Skip to content

v1.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Jul 16:57
· 1527 commits to master since this release
v1.3.0
bddaa8d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

New & Changed

  • feat(infra): Caddy default_sni for bare-IP HTTPS (LAN reachability) (#1010)
  • feat: add password-lifecycle i18n copy (change/forgot/reset/checklist, en + es) (#1004)
  • feat: link 'Forgot your password?' from the local login form (#1004)
  • feat: add public /reset-password page (local-mode gated, missing-token state) (#1004)
  • feat: add reset-password form (token from URL, generic error, route to /login) (#1004)
  • feat: add public /forgot-password page (local-mode gated) (#1004)
  • feat: add enumeration-safe forgot-password form (uniform confirmation) (#1004)
  • feat: add /change-password forced-change wall page (#1004)
  • feat: add forced-change client shell (session-token sync + forced ChangePasswordForm) (#1004)
  • feat: add forced-change wall layout (auth + local-mode guards, bare AuthShell) (#1004)
  • feat: mount the change-password panel in the profile view (#1004)
  • feat: add local-mode self-service change-password panel to the profile page (#1004)
  • feat: allow public /forgot-password and /reset-password through route protection (#1004)
  • feat: honor useSession().update to swap the fresh post-change session token (#1004)
  • feat: wire forced-change interception into the query/mutation onError seam (#1004)
  • feat: add shared ChangePasswordForm (self + forced) with fresh-token session swap (#1004)
  • feat: add reusable live password-strength checklist (mirrors ZitadelPasswordSchema) (#1004)
  • feat: test the forced-password-change interception (latch, loop-guard, code match) (#1004)
  • feat: add forced-password-change interception seam (403 PASSWORD_CHANGE_REQUIRED -> /change-password) (#1004)
  • feat: add password-lifecycle mutation hooks; change-password opts out of global auth handling (#1004)
  • feat: add local-mode password-lifecycle API endpoints (change/forgot/reset) (#1004)
  • feat(api): re-pin the canonical recent_activity view migration to password_lifecycle
  • feat(api): exempt GET /users/me from the forced-change gate (ADR-0086 §F4)
  • feat(api): register MustChangePasswordGuard as APP_GUARD between auth and authz
  • feat(api): wire the password-lifecycle controller/service + guard into LocalAuthModule
  • feat(api): tests for the password-lifecycle controller (uniform forgot body, 401 anon)
  • feat(api): PasswordLifecycleController — change/forgot/reset endpoints (ADR-0086 §F4)
  • feat(api): per-IP rate-limit guard for the public reset endpoints (ADR-0086 §F4)
  • feat(api): tests for the forced-change gate (blocks non-exempt, allows exempt/public/non-local)
  • feat(api): MustChangePasswordGuard — forced-change gate, 403 PASSWORD_CHANGE_REQUIRED (ADR-0086 §F4)
  • feat(api): @AllowPasswordChangeRequired exemption decorator (ADR-0086 §F4)
  • feat(api): security-graded tests for PasswordLifecycleService
  • feat(api): PasswordLifecycleService — change/forgot/reset (epoch-bump, enumeration-safe, single-use, ADR-0086 §F4)
  • feat(api): renderPasswordResetEmail branded template (ADR-0086 §F4)
  • feat(api): tests for the reset-token primitives (entropy, hash-at-rest, uniqueness)
  • feat(api): reset-token primitives (CSPRNG mint + SHA-256 hash-at-rest, ADR-0086 §F4)
  • feat(api): offline migration — password_reset_tokens table + enum values + recent_activity view (ADR-0086 §F4)
  • feat(api): PasswordResetToken model + two self-service UserHistory events (ADR-0086 §F4)
  • feat(shared): export the auth-password schemas
  • feat(shared): pin the two new verbs in the recent-activity actions test
  • feat(shared): add password_changed + password_reset_completed recent-activity verbs (ADR-0086 §F4)
  • feat(shared): pin the two self-service password events in the user-history enum test
  • feat(shared): add PASSWORD_CHANGED + PASSWORD_RESET_COMPLETED to UserHistoryEventType (ADR-0086 §F4)
  • feat(shared): tests for the password-lifecycle schemas
  • feat(shared): local-mode password-lifecycle wire contracts (change/forgot/reset) + PASSWORD_CHANGE_REQUIRED code (ADR-0086 §F4)
  • feat(infra): dev-setup local-auth default + --zitadel opt-in (#1000)
  • feat(infra): start.sh 3-way auth with local default + SESSION_SIGNING_SECRET (#1000)
  • feat(infra): import the auth site via an empty-safe glob (#1000)
  • feat(infra): extract the Caddy auth.{domain} site to sites/auth.caddy (#1000)
  • feat(infra): profile the dev Zitadel stack behind oidc in the dev override (#1000)
  • feat(infra): move api/web zitadel_secrets mounts to the oidc overlay (#1000)
  • feat(infra): add docker-compose.oidc.yaml overlay for the bundled Zitadel (#1000)
  • feat(infra): move Zitadel to profiles:[oidc] + mode-aware backup cron (#1000)
  • feat: local setup i18n keys (en+es) (#999)
  • feat: local login i18n keys (en+es) (#999)
  • feat: mode-aware done copy in setup wizard (#999)
  • feat: local-mode welcome step (no IdP picker) (#999)
  • feat: setup wizard local-mode fork (#999)
  • feat: add local to IdpChoice (#999)
  • feat: branch /login on authMode=local (#999)
  • feat: local sign-in form component (#999)
  • feat: add Credentials provider + cookie-scheme fix to auth.ts (#999)
  • feat: test reset-password 200 local-mode body path
  • feat: reset-password returns 200 { temporaryPassword } in local mode, 204 in OIDC (ADR-0086 §5)
  • feat: test local create hashing + local reset mint/epoch/audit + directoryOnly guard
  • feat: local branches in create (hash) + requestPasswordReset (temp-password, epoch-bump, audit) (ADR-0086 §5)
  • feat: test local setup (requires+hashes password, marker write) + oidc marker
  • feat: decouple requiresAdminPassword, local /setup branch + mode-marker write (ADR-0086 §5/§1)
  • feat: test resolveIntegrationMode local branch
  • feat: resolveIntegrationMode returns 'local' when AUTH_MODE=local (ADR-0086 §5)
  • feat: wire AUTH_MODE into the IdP factory + provide LocalProvisioningService (ADR-0086 §5)
  • feat: test LocalProvisioningService — hashing + policy-satisfying temp-password
  • feat: add LocalProvisioningService — set-password primitive + temp-password (ADR-0086 §5)
  • feat: test factory local branch + LocalIdentityProvider no-op (ADR-0086 §5)
  • feat: factory returns LocalIdentityProvider when AUTH_MODE=local (ADR-0086 §5)
  • feat: add LocalIdentityProvider — pure no-op for AUTH_MODE=local (ADR-0086 §5)
  • feat: offline migration — mustChangePassword column, PASSWORD_RESET_BY_ADMIN enum, recent_activity view (ADR-0086 §5)
  • feat: add User.mustChangePassword + PASSWORD_RESET_BY_ADMIN enum value (ADR-0086 §5)
  • feat: add AdminPasswordResetResult schema (local-mode reset temp-password, ADR-0086 §5)
  • feat: assert password_reset_by_admin in the recent-activity verb test
  • feat: add password_reset_by_admin to RECENT_ACTIVITY_ACTIONS (ADR-0086 §5)
  • feat: assert PASSWORD_RESET_BY_ADMIN in the event-type enum test
  • feat: add PASSWORD_RESET_BY_ADMIN to UserHistoryEventType (ADR-0086 §5)
  • feat: SEED_ADMIN_PASSWORD dev-only opt-in for local-auth (F1d, #994)
  • feat: reset-admin-password CLI — F1d local-auth recovery escape hatch (#994)
  • feat: extract admin password-reset core logic (F1d recovery CLI, #994)
  • feat: register LocalAuthModule in AppModule
  • feat: provide+export LocalCredentialService from AuthModule (shared by guard + login)
  • feat: add handleLocal branch to JwtAuthGuard — HS256 session verify + epoch revocation + state gates (ADR-0086 §3)
  • feat: add LocalAuthModule wiring the local login surface (ADR-0086 F1b)
  • feat: add LocalAuthController — @public rate-limited POST /auth/login (ADR-0086 §3)
  • feat: add LoginService — no-enumeration login flow + per-account backoff + rehash-on-login (ADR-0086 §3)
  • feat: add per-IP LoginRateLimitGuard for POST /auth/login (ADR-0086 §3 brute-force E)
  • feat: add LocalCredentialService — argon2id hash/verify + rehash + HS256 session mint/verify (ADR-0086 §3/§4)
  • feat: export local-auth constants + login schemas from @lazyit/shared barrel
  • feat: add local login request/response wire schemas — ADR-0086 F1b
  • feat: add local-auth shared constants (argon2id OWASP params, password cap, session TTL/alg) — ADR-0086 F1b
  • feat: mode-marker decision specs (ADR-0086 F1a)
  • feat: boot-config specs for 3-state AUTH_MODE + local signing-secret (ADR-0086 F1a)
  • feat: read + enforce the auth-mode marker at boot (ADR-0086 F1a)
  • feat: persisted auth-mode marker boot decision (ADR-0086 F1a)
  • feat: 3-state AUTH_MODE (shim|local|oidc), explicit-required + local signing-secret refine (ADR-0086 F1a)
  • feat: offline migration for local-auth columns + instance_config (ADR-0086 F1a)
  • feat: User local-auth columns + single-row InstanceConfig mode marker (ADR-0086 F1a)
  • feat: add 'local' to IntegrationMode + optional ConfigStatus.authMode (ADR-0086 F1a)

Fixes

  • fix(auth): register OIDC provider only when an issuer is configured (local-mode 500) (#1008)
  • fix(api): tests for the same-password rejection + reset-token sweep on change (F-2/F-3)
  • fix(api): reject same-password change + kill outstanding reset tokens on change (F-2/F-3, #1005)
  • fix: re-pin recent_activity canonical migration to 20260703010000_local_auth_provisioning (#618 guard)
  • fix: add es 'local' identity-provider label (ADR-0086 F1a)
  • fix: add en 'local' identity-provider label (ADR-0086 F1a)
  • fix: add 'local' to the exhaustive IntegrationMode label map (ADR-0086 F1a shared→web ripple)

Full changelog: v1.2.0...v1.3.0

Contributors

public
Assets 2
Loading