Release v2.5.0

Summary

Extends the back-channel client-credentials flow: a verified request can now carry a tenant through to the proxied service, and clients can refresh an access token without resending their client secret.

Added

• The client-credentials verification endpoint's 2xx response may now include a tenant JSON property. AuthProxy embeds it in the issued token as a cratis/tenant claim, which the existing Claim tenant-resolution strategy can resolve into the Tenant-ID header on proxied requests.
• POST /.cratis/token now also accepts grant_type=refresh_token, exchanging a refresh token for a new access/refresh token pair without recontacting the verification endpoint. Every successful client_credentials grant now returns a refresh_token alongside the access token.

Changed

• Documented the new tenant-propagation and refresh-token behavior in authentication.md, services.md, and tenancy.md.