Taesu
a172ca3abe
fix(oauth-provider): scope essential ACR checks to OIDC
2026-08-14 00:03:10 +09:00
Taesu
b554b91076
fix(oauth-provider): enforce essential ACR requests
2026-08-13 23:48:26 +09:00
Taesu
1065fe2a44
fix(oauth-provider): treat acr_values as voluntary
2026-08-13 14:25:10 +09:00
Gustavo Valverde and GitHub
3ca2c08dc3
fix(device-authorization): enforce RFC device flow requirements ( #10752 )
2026-08-11 18:05:25 -04:00
6782647d7c
refactor(oauth-provider)!: separate device grant ownership ( #10746 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-08-11 19:45:23 +00:00
Gustavo Valverde
dfa95cf560
fix(cli): limit version alignment to release train
2026-08-11 14:53:12 -04:00
Gustavo Valverde
73d6f80e5b
chore(sync): merge main into next
2026-08-11 14:14:49 -04:00
999acbd41d
Merge commit from fork
...
* fix(sso): bind domain verification to provider state
Complete domain verification with an atomic guarded transition keyed by the provider row, exact domain snapshot, and unverified state. Concurrent provider mutations now return a retryable conflict instead of applying stale DNS proof.
Document the conflict behavior and cover provider mutation, replacement, deletion, simultaneous verification, memory-adapter, and downstream trust cases.
* fix(sso): allow domain verification when the stored bit is null
* test(sso): assert the resolved DNS hostname outside the mock callback
* fix(sso): require verified domains for organization assignment
Use verified persisted provider domains and canonical verified user emails for domain-derived routing and organization membership. Keep explicit organization-bound SSO provisioning separate from domain trust.
* fix(sso): scope domain verification to organization assignment
* fix(sso): keep verified provider lookup internal
---------
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-08-11 13:50:45 -04:00
Taesu and GitHub
b8077b74ef
fix(cli): align packages with running CLI version ( #10743 )
2026-08-10 16:47:54 +00:00
Taesu and GitHub
d79740cb9c
docs(two-factor): align enrollment guidance with current behavior ( #10745 )
2026-08-10 12:45:03 -04:00
Taesu and GitHub
6e227c42c5
docs: clarify remaining 1.7 migration details ( #10744 )
2026-08-10 12:44:18 -04:00
81ef812251
docs: align the 1.7 migration guide with current behavior ( #10742 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-08-10 11:56:27 -04:00
Maxwell and GitHub
081d3c379c
feat(username): disable display-name ( #10330 )
2026-08-06 05:39:24 +00:00
Gustavo Valverde and GitHub
8b96573d78
fix(scim): create filtered PATCH values when no target matches ( #10682 )
2026-08-04 20:01:07 -04:00
Gustavo Valverde
5af0b3b77e
chore(sync): merge main into next
2026-08-04 18:34:05 -04:00
Taesu and GitHub
44e04d4bbe
fix(expo)!: use async secure storage access ( #10438 )
2026-08-04 21:00:23 +00:00
40ced39621
fix(cookies): decouple cookie cache from JWT plugin internals ( #10666 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-08-04 14:40:27 -04:00
Gustavo Valverde and GitHub
8bc28daf42
fix(core): preserve issuer-scoped account identities ( #10668 )
2026-08-04 13:47:09 -04:00
0b075395c5
docs: add SuperSend TX as an email provider example ( #10661 )
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-08-04 21:06:48 +09:00
Emmanuel Lucius and GitHub
114214a76a
docs: fix 2FA description in client plugin setup ( #10659 )
2026-08-04 16:45:41 +09:00
4533e2aeea
docs: centralize GHA reporting over email ( #10663 )
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-08-04 06:56:14 +00:00
Gustavo Valverde and GitHub
26b194960f
feat(scim): add managed connection catalog and runtime connection resolution ( #10592 )
2026-08-03 13:15:13 -04:00
Gustavo Valverde and GitHub
59c4c832fc
feat(sso): extend resolveUser to SAML and harden provider lifecycle ( #10621 )
2026-08-03 12:51:21 -04:00
Gustavo Valverde and GitHub
b7683b82be
feat(scim): add enterprise user attributes and interop conformance ( #10620 )
2026-08-03 07:15:59 -04:00
5c45abcd20
feat(oauth-provider)!: align MCP authorization with 2026-07-28 ( #10577 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2026-07-30 21:42:14 -04:00
Emmanuel Lucius and GitHub
de5acf171f
docs: fix grammar and wording in concepts/plugins.mdx ( #10500 )
2026-07-28 16:38:14 +09:00
Olivier Allard and GitHub
17cf2b94a4
docs: simplify waitUntil import for Cloudflare Workers ( #10536 )
2026-07-28 16:36:49 +09:00
Gustavo Valverde and GitHub
817a57ac9c
docs(mcp): document CLI device authorization ( #10565 )
2026-07-27 18:07:26 -04:00
Oliver Cordingley and GitHub
b4156672fb
docs: update stripe api version number ( #10529 )
2026-07-26 10:21:03 +09:00
9b08f4600e
docs: fix awkward wording in comparison.mdx ( #10517 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-07-25 06:25:34 +09:00
Emmanuel Lucius and GitHub
0268d2bf61
docs: fix wrong import path in facebook.mdx ( #10518 )
2026-07-25 06:15:26 +09:00
0xHouss and GitHub
0dbfd04e4d
docs: fix description metadata in comparison.mdx ( #10519 )
2026-07-25 06:14:26 +09:00
2f3a71458d
feat(passkey): create session during passkey registration ( #9873 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-07-23 11:29:19 -04:00
f68044dcfb
feat(oauth-provider): add device authorization grant (RFC 8628) ( #10135 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-07-23 12:32:32 +00:00
430c895490
feat(generic-oauth): add RP-initiated logout support ( #9368 )
...
Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-07-23 12:24:53 +00:00
0683a5f36b
fix(microsoft)!: use oid as account id ( #10204 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-07-23 12:23:34 +00:00
49b5cf650e
fix(device-authorization)!: add lookup indexes ( #10059 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-07-23 07:22:08 -04:00
Emmanuel Lucius and GitHub
b70cacbe47
docs: remove duplicated sentence in database.mdx ( #10489 )
2026-07-23 06:27:04 +09:00
Emmanuel Lucius and GitHub
1abe76285b
docs: fix variable shadowing in api.mdx code example ( #10488 )
2026-07-23 05:47:09 +09:00
Taesu and GitHub
c68b281ec1
docs: add july 2026 security update blog for Auth.js ( #10469 )
2026-07-23 05:20:55 +09:00
Gustavo Valverde and GitHub
973fdde79d
fix(siwe): issue addressless nonces ( #10234 )
2026-07-22 15:17:31 -04:00
Gustavo Valverde
1dd09ed096
docs(sync): address merged documentation comments
2026-07-22 14:22:50 -04:00
Gustavo Valverde
cd4eb5627f
fix(sync): address behavioral review findings
2026-07-22 14:22:40 -04:00
Gustavo Valverde
558d2de0a7
chore(sync): merge main into next
2026-07-22 10:39:55 -04:00
Gustavo Valverde and GitHub
dec763ef2c
feat(scim): expose active provisioned user links ( #10474 )
2026-07-22 07:07:34 -04:00
Gustavo Valverde and GitHub
ed61b4798e
feat(sso): add transactional OIDC user resolution ( #10473 )
2026-07-22 06:53:55 -04:00
c020a9d6a2
fix(sso): redirect idp initiated saml flows in split origin deployments ( #10388 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-07-22 06:14:46 -04:00
Taesu and GitHub
f6ee9e97f5
docs(blog): add theme-aware cover images ( #10470 )
2026-07-22 05:07:13 +09:00
Taesu and GitHub
0b571ff328
docs: add email provider section ( #10459 )
2026-07-21 03:35:09 +09:00
Gustavo Valverde and GitHub
a5f7c05924
docs(oauth): clarify provider field ownership ( #10432 )
2026-07-16 21:03:13 +01:00
Taesu
Gustavo ValverdeandGitHub
MaxwellandGitHub
Emmanuel LuciusandGitHub
Olivier AllardandGitHub
Oliver CordingleyandGitHub
0xHoussandGitHub
