Skip to content

v0.3.0

Choose a tag to compare

View all tags
@bambamboole bambamboole released this 18 Jul 13:46
v0.3.0
9288a1b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.3.0 (2026-07-18)

⚠ BREAKING CHANGES

  • the eleven incremental migrations are replaced by seven consolidated ones (one create per oidc_* table plus a single oauth_clients alter migration). Existing installs must delete previously published oidc_* package migrations and re-publish; the resulting schema is identical.

Features

  • add Apple social provider with ES256 client secret and form_post (7d1ae4a)
  • add authorizeAndApprove flow helper with PKCE and result DTO (fd65f72)
  • add generic OIDC social provider with discovery and id_token verification (c022165)
  • add Google and GitHub social providers (98936e0)
  • add InteractsWithOidc testing trait with identity and client helpers (0139e48)
  • add issueTokenFor test helper minting real signed tokens (68d72f7)
  • add oidc_social_accounts table and SocialAccount model (0ac31c2)
  • add public atomic env-writer service (edf1869)
  • add rollback and provider env accessors to provisioning result (bc21ee7)
  • add social account linking and unlinking (dcd9ba8)
  • add social account resolution (linked, link-by-email, JIT provisioning) (40bd95c)
  • add social login core (contract, OAuth2 base provider, routes scaffold) (7dc36f6)
  • add social provider registry with config wiring and facade seams (5cbe167)
  • add social redirect endpoint and form_post callback bounce (71fe29b)
  • complete social login callback with pipeline, MFA parity, and session claims (36c590e)
  • composable installer primitives (provisioning + env writing as services) (84b04b1)
  • consolidate package migrations into one per table (48fa807)
  • extract signing-key generation primitive (8fd4192)
  • testing kit + keyless-boot safety (5e6c3ca)

Bug Fixes

  • fail actionably when the authorization view returns non-JSON (4ed5f29)
  • harden testing kit failure affordances (76f9c24)
  • preserve .env file permissions across atomic write (8b57ec6)
  • read first-party client config at call time instead of construction (48d5a18)
  • reject non-string state and code callback parameters without warnings (fd8bffc)
  • resolve the token encrypter lazily so keyless boots survive (5f89f39)
  • wrap GitHub profile fetch failures in the social auth exception (1fcd61a)
  • wrap OIDC metadata transport failures and cover fail-closed verification paths (a479caa)

Refactoring

  • consume env-writer service and drop WritesEnvFile trait (679d0f6)
  • tighten testing kit comments to repo guidelines (1150457)

Documentation

  • add social login documentation (9e8b77d)
  • correct the unlink JSON response description (2a5e39b)
  • document testing kit side effects and audience-token scope (8eae818)
  • document the testing kit and keyless-boot guarantee (38ec079)
  • drop keyless-safety callouts (b77083c)
  • warn against firstOrCreate in social provisioning actions (4841288)
Assets 2
Loading