v1.11.0

Added

• Sign in with WeftID (OIDC provider). WeftID is now a spec-correct
  downstream OpenID Provider, layered additively on the existing OAuth2
  authorization-code flow. An OIDC-enabled app receives a signed RS256 ID token
  (gated on the openid scope) alongside the usual access/refresh tokens, plus a
  per-tenant discovery document (/.well-known/openid-configuration), published
  signing keys (/.well-known/jwks.json), and a /userinfo endpoint. Released
  claims are gated by the scopes the app requests (openid, profile, email,
  groups), with DAG-aware effective group memberships in the groups claim.
  Access uses the same group-based model as SAML service providers and
  forward-auth apps: users without a grant are denied at the authorize step
  before any code is issued. Managed from the admin UI and under
  /api/v1/oauth2/clients/{client_id} (enable OIDC, access mode, group
  assignments) and /api/v1/oidc/signing-key (inspect, rotate, and clean up the
  per-tenant RSA key, with a configurable JWKS overlap window and an automatic
  sweep of retired keys). See the new "Sign in with WeftID (OIDC)" admin guide.

Changed

• Upgraded the application runtime to Python 3.14.
• Normalized file permissions across the app tree in the production Docker image.
• Renamed the deactivated-client status badge from "Inactive" to "Deactivated"
  to match the rest of the lifecycle terminology.
• Updated bundled runtime dependencies (pydantic 2.13.4, anyio 4.14.1, uvloop
  0.22.1) and the documentation-site build toolchain (pygments 2.20.0,
  pymdown-extensions 11.0.1). uvloop 0.22.1 is the first release with prebuilt
  wheels for Python 3.14, which the runtime upgrade requires.

Fixed

• Fixed four periodic worker sweeps (service-provider and per-IdP certificate
  rotation/cleanup, SAML metadata refresh, and idle-user auto-inactivation) that
  silently returned no rows and never ran in deployments using the RLS-enforcing
  appuser connection. These background jobs now run as intended.

Security

• Fixed a pre-authentication denial-of-service on the OAuth2/OIDC token, refresh,
  and /userinfo endpoints, where a presented bearer token or authorization code
  was verified against every live credential in the tenant (one Argon2 hash per
  credential). Validation now resolves a single row via an indexed lookup and
  verifies exactly once. (A07:2021)
• Fixed OIDC access-revocation lag: removing a user's group access (or narrowing
  an app from available-to-all) now immediately revokes their outstanding tokens,
  and the refresh-token grant re-checks access, so a revoked user can no longer
  mint new access tokens for the remaining lifetime of the refresh token.
  (A01:2021)
• Stopped the OAuth2/OIDC authorize flow from rendering a consent page or issuing
  an authorization code for a deactivated client. (A01:2021)
• Fixed a cross-tenant injection in SAML service-provider bulk group assignment,
  where an unvalidated group id could create a grant referencing another tenant's
  group. (A01:2021)
• Stopped the passkey registration endpoint from returning raw exception text to
  the caller. A rejected payload was answered with the exception's message in a
  details field, and the surrounding except was broad enough that an
  unexpected internal error would have its message disclosed too. Present since
  1.5.0. (A05:2021)