Release v2.43.0

AuthProxy can now tell an application, server to server, when a user signs in and when a returning user's session makes its first request. It is off by default.

Added

• Optional per-service SignInCallback (Path, Interval, Timeout, Secret): AuthProxy posts a SignedIn callback right after an identity-provider sign-in succeeds, and a Returned callback on the first request of an existing browser session, then at most once per interval (default 12 hours) per user and service.
• The callback carries the usual x-ms-client-principal-* identity headers and the resolved tenant, a marker header and an optional shared secret, and a JSON body with the kind, subject, name, email, identity provider, tenant and time. AuthProxy strips the marker and secret headers from inbound requests, so they cannot be forged through the proxy.
• Callbacks are delivered from a background queue with the configured timeout and never block or fail the user's request; failures are logged without the secret or the user's identity.
• A "Sign-in Callback" configuration page describing the settings, the exact call and its delivery guarantees (the receiver must be idempotent).