Gustavo Valverde and GitHub
7abaaed53f
fix(oauth-provider): make private_key_jwt jti single-use atomic across processes ( #9964 )
2026-06-10 00:36:06 +00:00
Gustavo Valverde and GitHub
ec8a38c08f
feat(generic-oauth): verify discovery id_tokens and enable id_token sign-in ( #9966 )
2026-06-10 00:34:26 +00:00
Gustavo Valverde and GitHub
af572166a2
fix(auth)!: harden validateUserInfo source contract ( #9940 )
2026-06-07 22:52:59 -07:00
0cbaf81bed
feat(oauth): server-trusted state channel; fix anonymous cookieless linking ( #9930 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-06-08 01:00:05 +00:00
91f235f860
feat(auth): add per-provider requireEmailVerification for social sign-in ( #9929 )
...
Co-authored-by: Gautam Manchandani <161146829+GautamBytes@users.noreply.github.com >
2026-06-08 00:31:20 +00:00
e0140297a5
fix(electron)!: enforce S256 PKCE and harden origin checks ( #9645 )
...
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-07 23:43:06 +00:00
41cca606d1
feat(auth): add user.validateUserInfo provisioning gate ( #9864 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-07 14:34:48 -07:00
Gustavo Valverde and GitHub
b32094a46d
docs(oauth-provider): reframe back-channel logout changeset and fill doc gaps ( #9916 )
2026-06-06 07:39:23 -07:00
Gustavo Valverde and GitHub
e0d2b9eb9b
feat(oauth-provider)!: add OIDC back-channel logout ( #9304 )
2026-06-06 07:06:53 -07:00
7fe0e2b165
feat: add clientAssertion support to the Microsoft Entra ID social provider ( #9898 )
...
Co-authored-by: Bereket Engida <86073083+Bekacru@users.noreply.github.com >
Co-authored-by: Bereket Engida <Bekacru@gmail.com >
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-05 20:28:46 -07:00
Gustavo Valverde and GitHub
40b392ae21
feat(oauth)!: accumulate granted scopes as grantedScopes string[] ( #9825 )
2026-06-04 17:54:52 -04:00
Gustavo Valverde and GitHub
b4b086722c
fix(oauth-provider)!: bind RFC 8707 resource indicators to the authorization grant ( #9836 )
2026-05-31 14:14:50 +01:00
Gustavo Valverde and GitHub
a8ea86e25e
fix(scim)!: always bind personal SCIM connections to their creator ( #9840 )
2026-05-31 12:53:18 +00:00
Gustavo Valverde
065f5ad72d
chore: sync main to next
...
Brings the v1.6.13 stable fixes into next: redirect_uri scheme validation in oidc-provider and mcp (#9838 ), clientPrivileges enforcement on dynamic client registration (#9837 ), null organization logo support (#9842 ), the consumeOne non-numeric deleteMany guard (#9831 ), and the db-adapter guide alignment (#9830 ).
Conflicts were limited to release version bumps and CHANGELOG entries; resolved by keeping next's 1.7.0-beta.3 line. The ten changesets consumed by the v1.6.13 release are accepted as deleted, and no external dependencies changed.
2026-05-31 13:02:15 +01:00
Taesu and GitHub
df9e8b2951
docs: align db adapter guide with adapter contract ( #9830 )
2026-05-31 09:01:50 +00:00
Gustavo Valverde
be653ab90d
docs(two-factor): merge enforcement-scope clarification into OTP rewrite ( #9607 )
...
Layers main's #9607 clarification onto next's #9057 OTP-enablement rewrite.
The "Sign In with 2FA" section now states that 2FA sign-in enforcement
applies to the credential endpoints (/sign-in/email, /sign-in/username,
/sign-in/phone-number) and that passwordless flows are not gated by default,
with guidance to add custom hook handling to require it. The passwordless
callout and the allowPasswordless option note that the flag does not change
which sign-in methods are challenged. main's edit to the removed
skipVerificationOnEnable bullet is dropped, since next deleted that option.
(cherry picked from commit 6156cef51329e1c38544aa06eb5072d8a06ece7a)
2026-05-31 00:10:36 +01:00
Gustavo Valverde
ef4fb0ff95
chore: merge main into next ( #9533 )
...
Sync main (through #9821/#9820/#9822/#9768) into next. Conflicting
package.json files keep next's version and intentional divergences (for
example the cli's c12 v4) while taking main's dependency updates, including
the samlify 2.13.1 and fast-xml-parser security bumps; the lockfile is
regenerated from the reconciled set. The 13 source/doc/test conflicts take
next's refactored architecture as the baseline; main's colliding fixes are
re-applied on top in the following per-domain commits.
Clean main fixes land via this merge, including the auto-restored
account-takeover defenses #9578 and #9577 .
2026-05-31 00:10:16 +01:00
Gustavo Valverde and GitHub
e8696388bf
docs(oauth-provider): align metadata routing guidance ( #9768 )
2026-05-30 22:32:09 +01:00
23d7cbfa79
fix(oauth): apply updateUserInfoOnLink in OAuth callback link flow ( #8758 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-30 19:48:38 +01:00
d3919dc1a5
feat(account): support server-side accountInfo calls without session headers ( #9813 )
...
Co-authored-by: Nathan Colosimo <nathancolosimo@gmail.com >
2026-05-30 12:45:40 +01:00
5f282bd382
fix(account): default storeStateStrategy to "database" when using secondaryStorage ( #9591 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-30 11:05:28 +01:00
Taesu and GitHub
e131d3ac5b
fix(api-key): verify non-default keys when configId is omitted ( #9794 )
2026-05-30 03:14:57 +00:00
Gustavo Valverde and GitHub
c5b9f93498
fix(generic-oauth): add accessTokenExpiresIn for providers that omit expires_in ( #9799 )
2026-05-29 20:49:59 +00:00
17cd433c66
fix(oauth-proxy): missing state-cookie skip for oauth-proxy ( #9385 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-29 15:06:34 +00:00
093115e162
docs(oauth): added Roblox provider and alphabetized "providers without email" table ( #9786 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-05-29 03:16:35 +00:00
ac96316af3
fix(oauth): forward specific callback error codes via shared redirectOnError ( #9788 )
...
Co-authored-by: Gautam Manchandani <manchandanigautam@gmail.com >
2026-05-28 21:42:16 +00:00
Jonathan Samines and GitHub
64dd51c78a
docs: add automatic reply to enterprise customer inquiries ( #9775 )
2026-05-28 00:15:22 +00:00
Jonathan Samines and GitHub
d43281126f
docs: add data processing addendum ( #9771 )
2026-05-27 16:46:53 -06:00
Taesu and GitHub
6711e43f24
docs: align npm and star icons ( #9764 )
2026-05-27 07:38:03 +00:00
Taesu and GitHub
4cbc823e69
docs: add active state to products nav tab ( #9698 )
2026-05-19 23:47:20 +00:00
Gustavo Valverde and GitHub
e7eb45b065
feat(oauth): per-request additionalParams and loginHint ( #9305 )
2026-05-19 17:18:43 +00:00
Maxwell and GitHub
adc8d7f1af
docs: microsoft base64 profile image warning ( #9692 )
2026-05-19 16:41:44 +00:00
03e6c94e96
feat(generic-oauth,sso): support IDP-initiated flows via secure bounce ( #9301 )
...
Co-authored-by: Menachem Hornbacher <mhornbacher@kiddom.co >
2026-05-19 12:29:04 +00:00
MonoBit and GitHub
314ea2887d
docs: add ton-better-auth plugin information ( #9637 )
2026-05-19 07:14:38 +09:00
602ec40293
feat(sso)!: support multiple IdP signing certificates ( #8805 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-18 03:07:37 +00:00
aebf66d8e6
feat: add token endpoint client authentication ( #9625 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-16 18:27:15 +00:00
Taesu and GitHub
ab5422f2f8
docs: simplify landing navbar ( #9650 )
2026-05-17 02:52:51 +09:00
db4263cd3d
chore: use correct auth cli ( #9638 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-16 02:27:55 +00:00
Gautam Manchandani and GitHub
95765cfedd
docs: clarify 2fa sign-in enforcement scope ( #9607 )
2026-05-14 08:45:10 +00:00
Taesu and GitHub
6290b5c3db
docs(pricing): refine plan unit notation ( #9602 )
2026-05-12 23:46:52 +00:00
45d7cb8ad6
chore(deps): bump next from 16.2.3 to 16.2.6 ( #9580 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-05-12 23:44:51 +00:00
Gautam Manchandani and GitHub
29599d32b5
docs: document account storeStateStrategy ( #9557 )
2026-05-12 13:16:23 +00:00
Gustavo Valverde and GitHub
5f09d566a6
fix(magic-link): consume verification token atomically on verify ( #9572 )
2026-05-12 12:50:38 +00:00
Gustavo Valverde and GitHub
99a254a79b
fix(device-authorization): bind approval to verifier session ( #9573 )
2026-05-12 11:40:18 +00:00
Gautam Manchandani and GitHub
15bb1690b2
feat(cli): add create-admin command ( #9547 )
2026-05-12 10:30:04 +00:00
Taesu and GitHub
455efb67b7
docs: add per-ip rate limit to enterprise contact form ( #9570 )
2026-05-12 08:16:40 +00:00
e0f94294a5
chore(deps): bump mermaid from 11.13.0 to 11.15.0 ( #9566 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-05-12 08:15:35 +00:00
86765f1597
fix(sso): require org admin role to register SSO providers ( #9220 )
...
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-11 17:04:01 +00:00
Jonathan Samines and GitHub
eae63a9aff
docs: add docs for infra timeout options ( #9559 )
2026-05-11 08:59:03 -06:00
Gustavo Valverde and GitHub
e21d744987
fix(rate-limit): widen ipv6Subnet type and correct default in docs ( #9545 )
2026-05-11 07:04:16 +00:00
Gustavo ValverdeandGitHub
Jonathan SaminesandGitHub
MonoBitandGitHub
