2.4.0-rc.9

Bug fixes

GraphQL pagination schema standardized on a single-level shape (BREAKING). 6 List*Request input types (ListClients, ListTrustedIssuers, ListSAMLServiceProviders, ListOrganizations, ListOrgDomains, ListOrgMembers) and 3 operations (_verification_requests, _webhooks, _email_templates) required a PaginatedRequest wrapper (pagination: { pagination: { limit, page } }) that never existed on the proto/gRPC surface and that no strictly-typed SDK consumer could even construct correctly. PaginatedRequest is removed; all 9 affected fields/params now take PaginationRequest directly, matching every other GraphQL endpoint, the proto surface, and (coincidentally) the JS/Go/Python SDKs' existing type definitions for most of these endpoints.

• Coordinated SDK updates: authorizer-js, authorizer-go, and authorizer-py all need matching updates for this release — see each SDK's own changelog.

Social login — 2 account-identity bugs, both found via live e2e testing:

• Discord: _admin_meta's discovery flag (is_discord_login_enabled) was never populated, so no frontend could ever detect Discord login was configured, even though the OAuth flow itself worked.
• Roblox: under the default scope configuration (no email scope), the raw numeric sub was stored directly in user.Email instead of a synthesized address — not a duplicate-account risk, but a non-email string reaching anything that assumes user.Email is a valid address (magic-link resend, display text, webhook payloads).

Magic-link login: silent no-op when email service is misconfigured. MagicLinkLogin required EnableEmailVerification but never checked IsEmailServiceEnabled (unlike signup's identical guard) — with verification wanted but SMTP incomplete, the mutation created a verification request and fired a SendEmail guaranteed to fail, while still telling the caller a magic link was sent.

SCIM/group webhook events were unregisterable. IsValidWebhookEventName's allow-list was never updated when the SCIM provisioning-lifecycle webhooks (user.provisioned, user.deprovisioned, user.scim_updated, group.created, group.updated, group.deleted) shipped — an admin could never register a webhook for any of them, even though the SCIM service fired them correctly.

Verified via go build/go vet/make lint (clean), make test (SQLite, clean), and live round-trip verification against a locally built image for the pagination change across GraphQL, REST, and gRPC.

This is a release candidate (pre-release). Run make test-all-db cross-DB validation before promoting to a stable release.