v0.5.0 — Tinyauth OIDC 统一登录

Changes

• Optional administrator OIDC login, tested with Tinyauth. Authorization Code Flow uses RS256 ID Token validation, state, nonce and PKCE S256.
• Administrator authorization is bound to an explicit issuer + subject. Usernames, email addresses and first login do not grant administrator access.
• File-backed compose.oidc.yaml overlay. The base Compose deployment continues to support password login; OIDC may retain a collapsed password fallback.
• Logout clears only the AlertBridge session. Provider access/refresh tokens are not persisted.

Deployment and compatibility

Use the v0.5.0 image and matching base Compose and optional OIDC overlay. Keep the overlay selected for subsequent Compose operations and back up its server-side configuration separately from the database/master-key recovery pair.

Notification APIs, MCP authorization and business data remain compatible. No database migration is required. Administrator OIDC and MCP OAuth are separate flows; do not interchange their clients, callbacks or credentials. Other OIDC providers require validation against the implementation's same-host HTTPS endpoints, RS256, PKCE and Client Secret Basic constraints. The OIDC login button currently has a fixed provider label; see the deployment guide for this limitation.

Deployment, backup and rollback · MCP / Dots · Website and simulated demo

Validation covers Go tests, vet, release configuration, Docker E2E, OIDC rejection cases and race tests. GHCR remains the release authority; the optional ACR mirror copies and verifies the official AMD64/ARM64 runtime digests.