7.0.0

Security

• Bind SAML responses to the initiating browser's pending AuthnRequest instead
  of restoring a session selected through RelayState. A same-origin return page
  supports SameSite=Lax cookies across framework integrations. IdP-initiated
  login is now disabled by default and requires explicit opt-in. In-progress
  SAML logins must restart after upgrading.
• Bind OpenID assertions to the initiating browser session instead of restoring
  a session selected by the assertion's signed return URL. In-progress OpenID
  logins must restart after upgrading.

Added

• Add a BaseAuth.get_provider_error() hook for classifying provider errors in
  callbacks and HTTP responses.
• Add a Casdoor OpenID Connect backend for self-hosted Casdoor servers, with
  PKCE enabled by default.

Changed

• BaseAuth.authenticate() now runs the pipeline on the backend passed in the
  backend keyword argument through its new run_authentication() method.
  This preserves the original backend's state when a framework such as Django
  calls authenticate() on a separate backend instance. Passing a strategy
  different from the supplied backend's strategy now raises
  AuthConfigurationError; create the backend with the intended strategy.
• Assigning BaseAuth.strategy is deprecated and emits a DeprecationWarning.
  Type checkers now treat it as read-only. Create the backend with the intended
  strategy instead.
• Make backends and strategies generic in their framework response type,
  preserving that type through authentication actions and decorated partial
  pipeline steps, including steps returning HTML responses.

Fixed

• Bitbucket's rejection of a revoked refresh token (400 invalid_request) or
  of a deactivated user's refresh token (401 User is inactive) now raises
  AuthCredentialError with reauthentication_required instead of
  AuthProviderError or AuthCanceled.
• Classify OAuth invalid_request failures as AuthConfigurationError.
• Log configuration guidance when Azure AD returns AADSTS9002325, explaining
  that server-side callbacks must use the Web platform in the app registration.

Removed

• Drop support for Python 3.10. Python 3.11 or newer is now required.
• Remove BaseStrategy.get_session_id(), BaseStrategy.restore_session(), and
  BaseStrategy.SESSION_SAVE_KEY. Custom strategies and backends using them
  must migrate to browser-bound callback correlation.