Andras BacsaiandClaude Opus 5.5 3dabda5c56 fix(oauth): require a verified provider email for password users and use the instance callback URL ...

- Only password-less users from before OAuth identities skip the provider
  email verification claim. Otherwise an unverified provider account with
  the email of a password user (including root) could sign in as them.
- Build the default callback URL from the instance URL, not the request
  Host header, and do not save it during a login.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-02 16:01:10 +02:00

..

factories

feat: add Traefik ACME cert UI and shared managed DNS record ownership

2026-09-25 19:00:00 +02:00

migrations

fix(oauth): require a verified provider email for password users and use the instance callback URL

2026-10-02 16:01:10 +02:00

schema

chore(v5): archive V5 implementation and remove runtime integration

2026-08-15 19:13:30 +02:00

seeders

fix(databases): keep SSL certificate files and CA in sync with each engine

2026-09-30 19:01:11 +02:00

.gitignore

…