v0.4.6

Full Changelog: v0.4.5...v0.4.6

v0.4.5

Changes in v0.4.5

• Explicit Google OpenAuth Multi-Environment Allowlist: Reinstated /r/ and /a/ path prefixes and explicitly added oauth-redirect-sandbox.googleusercontent.com and oauth-redirect-test.googleusercontent.com to .env.example and setup-wizard.sh under the Google Gemini selection.
• Removed Code-Level Regex Bypasses: Removed domain-specific regex from src/auth/provider.ts, adhering strictly to generic prefix-matching against operator-configured OAUTH_ALLOWED_REDIRECT_URIS.
• ADR-0009 and Spec Alignment: Updated architecture decisions and specifications to reflect multi-environment allowlist configuration.
• Test Coverage: Added real-world test validating the exact 6-URL registration payload sent by Google Gemini Connected Apps OpenAuth client.

Full Changelog: v0.4.4...v0.4.5

v0.4.4

Changes in v0.4.4

• Strict Environment Redirect Allowlist: Codebase default OAUTH_ALLOWED_REDIRECT_URIS is strictly restricted to loopback (http://localhost, http://127.0.0.1). All remote OAuth redirect URLs are operator-configured via .env.
• Standard Google Gemini Base Callback: Standardized Google Gemini's callback to base https://oauth-redirect.googleusercontent.com/ in .env.example and setup wizard, cleanly matching all dynamic registration subpaths via standard prefix matching without hardcoded bypasses.
• Wizard Agent Auto-Population: Setup wizard auto-populates .env redirect URIs based on selected AI clients (Google Gemini, Claude Desktop/Code/Web, Cursor, ChatGPT), and cleanly detects loopback-only upgrades.
• RFC 7591 Default Auth Method: When token_endpoint_auth_method is omitted in dynamic client registration, it now defaults to client_secret_basic per RFC 7591 §2.
• Registration Normalizer Extraction: Extracted body normalization and candidate redirect extraction to src/auth/registration.ts.
• Architectural Documentation: Added ADR-0009 documenting explicit environment redirect allowlists and registration resilience.

Full Changelog: v0.4.3...v0.4.4

v0.4.3

Changes in v0.4.3

• Dynamic Client Registration Normalization: Added middleware on /register to accept both JSON and form-urlencoded requests, normalize singular redirect_uri to redirect_uris array, normalize scope/grant/response types, and strip empty string URL attributes that fail schema validation.
• Google OAuth Redirect Allowlist: Extended allowlist matching to accept any path under https://oauth-redirect.googleusercontent.com when present in the allowed redirect URI configuration.
• Verbose Registration Logging: Added detailed request and error logging on /register to stdout for diagnosis via docker logs.

v0.4.2 - Public & Confidential Client OAuth Dynamic Registration

What's Changed

🔐 Public and Confidential Client Support in RFC 7591 Dynamic Registration

This release resolves the dynamic registration failure encountered when connecting to Google Gemini Connected Apps (and other server-side OAuth agents), while preserving zero-friction public PKCE client connections for desktop AI clients (Claude Desktop, Cursor):

• RFC 7591 Dynamic Client Registration (POST /register):
  • Dynamically registers confidential clients requesting token_endpoint_auth_method: 'client_secret_post' or 'client_secret_basic' (or omitting the field per RFC 7591 §2 defaults).
  • Auto-generates, binds, and persists a 32-byte cryptographically random client_secret in oauth-tokens.json.
  • Retains public PKCE client registration (token_endpoint_auth_method: 'none') with no client secret.
  • Rejects unsupported auth methods with HTTP 400 invalid_client_metadata.
• Authentication at /token and /revoke:
  • Authenticates confidential clients via form body (client_secret_post) and case-insensitive HTTP Basic Auth headers (client_secret_basic).
  • Rejects requests with conflicting multiple client authentication methods per RFC 6749 §2.3.
• RFC 8414 Authorization Server Metadata:
  • Advertises ['none', 'client_secret_post', 'client_secret_basic'] for token_endpoint_auth_methods_supported and revocation_endpoint_auth_methods_supported.
• Architecture Documentation:
  • Formally documented in ADR-0008.

Full Changelog: v0.4.1...v0.4.2

v0.4.1

Full Changelog: v0.4.0...v0.4.1

v0.4.0

Full Changelog: v0.3.0...v0.4.0

v0.3.0 - Recurring Schedules & Automation Rules Suite

What's New in v0.3.0

📅 Recurring Schedules (5 Tools)

• list_schedules — Inspect recurring transactions, recurrences, and statuses.
• get_schedule_upcoming_dates — Query next scheduled execution dates with recurrence rules.
• create_schedule — Create recurring transactions with custom schedules and optional auto-transaction creation.
• update_schedule — Modify recurring rules, amounts, categories, or accounts.
• delete_schedule — Delete existing schedules.

⚙️ Automation Rules (4 Tools)

• list_rules — Query custom automation rules, conditions, and actions.
• create_rule — Create automation rules with conditional stages (pre, default, post).
• update_rule — Update existing automation rule conditions and actions.
• delete_rule — Delete automation rules.

🛡️ Standards & Architecture

• Full support for major-unit Decimal Amount conventions across all rule and schedule tools.
• Native TypeScript types and comprehensive test coverage (15 test suites, 138 passing tests).
• Automated CI testing on tag releases and Docker multi-arch builds (ghcr.io/pedroliu1999/actual-mcp:v0.3.0).