CortenDesk 0.9.2

Two fixes, both reported by users.

Fixed

• Single sign-on refused users whose provider does not assert email verification (#6). 0.9.1 handled providers that omit the email_verified claim, but Authentik deliberately sends email_verified: false for every user — it has no way to confirm someone owns their address — and that was still refused outright. The claim is no longer used to refuse a sign-in. Nothing to configure: upgrade and it works.

  A new Settings → SSO switch, "Require the provider to assert email verification", restores the strict behaviour. Off by default. Worth turning on only if you federate with a provider whose users can choose their own email address.

  Accounts are matched on the provider's stable user id (iss + sub); an email address is consulted only for the first link, after which it decides nothing. That, the email-domain allowlist and the new-user policy are what protect an account here.

• TRUSTED_PROXIES was silently ignored whenever the config was cached (#7). The proxy list was read with env() during bootstrap, and php artisan config:cache — which the Docker image and most deployments run — stops loading .env, so the setting never applied and the built-in private-range default was always used. If your reverse proxy reaches CortenDesk from a public address (Cloudflare, an external load balancer), it could not be trusted: HTTPS went undetected, assets were generated with http:// URLs, and sign-in could loop. The list now lives in config/trustedproxy.php and survives caching.

  Reported and diagnosed by @AJV20.

Notes

• No configuration changes are needed and no migrations are added.
• Still on 0.9.0? It could not migrate on MariaDB; 0.9.1 fixed that and this release includes it.

docker pull marcpope/cortendesk:0.9.2
docker pull ghcr.io/marcpope/cortendesk:0.9.2