Release v1.3.0

Minor Changes

• 53b1f57: Workout tracker: client notes and colored blocks

  • Exercise client note: unified add/edit UI (NoteField) with lucide icons (Plus/Pencil), label-prefixed display, moved to the bottom of the exercise card.
  • Workout note: the per-session note (workout-logs.notes) is now editable in the tracker footer; relabeled from "session" to "workout" to avoid ambiguity.
  • Colored blocks: groups can be merged into one colored band via the new bundleWithPrevious field on workout-groups. The loader bundles consecutive groups into blocks (index resets per section); the tracker renders one background per block.
  • Workout ID is shown in the tracker header for identification.

---

Pull Requests

No merged pull requests found for this release.

---

Full Changelog: v1.2.0...v1.3.0

Release v1.2.0

Minor Changes

• 0b33cdd: Harden security across configuration, auth, and HTTP headers.

  Requires running DB migrations on deploy (two migrations included).

  Configuration & API surface:

  • Explicit auth config on users and clients (2h token expiration, 5 max login attempts, 10 min lockout, secure cookies in production, sameSite: Lax)
  • Add serverURL, CORS and CSRF whitelists scoped to NEXT_PUBLIC_BASE_URL
  • Disable the unused GraphQL API and remove its routes to shrink the public API surface
  • Restrict Media uploads to images and cap file size at 5 MB

  Auth & data:

  • Enforce a minimum password length of 15 characters (NIST) on users and clients
  • Enable versioning/audit history on plans and clients (migration 20260618_162028_security_versioning)
  • Drop the share-links version tables and type to avoid retaining live tokens in history (migration 20260618_172305_drop_share_links_versions)

  HTTP security headers (next.config.ts):

  • HSTS (with preload), X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and a frame-ancestors 'self' CSP

---

Pull Requests

No merged pull requests found for this release.

---

Full Changelog: v1.1.1...v1.2.0

Release v1.1.1

1.1.1

Patch Changes

• d7d2235: Disable Postgres schema auto-push (push: false). Schema changes now go exclusively through migrations (payload migrate:create + payload migrate), so running yarn dev can no longer sync schema directly into a remote/production database. After this change a fresh database must be migrated before the app can run.

What's Changed

Other Changes

• Release/v1.1.1 by @kriss145 in #5

Full Changelog: v1.1.0...v1.1.1

Release v1.1.0

Minor Changes

• 143180b: Add Share Links feature (Phase 1 & 2): new share-links Payload collection with token auto-generation, expiry date, and per-link permissions (plan preview / results). Custom admin UI component shows the full share URL with a one-click copy button.
• 60adf5f: Add Share Links — Phase 3: readOnly mode across component chain and share page refactor. Adds readOnly prop to SeriesRow, ExerciseCard, WorkoutTracker, and WorkoutPlansAccordion — hides all mutation controls when true. Replaces the hardcoded PlanSection on the share page with WorkoutPlansAccordion readOnly={true}. Bug fixes: microcycles and workouts collections now expose read: isAuthenticated; training-plan-loader calls loadPlansItems with overrideAccess: true. Refactoring: fmtMinSec, isValidValue, buildExerciseMeta, and workoutGroupLabel extracted to lib/date.ts / lib/metrics.ts; loader renamed to load-plans-items.ts.
• 275c280: Add Share Links — Phase 4: results (logs) via share-token cookie. Middleware sets an HttpOnly share-token cookie on /share/* routes. New canReadViaShareToken access function validates the cookie and gates read access to workout-logs and set-logs for the plan owner's data. WorkoutTracker and WorkoutPlansAccordion gain a showResults prop — when true, logs are fetched client-side in read-only mode using the cookie for authorization.

---

Pull Requests

No merged pull requests found for this release.

---

Full Changelog: v1.0.1...v1.1.0

Release v1.0.1

Patch Changes

• Add release automation and improve repository documentation and presentation

---

Pull Requests

No merged pull requests found for this release.

---

Full Changelog: v1.0.0...v1.0.1

v1.0.0 - Initial release

Initial release

Open-source coaching app built with Payload CMS 3 and Next.js 16.

Features

• Workout plan hierarchy: Plan -> Microcycle -> Workout -> WorkoutGroup -> ExerciseRow
• Set logging: reps, weight, RIR, time, rounds per set
• Coach admin panel with full CRUD via Payload CMS admin
• Mobile-friendly client web app for workout tracking
• i18n: Polish and English (next-intl)
• PostgreSQL via @payloadcms/db-postgres

Tech stack

• Next.js 16 (App Router)
• Payload CMS 3
• PostgreSQL
• Tailwind CSS
• TypeScript 6

Getting started

See README for setup instructions.