identuum-ui v0.9.15

This release explains what a site administrator recovery changes and adds
tests for the existing account-claim screens. Console runtime behavior is
unchanged.

• Recovery documentation explains revocation and failure outcomes. The
  local Playwright guides explain that a credential update makes saved
  test credentials stale, even if a later recovery step fails. An authorized
  operator must resolve the fault, complete recovery, enroll MFA again and
  update the local credential file before another test run. Treat old
  sessions as live until revocation succeeds. Recovery auditing started in
  identuum-idp-oss v0.9.14; this release documents it.
• Claim answers and MFA continuation have characterization tests. Mocked
  unit tests cover validation and consume answers, request methods and
  payloads, rendered outcomes, and the existing MFA continuation. These
  tests do not certify browser or live-server behavior.

The console is delivered as an embedded static export. There is no new
setting or separate UI service to deploy for these changes. Final server
and export compatibility still needs the release checks; these unit tests
do not establish it.

identuum-ui v0.9.14

The static console export for identuum-idp-oss v0.9.14: the Invite user
form names an address that already has an account, and passkey and provider
sign-in show the password change an administrator requested. It needs
identuum-idp-oss v0.9.14, which gives the answers below.

• Invite user says when an address already has an account. An invite of
  an address another account holds showed "This user already accepted their
  invitation" for every 409. Now email_exists shows "This email address
  already has an account. Use another address."; user_not_pending keeps
  its words, and any other 409 gets the general invite failure.
• Passkey and provider sign-in show the required password change. A
  passkey sign-in that owes a password change opens the change step, as
  password sign-in does; an expired administrator-set password shows the
  same expiry words. The sign-in banner has plain words for the two new
  provider refusal reasons.

identuum-ui v0.9.13

The static console export for identuum-idp-oss v0.9.13: your connected
apps in Account settings, administrator reset links, a sign-in policy per
organization, a console that works on a phone, and plain words where the
server refuses.

• See and remove the apps that use your account. Account settings has
  a new "Applications" tab, also in the member menu. It lists each app you
  allowed, what it can see in plain words (for example "your email
  address" or "stay signed in") and the day you allowed it. "Remove
  access" asks first: the app will have to ask you again, and it may keep
  working for a short time, which the page states from the server's own
  setting. The Overview has an "Applications" card with the count and a
  "Review" link. A server without this feature says "Not available on
  this server." After a removal, the line "Access removed for ."
  stays on the page and keyboard focus moves to it.

• The user page says when a new password is due. When an
  administrator set a person's password and the person has not yet
  changed it, the user page shows "Must choose a new password at next
  sign-in."

• Reset links say why they cannot be made. When a reset link is
  refused, the user page now says why in plain words: the person has not
  activated the account, signs in only with a provider, belongs to an
  organization that allows only provider sign-in, or the server cannot
  make reset links yet. A "Done" button closes the link, and it is not
  shown again. The button follows the server's own setting on every
  edition.

• An expired password is named at sign-in. When a password set by an
  administrator has expired, the sign-in page says so and tells the person
  to ask for a new reset link, instead of "Invalid credentials".

• A taken domain is named. When a new organization cannot be created
  because its domain may already be in use, the Domain field says so,
  instead of "The backend returned an error".

• A taken name or email address is named too. When a new
  organization's name, domain or administrator email address is already
  in use, the server now says which, and that field shows it.

• The audit filter lists what the server records. The event types in
  the audit log filter now come from the server, on every edition, in
  groups with plain-word names. When the server cannot send the list, the
  filter says so and the other filters still work.

• A reset link that could not sign you out elsewhere. When the new
  password was set but your other sign-ins could not be ended, the page
  says the password was changed and asks you to have your administrator
  end the other sessions. It does not offer to try again.

• The console works on a phone. On screens narrower than 768 px the
  menu at the left is hidden, so pages no longer scroll sideways. A
  "Menu" button at the top opens the same menu, with Sign out, from the
  left. Tap a link, tap outside the menu, press Escape or press "Close
  menu" to close it. With a keyboard, focus stays in the open menu and
  goes back to "Menu" when it closes. A long email address at the top is
  cut short; the account menu shows all of it. On wider screens nothing
  changes.

• Choose how members sign in. In Settings, the "Sign-in providers" card
  has a "Change" button next to the sign-in policy. Choose "Password only",
  "Password or a sign-in provider" or "Sign-in provider only". "Sign-in
  provider only" stays off until the organization has an active provider.
  A move to or from it asks first and says who it affects: going to it,
  members who only have a password cannot sign in; going to "Password
  only", members who only sign in with a provider cannot sign in; going to
  both, passwords work again. A site administrator sees the policy and is
  told that only the organization's own administrator can change it.

• Removing the last provider is explained. When members can only sign in
  with a provider, the card says why its only provider cannot be removed,
  before you press "Remove…".

• Two people editing one application. When someone else saved the
  application after you opened it, your save is refused and nothing is
  lost: a banner offers "Load the latest version" or "Save my version
  anyway". Your typed values stay in the form.

• Plain words when a provider sign-in is refused: when the invitation is
  not accepted yet, when an administrator has not approved the account yet,
  when the provider did not share the email address, when the sign-in did
  not work or took too long, when the account may not sign in this way, or
  when the provider or sign-in cannot be reached. A sign-in address with a
  made-up reason shows no message, instead of an empty box or an error page.

• Administrators can verify their own email address from Account
  settings, Profile, like members on their Overview. The site administrator
  sees the status only.

• Smaller fixes: "Not verified yet" is not repeated when the server cannot
  send email, and the line is read out by screen readers; a click outside
  the remove dialog no longer lets focus escape it; "Passkeys" marks
  Security in the member menu; a provider error that starts with a name,
  such as "Google", keeps its capital letter; a server that does not offer
  sign-in providers is not reported as "Provider removed"; "User not found"
  is shown for both spellings of the server's answer; the account menu
  reads the email address outside the menu items; the phone menu keeps
  focus in place when the screen gets wider.

Verification machinery (repository-visible, not in the export)

• e2e-full exercises authenticator setup (initiate and complete), the
  caller's own consents (list and remove; the app's refresh token is then
  refused) and the administrator's reset link with its public validate and
  redeem pair. The role matrix grows 315 -> 332 committed cells; the
  closure set 55 -> 57.
• The role matrix's denominators follow the identuum-idp-oss golden to
  166/109/36 (total/role/class endpoints) for GET
  /api/v1/audit/event-types; no cells are added until a spec exercises it.

identuum-ui v0.9.12

The static console export for identuum-idp-oss v0.9.12: a complete member
area, sign-in providers in Settings, truthful email status, and fewer false
error messages.

• The member Overview shows real facts. The four "Coming soon" cards are
  gone. Three cards — Profile, Security and Sessions — show your name and
  email, whether two-step sign-in is on and how many backup codes are left,
  and how many devices are signed in. Each card opens its page. A card that
  cannot load says so and still opens its page.
• The member menu has Profile, Security and Sessions next to Overview,
  on the Overview and on the account settings pages.
• The provider page keeps working when a tab stays open. When the
  access token has expired, the console renews it and reads the
  organization again. After a server restart, a failed first read is tried
  once more.
• Provider save and remove failures say what happened. When the
  organization cannot be read, the message says whether the server did not
  answer, you lack permission, or the organization could not be read; a
  save the server refuses gives the server's reason. Settings
  and the Add and Edit pages say the same when they cannot read the
  organization. A failed save keeps what you typed, except the client
  secret. An expired session goes to the sign-in page.
• A visitor who never signed in sees the plain sign-in page, in the
  exported console and in the Next deployment. "Your session has expired"
  is shown only when a sign-in that was presented is refused.
• The sign-in page shows "You have been signed out." once. It goes away
  after a sign-in attempt or a reload. "Sign-out could not be confirmed"
  (with Retry sign-out) and "signed out on this device only" stay until they
  are resolved.
• Clearer text: the password tab says this device stays signed in and
  your other devices are signed out; the two-step tab explains recovery
  codes; the application forms point to "Rotate client secret".
• Sign-in providers are listed in Settings. The new "Sign-in providers"
  card shows each provider's name, type, short identifier, status, email
  domains, last update and the redirect URI, with a Copy button. It also
  says in words how members sign in (password only, password or a
  provider, or a provider only), and adds a hint when that policy and the
  list do not match.
• Add and Edit return to Settings. After a save you are back on Settings
  with "Provider saved." or "Provider updated." and the redirect URI in the
  list. You no longer need to reload the page. Cancel goes back without a
  change.
• Remove asks first and stays on the page. "Remove…" opens a short
  question. After you confirm, the provider leaves the list and the card
  says "Provider removed." A provider another tab already removed leaves the
  list too. If removal fails, the provider stays, the card says so, and the
  keyboard focus moves to that message.
• An unknown sign-in policy is not shown as "password only". A server
  that does not report the policy shows "The sign-in policy could not be
  read."
• "Add provider" says why it is off. This edition supports one sign-in
  provider, so the button is disabled while one exists, with that reason
  next to it.
• The old provider page address opens Settings at the providers card,
  so old links still work.
• One backup code reads in the singular: "Only 1 backup code left."
• The member Overview says how your email address was verified. It
  shows "Verified by email", "Verified by your sign-in provider" or
  "Verified". When the address is not verified yet, "Send verification
  email" mails you a link, and the page says what happened. When this
  server cannot send email, the page says so and asks you to contact your
  administrator. Needs identuum-idp-oss v0.9.12; other servers show the
  previous Verified / Unverified row.
• An administrator sees how a user's address was checked. The user
  page shows, under the address, whether it was verified by email, by the
  sign-in provider or before v0.9.12, or why it is not verified (set by an
  administrator, activated with an administrator's link, or set during
  setup).
• Smaller fixes on the member Overview. "Send verification email" is a
  44 px button. The "Signed in as" card says "Two-step sign-in", like the
  Security card. When the server does not answer, the Security card says it
  could not load.

identuum-ui v0.9.11

The static console export for identuum-idp-oss v0.9.11, with a sign-in
provider page and updated documentation and release tooling.

• Organization admins can open the sign-in provider page from Settings
  and create, update or remove their organization's provider in the exported
  console. (72a1304)

For contributors:

• README describes the console as it ships: a static export embedded in
  the identuum-idp-oss binary, with its release assets and development
  commands. (b1a3fd4)
• The CHANGELOG header identifies the export tarball, JSON manifest and
  SPDX SBOM as the published artifacts. (b1a3fd4)
• Release notes come from the tag's exact CHANGELOG section. The publish
  workflow refuses a missing or empty section before publication.
  (c348a3e)
• CI runners are pinned to Ubuntu 24.04 in the verification and export
  publication workflows. (70e603d)

identuum-ui v0.9.10

The static export that identuum-idp-oss v0.9.10 embeds, a security patch
release of the server. The console itself carries two fixes.

• Audit log filter: the From and To date inputs follow the Time range
  select: they are enabled for "Custom range" only, and a range applied as
  custom keeps them enabled.
• Assign administrator: an administrator who has not yet activated, with
  a valid activation link, now reads as "activation pending" with a link to
  the organization page, not as an active verified administrator.

For contributors (nothing in the export changes):

• The e2e-full sweep expects 403 when an org_user of an organization that
  requires MFA tries to disable MFA, the behaviour identuum-idp-oss
  v0.9.10 enforces.
• CI's Go toolchain pin is 1.27.2.

identuum-ui v0.9.9

identuum-ui v0.9.9 static export; see docs/releases/v0.9.9.md.

identuum-ui v0.9.8

identuum-ui v0.9.8 static export; see docs/releases/v0.9.8.md.

identuum-ui v0.9.7

identuum-ui v0.9.7 static export; see docs/releases/v0.9.7.md.

identuum-ui v0.9.6

identuum-ui v0.9.6 static export; see docs/releases/v0.9.6.md.