v2.2.0

Upgrading

No breaking changes. This release adds two database migrations (schema version 10 → 12), applied automatically on autentico start. If you run with --no-auto-migrate, run autentico migrate first.

New features

• Custom per-user claims. Admins can attach key/value claims to a user (Users → claims drawer, or GET/POST/DELETE /admin/api/users/{id}/claims). When a client is granted the new custom_claims scope, they are added to the access token, ID token and UserInfo. Values are strings; reserved and standard claim names are rejected. (#398)
• Applications on the account dashboard. Clients can be opted in with show_in_account, plus description, logo_uri and client_uri. Opted-in clients appear as an Applications card in the account UI (GET /account/api/apps). Existing clients stay hidden by default. (#423)
• Configurable link on the signed-out page. When RP-initiated logout can't redirect, the button links to the initiating client's client_uri, then the new logout_success_url setting, then /account/. The label is configurable with logout_success_label. (#425)
• Copy federated name claims on signup. New federation_copy_name_claims setting (off by default) copies given_name / family_name from the upstream ID token when a federated login creates a new user. Existing users are not changed. (#414)
• Admin UI: icon-only action buttons in lists and user drawers now have tooltips and accessible labels. (#405)

Fixes

• Federated login nonce: the client's nonce is now carried through federated login. Before, the ID token contained a server-generated nonce, and strict clients (e.g. oidc-js) rejected the first login with NONCE_MISMATCH. (#422)
• Federated email verification: a new federated user's email is marked verified when the provider reports email_verified: true. (#412)
• SMTP sender with a display name: smtp_from values like Name <no-reply@example.com> no longer fail with 501 invalid FROM parameter. The envelope sender uses the bare address and the From: header keeps the display name. Non-ASCII subjects are now encoded. Thanks @MrBeldum. (#420)
• Custom theme logos: theme_logo_url now works with https URLs, same-origin paths and data:image/... URIs. The logo's origin is added to the CSP img-src, and invalid values are rejected when settings are saved. (#424)

Docs

• New OpenCloud OIDC integration guide. (#404)

Full changelog: v2.1.4...v2.2.0