From 22c92a7e9dc2fc789214ef6e9226d96ece199be6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Thu, 23 Jul 2026 12:48:42 +0200
Subject: [PATCH] =?UTF-8?q?chore(release):=20v1.32.3=20=E2=80=94=20native?=
 =?UTF-8?q?=20step-up=20elevations=20for=20iOS=202FA=20management?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 CHANGELOG.md          | 21 +++++++++++++++++++++
 docs/api/openapi.yaml |  2 +-
 package.json          |  2 +-
 public/sw.js          |  2 +-
 4 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c18822e10..abd7cd83e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,27 @@
 
 ## [Unreleased]
 
+## [1.32.3] — 2026-07-23
+
+Security release. It ships on its own so the change to how a second factor is
+proven can be watched in isolation.
+
+- **A native client can manage its own second factor.** The iOS app can now
+  turn two-factor authentication on or off, add or remove a security key, and
+  regenerate recovery codes over its API session — actions that were reachable
+  only from a browser before. It does so through a short-lived, single-use
+  elevation the app earns by re-proving a factor, never by presenting its
+  token alone.
+- **The re-proved factor decides what the elevation reaches.** Re-proving with
+  a password reaches exactly what a plain browser session reaches; the actions
+  a browser gates behind a completed second factor now require the same over
+  the API — a re-proved TOTP code or security key, never the password alone.
+  Administrative endpoints remain reachable only from a browser session,
+  unchanged.
+
+One migration (0267), additive. Addresses the native 2FA-management gap
+(healthlog-iOS #57).
+
 ## [1.32.2] — 2026-07-23
 
 Security release. Ships on its own and ahead of everything queued, because it
diff --git a/docs/api/openapi.yaml b/docs/api/openapi.yaml
index e0268565f..c5b78d02f 100644
--- a/docs/api/openapi.yaml
+++ b/docs/api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.32.2
+  version: 1.32.3
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 
diff --git a/package.json b/package.json
index 7472ddb99..a05dfc191 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.32.2",
+  "version": "1.32.3",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",
diff --git a/public/sw.js b/public/sw.js
index 11a5a8b8f..f06b7724d 100644
--- a/public/sw.js
+++ b/public/sw.js
@@ -36,7 +36,7 @@ try {
 // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild.
 const CACHE_VERSION =
   (typeof self !== "undefined" && self.__APP_VERSION__) ||
-  /* @sw-version-fallback */ "v1.32.2";
+  /* @sw-version-fallback */ "v1.32.3";
 const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`;
 const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`;
 // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`