v0.6.0

0.6.0 (2026-05-30)

Bug Fixes

• auth: don't overwrite local password accounts during OIDC provisioning (cf9ea45)
• auth: handle UNIQUE constraint on username during OIDC auto-provision (4e26281)
• auth: import missing dbGetUserByUsername in auth/routes.js (ce64f7a)
• auth: link OIDC identity to existing username, update auth_provider to oidc (9c1c80f)
• auth: log full OIDC error cause for debugging (9623206)
• auth: migrate openid-client from v4 to v6 API (8555db6)
• auth: reconstruct OIDC callback URL from registered redirectUri to preserve port (2ef05fd)
• auth: remove nonce from OIDC flow — PKCE is sufficient for public clients (07dc293)
• auth: skip nonce check in OIDC callback if cookie not present (1ac7170)
• ci: add image tag so docker compose uses pre-built Keycloak image (1f34021)
• ci: HTTPS on nginx via self-signed cert, redirect URI from LIVE_BASE_URL (94a436c)
• ci: use 'orkllm' realm instead of 'master' for Keycloak import (5b988f9)
• ci: use 127.0.0.1:18000 as OIDC redirect URI in CI to avoid state cookie mismatch (81ac833)
• ci: use start-dev for Keycloak, bake realm into image, fix wait step (12844de)
• test:sso: update local npm script to use orkllm realm URL (3e1a10a)
• tests: after OIDC callback navigate to test server root before polling auth-status (63d3aa4)
• tests: derive OIDC redirect URI protocol from ORKLLM_TEST_REDIRECT_BASE (cda9790)
• tests: ensure local auth enabled before login; skip SSO if server unreachable (57842ab)
• tests: login before DELETE in SSO finally blocks; docs: require doc review on commits (b13de22)
• tests: make live server URL configurable via ORKLLM_TEST_LIVE_URL env var (f00f5f5)
• tests: read admin credentials from env in all spec files (a0455b0)
• tests: remove hardcoded URL assertion in ssoLogin, poll auth-status instead (6eb723f)
• tests: suppress Keycloak VERIFY_PROFILE and isolate SSO test cleanup (ad046e8)
• tests: use API login in rbac tests to avoid Vuetify form timing issues (84ae7d1)
• tests: use API login in SSO test finally blocks to bypass OIDC redirect (c47adb0)
• tests: verify OIDC provider is deleted after SSO admin test finally block (cccfade)

Features

• ci: use Keycloak container for SSO E2E tests — identical in CI and locally (0c00b96)
• DB migrations, trusted proxy, mock OIDC SSO tests in CI (e213722)
• release: add beta and alpha pre-release channels (a3adcd9)
• test: docker-compose.test.yml for identical SSO test environment locally and in CI (ac43882)