merge branch v2 (release 2.0.0-beta.38)

Author: marcantondahmen

.gitignore

@@ -1,3 +1,4 @@
+/automad/.wizard-completed
 /automad/legacy
 /automad/src/client/blocks/legacy
 /automad/tests/main/config

CHANGELOG.md

@@ -1,8 +1,18 @@
 # Changelog
 
-## [v2.0.0-beta.37](https://github.com/marcantondahmen/automad/commit/8c19c19fedd220cea58d9a1f98f7d51a84a988bc)
+## [v2.0.0-beta.38](https://github.com/marcantondahmen/automad/commit/6fea03e6f009b332a65f620bf727ae25db8576b6)
 
-Tue, 2 Jun 2026 21:59:07 +0200
+Sat, 6 Jun 2026 21:44:32 +0200
+
+### New Features
+
+- add setup wizard for new installations and after system updates ([9be052c4c](https://github.com/marcantondahmen/automad/commit/9be052c4ca7697a42725b22ffdb366d2aa639bff))
+- include + into regex for valid email addresses ([fafec3c71](https://github.com/marcantondahmen/automad/commit/fafec3c718c01f9d64d00a20e4747fbb19b600fc))
+- update standard-lite theme ([6fea03e6f](https://github.com/marcantondahmen/automad/commit/6fea03e6f009b332a65f620bf727ae25db8576b6))
+
+## [v2.0.0-beta.37](https://github.com/marcantondahmen/automad/commit/c24eb96ee1c9743d568e33a376dea2263af5c22a)
+
+Tue, 2 Jun 2026 22:01:05 +0200
 
 ### Bugfixes
 

SECURITY.md

@@ -41,7 +41,17 @@ After successfully being authenticated, the _username_ and a _csrf token_ will b
 
 ### Implications for Security
 
-In order to fully understand possible attack vectors and the severity of reported vulnerabilities, one has to take the architectural concept, the way sessions work in Automad and the limitation of the visitor role into account. Generally, vulnerabilities can be broken down into two categories — _XSS (cross-site-scripting)_ and _CSRF (cross-site-request-forgery)_.
+In order to fully understand possible attack vectors and the severity of reported vulnerabilities, one has to take the architectural concept, the way sessions work in Automad and the distinction between visitors and admins into account. In particular, it is important to understand which actions are available to visitors, which actions require administrative privileges and where actual security boundaries exist.
+
+#### Administrative Capabilities
+
+Admins are fully trusted users that are granted complete control over an Automad installation by design. Among other things, admins can create and modify content, change configuration, install Composer packages, install and modify templates, deploy extensions and execute arbitrary PHP and JavaScript code as part of normal site development and maintenance workflows.
+
+As a consequence, reports that require authenticated admin access and only demonstrate actions that could already be performed through custom templates, extensions, Composer packages, arbitrary PHP code or other administrative capabilities are generally not considered security vulnerabilities.
+
+Such reports do not constitute privilege escalation, authentication bypass, unauthorized access or a security boundary violation. To be considered a security vulnerability, a report must demonstrate that an attacker can gain capabilities beyond those already granted to an authenticated admin or affect visitors without administrative privileges.
+
+Please make sure that you understand Automad's architecture and security model before submitting a report.
 
 #### XSS
 

automad/lang/english.json

@@ -432,7 +432,6 @@
 	"passwordRepeatError": "Please enter twice the same new password!",
 	"passwordRequirementsError": "A password must at least contain one character of {1} and has a minimum length of {2} characters.",
 	"passwordResetSave": "Save password",
-	"passwordResetToken": "Authentication token",
 	"passwordReuseError": "Don't reuse your old password!",
 	"penTool": "Pen",
 	"permissionsDeniedError": "Permissions denied",
@@ -523,7 +522,7 @@
 	"systemAiCardInfo": "Configure AI providers for an AI assisted editing experience",
 	"systemAiChangeApiKey": "API key",
 	"systemAiClaudeSetupHelp": "Using the Claude API requires an account on their <a href='{urlPlatform}' target='_blank'>API platform page</a>, an active billing setup, and a valid API key, which can be managed <a href='{urlApiKeys}' target='_blank'>here</a>.",
-	"systemAiInfo": "Enable AI-assisted editing to enhance your writing workflow directly in the editor. Use the AI assistant to rewrite, expand, summarize, translate, and refine content, helping you create and improve text more efficiently.",
+	"systemAiInfo": "AI assistance helps you generate, rewrite, and improve content directly inside content editors. It is an optional feature and you are free to disable it entirely at any time. When turned off, the system will operate without any AI-powered functionality.",
 	"systemAiOpenAiSetupHelp": "Using OpenAI requires an account on their <a href='{urlPlatform}' target='_blank'>API platform page</a>, an active billing setup, and a valid API key, which can be managed <a href='{urlApiKeys}' target='_blank'>here</a>.",
 	"systemAiProviderApiKeyModalButton": "Validate and save",
 	"systemAiProviderApiKeyModalTitle": "API Key",
@@ -565,7 +564,7 @@
 	"systemMailConfigError": "Error saving mail configuration.",
 	"systemMailInfo": "You can configure how emails are sent for registration, account recovery or from contact forms on the website. By default, Automad uses PHP's sendmail function for this. However, it is recommended to send emails via an SMTP server, whose access data can be entered below.",
 	"systemMailReset": "Do you want to reset the current email configuration?",
-	"systemMailSendTest": "Send test email",
+	"systemMailSaveSendTest": "Save and send test email",
 	"systemMailSendTestNoEmail": "There is no email address associated with your user account. Please add a valid email address inside the user settings.",
 	"systemMailSendTestSuccess": "A test email was successfully sent to",
 	"systemMailSmtpPasswordPlaceholder": "Leave this field empty in order to keep the existing password",
@@ -699,6 +698,13 @@
 	"visitSyntaxGallery": "Visit the syntax theme gallery",
 	"warmthTool": "Warmth",
 	"watermarkTab": "Watermark",
+	"wizardButtonBack": "Back",
+	"wizardButtonFinish": "Finish",
+	"wizardButtonNext": "Next",
+	"wizardFinishDialogButton": "Finish configuration",
+	"wizardFinishDialogText": "You can review and update these settings at any time in the System Settings section. Would you like to finish the configuration wizard now?",
+	"wizardSubtitle": "You are almost ready. Please review the following settings and confirm that they match your requirements and are configured as intended.",
+	"wizardTitle": "Complete Your Configuration",
 	"write": "Write",
 	"zoomInTitle": "Zoom in",
 	"zoomOutTitle": "Zoom out"

…ient/admin/components/Forms/SetupForm.ts …admin/components/Forms/CreateUserForm.tsautomad/src/client/admin/components/Forms/SetupForm.ts renamed to automad/src/client/admin/components/Forms/CreateUserForm.ts automad/src/client/admin/components/Forms/SetupForm.ts renamed to automad/src/client/admin/components/Forms/CreateUserForm.ts

@@ -48,7 +48,7 @@ import { FormComponent } from './Form';
  *
  * @extends FormComponent
  */
-export class SetupFormComponent extends FormComponent {
+export class CreateUserFormComponent extends FormComponent {
 	/**
 	 * The callback function used when an element is created in the DOM.
 	 */
@@ -171,4 +171,4 @@ export class SetupFormComponent extends FormComponent {
 	}
 }
 
-customElements.define('am-setup-form', SetupFormComponent);
+customElements.define('am-create-user-form', CreateUserFormComponent);

automad/src/client/admin/components/Forms/MailConfigForm.ts

@@ -206,24 +206,35 @@ export class MailConfigFormComponent extends FormComponent {
 
 		this.listen(transportSelect, 'change', toggleSmtpCard);
 
-		const footer = create('div', [CSS.flex, CSS.flexGap], {}, this);
+		const footer = create(
+			'div',
+			[CSS.flex, CSS.flexGap, CSS.flexWrap],
+			{},
+			this
+		);
 
-		create(
-			'am-submit',
+		const sendTestMail = create<HTMLButtonElement>(
+			'button',
 			[CSS.button, CSS.buttonPrimary],
-			{ disabled: 'true' },
+			{},
 			footer,
-			App.text('save')
+			App.text('systemMailSaveSendTest')
 		);
 
 		const reset = create(
 			'button',
-			[CSS.button, CSS.buttonDanger],
+			[CSS.button],
 			{},
 			footer,
 			App.text('reset')
 		);
 
+		this.listen(sendTestMail, 'click', async () => {
+			await this.submit();
+
+			await requestAPI(MailConfigController.test);
+		});
+
 		this.listen(reset, 'click', async () => {
 			if (!(await confirm(App.text('systemMailReset')))) {
 				return;

automad/src/client/admin/components/Pages/BaseCenteredLayout.ts

@@ -52,6 +52,7 @@ export abstract class BaseCenteredLayoutComponent extends BaseLayoutComponent {
 	 */
 	protected partials: Partials = {
 		main: this.renderMainPartial(),
+		variant: this.getVariant(),
 	};
 
 	/**
@@ -60,4 +61,13 @@ export abstract class BaseCenteredLayoutComponent extends BaseLayoutComponent {
 	 * @returns the rendered HTML
 	 */
 	protected abstract renderMainPartial(): string;
+
+	/**
+	 * Use a custom variant class for the centered content.
+	 *
+	 * @return the variant css class
+	 */
+	protected getVariant(): string {
+		return '';
+	}
 }

…rc/client/admin/styles/utils/margin.less …ent/admin/components/Pages/CreateUser.tsautomad/src/client/admin/styles/utils/margin.less renamed to automad/src/client/admin/components/Pages/CreateUser.ts automad/src/client/admin/styles/utils/margin.less renamed to automad/src/client/admin/components/Pages/CreateUser.ts

@@ -22,18 +22,54 @@
  *               ::::   ::::    ..''
  *               :::: ..:::: .:''
  *                 ''''  '''''
- * 
+ *
  *
  * AUTOMAD
  *
- * Copyright (c) 2026 by Marc Anton Dahmen
+ * Copyright (c) 2022-2026 by Marc Anton Dahmen
  * https://marcdahmen.de
  *
  * See LICENSE.md for license information.
  */
 
-.am-u-margin {
-	&-top-none {
-		margin-top: 0 !important;
+import {
+	Attr,
+	getTagFromRoute,
+	html,
+	Route,
+	UserCollectionController,
+} from '@/admin/core';
+import { BaseCenteredLayoutComponent } from './BaseCenteredLayout';
+
+/**
+ * The create user view.
+ *
+ * @extends BaseCenteredLayoutComponent
+ */
+export class CreateUserComponent extends BaseCenteredLayoutComponent {
+	/**
+	 * Set the page title that is used a document title suffix.
+	 */
+	protected get pageTitle(): string {
+		// Setup happens before a user can set a language.
+		// Therefore the title will be by default in English.
+		return 'Create User';
+	}
+
+	/**
+	 * Render the main partial.
+	 *
+	 * @returns the rendered HTML
+	 */
+	protected renderMainPartial(): string {
+		return html`
+			<am-create-user-form
+				${Attr.api}="${UserCollectionController.createFirstUser}"
+				${Attr.focus}
+				${Attr.enter}
+			></am-create-user-form>
+		`;
 	}
 }
+
+customElements.define(getTagFromRoute(Route.createuser), CreateUserComponent);

automad/src/client/admin/components/Pages/Partials/System/Mail.ts

@@ -32,26 +32,28 @@
  * See LICENSE.md for license information.
  */
 
-import { App, Attr, CSS, EventName, MailConfigController } from '@/admin/core';
+import {
+	App,
+	Attr,
+	CSS,
+	EventName,
+	html,
+	MailConfigController,
+} from '@/admin/core';
 
 /**
  * Render the email section.
  *
  * @returns the rendered HTML
  */
 export const renderMailSection = (): string => {
-	return `
+	return html`
 		<p>${App.text('systemMailInfo')}</p>
 		<div class="${CSS.flex} ${CSS.flexColumn} ${CSS.flexGapLarge}">
-			<am-mail-config-form 
+			<am-mail-config-form
 				${Attr.api}="${MailConfigController.save}"
 				${Attr.event}="${EventName.appStateRequireUpdate}"
 			></am-mail-config-form>
-			<am-form ${Attr.api}=${MailConfigController.test}>
-				<am-submit class="${CSS.button}">
-					${App.text('systemMailSendTest')}
-				</am-submit>
-			</am-form>
 		</div>
 	`;
 };

automad/src/client/admin/components/Pages/Partials/System/Users.ts

@@ -57,9 +57,7 @@ export const renderUsersSection = (): string => {
 			${Attr.event}="${EventName.appStateRequireUpdate}"
 			${Attr.watch}
 		>
-			<h2 class="${CSS.marginTopNone}">
-				${App.text('systemUsersYourAccountHeading')}
-			</h2>
+			<h2>${App.text('systemUsersYourAccountHeading')}</h2>
 			<p>${App.text('systemUsersYourAccountText')}</p>
 			<div class="${CSS.flex} ${CSS.flexColumn} ${CSS.flexGap}">
 				<am-form-error></am-form-error>