Changelog #

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

2.0.1 - 2026-02-23 #

Setup wizard double-protocol bug: entering https://abs.example.com in domain field no longer produces https://https://abs.example.com/... in redirect URIs

Gitea OIDC client registration (client_id: gitea, PKCE disabled for compatibility)
Regression test for wizard domain protocol stripping

CLAUDE.md: lean rewrite, operational content moved to .claude/commands/ skills
README.md: rewritten for OIDC provider reality (removed stale Rust/TS library references)
Admin token rotated from placeholder to proper random token

OIDC Provider: Full OpenID Connect provider using AT Protocol OAuth as identity source
- Authorization endpoint with PKCE support
- Token endpoint (authorization_code + refresh_token grants)
- UserInfo endpoint with DID-to-handle resolution via AT Protocol API
- Token revocation endpoint
- JWKS endpoint with ES256 key rotation
- Discovery document (/.well-known/openid-configuration)
Forward-Auth SSO Proxy: nginx auth_request based single sign-on for arbitrary services
- Per-user DID and handle pattern access control rules
- Deny-overrides evaluation model
- Per-origin and global rule scoping
- HMAC-SHA256 signed session cookies with typ discriminator
- Ticket-based exchange for X-Auth-DID/X-Auth-Handle headers
Admin Dashboard: Server-rendered HTML admin UI replacing static React SPA
- OIDC client management (list, create, edit, delete, secret rotation)
- Setup wizard with presets for 10 common self-hosted apps (Audiobookshelf, Jellyfin, Nextcloud, Gitea, Immich, Grafana, WikiJS, Portainer, Outline, Mealie)
- Forward-auth proxy quick setup wizard with nginx/k8s config snippet generation
- Proxy origin management, access rule management, session management
- Access check dry-run tool
- HMAC-signed CSRF tokens on all forms
- Cookie-based auth (24h TTL) alongside Bearer token auth
CI/CD: Gitea Actions pipeline (test -> build -> push -> deploy to DigitalOcean k8s)

Infrastructure: Migrated from local k3s (Proxmox) to DigitalOcean Managed Kubernetes
Registry: Moved from Gitea container registry to DigitalOcean Container Registry
Deployment strategy: Recreate (RWO PVC for SQLite)
Test suite: Expanded from ~50 to 262 tests across 11 test files

OIDC token endpoint: hash incoming client secret before comparing against stored SHA-256 hash
OIDC authorize: pass explicit redirect_uri to AT Protocol OAuth callback (prevents @atproto/oauth-client fallback mismatch)
OIDC userinfo: resolve DID to handle via app.bsky.actor.getProfile when no cached mapping exists
Legacy /auth/init: separate OAuth redirect_uri from downstream app callback URL
Register OIDC and forward-auth callback URIs in NodeOAuthClient metadata

Express 5: Migrated gateway from Express 4 to Express 5
ESLint 9: Migrated to ESLint 9 flat config with typescript-eslint 8
Async Error Handling: Route handlers now use throw pattern instead of try/catch blocks
Added HttpError class and httpError factory functions for cleaner error handling

Enabled projectService in typescript-eslint for better type-aware linting performance
Simplified error handling code (~150 lines of boilerplate removed)

TypeScript library unit tests for token and validation modules
Security report issue template
GitHub issue labels (security, rust, typescript, gateway, breaking change, ci/cd)

BREAKING: TokenVerifier::new() now returns Result<Self, AuthError> instead of Self
Minimum HMAC secret key length enforced at 32 bytes (256 bits)
TypeScript library defaults to sessionStorage instead of localStorage
Docker compose binds to localhost only (127.0.0.1) by default