Skip to content
ironflow

Ironflow v0.27.0

Ironflow v0.27.0 closes three tenant-isolation gaps in authentication, secrets, and webhook ingest, and adds a one-command deploy of Ironflow to a single VPS over SSH. Event queries on both backends were re-indexed against their real query shapes, and the docs site was rebuilt around one flat sidebar.

Breaking Changes

Section titled “Breaking Changes”
  • Tenant requests must now carry an environment scope. envFilter is the only tenant predicate on the events table, and it appended nothing when the request context had no environment — so a tenant principal reaching a list handler without one read every organization’s rows. A single guard at dispatchAuthenticated now returns 403 for any non-platform principal with an empty environment, covering every envFilter-scoped table rather than the two handlers the issue named. CreateAPIKey also rejects an env-less tenant key, enforced in the store so all four mint sites are covered. No data migration: none of the mint sites could produce an env-less tenant key, but if one exists in a live database it now 403s at authentication instead of reading deployment-wide (#1560)

Features

Section titled “Features”
  • ironflow deploy: put Ironflow on a single VPS over SSH. One command provisions and deploys to a plain virtual machine — no Kubernetes, no Helm, no cluster (#1564)
  • Public issue tracker. Bug reports now route to sahina/ironflow-issues, linked from the marketing site and the docs (#1554, #1552)
  • Flat, subject-grouped docs sidebar. The Diataxis tabs are gone; one sidebar organized by subject replaces them (#1584)

Fixes

Section titled “Fixes”
  • Cross-tenant secrets isolation. A tenant API-key request whose declared environment differed from the key’s scope is now rejected, and every secrets handler reads the authenticated request context instead of a caller-supplied header. Environment names resolve within the API key’s project, so duplicate names like default across tenants stay valid (#1557)
  • Webhook ingest-token rejection rows are bounded per source and written off the response path — an unauthenticated caller could previously drive unbounded row growth and add write latency to the reject path (#1555, #1558)
  • SQLite TEXT timestamps now pass through a single choke point, ending the format drift between write sites (#1574)
  • Docs nav points at the introduction page, not Getting Started (#1588)
  • Marketing nav logo is vertically centered on desktop (#1580)

Improvements

Section titled “Improvements”
  • Event indexes re-keyed to the queries that actually run. SQLite’s idx_events_timestamp is now (timestamp, id) to match the real ordering, and the redundant idx_events_env was dropped on both backends (#1559, #1561)
  • Flow Map endpoints are cached and firehose payloads trimmed, cutting load on high-traffic maps (#1556)
  • Docs audited against the implementation. A full source-verified pass fixed three factual errors, corrected CLI-vs-MCP coverage claims, and repaired run --status help text; “What is Ironflow?” was rewritten as a 60-second orientation page; a new guide covers running Ironflow alongside your app in Go, TypeScript, Python, and REST (#1587, #1590, #1576, #1585, #1578)

Ironflow Desktop ships on its own cadence — see the Desktop changelog for its release notes.