Bump package manifests, README badges, and logger/monitoring defaults
to 1.5.0 covering this cycle's user-facing changes:
- New POST /api/logout with CSRF guards (X-Requested-With + Origin +
Sec-Fetch-Site) and the sensitive rate-limit preset; frontend
logout() always clears local state (cache, OTP timers, secrets,
search) so users can sign out even when the server is unreachable
- Bulk import is now chunked into 100-item batches with a
pending_backup_hash trail so large imports stay within rate limits
and never lose backup coverage on partial failures
- Restore flow now accepts directly uploaded backup files
- P1 responsive refactor: mobile bottom-sheet modals, sort moved into
a search-row popover, FAB consolidated to bottom-right; theme and
PWA install entries relocated under Settings > Preferences
- Native confirm() replaced with a themed showConfirmDialog (focus
trap, ARIA, danger variant, re-entrancy guard); body-scroll lock
is reference-counted so stacked modals stop leaking the lock
Docs:
- API_REFERENCE.md gains the /api/logout endpoint in the public list,
endpoint table, dedicated section, and the rate-limiting matrix
- README.md / README_EN.md mention the Sign Out entry under Settings
Add a dedicated /api/secrets/export route (api/secrets/export.js)
that streams the unified backup format (JSON/CSV/HTML/TXT) with size
and auth guards. Settings persist the preferred export format per
user; backup runs pick it up so generated files match the chosen
schema. The UI settings label/toast reads "导出偏好格式" to clarify
the preference applies to batch export and backup export. The
Service Worker passes through offline responses, utils/backup-format.js
is slimmed down after route consolidation, and unused createdAt is
dropped from the unified format and validation.
Add OAuth2 flows and REST clients (utils/oauth.js, utils/onedrive.js,
utils/gdrive.js) plus UI tools so backups mirror to personal cloud
drives. New /api/onedrive/* and /api/gdrive/* routes handle auth,
token refresh and push; triggerBackup() fans out to configured
providers alongside S3/WebDAV. Adds CLOUD_DRIVE_SETUP.md, validation
for the new secrets, and coverage across api/utils layers.
