v1.4.0-beta.3

OPAL 1.4.0-beta.3: One step closer to general availability!

Howdy! This is a pretty big prerelease patch that cleans up a lot of blocking work for v1.4.0 general availability. As with the last release, sorry for the big gap between. Expect cadence to pick up in the next few weeks!

-- abby

Changes from 1.4.0-beta.2 (2026-07-24).

BREAKING

• The exe auth mode is gone.
  • OPAL no longer trusts the X-ExeDev-UserID and X-ExeDev-Email headers. No request header confers identity now.
  • The OPAL_AUTH_MODE and OPAL_EXE_PROXY_SECRET settings no longer exist. First-run setup drops the auth mode picker.
  • Migration e7a1c93f2b48 drops the user.exe_user_id column and deletes the stale settings rows. An instance that ran exe mode falls back to password sign-in after the upgrade.
• Password, passkey and OIDC sign-in are three independent toggles now. One auth mode switch no longer selects between them.
• The Onshape panel moves off /settings onto its own extension page. All Onshape URLs and API endpoints stay the same.

NEW

• OpenID Connect SSO

  • Single sign-on through the OAuth 2.0 authorization-code flow with PKCE (S256). Any spec-compliant provider works. Pocket ID is the reference target.
  • Identity is the issuer and subject pair, never the email address. OPAL reads an address once to claim an existing account, then never to match one.
  • OPAL checks every ID token for signature, issuer, audience, expiry and nonce, and strips alg: none.
  • OPAL_OIDC_ADMIN_GROUP sets admin rights at every sign-in, and both grants and revokes them.

• Extensions

  • An extension is a directory with an opal-ext.yaml manifest.
  • registry.sync() reconciles the filesystem against the extension table at every settings read. A directory that you add or remove by hand appears without a restart.
  • Two origins. A bundled extension ships in the package and can declare a code: entry point. An installed extension comes from an operator ZIP upload and carries declarative content only. OPAL refuses a code: key at install time.
  • Onshape becomes the first bundled extension, opal.onshape. Its extension page is also its on/off switch.
  • Archives unpack under hostile-input rules: caps on size, member count and uncompressed total. OPAL rejects absolute, drive-qualified and .. member names. OPAL rejects symlinks. A staging directory swaps into place only after the manifest validates.
  • An admin imports procedure and dataset templates by an explicit action. Imported content becomes ordinary project data, so an uninstall does not retract it.
  • Install, enable, disable and uninstall are admin-only and audited.
  • An Extensions chapter in the manual, and 48 tests.

• Notifications

  • A NOTIFS control in the menu bar carries the unread count and the eight most recent items.
  • /notifications is the full inbox, with category, read-state and sort filters, per-item dismiss, and mark-all-read. To select a notification marks it read and follows it to the record.
  • Six kinds. An issue assigned to you raises one. An issue that you raised or own raises one when somebody dispositions, comments on or closes it. A work order that you worked raises one when it blocks or unblocks.
  • The Mojave Sphinx demo seeds ten notifications in all six kinds. They spread across about four weeks, in both read and unread states.

FIXED

• Requirements PATCH clears parent_id on an explicit null now (issue #30). Before, the call returned 200 and kept the parent, so a child requirement could never return to a level-0 root.
• The demo inbox was empty for the operator who entered the demo. The seed addressed the notifications to the demo users, so an operator signed in as themselves saw an empty bell. Entry into a demo copies the build-lead notifications onto the entering operator now.
• The scrap modal on the OPAL detail page named two CSS classes that do not exist. It rendered in the document flow at the foot of the page. It is a real fixed overlay now.