Skip to content

Release v2.7.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Jul 16:59
v2.7.0
d4b0e48
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Adds the AuthProxy pieces required by Studio's "log out and switch tenant" feature (Cratis/Studio#856). The Studio frontend is already live, but the flow was broken end-to-end because AuthProxy had no logout endpoint and never kept the tenant list available to the post-login toolbar switcher.

Added

  • GET /.cratis/logout — signs the user out of the authentication cookie and clears every AuthProxy session cookie (.cratis-identity, .cratis-tenant, .cratis-tenants, .cratis-invite, .cratis-registration, .cratis-providers), then redirects to the absolute URL in the redirect query parameter. The target is validated against an allow-list of origins (the proxy's own public origin plus configured service/lobby frontends) so it cannot be used as an open redirect; a missing or disallowed target falls back to the application root. The endpoint is anonymous and runs before the authentication-challenge stages, so it works without a valid session.

Changed

  • .cratis-tenants now persists for the post-login tenant switcher. It is written as a session cookie and is no longer deleted when a tenant is selected, so a user with more than one tenant keeps the list available for an in-app switch control for the rest of the browser session. Single-tenant users still have the cookie removed on auto-selection (no switcher), and every selection continues to re-validate membership against the tenants endpoint.

Closes the AuthProxy side of Cratis/Studio#856.

Assets 2
Loading