[0.14.0] - 2026-10-28

Added

• [identity] scope sessions by requested authorization client id enabling concurrent sessions. The change reset all active sessions.
• [identity] log WebAuthn and TOTP registration and authentication successes and failures
• [identity] identity providers can select stateless (default) or stateful request mode; stateful mode stores the signed request JWT in the session cookie and omits it from initial identity-route URLs. Do not enable stateful mode until login and other identity steps are bound to individual requests.
• [admin] user edit pages show saved consents with client IDs, scopes, and update times
• [ssi] machine users can grant consent for OID4VP requests using their verified DID as the client identity

Changed

• [ssi] vp_token response type requires resource owner or machine authentication
• [auth] add public client id unique index
• [auth] authorization and token success logs include the authorized scope

Fixed

• [admin] resetting a template updates the text editor with the default content immediately
• [identity] updated identity provider templates no longer serve stale cached content when the update omits the template type
• [identity] consent requests with no scope do not throw an internal server error
• [identity] prefill user edition form on update failure
• [ssi] verifiable credential claim status TTL persists from the backend form
• [ssi] public-client preauthorization resumes with the expected response types
• [identity] backend metadata defaults persist from the admin form and populate issued credential claims when the user has no value

Security

• [identity] stateful consent forms submit an opaque request ID and reject missing or replaced requests, preventing an earlier form from granting consent to a different client
• [ssi] machine-user sessions are bound to the originating authorization code and DID, and unrelated authorization requests clear the machine session