PortalWeave SSO 1.3.1

PortalWeave SSO 1.3.1 fixes all three reported findings from the latest completed Codex Security scan.

• Enforce content restrictions on mixed-case REST routes and on the effective object and parent IDs selected through query or JSON parameters.
• Reject native Application Password authentication for deactivated, pending, blocked and expired accounts, preserving multisite isolation and credentials for reactivation.
• Prevent request parameters from suppressing password-login audit events, and record OAuth, JWT and shared SSO completion without duplicate local-login entries.

Existing settings, roles and stored credentials are retained. Install the attached plugin ZIP; its SHA-256 checksum is attached separately.

The package is the exact artifact verified by the Release workflow for immutable tag v1.3.1. Required checks cover PHP 8.1/8.3 syntax, minimum/current WordPress integration and HTTPS flows, multisite, tooling, strict official Plugin Check and package integrity.

Merged fixes: #35

WordPress.org publication remains disabled pending directory approval.

Verification run: https://github.com/RobotHanzo/PortalWeaveSSO/actions/runs/42293282098

PortalWeave SSO 1.3.0

The sign-out page now gives you clear choices:

• Sign out of this site and the named identity provider.
• Sign out of this site only.
• Go back and stay signed in.

Provider sign-out is shown only when the linked provider has a valid configured HTTPS end-session endpoint. The responsive design supports keyboard navigation and works without JavaScript. Confirmation preferences are retained.

Includes refreshed sign-out screenshots, updated setup guidance, and regression checks for local sessions, provider logout state, invalid requests and safe cancellation.

The attached plugin ZIP and checksum are the exact artifacts from the successful release-tag verification workflow. Upload the ZIP through WordPress Plugins → Add New → Upload Plugin.

PortalWeave SSO 1.2.1

PortalWeave SSO 1.2.1 fixes client-IP attribution in opted-in audit logs behind Nginx and Cloudflare.

• Resolve IPv4 and IPv6 visitor addresses through explicitly trusted proxy IPs/CIDRs.
• Support X-Forwarded-For chains, X-Real-IP and CF-Connecting-IP without trusting caller-supplied headers from arbitrary peers.
• Preserve the original IPv6 address when trusted Cloudflare traffic uses Pseudo IPv4 overwrite mode.
• Keep IP collection off by default, with unchanged audit retention and no automatic proxy-list downloads.

When the web server still supplies the proxy as REMOTE_ADDR, configure PORTALWEAVE_SSO_TRUSTED_PROXIES and PORTALWEAVE_SSO_CLIENT_IP_HEADER in wp-config.php. If Nginx already restores REMOTE_ADDR, keep application-level proxy trust disabled. See the Nginx and Cloudflare deployment guide.

Validation includes 132 WordPress integration tests, 95 tooling checks, 13 HTTPS protocol tests, the minimum/current WordPress and multisite CI matrix, and strict Plugin Check. The attached ZIP and SHA-256 file are the exact verified artifacts from the successful workflow for this tag.

Full changelog

PortalWeave SSO 1.2.0

PortalWeave SSO 1.2.0 makes administrator configuration easier to navigate and edit.

• Open PortalWeave SSO directly from the WordPress admin sidebar. Existing Settings bookmarks redirect to the new entry.
• Configure profile, role, domain, redirect and content mappings with visual editors, and switch to Advanced JSON when needed.
• Save or revert settings from an animated floating reminder. Reduced-motion preferences are respected.
• Configure optional integrations in focused sections with related provider settings together.
• Browse all retained audit events in pages of 50, with counts, stable navigation and a refresh action.
• Upload or select provider button logos through the WordPress media library, with preview and removal controls.
• View the refreshed documentation gallery: all 22 existing screenshots retaken and four new feature captures added.

Existing PortalWeave SSO configuration and encrypted credentials are retained. WordPress 6.5+, PHP 8.1+, OpenSSL and HTTPS remain required.

The release passed required CI, minimum/current WordPress integration, HTTPS protocol tests, multisite checks, strict WordPress Plugin Check and package verification. The attached ZIP and SHA-256 file come directly from the successful release workflow for this immutable tag. Documentation screenshots and development fixtures are excluded from the installable ZIP.

Full changelog

PortalWeave SSO 1.1.0

PortalWeave SSO 1.1.0 adds connection testing before saving, clearer provider administration, activity charts and independent WordPress sign-in styling.

• Test new connections before saving. Use Test connection on the final setup step. The test opens separately, preserves the setup entries and administrator session, and shows the returned attributes without creating a WordPress account.
• Customize WordPress sign-in buttons. Adjust text, colors, hover states, sizing, corners and icons under Appearance → WordPress sign-in. Includes a live preview, presets, provider logos, media-library images and a no-icon option.
• Configure providers through focused tabs. Connection, Endpoints, Security, Mapping, Accounts, Integrations and Login button keep related settings together and preserve edits when switching sections.
• Visualize activity. The Activity overview charts retained events over 7, 30 or 90 UTC days, with a separate tab for audit logs and exports.
• See clear action feedback. Clipboard actions and form submissions show progress and results, with duplicate-save protection, keyboard navigation and responsive layouts.
• Follow the visual guides. The README now demonstrates important features with current screenshots; provider, administration and privacy guides describe the new behavior.

Upgrading from 1.0.1 retains existing settings. Custom WordPress sign-in styling is opt-in and otherwise inherits the existing appearance. A connection test checks the provider protocol and returned attributes; review mappings and account policies and test normal sign-in before enforcing SSO. Installations using the technical namespace from before 1.0.1 require the controlled replacement procedure in the bundled provider guide.

The installable ZIP and its SHA-256 checksum are attached. Requirements remain WordPress 6.5+, PHP 8.1+, HTTPS and OpenSSL; native WordPress abilities additionally require WordPress 6.9+.

PortalWeave SSO 1.0.1

PortalWeave SSO 1.0.1 includes the new identity-provider setup experience and the completed technical namespace migration.

• Provider-specific guided setup with registration and credential instructions, local provider logos, alphabetical choices and a borderless logo presentation.
• PortalWeave SSO PHP/API/configuration names and the [sso_oauth_login] shortcode.
• Plugin Check advisory fixes and strict checks across every official static/runtime category, including experimental checks.
• Bash helper entrypoints and verified ZIP packaging, plus bounded retries for CI image downloads.

Upgrade: This release replaces the earlier technical namespace without compatibility aliases or automatic data conversion. Existing installations must follow the controlled replacement procedure, including settings, provider URLs, identity links and private-media metadata.

Download portalweave-sso-1.0.1.zip below and upload it through Plugins → Add New → Upload Plugin. The .zip.sha256 file verifies the installable package.

Requirements: PHP 8.1+, WordPress 6.5+, HTTPS and OpenSSL. Native abilities require WordPress 6.9+.

The attached package comes from the verified CI artifact for this immutable tag. WordPress.org approval and publication remain pending.

Release verification passed the minimum/current WordPress integrations, multisite, HTTPS OAuth, tooling and strict Plugin Check gates. The downloaded ZIP's 51 production files were independently verified against the tagged source. Test your provider registration and claim mappings before enforcing SSO.