Publishing a project stopped being a matter of copying files over FTP. Version 2.4.0 brought a dedicated endpoint to receive the project package and apply it to the installation.
What landed
- OAuth 2.0 server in the system itself, with JWT validation. The deploy endpoint only accepts authenticated calls.
- Automatic renewal: when the token expires, the client detects the 401 response, renews and repeats the call.
- Package validation: a 100 MB size limit, type and ZIP structure checked before applying, with or without a root folder.
- Database without command execution: the database update runs inside the same process, without
shell_exec, so it works on hosts that block command execution.
Day to day
A single command runs the sequence: update the resources, compress and upload. The release notes record an integration suite with six tests covering configuration, resources, deploy, OAuth and the API.
This endpoint is the origin of what later became the project pipeline and the safe update.
Source: Core · v2.4.0