[FEATURE] :APIs Security Report & Actions Finds where a user could see data that is not theirs, gives your account a score out of 100, and fixes many problems in one click. The report is kept in git and updates itself while your local client is connected or manually on button click.
[FEATURE] :Index Maker : automatic indexes. Switch the mode on and Index Maker records the queries of your APIs at regular intervals, asks the database with explain which ones use no index, and creates an index for the slow or frequent queries on big tables (thresholds, fields per index, indexes per table, excluded collections... are settings of the account). Every index goes into the migration script am_index_maker, a JSON list the script itself applies, so every environment creates the same indexes on its next deploy. The script can not be deleted, runs again without harm, and every decision is kept on its scanning period with the reason.
[FEATURE] :Index system APIs : g.sys.system.createIndexes, g.sys.system.dropIndexes and g.sys.system.getIndexes (and /create-indexes, /drop-indexes, /get-indexes) work the same on MongoDB, MySQL, MariaDB, SQL Server, PostgreSQL and Oracle. An index which exists already is EXISTS, a field no plain index can hold is SKIPPED with the reason, a refusal of the database is FAILED with its message.
[FEATURE] :Custom APIs : No need to define interfaces anymore for APIs response. System will identify them automatically for instance APIs. ex: g.sys.db.getAll
[IMPROVEMENTS] : Index Maker page redesigned : the automatic indexes panel, a summary of every scanning period with its state and shapes, suggestions with Add to script, and the index form with the verdict of every field, the existing indexes and the size of the table. Indexes get a name built from their fields, the same in every environment and within the limit of every database.
[IMPROVEMENTS] : Index names are quoted on Oracle and bracketed on SQL Server, so tables with lower-case or mixed-case names get their indexes.
[IMPROVEMENTS] : Docker tab added in analytics dashboard.
[IMPROVEMENTS] : Local Client : It will start immediately without installing and waiting for the dependencies. Local client is standalone now.
[IMPROVEMENTS] : Local Client : 2 way sync is implemented.
[IMPROVEMENTS] : Git status will not show difference when there is change of new line at the end of file.
[BUG] : Fields having encryption, decryption or hashing conversion can now be saved & updated with null value, earlier it was giving error or storing wrong value because API Maker was trying to convert the null value.
[BUG] : The schema code of a PostgreSQL table with an array or json column could not be generated.
[BREAKING] : The request header x-am-secret is removed. Every request uses the default secret of the account ; a request which still sends the header is answered as if it did not. To read another secret, name it from your code : g.sys.system.getSecret(keys, 'secret name').
[SECURITY] : The token of a person of a DB auth provider without passwordChangedAtColumn no longer carries the stored password (hash, cipher text or plain text). It carries a keyed fingerprint instead, which still ends the token when the password changes. Tokens made before keep working until they expire.
[SECURITY] : A token sent in x-am-user-authorization, and its refresh token, is accepted only by the DB auth provider which made it, in the admin user account which made it (your other accounts accept it only with the root setting Allow API Maker User's Token Across Admin Users, see below). Earlier any token signed by the server was read with the columns of the provider the API asked for : the token of an API user, of another provider or of another account could be accepted as a person when the columns it happened to carry matched a row, and a token without the username column answered 500 with the SQL error on PostgreSQL, SQL Server and Oracle. Such a token now answers 401 Invalid token provided in 'x-am-user-authorization' header. Tokens made before keep working until they expire, and a refresh gives them the new form. Only the tokens of a provider with passwordChangedAtColumn made before are refused, because they carry no password : those people sign in again once.
[BUG] : A DB auth provider whose usernameColumn is name works now. Its tokens always answered Token user not found, because the name of the provider was written over the name column in the token. A token now names its provider in __amTokenGenerator and its account in __amAdminUserId ; name in a token, and in g.req.body of the Fields Generator, is the name column of the person.
[IMPROVEMENTS] :Allow API Maker User's Token Across Admin Users covers the token of a database user (x-am-user-authorization) too. With the root setting on, the DB auth provider of the same name in your other admin user accounts accepts it, when the token is still valid in the account that issued it and the users table of the account serving the request has a person with the same username and the same password (compared as each table keeps it : plain, encrypted or hashed). The permissions are always those of the person in the account serving the request, and a password changed in the issuing account ends the token everywhere. Test tokens of the admin panel stay limited to their own account, and a refresh is asked of the account that issued the token.
[BUG] : With passwordChangedAtColumn and a password column stored as it is, the token of a person whose password had never changed (the column still empty) kept working after the first password change. It now ends with that change, like every other token ; its refresh token already did.
[BUG] : A request payload (x-am-encrypted-payload) encrypted with another key always answers 400 Unable to decrypt data of 'dataEncFE' field. ; it used to answer 500 or another message depending on the random bytes of the payload.
[IMPROVEMENTS] : The deployment hook form says that the hook URL and the access token take letters, digits and _ only, and checks it before saving.