v0.1.6 — Security patch

🔒 Security release — upgrade strongly recommended

This patch fixes access-control vulnerabilities present in 0.1.5 and earlier. All deployments should upgrade.

Fixed

• OAuth collections were writable by any authenticated user. oauth-clients, oauth-auth-codes, and oauth-tokens gated REST/GraphQL access on "is the request authenticated" — and admin: { hidden } only hides the UI, not the API. Any authenticated Payload user could:

  • rewrite a registered client's redirectUris → steal authorization codes / take over connected accounts,
  • read all token rows and revoke/delete other users' tokens.

  These collections now deny all public REST/GraphQL access; they are managed exclusively server-side (endpoints use overrideAccess, admin views use the Local API). The full OAuth handshake is unaffected.

• No HTTPS enforcement on the issuer in production. resolveConfig now refuses to boot when NODE_ENV=production and the issuer is not https:// (auth codes and bearer tokens travel to/from the advertised endpoints).

• Silent insecure token-pepper fallback. The built-in development pepper was used in any non-production environment. It is now used only when NODE_ENV is explicitly development or test; production/staging/unset require a real ≥32-char PMOAUTH_TOKEN_PEPPER.

Upgrade

pnpm add @brainwebuk/payload-plugin-mcp-oauth@0.1.6

No config changes required. If you run with an unset NODE_ENV in production, ensure PMOAUTH_TOKEN_PEPPER is set (≥32 chars) and your issuer is https://.

See #33 for the full fix.