v3.0.1 - SSO Auto-Provisioning & Admin Safeguards

Note

Small patch release on top of 3.0.0. No migration surprises, purely additive.

🔐 OIDC Auto-Provisioning

• Automatic account creation from your IdP: with OIDC_ALLOW_SIGNUP=true, a successful SSO login for an unknown identity now provisions a DVinyl account on the fly (SSO-only, no local password) instead of being rejected.
• Group-based access control: OIDC_ALLOWED_GROUP restricts signup and every subsequent login to members of an IdP group. Membership is re-checked on every login, so removing someone from the group in your IdP revokes their DVinyl access immediately.
• Group-based admin mapping: OIDC_ADMIN_GROUP automatically grants instance admin rights to members of that group.
• Safe account linking: auto-provisioning only links to an existing local account sharing the same email when the IdP has verified that email, to prevent account takeover.

🛡️ Instance Admin Safeguards

• Instance admins are now peers: none of them can reset another instance admin's password or delete another instance admin's account, only their own.

🛠 Fixes

• Fixed disabling the music module, which was silently failing.
• Fixed a couple of admin error messages (deleting/resetting another admin) that showed a raw translation key instead of the localized text.
• Footer/login/setup wording updated from "for music" to "for the collection", consistent with multi-collection support.