v2.0.3

Contrack 2.0.3 adds sign-in with an OpenID Connect provider, and updates five dependencies that had published security advisories (#250, #261).

Added

• Single sign-on with OpenID Connect (#250, #261):
  • Members can sign in with one OIDC provider, such as Authentik, Keycloak, Pocket ID, Authelia or Google. An admin sets it up under Settings → Administration → General → Sign-in, or with the OIDC_* environment variables.
  • A member links the provider under Account → Sign-in methods → Single sign-on, and can unlink it there.
  • Email matching is off by default. When an admin turns it on, a verified provider email reaches only an account whose own email Contrack trusts: one made at setup, by an admin or from an invitation to that address, or one that a mailed link proved. Existing accounts start trusted.
  • Each flow is bound to its browser by a secret cookie. Starts and callbacks each have a limit of 20 a minute per IP, apart from password sign-in.
  • A password reset removes the account's linked sign-ins.
  • Two new migrations, 0002_sign_in_identities and 0003_address_trust, run on start.

Security

• Dependency updates for published advisories (#261): undici 8.12.3 and 7.30.1, multer 2.5.0, body-parser 2.4.0, nodemailer 10.1.4 and fast-uri 3.1.9. npm audit reports no known vulnerabilities.

Full Changelog: v2.0.2...v2.0.3