Release v2.23.0

Changed

• AuthProxy now forwards the resolved tenant under both x-cratis-tenant-id and the previous Tenant-ID name, including calls to identity endpoints. Existing backends need no configuration change; Arc applications can remove options.UseHeaderTenancy("Tenant-ID") to use Arc's default, or keep that line to retain legacy-header tenancy. See the upgrade note. (part of #154)
• Service-ID is still accepted inbound, and x-cratis-microservice is now accepted too and wins when both are sent. Both headers are forwarded with the routed service's configured name and original casing, including query-only requests using ?service= and single-service requests with no selector. Arc HTTP service selection works with its default header; multi-service WebSocket and SSE connections still need Globals.microserviceWSQueryArgument = 'service'; because ?x-cratis-microservice= is not routed yet. See the service selection upgrade guidance. (part of #154)

Security

• AuthProxy strips client-supplied x-cratis-tenant-id and Tenant-ID headers regardless of casing, both inbound and again before forwarding, then writes only its resolved tenant under both names. Previously only Tenant-ID was stripped, allowing a client value to reach Arc backends on default tenancy settings. All inbound x-ms-client-principal* headers are also stripped without normalizing unrelated forwarded header values. (#157)
• Per-service claim requirements now apply to the service selected by the route. An unknown service header can no longer bypass the requirements of a protected service selected by ?service=. (#172)

Deprecated

• Forwarding Tenant-ID and Service-ID is deprecated and will be removed in a future major release. Move backends to x-cratis-tenant-id and x-cratis-microservice during the compatible transition described in the upgrade note. (part of #154)