Skip to content

v0.13.0

Choose a tag to compare

View all tags
@mortondev mortondev released this 27 Jun 13:58
v0.13.0
3766645
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release unifies sign-in into a single dialog for both portal users and team admins, and reworks SSO into a multi-provider model: you can register any number of OIDC identity providers, each with its own verified domains, email routing, and per-domain enforcement. It also ships a redesigned provider editor, a settings-permission fix, and a security update.

Upgrade notes for self-hosters

  • Auth and feature flags are now managed in the admin UI only. The config file no longer applies auth or features blocks. If yours still contains them they are ignored (and surfaced as a warning in status), not a hard error. Configure sign-in methods, OIDC providers, and feature flags under Settings.
  • Magic link is opt-in. Magic-link sign-in is now off by default for every role unless enabled. Upgrading workspaces keep whatever sign-in methods they already had working.
  • Old auth routes redirect. /admin/login, /auth/login, /auth/signup, /sso, and the standalone two-factor pages now redirect into the unified sign-in dialog.

Features

  • One sign-in surface for everyone. Portal users and team admins now sign in through the same dialog, with a recovery-code break-glass path for SSO-only workspaces. (#284)
  • Multiple OIDC identity providers. Register any number of OIDC providers (Okta, Microsoft Entra, Google Workspace, Auth0, Keycloak, or any OIDC issuer). Each provider carries its own verified domains: emails at a verified domain are routed to that provider, and a domain can be enforced so its users sign in with SSO only. Roles map from the provider's group or role claims, and a claim-attested role provisions regardless of email domain. (#284)
  • Redesigned SSO provider editor. One default-role control, progressive group/claim mapping with autocomplete, full ID-token inspection in the connection test, manual-endpoint support for IdPs without a discovery document, and a per-provider toggle to show or hide the sign-in button. (#287)
  • Inline two-factor. Two-factor enrollment and challenge now happen inside the sign-in dialog instead of separate pages. (#284)

Bug fixes

  • Settings are admin-only. The settings cog is hidden from non-admin team members, and a non-admin who reaches an admin-only page sees a calm permission notice instead of a raw error. (71b6c8f6)

Security

  • nodemailer 9.0.1 (GHSA-p6gq-j5cr-w38f). Patches a message-level option that could bypass file and URL access controls. Quackback never used the affected option, but the dependency itself was flagged. (74d3dab4)

Full Changelog: v0.12.4...v0.13.0

Assets 3
Loading