Claude
ea474eb6c8
docs: point MCP authorization references at the 2026-07-28 spec revision
...
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
Claude-Session: https://claude.ai/code/session_01QbU1ZgRHK5A1btqpdR5gbD
2026-07-28 19:31:36 +00:00
Claude
8e8a74f73f
feat(oauth-provider): accept application_type in dynamic client registration
...
OIDC Registration §2 / MCP 2026-07-28 (SEP-837): when a registration
declares application_type, redirect URIs are constrained to what the
declared type allows — native clients may use custom schemes, loopback
http redirects, or claimed https links, while web clients require https
on non-loopback hosts. Only enforced when the parameter is explicit, so
existing registrations keep working. The field round-trips through
client metadata and is echoed in the registration response.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
Claude-Session: https://claude.ai/code/session_01QbU1ZgRHK5A1btqpdR5gbD
2026-07-28 19:31:29 +00:00
Claude
0d1ba97145
feat(oauth-provider): answer insufficient scope with a 403 insufficient_scope challenge
...
Per the MCP 2026-07-28 scope-challenge guidance (RFC 6750 §3.1),
raiseResourceServerChallenge now maps FORBIDDEN errors to a 403 with a
WWW-Authenticate challenge carrying error="insufficient_scope", the
required scope, and the resource_metadata pointer so MCP clients can
step up their authorization. requireMcpAuth and mcpHandler gain a
`scopes` option enforced against the token's scope claim, and awaited
handlers let handler-thrown FORBIDDEN errors produce the same challenge.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
Claude-Session: https://claude.ai/code/session_01QbU1ZgRHK5A1btqpdR5gbD
2026-07-28 19:31:09 +00:00
Gustavo Valverde and GitHub
817a57ac9c
docs(mcp): document CLI device authorization ( #10565 )
2026-07-27 18:07:26 -04:00
Gustavo Valverde and GitHub
d701f90e6f
fix(types): expand workspace and consumer type checking ( #10505 )
2026-07-27 16:01:26 +00:00
2f3a71458d
feat(passkey): create session during passkey registration ( #9873 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-07-23 11:29:19 -04:00
f68044dcfb
feat(oauth-provider): add device authorization grant (RFC 8628) ( #10135 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-07-23 12:32:32 +00:00
430c895490
feat(generic-oauth): add RP-initiated logout support ( #9368 )
...
Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-07-23 12:24:53 +00:00
0683a5f36b
fix(microsoft)!: use oid as account id ( #10204 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-07-23 12:23:34 +00:00
49b5cf650e
fix(device-authorization)!: add lookup indexes ( #10059 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-07-23 07:22:08 -04:00
better-release[bot] and GitHub
cc708e51bc
chore: release v1.7.0-rc.2 ( #10327 )
2026-07-22 15:51:41 -04:00
Gustavo Valverde and GitHub
973fdde79d
fix(siwe): issue addressless nonces ( #10234 )
2026-07-22 15:17:31 -04:00
Gustavo Valverde and GitHub
c78aca7a23
chore: sync main to next
...
chore: sync main to next
2026-07-22 15:00:18 -04:00
Gustavo Valverde
1dd09ed096
docs(sync): address merged documentation comments
2026-07-22 14:22:50 -04:00
Gustavo Valverde
cd4eb5627f
fix(sync): address behavioral review findings
2026-07-22 14:22:40 -04:00
Gustavo Valverde
337e0f7d75
test(drizzle-adapter): support TypeScript 6 diagnostics
2026-07-22 10:49:05 -04:00
Gustavo Valverde
47012469e8
test(sso): validate redirects through provider schema
2026-07-22 10:49:00 -04:00
Gustavo Valverde
8dc275cfc1
chore(sync): carry forward CLI prompt update
2026-07-22 10:41:23 -04:00
Gustavo Valverde
73e2d2dd62
fix(sync): align tests with next contracts
2026-07-22 10:40:52 -04:00
Gustavo Valverde
558d2de0a7
chore(sync): merge main into next
2026-07-22 10:39:55 -04:00
Gustavo Valverde and GitHub
bfdaa35e20
feat(demo): demonstrate SCIM-backed employee SSO ( #10475 )
2026-07-22 09:17:24 -04:00
Gustavo Valverde and GitHub
dec763ef2c
feat(scim): expose active provisioned user links ( #10474 )
2026-07-22 07:07:34 -04:00
Gustavo Valverde and GitHub
ed61b4798e
feat(sso): add transactional OIDC user resolution ( #10473 )
2026-07-22 06:53:55 -04:00
better-release[bot] and GitHub
9a661c7b7a
chore: release v1.6.24 ( #10323 )
2026-07-22 06:30:26 -04:00
c020a9d6a2
fix(sso): redirect idp initiated saml flows in split origin deployments ( #10388 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-07-22 06:14:46 -04:00
Gustavo Valverde and GitHub
69acb7a3db
fix(oauth-provider): defer logout effects until commit ( #10472 )
2026-07-22 06:09:55 -04:00
Taesu and GitHub
f6ee9e97f5
docs(blog): add theme-aware cover images ( #10470 )
2026-07-22 05:07:13 +09:00
Taesu and GitHub
9a16103863
docs: remove careers page ( #10468 )
2026-07-22 05:06:51 +09:00
Taesu and GitHub
0b571ff328
docs: add email provider section ( #10459 )
2026-07-21 03:35:09 +09:00
4e685eef42
fix(open-api): include plugin user fields on sign-up/update bodies ( #10453 )
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-07-19 12:00:29 +00:00
Akshat malik and GitHub
d3ce782332
fix(cookies): tighten CookieAttributes index signature type ( #10441 ) ( #10442 )
2026-07-19 04:26:51 +00:00
Maxwell and GitHub
67cff3edbf
chore(electron): bump tested Electron to 43 ( #10440 )
2026-07-18 04:18:18 +00:00
Gustavo Valverde and GitHub
a5f7c05924
docs(oauth): clarify provider field ownership ( #10432 )
2026-07-16 21:03:13 +01:00
Gustavo Valverde and GitHub
dbd302e422
feat(auth)!: scope accounts by issuer ( #10403 )
2026-07-16 17:24:34 +01:00
Gustavo Valverde and GitHub
763a2671c5
feat(db): add compound table indexes ( #10402 )
2026-07-16 14:31:48 +01:00
Gustavo Valverde and GitHub
0de88f5e61
feat(scim)!: decouple provisioning from the organization plugin ( #10390 )
2026-07-16 11:17:06 +01:00
Maxwell and GitHub
ae78109118
fix(client): preserve null in useSession().data type with throw:true ( #9787 )
2026-07-16 06:55:23 +00:00
bb6c1021e8
feat(organization): add getOrganization for metadata-only fetches ( #10397 )
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-07-15 12:49:26 +00:00
Maxwell and GitHub
8784c1c1f4
chore!: move joins to advanced.database.joins ( #10359 )
2026-07-14 22:21:38 +00:00
Taesu and GitHub
502a262ff2
chore: bump tsdown ( #10393 )
2026-07-14 14:34:37 +00:00
Taesu and GitHub
6fe5156ce4
docs: remove "what's next" section from 1.7 rc blog ( #10389 )
2026-07-14 16:19:20 +09:00
f6d18fa8f7
fix(client): restore auth query lifecycle after remount ( #10379 )
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-07-13 21:22:27 +00:00
fa8deed833
docs: migrate AI chat from OpenRouter to Vercel AI Gateway ( #10384 )
...
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-07-13 14:28:42 -07:00
e4818b5459
fix(kysely-adapter): restore local migration constants ( #10377 )
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-07-13 06:32:49 +00:00
54fab08446
fix(core): dedup request-state AsyncLocalStorage init to fix intermittent "No request state found" ( #9862 )
...
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com >
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-07-12 20:14:35 +00:00
086ca91f51
fix(magic-link, email-otp): force-validate Origin on cookieless send endpoints ( #10368 )
...
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com >
Co-authored-by: Cursor <cursoragent@cursor.com >
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-07-12 19:32:32 +00:00
Maxwell and GitHub
bae71988ab
fix(organization): apply membershipLimit to listMembers user fetch ( #10342 )
2026-07-12 18:58:21 +00:00
7508940376
fix(db): avoid duplicate unique indexes in kysely migrations ( #10357 )
...
Co-authored-by: Bereket Engida <86073083+Bekacru@users.noreply.github.com >
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-07-12 18:14:09 +00:00
c4d1ddaa95
feat: add ctx to verifyIdToken ( #10376 )
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-07-12 18:01:00 +00:00
c178eeec5b
docs: warn that community plugins are not official or verified ( #10375 )
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-07-12 16:35:41 +00:00
Claude
Gustavo ValverdeandGitHub
better-release[bot]andGitHub
TaesuandGitHub
Akshat malikandGitHub
