v1.11.1

What's Changed

• Fixed the avatar upload page (/avatar/ui) failing PKCE over plain http: the PKCE challenge now uses a pure-JS SHA-256 instead of crypto.subtle (undefined in non-secure contexts), so a self-hosted http deployment can sign in and upload a profile picture (#94).

v1.11.0

Adds the profile-picture avatar SPI + Schuly-branded upload page, and a shadcn (Nova) account console theme matching the login. Realm config (roles scope, picture attribute, schuly-avatar client, accountTheme) wired into realm.json.

v1.10.0

Email verification by code

Changed

• Email verification now uses a 6-digit code the user types on the Keycloak page, instead of a click-a-magic-link email (#80). Adds a custom VERIFY_EMAIL_CODE required-action SPI (emails the code, validates it, marks the email verified), a code email template, and an OTP code-entry page. The realm now defaults new registrations to this action (verifyEmail disabled).

v1.9.1

Proper RP-initiated logout

Added

• post.logout.redirect.uris on the schuly-app client so the mobile app can complete a real logout via the end_session_endpoint and return to its scheme (#78)

v1.9.0

Registration, email verification & branded auth

Added

• Centered shadcn-style login card with social providers above the form (#63)
• Email verification on registration — full default required-actions set incl. VERIFY_EMAIL (#65)
• Branded, cross-client-tested verification email, minimalist style with the hosted Schuly logo (#67, #69, #71)
• "Return to Schuly" deep-link on the info page so mobile users route back to the app after verifying (#73, #75)

Fixed

• Realm ${env.*} placeholders now resolved at container startup so no secrets are baked into the image (#59)

Removed

• reCAPTCHA from registration (#76)

v1.8.0

Made the SMTP server config env-driven (#56)

v1.6.0

Add picture OIDC scope and enable self-registration (#29)

- Add a `picture` client scope (usermodel-attribute mapper) and assign it as a default scope on the schuly-app client, so the app's 'openid profile email groups picture' request no longer fails with invalid_scope.
- Enable user self-registration (registrationAllowed: true) so the login page shows the Register link.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

v1.5.0

Document sign-in choices: account vs privacy mode, passkey vs authent…

v1.4.0

Revert docs-sync pipeline test (#15)

v1.3.0

Bumped application.properties to 1.1.1 for release (#9)