8 Commits
Author SHA1 Message Date
Linus Rath 31326c7daf fix: keep OAuth client secrets and the session secret out of the admin audit log, config API and dashboard writes 2026-10-19 00:50:16 +02:00
Linus Rath 4adbad25f6 feat: end the provider session through a configured logout URL #1279 2026-10-18 13:46:48 +02:00
Linus Rath 4d733aa598 chore: remove unused exports and the dead plugin error boundary 2026-10-13 13:36:51 +02:00
Linus Rath 5597eadc28 fix: give a server its own sign-in button only when it has a button label #1135
A server entry's OAuth client ID already has a meaning while OAuth is
off globally: it is the registered client that password and TOTP logins
use with Stalwart's require_client_registration. The PR made every such
entry offer OAuth on its own, so existing installs would suddenly run
discovery and show SSO buttons on the login page, and multi-IdP setups
would get one extra button per server.

A server now gets its own button only with both a client ID and a button
label, which no existing config has. The rule lives in `offersOwnOAuth`
with a test. Also:
- the OAuth-only login form uses the selected server's label
- the public config validator checks `buttonLabel` is a string
- the admin hint and `.env.example` say the label enables the button
2026-10-01 11:01:17 +02:00
lucamzanon 1fac44832a feat(auth): let one server in the list sign in with OAuth on its own
A server entry that names its own OAuth client now offers the OAuth
button even while OAuth is off globally, so a Gmail bridge can sign in
with Google next to a server that uses passwords. The entry can also
name the button ("Sign in with Google"); the generic SSO label stays
the default.
2026-09-30 21:28:06 +02:00
Linus Rath 3823d2da17 fix: sign in and show addresses on internationalized domains #1100 2026-09-24 21:15:22 +02:00
Linus Rath 178922323d chore: update version to 1.6.2 2026-05-06 20:07:36 +02:00
Linus Rath d3d79be64c feat: multi-server JMAP support 2026-05-06 17:33:55 +02:00