Release v2.25.0

Changed

• IdentityVerification now defaults to Required rather than BestEffort for services with an identity-details endpoint. Under the previous default, only HTTP 403 denied a caller; services that omit this setting now also deny missing, unreachable, timed-out, invalid or negative answers unless the endpoint explicitly authorizes the caller. To keep the previous enrichment-only behavior for a service, set Cratis__AuthProxy__Services__<name>__IdentityVerification=BestEffort. See the upgrade note. (#163)
• Because Required is now the default, a participating service that states no IdentityVerification also refuses startup when TenantResolutions is empty, denies authenticated application requests with no resolved tenant, defaults the /.cratis/me wait to ten seconds, and writes no remembered authorization cookie when IdentityRevalidationInterval is zero or negative. The independent in-memory result cache still applies. (#163)

Fixed

• Required identity denials emit one warning naming the service, reason and exact opt-out, including unsuccessful status codes, unreadable responses, transport failures and timeouts. Client disconnects log only at Debug, including disconnects during an identity call. (#163)

Security

• Required verification accepts remembered authorization only for the participating Required services that verified the caller. Cookies from BestEffort or older releases cannot bypass verification, even when Data Protection keys survive an upgrade. Changing the Required service set forces verification again for both cookies and cached results, so a cached BestEffort admission cannot become proof of Required verification after a configuration reload. (#163)