v2.0.4

Contrack 2.0.4 tightens account security around the single sign-on added in 2.0.3. A new email is confirmed by a link mailed to it, a change to a linked sign-in needs the current password, and email trust from the 2.0.3 upgrade is corrected (#264, #265).

Correction to the 2.0.3 notes

The 2.0.3 notes said that existing accounts start trusted for single sign-on email matching. 2.0.4 takes that trust back where nobody vouched for the address: an account from open registration, and one that accepted an invitation with another address or with none. Admins, accounts an admin made, and invitations accepted with the invited address keep their trust. Contrack has no record of an email a member changed before 2.0.3, so check those addresses before you turn email matching on. Email matching stays off by default.

Security

• Email trust after the 2.0.3 upgrade (#264): migration 0004_unproven_addresses applies the rule above.
• Email change (#265), as the OWASP Authentication Cheat Sheet advises:
  • A new email needs the current password.
  • With outgoing mail and PUBLIC_URL, the new address waits for a link mailed to it, which works for 24 hours. The old address gets a notice, and the account keeps its old email until the link is opened. Account → Profile shows the waiting change, with Cancel the change.
  • Without outgoing mail, the email changes at once, and single sign-on email matching does not trust it until a mailed link proves it.
• Single sign-on (#265):
  • Link and Unlink need the current password.
  • With outgoing mail, the account gets a notice when a sign-in is linked or unlinked.
  • A password change keeps linked sign-ins, and a password reset still removes them.
• Migration 0005_address_change_links runs on start.

Fixed

• Accessibility (#264): filter chips, map facets, Narrow chips, contact rows, Ask history rows, Tags page links and the import drop zone have names that hold their visible words in order, as axe-core 4.14 checks.
• Settings (#264): Remove on the Google OAuth and OpenID Connect rows moves focus to the first empty field and clears an old save error. The Single sign-on card follows a provider change at once.
• Single sign-on (#264): a signed-in person whose sign-in did not finish sees a message. The unlink dialog warns about linking again only when that can happen.
• Possible duplicates (#265): a decision made right after an Undo keeps its own message and Undo.

Dependencies

• @anthropic-ai/sdk 0.136.0, imapflow 2.5.9, nodemailer 10.1.7 and @axe-core/playwright 4.14.0 (#264).

Full Changelog: v2.0.3...v2.0.4