v1.0.6

Changes

• Add database-managed OAuth resources with per-resource scopes, client assignments, GraphQL management operations and client resource policy queries.
• Use Light's registered concrete permissions as the default scope catalog. OAUTH_SCOPES optionally restricts the catalog; wildcard permissions are excluded.
• Enable RFC 8693 token exchange automatically. Confidential clients authenticate with their secret and explicitly select a target resource (or audience). Both source and target must be registered, enabled and assigned to the exchanging client.
• Validate source tokens against their persisted resource, including DCR/CIMD user tokens. Preserve scope narrowing, source revocation checks, source-bounded expiry and the prohibition on chained exchanges.
• Configure the maximum derived-token lifetime with OAUTH_TOKEN_EXCHANGE_TTL (default PT5M).

Upgrade notes

• Apply migrations/002_oauth_resources.sql, register trusted resources and assign them to clients before upgrading an existing OAuth installation. New installations also require migration 001. Resource policy is always enabled; the resource registry switch has been removed.
• OAUTH_TOKEN_EXCHANGE_POLICY and the TokenExchangePolicy class have been removed. Update manual provider/factory calls that passed a policy object. Use confidential-client resource assignments and scopes instead.
• Exchange requests must explicitly select one target. Assign the MCP server client both its source MCP resource and target API resource. Public DCR/CIMD clients cannot perform exchange themselves.
• Without OAUTH_SCOPES, the catalog now includes all registered concrete Light permissions. Existing resource/client/token scopes continue to constrain access.

Validation

PHPUnit: 140 tests, 773 assertions; 10 skipped.

v1.0.5

Adds an optional frontend authorization UI and lets users choose which requested scopes to approve.

• Set OAUTH_AUTHORIZATION_UI_URL on the API to redirect to a Nuxt authorization page. The existing PHP authorization page remains the default when unset.
• Adds a session-backed OAuth interaction endpoint for login, two-factor authentication, consent, and validated callback redirects, with CSRF and origin checks, expiring request IDs, and replay protection.
• Restricts issued permissions to the user-selected subset of the requested and permitted scopes.
• Documents frontend configuration and updates the environment example.

Validation: Composer validation passed. Full suite passed with 127 tests, 620 assertions, and 9 optional integration skips. Browser and frontend authorization integration tests passed separately against a configured Light checkout (3 tests, 53 assertions).

v1.0.4

Adds optional scope selection for authorization requests that omit scope. Enable OAUTH_AUTO_SELECT_SCOPES=true through ProviderFactory, or autoSelectScopes: true on Config. Selected scopes are the intersection of the provider allowlist, client scopes, and current user permissions.

• Shows selected scopes in the built-in consent page and requires renewed consent if the selection changes before approval.
• Rejects an empty intersection and preserves strict handling of explicitly requested scopes.
• Keeps automatic selection disabled by default. Custom AuthorizationFlow implementations must integrate the request-local AutomaticScopes helper before enabling it; README includes migration instructions.
• Updates README and .env.example with configuration and behavior.

Validation: full suite completed with 117 tests, 600 assertions, and 8 optional integration skips. Both browser consent integration tests also passed separately with a configured Light checkout (28 assertions). Composer validation passed.

v1.0.3

Add opt-in RFC 7591 Dynamic Client Registration for public PKCE clients.

• Enable with OAUTH_DCR_ENABLED=true through ProviderFactory, or dcrEnabled: true on Config.
• Expose POST /oauth/register and advertise registration_endpoint in discovery.
• Validate JSON metadata, callback URLs, exposed scopes and supported authorization-code/refresh grants.
• Create public client records with server-generated IDs and return HTTP 201 without client secrets.
• Preserve mandatory PKCE, user permission checks and consent. DCR and CIMD can be enabled together.
• Include DCR documentation, request size limits and regression coverage. Registration rate limits and retention remain application/proxy responsibilities.

CIMD retains the strict DNS policy from v1.0.2. The intermediate DNS address-selection change was reverted and is not included in this release's behavior.

Validation: full suite passed before the DNS-policy revert (111 tests, 7 environment-dependent skips). After the revert, all 13 targeted CIMD/DCR tests passed with 148 assertions. PHP syntax and diff checks passed.

v1.0.2

Fix Codex CIMD login failing with invalid_client when its metadata document includes both 127.0.0.1 and localhost callback alternatives.

• Accept the exact HTTP localhost hostname in CIMD callback metadata while preserving existing database client validation.
• Keep variable-port matching limited to loopback IP callbacks; callback host and path validation remain enforced.
• Keep metadata fetching protections against localhost and private network destinations.
• Document callback behavior and add regression coverage using Codex's metadata shape.

Validation: 30 relevant tests completed, with 2 environment-dependent tests skipped; the actual Codex document and reported callback also passed local validation.

v1.0.1

Full Changelog: v1.0.0...v1.0.1

v1.0.0

Update LICENSE