as request.api_key / request.auth_user, and bumps last_used_at on every successful authentication.

Updated

• /pages/api-docs/ — keeps the static code-sample reference but now opens with a banner pointing at the live Swagger UI + the raw OpenAPI schema URL.

Tests

• 52 new unit tests (auth, every CRUD endpoint, filter + cursor pagination, webhook dispatch + signing, schema served). Total now 886.

Notes

• Webhook delivery is synchronous — fine for low volume; a real queue (Celery / RQ / arq) is a follow-up for production scale.
• Real Web Push delivery (Phase 13) reuses the same dispatch pattern but lives in the notifications app, not here.

Phase 13 — Notification center. Promotes notifications from "bell +

dropdown" to a real category-aware center with per-user, per-channel

preferences and browser-push opt-in scaffolding.

Added — Models

• Notification gains: - category (system / billing / mention / comment / security) — the new dimension that preferences key off - actor FK (optional) — for "Sara mentioned you" rows with avatars - archived_at — soft-archive that excludes from default views - target_url alias on url for forward-compat - extended kind enum (mention, comment, security)
• NotificationPreference — per-user × per-category × per-channel toggle (in_app / email / push). Lazy defaults via CHANNEL_DEFAULTS so users don't need a row to receive sensible defaults (in_app on for everything; email on for billing + security; push always off until explicitly enabled).
• PushSubscription — Web Push subscription endpoint with endpoint / p256dh / auth keys + user-agent.
• NotificationQuerySet gains .active(), .archived(), .for_category() helpers.

Added — Central dispatcher

• apps.notifications.dispatch.notify(...) — single entry point for emitting notifications. Honors NotificationPreference per channel: in_app creates a row, email sends via the configured backend, push fires via pywebpush when configured.
• notify_many(...) — fan-out helper.
• All legacy helpers (notify_invoice_sent, etc.) now route through notify() so preference checks apply uniformly.
• get_effective_pref(user, category, channel) — resolution helper; falls back to defaults for users who haven't customized.

Added — Surfaces

• /notifications/ rewritten with: - Category filter pills (with per-category counts) - Active / Archived scope tabs - Day-bucketed grouping (Today / Yesterday / Earlier this week / Earlier this month / Older) - Per-row archive button (and restore from the Archived view) - Actor avatar + colored category pill on each row
• /notifications/preferences/ — category × channel toggle grid with descriptive copy for each category and a browser-push opt-in panel below the form.
• /notifications/<pk>/archive/ + restore.
• /notifications/push/{subscribe,unsubscribe}/ — JSON endpoints consumed by the browser's PushManager subscription flow.

Added — Service worker + Alpine factory

• static/sw.js — minimal service worker handling push and notificationclick events. Phase 19 (PWA) extends this same file with offline shell + asset caching.
• apexPushOptIn() Alpine factory in static/js/shell.js — registers the service worker, requests permission, subscribes via PushManager, POSTs the subscription to the server. Detects unconfigured VAPID keys and shows a friendly status instead of attempting to subscribe.

Migrations

• 0004_notificationpreference_pushsubscription_and_more — schema changes for the new fields/models.
• 0005_backfill_category — back-fills category from the legacy kind enum so filter pills partition existing data correctly.

Tests

• 28 new unit tests (preferences, archive, push subscribe/unsubscribe, dispatch matrix). Total now 834.

Notes

• Real Web Push delivery requires VAPID keys + pywebpush. The model + endpoints + service worker + opt-in UI are shipped now; production delivery is a small follow-up that adds an apps/notifications/push.py module with send_push_to_user(). The notify() dispatcher already imports it lazily, so adding push delivery is a no-rewrite change.

Phase 12 — Forms 2.0. A polished widget library that subclasses Django's

forms.Widget with proper sizes, validation states, and helper text

plumbing. Closes the "form polish = perceived quality" gap with

floating-label inputs, chip-style multi-select, free-form tag input,

typeahead combobox, drag-drop file dropzone with XHR upload, date

range picker, and a self-hosted Markdown rich text editor.

Added — Widget library (apps/core/widgets/)

• WrappableWidget mixin + _field_wrapper.html — shared shell for label / widget / helper / error rendering with auto-detected validation state (default / success / warning / error).
• {% apex_field %} template tag — render any BoundField wrapped in the canonical Apex form-field shell. Auto-derives state from form errors; helpers can be overridden per-field.
• Three sizes (sm / md / lg) shared across every widget.

Added — Inputs

• FloatingLabelInput — single-line input with a label that floats inside on focus or when filled. Pure CSS, no JS for the float.
• FloatingLabelTextarea — multi-line variant with auto-grow (Alpine apexAutogrow) and optional character counter.
• IconPrefixInput — Lucide icon inside the left edge.
• IconSuffixInput — icon at the right edge; clickable=True makes it a button that dispatches apex:icon-suffix:click (for password show/hide, copy-to-clipboard, etc.).

Added — Choice

• MultiSelect — chip-style picker over a fixed option set. Backs forms.MultipleChoiceField. Posts as repeated form values.
• TagInput — free-form chips with paste-to-split + optional suggestion chips. Stores as a comma-joined string.
• Combobox — single-select typeahead with an optional async_url for HTMX/JSON-driven options.
• TypeaheadMixin — paired view mixin that converts ?_typeahead=1&q=… requests into JSON option lists.

Added — Date + upload

• DateRangePicker — trigger-button + popover with two native date inputs and preset shortcuts (Today, Last 7 days, etc.). Stores the range as a comma-joined ISO string.
• FileDropzone — drag-drop multi-file with previews and per-file XHR progress. Configurable upload_url, accept, max_files, max_size_mb. Endpoint must return JSON {id, name, size, url}; the widget tracks IDs in a hidden field.

Added — Rich content + helpers

• RichText — Markdown editor backed by self-hosted EasyMDE (vendored under static/{js,css}/vendor/, refreshable via npm run vendor:easymde). Toolbar presets: minimal, basic, full.
• apexCharCounter(maxLen) — Alpine helper for any text input with auto-coloring (amber → red) as you approach the cap.
• apexReveal(targetId, predicate) — show/hide a field group based on another field's value. Pure Alpine, no backend.

Added — Alpine factories (in static/js/shell.js)

• apexAutogrow(maxRows) — textarea auto-grow.
• apexDateRange({from, to}) — popover state + ISO string handling.
• apexCharCounter(maxLen) — character-count tracking.
• apexReveal(targetId, predicate) — conditional reveal.
• Extended apexDropzone with XHR upload mode, per-file progress, cancel, server ID tracking, and uploadedIds getter for the form hidden input.

Added — Template tags

• {% apex_field bound_field %} — wraps a field in _field_wrapper.html.
• {{ value|json_dumps }} — JSON-serialize a value for safe Alpine init.

Added — Demo upload endpoint

• pages:forms_gallery_upload — synthetic multipart endpoint backing the gallery's FileDropzone demo.

Settings

• FORM_RENDERER = "django.forms.renderers.TemplatesSetting" so widget templates resolve from the project templates/ directory.
• django.forms in INSTALLED_APPS so Django's built-in widget templates remain discoverable.

Forms upgraded

• Customer create/edit — FloatingLabelInput, IconPrefixInput (email), FloatingLabelTextarea (notes with character counter).
• Profile edit — FloatingLabelInput, IconPrefixInput (email), FloatingLabelTextarea (bio).
• Mail compose — Combobox (recipient), FloatingLabelInput (subject), FloatingLabelTextarea (body).
• Project create/edit + task + milestone — FloatingLabelInput, FloatingLabelTextarea, Combobox.

Forms gallery rewrite

• pages/forms_gallery.html rebuilt as a left-rail TOC with 12 widget sections + reference sections for validation states and sizes. Each section renders the live widget via {% apex_field %} and shows the Python snippet to declare the field.

Tests

• 81 new unit tests across base infrastructure, inputs, choice, date, upload, rich text. Total now 806.
• 7 new E2E tests covering the gallery + the upgraded Customer form.

Dependencies

• easymde@^2.20.0 (npm devDependency, vendored to static/).

Phase 11 — HTMX datatable. A reusable, server-driven table system that

any list view can opt into. Closes the "tables are where buyers stress-test

dashboards" gap with sort, filter, paginate, search, bulk actions, saved

views, column visibility, and three export formats — all without a SPA.

Added — Datatable system

• apps/core/tables/ package with TableConfig, Column, Filter, BulkAction frozen dataclasses + TableView mixin. Public API:

```python

from apps.core.tables import TableView, TableConfig, Column, Filter, BulkAction

```

• HTMX swaps for every interaction (sort, filter, search, paginate, bulk action) — server-rendered _table.html partial is the only thing that re-renders. URL is push-stated so back/forward works.
• 6 filter widgets: text, select, multi-select, daterange, numeric range, boolean. Filter value translation is whitelist-driven — URL params for unconfigured columns are silently ignored.
• Multi-column sort via ?sort=col1,-col2,col3. Disallowed columns drop silently.
• Bulk-action toolbar appears when ≥1 row selected. Confirm modal uses Phase 10's modal primitive. Subclasses implement handle_bulk_action(action, ids, request).
• Saved views (SavedView model) — per-user named filter+sort combos. Default-view auto-applies on bare visit; switcher / set-default / delete via ?_view_action=... round-trips.
• Column visibility (UserPreference model) — per-user persisted via a generic JSON-blob preference store. Pinned columns can't be hidden.
• 3 export formats: - CSV (stdlib csv, all rows of current filter) - XLSX (openpyxl — added as a runtime dep) - PDF (WeasyPrint, capped at 500 rows; cap check happens before importing WeasyPrint so the over-cap error works without cairo)
• Empty states with three modes auto-detected: "no data yet", "no matches" (filter narrowed too much), or generic "no rows". Per-table copy via TableConfig.empty_headline / empty_body.
• Mobile fallback — table collapses to stacked label/value cards under md via _row_card.html.

Added — Models

• UserPreference(user, key, value JSON) — generic per-user JSON store.
• SavedView(user, table_key, name, params, is_default) — per-table named filter+sort combos.

Added — Templates

• templates/core/tables/ — full set: _table.html, _table_body.html, _row.html, _row_card.html, _toolbar.html, _pagination.html, _empty.html, _skeleton.html, _export.html, _bulk_toolbar.html.

Added — Template tags

• {% sort_link col_key label %} — sortable header anchor with HTMX swap, asc → desc → unsorted toggle, ARIA-correct aria-sort.
• {% table_url page=N %} — preserve params with optional overrides.
• {% page_ids_script object_list config.key %} — feeds bulk selection.
• {{ obj|dotted_attr:"a.b.c" }} — walks dotted attribute paths on rows.
• {{ {…}|urlencode_dict }} — encodes a dict-of-lists for saved-view URLs.

Added — Alpine factory

• apexBulk({pageIds}) — selection + select-all-on-page + confirm modal state. Lives in static/js/shell.js.

Wired into

• Customers list — 6 columns, 3 bulk actions, friendly empty state.
• Orders list — 5 columns, 3 status-transition bulk actions.
• Invoices list — 6 columns, 3 lifecycle bulk actions.
• Products list — 6 columns, 2 publish/archive bulk actions.
• Users list — 5 columns, activate/deactivate bulk actions, boolean filter on is_active.
• Activity log — replaces the timeline grouping with a sortable, filterable, exportable audit table; KPI strip preserved on the page.

Showcase

• pages/datatable.html rewritten as a links-out grid pointing at the six TableView-powered list views, plus a "what's included" summary and a copy-paste view-creation snippet.
• seed_demo bumped from 20 → 100 customers so the table has realistic pagination and filter scenarios out of the box.

Tests

• 81 new unit tests (config, filters, prefs, models, view, bulk, saved views, exports). Total now 725.
• 8 new E2E tests covering search swap, sort, pagination, CSV download, bulk select, column visibility menu, save+apply view.

Removed

• The hand-rolled pages/datatable/ mock backend (200+ lines of static rows + custom filter/sort/export logic). Replaced by the real system.

Dependencies

• openpyxl>=3.1 (runtime).

Notes

• PDF export tests skip gracefully when WeasyPrint's native libs (cairo, pango, gdk-pixbuf) aren't installed, mirroring the existing apps/invoices/tests/test_pdf.py pattern.
• The activity log's old date-bucket timeline UI is replaced by a TableView. Trade-off accepted for sort + filter + export power; the KPI strip and scope=mine filter are preserved on the page.

Phase 10 — Component library. Adds a first-class /components/ surface

documenting every reusable UI primitive shipped with Apex, plus a

toast-notification system wired into Django's messages framework.

Added — Components surface

• apps.components new app with /components/ index + per-primitive detail pages (components:index, components:detail).
• 26 primitives across 7 categories, each on its own page with multiple documented variants: - Overlay: Modal, Drawer, Toast, Tooltip, Popover. - Disclosure: Tabs (underline / pill / vertical / with-badges), Accordion (single / multi / FAQ), Stepper (horizontal numbered / progress-bar / vertical). - Inputs: Datepicker, Daterange, Timepicker, Color picker. - Choice: Multi-select, Tag input, Combobox, Toggle group, Segmented control, Rating (interactive + read-only), Slider (single / stepped / min-max range). - Upload: File dropzone (multi-file with previews + single avatar). - Feedback: Skeleton, Spinner, Progress ring, Empty state. - Identity: Avatar (sizes / status dot / group stack / squared), Badge (status pills / dot / solid / counts / sizes).
• Component registry (apps/components/registry.py) — single source of truth for the index page + detail page lookup + palette keywords.
• "Components" sidebar entry under Showcase, with command-palette keyword search across modal / drawer / toast / tabs / accordion.

Added — Toast notification system

• **apps.core.messages.toast(request, level, body, *, action, persistent)** helper built on Django's messages framework. Existing messages.success(...) calls also light up automatically.
• {% apex_toasts %} inclusion tag drains messages into a JSON payload consumed by Alpine.
• Toast container partial (templates/partials/toasts.html) wired into layouts/dashboard.html and layouts/public.html. Sticky bottom right, aria-live="polite", per-level styling, action button, dismiss.
• window.apexToast({...}) global JS helper for client-side pushes without a server round trip.
• Reduced-motion respect: auto-dismiss extends 5s → 8s when prefers-reduced-motion is set.

Added — Alpine factories (in static/js/shell.js)

• apexModal(id), apexDrawer(id) — focus restoration on close, dispatch via $dispatch('apex:open', id).
• apexPopover() — local toggle with click-outside / Esc handling.
• apexTabs(initial) — roving tabindex + arrow / Home / End keyboard nav.
• apexAccordion({multi, initial}) — single / multi-open with isOpen / toggle API.
• apexToasts(), apexMultiSelect, apexTagInput, apexCombobox, apexDropzone — pattern factories powering the demo pages.

Added — Lucide icons

• 18 new lucide glyphs added to apps/core/templatetags/apex.py ICONS: blocks, panel-right, info, message-square, layout, chevrons-up-down, list-ordered, calendar-range, palette, list-checks, tag, toggle-right, sliders-horizontal, upload-cloud, inbox, user-circle, badge, loader-circle, square-stack.

Tests

• 30 new unit tests covering registry integrity, view auth gating, the toast extra_tags round-trip, and "every primitive returns 200" for all 26 slugs.
• 6 new E2E tests (Playwright) for index, modal, drawer, toast, tabs, accordion.

Notes

• Field-grade Django form widgets for Multi-select, Tag input, Combobox, Date range, and File dropzone land in Phase 12 — Forms 2.0. The Phase 10 demos document the patterns; Phase 12 hardens them into forms.Widget subclasses.

Major template-parity expansion. Closes the Tier-1, Tier-2, and Tier-3

gaps vs Metronic-class dashboard templates with 13 new phases of work.

Added — Dashboards

• 4 dashboard variants at /dashboards/{analytics,crm,ecommerce,saas}/, each with realistic mock data, theme-aware ApexCharts, and ~5 sections: - Analytics: page views chart, category revenue, top pages, top countries. - CRM: pipeline overview, deal stages donut, top sales reps, lead sources, recent deals, quarterly targets. - eCommerce: 30-day daily sales, order status, top products, sales by category, recent transactions, revenue targets. - SaaS: MRR/ARR growth, plan donut, marketing channels, user growth, recent signups, growth targets.
• New "Dashboards" sidebar group bundling Overview + 4 variants.
• 11 new ApexCharts factories in static/js/charts.js, all theme-aware.

Added — Apps

• Projects + Tasks + Milestones (apps/projects/): full CRUD with 4-tab detail surface (Overview / Tasks / Team / Activity), kanban-style task board, milestone tracker, soft-delete archive. 6 seeded projects.
• Public profile pages (apps/profiles/): rich user profile with 4 tabs (Overview / Projects / Activity / Connections), team directory, shared-project teammates view. New User fields: title, location, website.
• Activity log (apps/activity/): workspace-wide event stream driven by signal hooks on customer/order/invoice/project/task creation + login. Date-grouped buckets, category + scope filters, KPI strip.
• Subscription / billing portal (apps/billing/): Stripe-Customer- Portal-style surface with Subscription + PaymentMethod models, usage meters, plan comparison, payment-method management, cancel/reactivate.
• Help center / knowledge base (apps/help/): Category + Article models, full-text search, related articles, view counters. 6 categories + 19 seeded articles.
• Public blog (apps/blog/): Topic + Post models, featured hero, topic chips, search. 4 topics + 9 seeded posts with emoji covers.

Added — Showcase / status pages

• Coming Soon page with live Alpine countdown timer + email signup.
• Maintenance page (HTTP 503) with start + ETA timestamps.
• 503 Service Unavailable with synthetic incident reference.
• Forms gallery — every layout, input, validation state, choice control, size, and wizard-stepper pattern in one anchored page.
• Widgets gallery — stat cards, badges, avatars, leaderboard, progress targets, timeline, button variants, empty states.
• Datatable showcase with server-side sort/filter/search/paginate, column visibility, row density, bulk select, CSV export.
• API docs page with sticky sidebar nav, copy-to-clipboard code blocks, method pills, webhooks, errors, rate limits, SDKs, changelog.
• Maps page powered by Leaflet + OpenStreetMap (no API key required): customer markers + popups, MRR-proportional density circles, dark-mode tile filter. Leaflet loads only on this page via head_extra.

Added — Demo experience

• Strong demo password (ApexShowcase!2026) replaces demo1234 — no more Chrome "weak password" warnings on signin.
• DEMO_MODE setting auto-fills the login form's username and password fields and shows a small "Demo credentials" banner. Off in production by default; on in dev. Form-level autocomplete="off" + data-1p-ignore + data-lpignore so password managers don't offer to save the demo password.
• seed_demo reads from settings.DEMO_USERNAME / DEMO_PASSWORD so rotating the demo password is a single setting change.
• 11 new Lucide icons (eye, mouse-pointer, clock, trending-up, trophy, target, shopping-bag, rotate-ccw, user-minus, user-check, bar-chart-3, briefcase, check, map-pin) for the new pages.

Added — Tests

• 188 new unit tests bring the total to 588 passing (was 400).
• Coverage: model invariants, signal handlers, view filters, KPI math, CSV export shape, datatable sort + filter regressions, profile tab context counts, billing plan changes, payment-method scoping, help paragraph splitting, blog featured-hero behavior.

Changed

• README rewritten with a feature table broken into 4 sections (Dashboards / Apps / Marketing & content / Showcase / Account) and a comprehensive screenshot gallery covering every new page.
• capture_screenshots.py updated to capture all 50+ pages with dynamic resolvers for first-project / first-person / first-post slugs.
• Updated demo credential references across 14 e2e test files, getting-started.md, README, and CHANGELOG.
• Migrated nav from a flat list of 17 items to a structured 6-group sidebar (Dashboards / Commerce / Apps / Marketing / Showcase / Account) with 35 entries.

Initial MVP release.

Added

• Django 5.1 project scaffolding with Tailwind CSS v4 and pytest harness.
• Base template with Apex OKLCh design tokens, dark-mode flash prevention, and CDN-loaded Alpine + HTMX (with SRI hashes).
• Sidebar navigation with 5 MVP items (Dashboard, Orders, Products, Users, Settings) via context processor + inline Lucide SVG icon templatetag.
• Sticky header with theme toggle (persists via localStorage) and conditional logout form.
• Custom User model with avatar, role (admin/manager/staff), and bio fields.
• Auth flows: registration, login, logout, 4-step password reset.
• Dashboard landing with stats cards (4-up), revenue chart (ApexCharts area + 7d/30d/90d range selector), side panel (traffic donut + goal progress bars), recent orders table, and activity feed.
• Products module with Product + Category models and full CRUD (list, detail, create, edit).
• Orders module with Order + OrderItem models, CRUD, and inline formset for line items (Alpine-driven add-row).
• User management CRUD at /users/ gated to staff-only via StaffRequiredMixin.
• Profile settings page at /settings/ where users edit their own profile.
• Custom 403, 404, and 500 error pages.
• seed_demo management command that populates a demo DB (demo / ApexShowcase!2026 login + 15 users + 25 products + 30 orders).
• Playwright E2E smoke test suite (login, dashboard render, sidebar navigation, theme toggle, orders list).

Known limitations

• Verify-email flow is deferred; registration auto-logs-in without verification.
• Search input in the header is cosmetic (Phase 2).
• Mobile sidebar has no hamburger toggle (Phase 2).