Releases: bambamboole/laravel-oidc
Releases · bambamboole/laravel-oidc
Release list
v0.12.1
v0.12.0
0.12.0 (2026-08-01)
Features
- server: add SigningKeyStore contract with env-backed implementation (62ee015)
- server: rotate signing keys through the bound key store (83fe4f8)
- server: swappable signing-key storage + CRLF-safe env encoding (a8ef6ab)
Bug Fixes
- server: correct namespace typo in provider imports (3ace789)
- server: normalize CRLF line endings when encoding env values (1b46243)
Refactoring
- server: resolve signing keys through the bound SigningKeyStore (4a69cfa)
Documentation
v0.11.0
0.11.0 (2026-07-31)
⚠ BREAKING CHANGES
- ui: PasskeyVerify's fluent label()/loadingLabel()/separator() setters are gone — pass named arguments to make().
- client: the oidc-client.handlers and oidc-client.routes.* config keys are removed — the route table is fixed and oidc-client.enabled=false disables it; HandlerConfig and HandlerRegistrar are gone; OidcClientFake::issuer() and forUser() are removed (set the oidc-client.issuer config before fake(), use loginAs()).
- server: Oidc::issuer() and Oidc::handlerConfig() are removed (use Issuer::url() / Handler::config()); FactorProvider::verify() takes a plain array instead of FactorResponse; RegisterView::respond() and PasswordConfirmationView::respond() lost their prompt argument; EnvironmentStore is removed (type-hint EnvironmentFile); AuthorizationCodeResult::json() is removed (use ->response->json()); token-exchange audiences accept http(s) URLs or any urn: string.
- server: host user models must be uuid-keyed (e.g. HasUuids) — integer user ids no longer fit the uuid reference columns. The laravel/passkeys migration derives its user_id type from the user model automatically.
- server: the shipped migrations changed in place — existing installs must re-run them (fresh migrate) or convert the columns manually. The sid claim and all enrollment ids are now uuid-formatted strings. The vendor laravel/passkeys table keeps its own key scheme; publish its migration to change it.
- server: the FactorAuthenticatable contract is gone — user models only need to be Eloquent models (plus PasskeyUser for webauthn). Type hints against it become Model/PasskeyUser.
- ui: the oidc.passkey-registration component props changed from optionsUrl/submitUrl to beginUrl/confirmUrl.
- server: the three identity.passkey registration/destroy routes are gone (use identity.two-factor.enroll/confirm/revoke with provider=webauthn), and manually seeding only login.id into the session no longer yields a totp challenge — seed login.factor as well.
- ui: PasskeysTable (oidc.passkeys) and DeletePasskeyAction (oidc.passkeys.delete) are removed — compose TwoFactorMethodsTable (oidc.two-factor.methods) with RevokeFactorAction instead. The security.passkeys translation group is gone and the two-factor enable/disable copy changed shape ('Add :method' / 'Disable two-factor authentication').
- server: the TOTP-specific routes identity.two-factor.qr-code, identity.two-factor.secret-key, identity.two-factor.recovery-codes, and identity.two-factor.regenerate-recovery-codes and their controllers are removed. The QR code and secret ship in the TOTP begin-enrollment metadata (qr_svg, qr_url); recovery codes are read and regenerated by enrolling the recovery_code provider.
- server: the challenge_providers default now includes webauthn, so a password login by a user with an enrolled passkey is challenged with that passkey as second factor. Set the config to ['totp'] to restore the old behavior.
Features
- client: fixed route table, slimmer validator and testing internals (4813575)
- server: boot-safe Oidc facade, leaner internals, new auth APIs (0e57d32)
- server: enrollable webauthn and recovery-code providers, retire legacy TOTP endpoints (1dca842)
- server: native uuid columns for user references (b14b44a)
- server: offer every challengeable factor and allow switching mid-challenge (7cae8da)
- server: single passkey registration path and strict pending-challenge state (57f37ff)
- server: uuid primary keys for every package table (26f7455)
- ui: drive passkey registration through the generic webauthn ceremony (6fd44cb)
- ui: named-argument PasskeyVerify, inlined single-use seams (0cbafe5)
- ui: provider-parameterized MFA components and challenge factor picker (53d3323)
- ui: unified methods table, recovery-code display, per-enrollment picker (363fd24)
Refactoring
- server: providers own factor storage, drop FactorAuthenticatable (60b4e3d)
Documentation
v0.10.2
v0.10.1
v0.10.0
0.10.0 (2026-07-27)
⚠ BREAKING CHANGES
- server: when oidc.session_token.guard is null it now resolves to oidc.auth.guard (default: identity) before the application default guard. Apps relying on the previous app-default behaviour should set OIDC_SESSION_TOKEN_GUARD (or oidc.session_token.guard) explicitly.
Features
- server: surface OIDC details in the about command (9e40b1f)
Bug Fixes
v0.9.0
0.9.0 (2026-07-26)
⚠ BREAKING CHANGES
- identity.two-factor.{enable,confirm,disable} routes and TwoFactorManager are gone — use identity.two-factor.{enroll,enroll.confirm, revoke} and the EnrollableFactorProvider seam. Recovery codes are generated at confirmation, not at enable.
- FirstPartyClientProvisioningOutcome is gone; result consumers read wasCreated/secretRotated. 2FA qr-code and recovery-codes endpoints return 404 (previously 200 []) when two-factor is disabled.
- AuthenticationMethods is gone (use AuthSessionState); DeviceRecognizer, EnvironmentStore, ProtocolClaims, AuthenticationContextStore, AccessTokenContextLink moved namespaces; SessionRegistry is now Session\OidcSessionRepository.
- IdTokenValidator/LogoutTokenValidator constructors take a ValidatorConfig; construct via the container or ValidatorConfig::fromConfig().
- published oidc-client.php configs must replace the full handlers map with sparse overrides (an entry that mirrors the old defaults keeps working); OidcClient::routes() is gone.
- every import of Bambamboole\LaravelOidc* (server) and Bambamboole\LaravelOidcClient* must be updated to the new prefixes.
- Passport::scopes()/scopeIds() no longer reflect oidc.passport.scopes; enumerate through the ScopeRepository contract. DefaultScopeRepository's constructor now requires the application container — code instantiating or decorating it directly must pass it.
Features
- client validators take injected config and verify per-JWK algorithms (e356922)
- make WebAuthn usable as a deferred second factor (269ffe6)
- provider-keyed factor enrollment endpoints (97446c7)
- reject replayed back-channel logout tokens; harden client test infra (c5d6825)
- scope repository consumes the configured catalog directly (91a9ad0)
Bug Fixes
- allow audience members to introspect tokens (eb53b9c)
- exclude hidden scopes from the consent page (97102f6)
- finalize every interactive login through the post-login pipeline (cd8a943)
- honor retained previous keys when verifying token signatures (6bd6f46)
- keep auth pages rendering when passkey handlers are disabled (61ac68e)
- pin ui→server constraint to the released version and stop version rot (cb76c80)
- require laravel/passkeys 0.2.1 as the floor (a666464)
- resolve tier-1 audit findings (release, auth policy, key rotation, consent, WebAuthn 2FA) (820351a)
- scope session-token lifecycle to a single owning guard (8858f4a)
Refactoring
- client routes default in code with sparse config overrides (a79eccc)
- close out the audit's grouped design items (c047bab)
- the generic enrollment API is the only enrollment path (68506af)
- typed session state and protocol infrastructure moves (f0d9c49)
- unify package namespaces under Bambamboole\LaravelOidc (32282fb)
Documentation
- cover the tier-2 surface changes (c409ad1)
v0.8.0
0.8.0 (2026-07-26)
Features
- add ScopeCatalog contract and oidc.passport config seams (305327c)
- materialize the scope catalog lazily on first scope enumeration (70ae82f)
- passport seams (token model, scope catalog) and conventional locale/zoneinfo claims (3b4059d)
- resolve locale and zoneinfo claims from conventional user attributes (1021db0)
- wire Passport token model and scope catalog from oidc config (b06d61c)
Bug Fixes
- guard non-array scope config and sharpen catalog failure docs (77ad762)
Documentation
v0.7.0
0.7.0 (2026-07-25)
⚠ BREAKING CHANGES
- upgrade to lattice 0.26
- wire lattice discovery and 0.25 for master-package installs
- ship the frontend as a lattice component plugin
- adopt lattice 0.25 declarative discovery and the server view contracts
- route the consent view through the ConsentView contract
AuthViewManagerand theOidcManager/Oidcfacade fluent view-bind methods (loginView(),registerView(), etc.) are removed. Bind the new contracts directly on the container instead.
Features
- adopt lattice 0.25 declarative discovery and the server view contracts (5da7476)
- replace the auth view manager with typed view contracts (87ad2ba)
- route the consent view through the ConsentView contract (bdb7e26)
- ship the frontend as a lattice component plugin (0753993)
- upgrade to lattice 0.26 (159b1da)
Bug Fixes
- register the oidc-ui translation namespace directly on the loader (9b3c88b)
- wire lattice discovery and 0.25 for master-package installs (e9844bf)
Documentation
v0.6.0
0.6.0 (2026-07-22)
⚠ BREAKING CHANGES
- wire the ui package into the master package and CI
- drop Laravel 11 support
- turn the repo root into the laravel-oidc master package
- import laravel-oidc-client into packages/client
- move the server package to packages/server
Features
- consolidate docs and add the monorepo split workflow (3233365)
- drop Laravel 11 support (32acd68)
- import laravel-oidc-client into packages/client (1b25e5f)
- port auth layout, shared concerns, and translations to the ui package (e9af4c7)
- port auth pages and bind AuthViewManager defaults (21f9789)
- port the oauth consent page and wire Passport authorization view (976b236)
- port two-factor and passkey security components (2b0be3b)
- scaffold the laravel-oidc-ui package (9674908)
- turn the repo root into the laravel-oidc master package (f293c17)
- wire the ui package into the master package and CI (625cc3e)
Bug Fixes
- harden consent email fallback and cover verification-email action (412f1be)
- omit the verify-email logout link when the host app has no logout route (f2c77bd)
Refactoring
- move the server package to packages/server (4f2d335)