Release v22.46.0

Summary

Arc derives identity from the authenticated request instead of a client-controlled identity cookie.

Changed

• Arc's identity endpoint no longer writes the readable .cratis-identity cookie. IProvideIdentityDetails now runs on every identity request instead of being skipped while the cookie exists; requests without an authenticated principal return 401. ModifyDetails changes only the current response. Stop reading the cookie directly and expose /.cratis/me to the frontend; see the migration guide. (#2939)
• IdentityProvider.getCurrent() in @cratis/arc fetches /.cratis/me and caches the answer in memory. It reads the legacy cookie only after a 404, with a warning; a 401 or 403 is never overruled by the cookie. Cookies restored after a refresh use SameSite=Lax and remain Secure on HTTPS. (#2939)

Fixed

• Explicit identity refreshes recompute identity, roles and details against earlier backends rather than returning stale cookies, including after credentials expire. The 404 transition fallback survives consecutive refreshes and page reloads, and uses an updated cookie issued by the response; clearCache() discards it on logout. (#2939)
• Requests to /.cratis/me expire leftover identity cookies on unauthorized and forbidden responses as well as successful responses. (#2939)

Security

• Arc no longer trusts the client-controlled, unsigned .cratis-identity cookie on the server. IIdentityProvider.Get(), Get<TDetails>() and /.cratis/me derive identity only from the authenticated principal. (#2939)

Deprecated

• IdentityProvider.IdentityCookieName in .NET, and IdentityProvider.CookieName and IdentityProvider.clearIdentityCookie() in @cratis/arc. Replace IdentityProvider.clearIdentityCookie() with IdentityProvider.clearCache(). (#2939)