Lantern

Appearance

Changelog - Dev - 06.29.2026 ​

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog.

[Unreleased] - 2026-06-29 ​

Added ​

  • Sealed-identity Stage B phoneHash to userId sealing: Implements Stage B of sealed-identity: seals the phoneHash to userId resolution under the user's PIN so the server can no longer map phone numbers to user IDs. New accounts are born sealed; existing accounts migrate lazily at next login. Ships dormant behind feature flags (STAGE_B_SEALED_USERID_ENABLED server-side, VITE_STAGE_B_SEALED_USERID client-side), with no user-facing behavior change until explicitly enabled per environment. (#627) enhancement
  • Manual ban/unban drawer with moderation UI: Adds a slide-in drawer interface for manual ban and unban operations, replacing inline moderation controls. Includes support for banning by phone number and unban by phone number to lift standalone bans. Drawer closes on outside click and features styled CTA buttons with gradient/glow effects. (#627) enhancement
  • Moderation cases prototype with filters and activity tracking: Introduces a moderation cases prototype in the admin panel with filtering, drawer sub-navigation, notes, activity logs, and sticky headers. Includes visual mock data and establishes the foundation for reports/cases/notices model documented in the safety section. (#627) enhancement
  • Ban/unban and purge-orphans in dev tools OTP group: Adds ban, unban, and purge-orphans commands to the DEV TOOLS OTP group in lantern-control, enabling developers to manage test account bans and clean up sealed test-account orphans during development. (#627) enhancement
  • OTP test ban now blocks full Auth login: Expands otp:test:ban to enforce a full ban that blocks Auth login, not just signup. Allows comprehensive testing of ban enforcement across all authentication flows. (#627) enhancement
  • OTP purge-orphans command for sealed test cleanup: Adds otp:test:purge-orphans command to clean up sealed test accounts that lack corresponding OTP records, supporting Stage B testing and development workflows. (#627) enhancement
  • Ban/unban support in dev OTP test helper: Extends the dev OTP test helper with ban and unban operations, enabling developers to test ban enforcement during development and testing. (#627) enhancement

Changed ​

  • Login error messaging for banned and disabled users: Changes login error messaging to show banned or disabled users a clear, specific message instead of the generic 'Incorrect PIN' error, improving transparency and user experience. (#627) enhancement
  • Moderation drawer UI sizing and styling refinements: Refines the manual ban/unban drawer with improved sizing (1/3 viewport width), segmented toggles sized to content rather than full-width, identifier input width constraints, and gradient/glow styling on CTA buttons and selected toggles. (#627) enhancement
  • Dev OTP reset and delete operations for Stage B: Updates dev OTP reset and delete operations to be Stage B-aware, ensuring proper handling of sealed accounts during development and testing. (#627) enhancement

Fixed ​

  • VitePress build backtick angle-bracket placeholders: Fixes documentation build issues by properly escaping angle-bracket placeholders with backticks so VitePress renders them correctly. (#627) enhancement
  • Block scripted token login for banned sealed accounts: Prevents scripted /token endpoint login for banned sealed accounts, closing a potential bypass in ban enforcement for Stage B sealed identities. (#627) enhancement
  • Block login for banned phones including sealed accounts: Enforces ban checks at login for banned phone numbers, including sealed accounts, ensuring consistent ban enforcement across all authentication flows. (#627) enhancement
  • Seal strips plaintext phone field not just phoneHash: Corrects the sealing process to strip both the plaintext phone field and phoneHash, preventing unintended data leakage during Stage B migration. (#627) enhancement
  • Weak PIN check only applies when setting PIN: Removes weak-PIN validation when entering a PIN during login or unlock, allowing users to authenticate with any PIN they previously set. (#627) enhancement
  • Scripts panel re-points when active folder switches: Fixes lantern-control Scripts panel to update its reference when the active folder changes, preventing stale script references. (#627) enhancement
  • Force-reinstall VS Code extension with flag: Adds --force flag to VS Code extension installation to ensure clean reinstalls during development. (#627) enhancement
  • Remove em dash from sync-skills AUTO-SYNCED header: Removes em dash character from the sync-skills AUTO-SYNCED header for consistency with project style guidelines. (#627) enhancement

Security ​

  • Sealed-identity Stage B privacy and ban enforcement: Implements privacy-critical Stage B sealing that prevents the server from mapping phone numbers to user IDs, combined with comprehensive ban enforcement across signup, login, and token endpoints to block banned users from accessing the system. (#627) enhancement

Update - 2026-06-29 17:24 UTC ​

Fixed ​

  • Add phoneHash login fallback for flag-off environments: When the STAGE_A_PHONE_HASH_LOOKUP_ENABLED flag is disabled, accounts created with phoneHash-only credentials were incorrectly returning "No account found" errors. The login handler now falls back to a phoneHash query when plaintext phone lookup is unavailable, ensuring accounts remain accessible regardless of flag state. (#628) bug

Update - 2026-06-29 20:25 UTC ​

Added ​

  • Activity skeletons and shared login-activity utilities: Introduces skeleton placeholders on the Users and Activity pages during data load, improving perceived performance and providing visual feedback while queries complete. (#632) enhancement
  • Rework Users page in Moderation idiom: Restructures Admin > Users to mirror the Moderation page pattern, replacing the Dashboard view with Users and Activity sub-nav tabs and moving user-creation actions into right-side overlay drawers for consistency. (#632) enhancement

Fixed ​

  • User-row selection, drawer polish, UID search, and cross-surface last-login: Fixes selection row focus-visible styling, improves drawer UX, enables UID-based search, and ensures last-login data displays consistently across admin surfaces. (#632) enhancement
  • Selection row focus-visible and create-form section dividers: Improves keyboard navigation accessibility on selection rows and adds visual section dividers in creation forms for better information hierarchy. (#632) enhancement

Built with VitePress

Copyright © 2026 Lantern