Bereket Engida
692d96bd49
fix(auth): identify accounts by providerId and accountId again
...
Remove the account issuer column introduced in 1.7.0 together with
account.identityStrategy, the accountIssuer provider option, and the
guided auth migrate plan/apply workflow. Accounts are recognized by
(providerId, accountId) as in 1.6.
2026-09-03 21:13:04 -07:00
5fe5bc21d1
fix(generic-oauth): skip providers whose discovery fails ( #10978 )
...
Co-authored-by: Yuzhong Zhang <BetterAndBetterII@users.noreply.github.com >
Co-authored-by: Taesu <bytaesu@gmail.com >
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-09-04 01:01:57 +00:00
Taesu and GitHub
a9d8c12d14
feat(haveibeenpwned): expose password compromise check ( #11147 )
2026-09-04 00:26:54 +00:00
Taesu and GitHub
3e9e19746e
feat(oauth): support custom token request authentication ( #11101 )
2026-09-02 14:45:20 +00:00
Taesu and GitHub
626adf6717
docs: establish social provider integration policy ( #11059 )
2026-08-30 01:29:44 +00:00
Gustavo Valverde and GitHub
6a0a7cbcb1
fix(auth): preserve provider-scoped account identity ( #10969 )
2026-08-28 22:34:54 +00:00
Taesu and GitHub
88f36c63cf
docs: add versioned documentation ( #11041 )
2026-08-29 07:10:36 +09:00
Taesu and GitHub
5bd709640a
fix(two-factor): reject re-enrollment when TOTP is active ( #11037 )
2026-08-28 19:20:46 +00:00
Taesu and GitHub
b4ad5a110c
refactor: centralize placeholder email generation ( #10982 )
2026-08-25 08:15:14 +00:00
d7141a8a31
docs: add APIMethod documentation for anonymous sign-in endpoint ( #7516 )
...
Co-authored-by: Arthur Zhang <a8zhang@uwaterloo.ca >
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-08-24 17:50:37 +09:00
Taesu and GitHub
73a61ec1b7
docs: sync sidebar navigation and links ( #10868 )
2026-08-18 21:27:37 +00:00
Gustavo Valverde and GitHub
f451d1c758
fix(oauth-provider): complete RP-initiated logout flow ( #10812 )
2026-08-14 17:35:54 +00:00
Gustavo Valverde and GitHub
801968e354
fix(oauth-provider): accept issuer audience for client assertions ( #10811 )
2026-08-14 17:35:53 +00:00
Taesu and GitHub
a966815b13
fix(oauth-provider): handle voluntary and essential ACR requests ( #10790 )
2026-08-13 19:10:36 +00:00
Gustavo Valverde and GitHub
3ca2c08dc3
fix(device-authorization): enforce RFC device flow requirements ( #10752 )
2026-08-11 18:05:25 -04:00
6782647d7c
refactor(oauth-provider)!: separate device grant ownership ( #10746 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-08-11 19:45:23 +00:00
Gustavo Valverde
73d6f80e5b
chore(sync): merge main into next
2026-08-11 14:14:49 -04:00
999acbd41d
Merge commit from fork
...
* fix(sso): bind domain verification to provider state
Complete domain verification with an atomic guarded transition keyed by the provider row, exact domain snapshot, and unverified state. Concurrent provider mutations now return a retryable conflict instead of applying stale DNS proof.
Document the conflict behavior and cover provider mutation, replacement, deletion, simultaneous verification, memory-adapter, and downstream trust cases.
* fix(sso): allow domain verification when the stored bit is null
* test(sso): assert the resolved DNS hostname outside the mock callback
* fix(sso): require verified domains for organization assignment
Use verified persisted provider domains and canonical verified user emails for domain-derived routing and organization membership. Keep explicit organization-bound SSO provisioning separate from domain trust.
* fix(sso): scope domain verification to organization assignment
* fix(sso): keep verified provider lookup internal
---------
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-08-11 13:50:45 -04:00
Taesu and GitHub
d79740cb9c
docs(two-factor): align enrollment guidance with current behavior ( #10745 )
2026-08-10 12:45:03 -04:00
Maxwell and GitHub
081d3c379c
feat(username): disable display-name ( #10330 )
2026-08-06 05:39:24 +00:00
Gustavo Valverde and GitHub
8b96573d78
fix(scim): create filtered PATCH values when no target matches ( #10682 )
2026-08-04 20:01:07 -04:00
Gustavo Valverde
5af0b3b77e
chore(sync): merge main into next
2026-08-04 18:34:05 -04:00
40ced39621
fix(cookies): decouple cookie cache from JWT plugin internals ( #10666 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-08-04 14:40:27 -04:00
Gustavo Valverde and GitHub
8bc28daf42
fix(core): preserve issuer-scoped account identities ( #10668 )
2026-08-04 13:47:09 -04:00
Emmanuel Lucius and GitHub
114214a76a
docs: fix 2FA description in client plugin setup ( #10659 )
2026-08-04 16:45:41 +09:00
Gustavo Valverde and GitHub
26b194960f
feat(scim): add managed connection catalog and runtime connection resolution ( #10592 )
2026-08-03 13:15:13 -04:00
Gustavo Valverde and GitHub
59c4c832fc
feat(sso): extend resolveUser to SAML and harden provider lifecycle ( #10621 )
2026-08-03 12:51:21 -04:00
Gustavo Valverde and GitHub
b7683b82be
feat(scim): add enterprise user attributes and interop conformance ( #10620 )
2026-08-03 07:15:59 -04:00
5c45abcd20
feat(oauth-provider)!: align MCP authorization with 2026-07-28 ( #10577 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2026-07-30 21:42:14 -04:00
Gustavo Valverde and GitHub
817a57ac9c
docs(mcp): document CLI device authorization ( #10565 )
2026-07-27 18:07:26 -04:00
Oliver Cordingley and GitHub
b4156672fb
docs: update stripe api version number ( #10529 )
2026-07-26 10:21:03 +09:00
2f3a71458d
feat(passkey): create session during passkey registration ( #9873 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-07-23 11:29:19 -04:00
f68044dcfb
feat(oauth-provider): add device authorization grant (RFC 8628) ( #10135 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-07-23 12:32:32 +00:00
430c895490
feat(generic-oauth): add RP-initiated logout support ( #9368 )
...
Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-07-23 12:24:53 +00:00
0683a5f36b
fix(microsoft)!: use oid as account id ( #10204 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-07-23 12:23:34 +00:00
49b5cf650e
fix(device-authorization)!: add lookup indexes ( #10059 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-07-23 07:22:08 -04:00
Gustavo Valverde and GitHub
973fdde79d
fix(siwe): issue addressless nonces ( #10234 )
2026-07-22 15:17:31 -04:00
Gustavo Valverde
cd4eb5627f
fix(sync): address behavioral review findings
2026-07-22 14:22:40 -04:00
Gustavo Valverde
558d2de0a7
chore(sync): merge main into next
2026-07-22 10:39:55 -04:00
Gustavo Valverde and GitHub
dec763ef2c
feat(scim): expose active provisioned user links ( #10474 )
2026-07-22 07:07:34 -04:00
Gustavo Valverde and GitHub
ed61b4798e
feat(sso): add transactional OIDC user resolution ( #10473 )
2026-07-22 06:53:55 -04:00
c020a9d6a2
fix(sso): redirect idp initiated saml flows in split origin deployments ( #10388 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-07-22 06:14:46 -04:00
Gustavo Valverde and GitHub
dbd302e422
feat(auth)!: scope accounts by issuer ( #10403 )
2026-07-16 17:24:34 +01:00
Gustavo Valverde and GitHub
0de88f5e61
feat(scim)!: decouple provisioning from the organization plugin ( #10390 )
2026-07-16 11:17:06 +01:00
bb6c1021e8
feat(organization): add getOrganization for metadata-only fetches ( #10397 )
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-07-15 12:49:26 +00:00
c178eeec5b
docs: warn that community plugins are not official or verified ( #10375 )
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-07-12 16:35:41 +00:00
Maxwell and GitHub
f23ce5012e
feat(last-login-method): beforeStoreCookie option for GDPR compliance ( #5753 )
2026-07-10 01:02:04 +00:00
3bf0e4981e
fix(organization): pass endpoint context to organization delete hooks ( #10190 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-07-08 22:43:03 +00:00
Gustavo Valverde
c02ea52953
chore(sync): merge main into next
...
Resolve the sync conflicts by keeping the next release train package versions, carrying the 1.6.23 stable changelog entries forward, and unioning the cspell word list.
2026-06-29 18:12:01 -04:00
8581f97ea0
feat(oauth): add Yandex social provider ( #9138 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-06-27 03:32:45 +00:00
Bereket Engida
Gustavo ValverdeandGitHub
MaxwellandGitHub
Emmanuel LuciusandGitHub
Oliver CordingleyandGitHub
