Release v2.13.0

Summary

AuthProxy 2.13 adds opt-in signed invitation completion and canonical provider identities, allowing a downstream invitation authority to verify who authenticated without trusting browser-authored identity fields. Existing unsigned invitation behavior remains the default unless signed attestations are configured.

Added

• Add a two-stage invitation protocol that signs the authenticated provider identity and invitation transaction with short-lived RS256 attestations. (#88)
• Add active and previous attestation keys, strict 10–60 second lifetimes, Aspire configuration, and verified GitHub email lookup. (#88)
• Add immutable Microsoft Entra invitation binding using the validated tenant-specific issuer and oid when mailbox verification is unavailable. (#88, #76)

Changed

• Use one configured canonical (provider key, issuer, subject) identity across forwarded principals, invitation exchange, credential linking, tenant revalidation, and sign-in notifications. (#76)
• Keep existing constructors and unsigned invitation exchange compatible; signed invitation mode is additive and opt-in. (#88)

Fixed

• Remove conflicting reserved canonical identity claims and reject missing, duplicate, or noncanonical provider identity values. (#76)
• Require exactly one invitation recipient proof: a verified email address or a complete opaque provider identity binding. (#88, #87)
• Preserve GitHub organization and team enrichment while deriving the final canonical invitation evidence. (#88, #87)

Security

• Bind signed invitation completion to the issuer, audience, tenant, invitation, transaction, challenge, exact capability hash, JWT ID, provider identity, assurance, and authentication time. (#88)
• Reject malformed signing keys, stale configuration, mixed recipient modes, and mismatched protected callback state without falling back to unsigned exchange. (#88)