From 28f15c92f3c1f2fe754bbf53043d94f69bda3468 Mon Sep 17 00:00:00 2001
From: Tower Bot <tower@odoosky.org>
Date: Thu, 30 Apr 2026 11:03:12 +0300
Subject: [PATCH] =?UTF-8?q?tower=200.61.2=20/=20tower-ui=200.61.7=20?=
 =?UTF-8?q?=E2=80=94=20fixes=20from=20end-to-end=20smoke?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

3 bugs caught while smoke-testing the multi-tenant signup → first
deploy flow:

1. /api/me returned capabilities: null when scope.role was nil
   (a tenant member viewing the platform tenant context). Frontend's
   useAuth.can() does for-of on the array → TypeError. Fix: backend
   returns []string{} not nil; frontend defends against null.

2. WelcomeView slug input pattern '[a-z][a-z0-9-]{2,39}' is rejected
   by Firefox's HTML5 form validation under the v-flag (treats trailing
   '-' as a class-range start). Move hyphen to start of the class.

3. Domain & DNS Save button is genuinely separate from the Cloudflare
   token Save (by design — token rotates independently). Documenting
   here so the next person doesn't think they saved when they didn't.
---
 values.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/values.yaml b/values.yaml
index 89eda2a..419c4be 100644
--- a/values.yaml
+++ b/values.yaml
@@ -9,7 +9,7 @@ backend:
     # so every cluster that runs Tower needs the same imagePullSecret
     # provisioned out-of-band (until cluster-platform-v3 owns it).
     repository: registry.odoosky.cloud/odoosky/docker-mirror/tower
-    tag: "0.61.1"
+    tag: "0.61.2"
     pullPolicy: IfNotPresent
   imagePullSecrets:
     - name: docker-mirror-pull
@@ -29,7 +29,7 @@ frontend:
   enabled: true
   image:
     repository: registry.odoosky.cloud/odoosky/docker-mirror/tower-ui
-    tag: "0.61.6"
+    tag: "0.61.7"
     pullPolicy: IfNotPresent
   imagePullSecrets:
     - name: docker-mirror-pull