Release v0.9.0 · bambamboole/laravel-oidc

0.9.0 (2026-07-26)

identity.two-factor.{enable,confirm,disable} routes and TwoFactorManager are gone — use identity.two-factor.{enroll,enroll.confirm, revoke} and the EnrollableFactorProvider seam. Recovery codes are generated at confirmation, not at enable.
FirstPartyClientProvisioningOutcome is gone; result consumers read wasCreated/secretRotated. 2FA qr-code and recovery-codes endpoints return 404 (previously 200 []) when two-factor is disabled.
AuthenticationMethods is gone (use AuthSessionState); DeviceRecognizer, EnvironmentStore, ProtocolClaims, AuthenticationContextStore, AccessTokenContextLink moved namespaces; SessionRegistry is now Session\OidcSessionRepository.
IdTokenValidator/LogoutTokenValidator constructors take a ValidatorConfig; construct via the container or ValidatorConfig::fromConfig().
published oidc-client.php configs must replace the full handlers map with sparse overrides (an entry that mirrors the old defaults keeps working); OidcClient::routes() is gone.
every import of Bambamboole\LaravelOidc* (server) and Bambamboole\LaravelOidcClient* must be updated to the new prefixes.
Passport::scopes()/scopeIds() no longer reflect oidc.passport.scopes; enumerate through the ScopeRepository contract. DefaultScopeRepository's constructor now requires the application container — code instantiating or decorating it directly must pass it.

client validators take injected config and verify per-JWK algorithms (e356922)
make WebAuthn usable as a deferred second factor (269ffe6)
provider-keyed factor enrollment endpoints (97446c7)
reject replayed back-channel logout tokens; harden client test infra (c5d6825)
scope repository consumes the configured catalog directly (91a9ad0)

allow audience members to introspect tokens (eb53b9c)
exclude hidden scopes from the consent page (97102f6)
finalize every interactive login through the post-login pipeline (cd8a943)
honor retained previous keys when verifying token signatures (6bd6f46)
keep auth pages rendering when passkey handlers are disabled (61ac68e)
pin ui→server constraint to the released version and stop version rot (cb76c80)
require laravel/passkeys 0.2.1 as the floor (a666464)
resolve tier-1 audit findings (release, auth policy, key rotation, consent, WebAuthn 2FA) (820351a)
scope session-token lifecycle to a single owning guard (8858f4a)