Release 1.7.2

Goiabada 1.7.2

A fix release for 1.7.1: OAuth interoperability, safer sessions and sign-out, and client certificates for database TLS. All changes

⚠️ Breaking changes

• #575 Adding a plain http redirect URI outside 127.0.0.1, [::1] or localhost is refused; stored ones keep working with a warning but can't be added back once removed. (PR #582 by @choksi2212)
• #121 response_mode=form_post refuses custom-scheme redirect URIs; use query or fragment. (PR #595 by @Mihir-Rabari)
• #576 A changed issuer must be an HTTPS URL with no query, fragment or user info, or exactly GOIABADA_AUTHSERVER_BASEURL; a stored value outside that rule is served unchanged with a startup warning.
• #151 Creating or renaming a client to a resource's identifier, or the reverse, is refused; existing collisions keep working with a startup warning. (PR #604 by @Mihir-Rabari)
• #474 Basic authentication form-decodes the client identifier and secret, as RFC 6749 section 2.3.1 requires: a raw + now means a space, so send %2B. (PR #593 by @Mihir-Rabari)
• #533 A client whose default ACR is urn:goiabada:level2_mandatory, with its code flow on, gets unauthorized_client for every password grant. (PR #602 by @Mihir-Rabari)
• #411 Custom templates: copy both servers' new files and reapply your changes, including the console's account_logout_confirm.html and the auth server's logout_declined.html.
• #576 The auth server always uses its built-in form_post.html; a copy in your template directory is ignored.
• #576 Issuers with a path: route /.well-known/oauth-authorization-server/<path> to the auth server's /.well-known/oauth-authorization-server, as RFC 8414 section 3.1 defines.

⚙️ Config changes

• Database: no migrations; the schema stays at 000064.
• #546 New, optional: GOIABADA_DB_TLS_CLIENT_CERT_FILE and GOIABADA_DB_TLS_CLIENT_KEY_FILE present a client certificate to PostgreSQL and MySQL. (PR #614 by @Mihir-Rabari)
• #546 New, optional: GOIABADA_DB_TLS_SERVER_NAME sets the host name verify-full checks, on all three network engines. (PR #614 by @Mihir-Rabari)
• #525 New, optional: GOIABADA_ADMINCONSOLE_INTERNAL_CA_FILE lets the console trust a private CA for its calls to the auth server, beside the system roots. (PR #613 by @Mihir-Rabari)
• #474 If the console's client secret contains spaces, upgrade the auth server before the console.
• #546 The setup wizard asks for the database client certificate and server name, for native and Kubernetes deployments. (PR #614 by @Mihir-Rabari)

New

• #576 OAuth discovery is also served at /.well-known/oauth-authorization-server (RFC 8414).
• #576 Every authorization response carries iss (RFC 9207).
• #576 Redirects answering sign-in POSTs use 303 See Other.
• #590 An authorization response sent to a stored plain-http redirect URI on a non-loopback host logs a warning. (PR #592 by @Mihir-Rabari)

Fixed

• #579 A stalled sign-in step no longer overwrites a newer ceremony or restores a signed-out browser session.
• #538 An older sign-in can't replace newer authentication on the session. (PR #572 by @choksi2212)
• #538 A stale bind is answered as a ceremony the browser has replaced.
• #535 Signing in as someone other than the id_token_hint's user is refused before a session is bound. (PR #611 by @Mihir-Rabari)
• #411 The admin console signs out through a confirmed POST guarded against cross-site requests, no longer a GET. (PR #610 by @Mihir-Rabari)
• #152 Declining the auth server's sign-out works without JavaScript or browser history. (PR #596 by @Mihir-Rabari)
• #407 Concurrent saves to different settings sections no longer overwrite each other or release the cleanup job's claim. (PR #606 by @Mihir-Rabari)
• #573 A missing grant_type returns invalid_request. (PR #574 by @wzd8888)
• #573 Authorization redirects carry Cache-Control: no-store and Pragma: no-cache. (PR #574 by @wzd8888)
• #573 A client with its code flow off receives unauthorized_client at its redirect URI. (PR #587 by @choksi2212)
• #530 Redeeming a session-bound code after its session ended returns invalid_grant instead of a 500. (PR #598 by @Mihir-Rabari)
• #474 The admin console authenticates its token grants with HTTP Basic. (PR #593 by @Mihir-Rabari)
• #531 Translated email bodies match regional language tags, as their subjects already did. (PR #588 by @choksi2212)
• #607 Registration emails follow the language the registration page was shown in. (PR #609 by @Mihir-Rabari)
• #487 migrate to acknowledges a stop signal at once, finishes the migration already running and starts no further one. (PR #603 by @Mihir-Rabari)
• #570 SQLite logs a WAL checkpoint that did not complete at shutdown. (PR #585 by @choksi2212)

Maintenance

• #408 Docs: the auth server and the admin console must share one registrable domain, since the console's session cookie is SameSite=Lax.
• #580 The sign-in ceremony is restructured into one operation per step in internal/authflow, with the same behavior.
• #475 The OpenAPI requiredness lint fails an exception that has stopped being read. (PR #600 by @Mihir-Rabari)
• #476 A missing writer on the client pages' test stub is a compile error, not a panic. (PR #599 by @Mihir-Rabari)
• #480 schemadump shares core's source-root lookup instead of declaring the module directories again. (PR #608 by @Mihir-Rabari)
• #483 A test drives the admin console's route table to each area's list page. (PR #601 by @Mihir-Rabari)
• #510 Migration tests seed their rows as SQL at the version they run against. (PR #612 by @Mihir-Rabari)
• #584 The docs guards that drive the ceremony decisions moved into authflow and are unexported. (PR #605 by @Mihir-Rabari)
• #536 The docs tests share a Markdown section and table reader. (PR #586 by @choksi2212)
• #591 Integration tests close every response, not only the last one. (PR #594 by @choksi2212)
• #577 A fork's pull request pulls the CI images anonymously.
• #597 The API reference in llms-full.txt is written as lists.
• e2e: RFC 6749 and RFC 9700 conformance suites.
• golangci-lint 2.15.0, daisyUI 5.7.50 and updated Go modules.