v1.0.1

Maintenance release of the CTFd OIDC / OAuth2 Identity Provider plugin.

What's new in v1.0.1

• Add Apache-2.0 LICENSE and NOTICE files (matching CTFd's license).
  The license text was added to main after v1.0.0 was tagged, so this release
  includes it in the tagged source.

Everything else is identical to v1.0.0.

Features

• Authorization Code grant with PKCE; optional refresh tokens
• OpenID Connect id_tokens (RS256), userinfo, revocation, introspection, discovery + JWKS
• Public and confidential clients; trusted (first-party) apps skip consent
• Admin UI under the Plugins menu; user Authorized Apps tab on the Settings page
• Declarative provisioning of applications from a mounted YAML file
• Claims for profile, email, CTFd team and admin / role

Deployment

• Classic CTFd plugin install (requirements.txt)
• Plugin-only OCI image for Kubernetes volume mounting:
  ghcr.io/aydev-fr/ctfd-oidc-provider:1.0.1
• GitHub Actions: multi-arch OCI build/push to GHCR + CI

Security hardening

• PKCE enforced for public clients on both the GET and POST authorize paths
• Startup warning when OIDC_PROVIDER_ISSUER is unset (spoofable Host header)
• Client secrets are never auto-generated or written to logs
• At least one absolute http(s) redirect URI required per app
• client_uri restricted to http(s) (no javascript: on the consent screen)

See the README for installation, configuration and usage.