[dependabot]

Bumps the github-actions group with 1 update: fells-code/seamless-cli/.github/workflows/verify-conformance.yml.

Updates fells-code/seamless-cli/.github/workflows/verify-conformance.yml from 0.25.1 to 0.26.0

Release notes

Sourced from fells-code/seamless-cli/.github/workflows/verify-conformance.yml's releases.

v0.26.0

Minor Changes

• fells-code/seamless-auth-api#490403 step_up_required, the CLI asks for the code, verifies it with POST /totp/verify-mfa on the same session, and retries the write once. This covers config set, config apply, config oauth-providers add|update|remove, users delete, users prepare-device-replacement, the org and org members writes, and every batch of migrate. A wrong code can be re-entered up to three times; a lockout, a rate limit, and an account with no authenticator app enrolled each get their own message instead of the old "requires an admin role" one. Without a terminal, SEAMLESS_TOTP_CODE supplies the code for the first step-up of a run.

  Breaking: users prepare-device-replacement now requires --proofing <in_person|remote_exception> and --evidence-ref <ref> (with an optional --approver <name>), because the auth server rejects a device replacement that does not record how the user's identity was established.

• 79590f0: New projects scaffold auth server v0.20.0, admin dashboard v0.11.0 and seamless-templates v0.21.0 (the v0.20 SDKs). These include the fixes for GHSA-qx82-28gf-w744, GHSA-9xg2-j8fg-427c, GHSA-v9q2-hcqj-ggqr, GHSA-v2q2-q246-8chm and GHSA-m5x9-cjv4-6q3w, first shipped in auth server v0.19.4 and seamless-templates v0.20.3.

  --auth=local now clones the auth server at the same v0.20.0 tag the Docker image is built from, instead of the tip of main.

• d0f5f9c: config set and config apply now write recovery_codes and account_recovery, which auth server v0.20 accepts (#310). Both are objects, and a field left out takes its default, so send the whole object, for example config set account_recovery '{"enabled":true,"delay":"24h"}'. An instance older than v0.20 rejects a patch that carries either key.

• 55a9fd2: seamless init keeps every secret out of the generated docker-compose.yml.

  • With --auth=docker, the auth server's environment is now written to auth/.env and loaded with env_file: ./auth/.env, the same file --auth=local already used. The compose file no longer has an inline environment: block for the auth service.
  • The api service (or the web service of a full-stack app) no longer sets SEAMLESS_SERVICE_TOKEN inline. init writes it to api/.env (or web/.env), which compose already loads.
  • init writes a root .gitignore covering .env, .env.* (keeping .env.example), keys/ and *.pem. An existing .gitignore keeps its lines and gains only the missing patterns.
  • seamless owner-code and the generated AGENTS.md point at auth/.env for OWNER_EMAIL in both auth modes. Projects scaffolded earlier, with the variable inline in compose, still work.

  The scaffold now also generates DECOY_SUBJECT_SECRET for the auth server, which v0.20 requires instead of falling back to the service token (OAUTH_STATE_SECRET is still generated whenever OAuth providers are configured).

  Every generated .env file (from init, add, template env and env merges) is written with mode 0600, and an existing file is tightened to 0600 when it is rewritten.

Patch Changes

• 525ed2c: seamless verifyfells-code/seamless-auth-api#490
• 3bd0e2d: Update @seamless-auth/types to 0.30.0.
• 60ee807: Update @seamless-auth/types to 0.33.0.

Changelog

Sourced from fells-code/seamless-cli/.github/workflows/verify-conformance.yml's changelog.

seamless-cli

0.27.1

Patch Changes

• 3c94d99: seamless init scaffolds templates v0.21.2, whose API and full-stack starters declare the v0.21 server adapters: @seamless-auth/express 0.23, @seamless-auth/fastify 0.14, @seamless-auth/nextjs 0.7, and seamless-auth 0.4 for Go, Rust and Python.

0.27.0

Minor Changes

• 0413554: seamless clients shows whether an application requires PKCE and the nonce, and create and update accept --pkce/--no-pkce and --nonce/--no-nonce. Only a confidential client can turn PKCE off, and the nonce can be turned off only once PKCE is off. An application with both off relies only on state and client authentication against authorization code injection, so list, get, create and update warn about it. Pins @seamless-auth/types 0.34.0.

• d6304a1: Set hosted page branding from the CLI (#320). seamless config hosted-ui get|set|reset (alias branding) reads the instance's hosted_ui system config, merges the fields you pass (--app-name, --logo, --font-family, and the six color flags) into the current branding, validates the result with HostedUiSchema from @seamless-auth/types, and writes the whole object back, since the instance replaces it rather than merging. reset removes named fields or, after a confirmation (--force to skip), clears all branding. hosted_ui is also writable as a whole value with config set hosted_ui '<json>' or config set hosted_ui null. The logo must be an https URL where the image is hosted: the instance does not store uploaded files, so a local path is refused with that message. Needs auth server v0.21 or later; an older instance reports that it does not support branding. Bumps @seamless-auth/types to 0.34.0 and lists the four new OpenID Provider keys as not yet writable (#332).

• 8aea8aa: seamless migrate assess <csv|entra-id|auth0|cognito> [source args] [--report <path>] [--json] writes a readiness report from the source alone, with no Seamless Auth instance and no login. It reuses each source's parsing and validation and reports users found, how many would import and why the rest would not (including duplicate emails), contact coverage (verified email, phone only, neither), the roles and organization memberships that would be granted and the fields left behind, source features Seamless Auth does not cover (such as Auth0 enterprise connections or Cognito SAML providers, plus what an export cannot show, such as Cognito identity pools) with a link to the matching guide, and a link to the docs cost calculator with the user count filled in. The Markdown report holds counts and names of fields, roles and organizations, never a user's email, phone or id. --json prints the same assessment.

• 6b8105e: seamless migrate auth0 <export.ndjson> and seamless migrate cognito <list-users.json>... read an Auth0 user export and Amazon Cognito list-users output directly, so the migration guides no longer need a jq conversion to CSV. Both share the dry run, --apply, --report and --json of migrate csv, and read files only (no AWS or Auth0 SDK or credentials).

  • Auth0: user_id becomes the external id, with email and phone_number. A gzip-compressed export is read as downloaded. Roles and organizations come from app_metadata or user_metadata only through --map.
  • Cognito: the sub attribute becomes the external id, with email and phone_number. --groups turns the guide's username-to-groups map into roles (ignoring Cognito's per-provider groups), and --map can read an attribute such as custom:tenant into organizations. One response, the Users array, an array of responses, concatenated responses, and several chunk files are all accepted.

  Blocked or disabled users, users whose email the source marks unverified (--allow-unverified imports them) and unconfirmed Cognito sign-ups (--include-unconfirmed) are skipped and listed in the report. Users with no email, including phone-only users, are reported invalid. Unlike the guides' earlier jq recipes, unverified emails are no longer imported by default.

• 471b05a: Configure an OAuth provider from its issuer. seamless config oauth-providers add and update take --issuer <url>, and a provider with an issuer can leave out authorizationUrl, tokenUrl, userInfoUrl, and jwksUri: the instance reads the missing ones from the issuer's /.well-known/openid-configuration. Without an issuer, add refuses before sending anything and names the missing endpoints. The new seamless config oauth-providers refresh <id> (alias discover) asks the instance to read the discovery document again and drop its cached signing keys, then prints the endpoints sign-in will use (--json for the provider object); like other provider writes it steps up when the instance asks. oauth-providers list shows a provider's issuer. Needs auth server v0.21 or later. Bumps @seamless-auth/types to 0.34.0, which also adds the oidc_account_notice_sent and oidc_account_notice_failed auth event types.

• 411691e: Add seamless clients and seamless resources for the OpenID Provider. clients lists, creates, updates and deletes OIDC clients, rotates a shared secret (printed once), registers a key file or JWKS URI, and sets which resources and scopes a client may use. Public clients, loopback and private-use redirect URIs, the device grant and token TTLs are flags, and redirect URIs and cross-field rules are checked with the @seamless-auth/types schemas before the instance is asked. resources manages the APIs clients may get tokens for and their scopes. Writes use the existing step-up flow. seamless apps still means managed applications in the portal. Needs an auth API with the /admin/applications and /admin/resources routes.

• 2e758a2: Write the OpenID Provider config keys (#332). oidc_provider_enabled, oidc_issuer, allow_client_secrets, and third_party_clients_enabled are now writable with seamless config set and config apply. config set checks their values before sending: the three switches take true or false, and oidc_issuer takes a URL, or null to clear it. seamless config --help documents them: the instance refuses to enable the provider until oidc_issuer is set, allow_client_secrets enables the weaker shared-secret client authentication (and seamless clients refuses shared-secret clients until it is on), and third-party clients need third_party_clients_enabled. Needs auth server v0.21.0 or later, whose strict patch schema is the first to accept these keys. Bumps @seamless-auth/types to 0.34.0.

Patch Changes

• 9ce5813: Pin source downloads to commits. --auth=local now checks that the cloned seamless-auth-api tag is the commit this CLI pins and removes the clone, before anything in it runs, when it is not. --admin=source downloads the dashboard by its pinned commit and checks the archive's commit before unpacking. The auth server and dashboard images are referenced by digest as well as tag, and npm run check:pins checks every pin against its tag.
• ff1736c: seamless init scaffolds auth API v0.21.0 and admin dashboard v0.12.0, pinned to the commits and image digests their tags name.
• 877e90a: seamless init --auth=local and --auth=docker (and seamless add --local) now write a generated JWKS_KID such as local-3f9a0c1b2d4e instead of dev-main, so the scaffolded adapter no longer warns on every boot that its kid is a placeholder. Re-running init on an existing project keeps a kid it already wrote. The value is only the kid header on the service tokens the adapter signs with the service secret; nothing verifies against it.
• 0bbdb1d: Scaffold templates v0.21.1, whose production images run as non-root and listen on port 8080, matching the compose file the CLI now generates.
• 364bd55: Depend on @seamless-auth/types ^0.34.0, the stable release, instead of the 0.34.0 prerelease.
• babb5bd: Map the web container to port 8080. The seamless-templates web and Next.js images now run as non-root and listen on 8080 instead of 80 (seamless-templates#133), so the generated compose file publishes 127.0.0.1:5173:8080 and health-checks /health on 8080, and the verify harness serves every web, reference, and Next.js app on 8080 (the nginx ones from nginxinc/nginx-unprivileged, as the templates do). This needs a templates release that carries the change: a scaffold from the templates pinned before it would map a port its web image no longer listens on.

0.26.0

Minor Changes

• fells-code/seamless-auth-api#490403 step_up_required, the CLI asks for the code, verifies it with POST /totp/verify-mfa on the same session, and retries the write once. This covers config set, config apply, config oauth-providers add|update|remove, users delete, users prepare-device-replacement, the org and org members writes, and every batch of migrate. A wrong code can be re-entered up to three times; a lockout, a rate limit, and an account with no authenticator app enrolled each get their own message instead of the old "requires an admin role" one. Without a terminal, SEAMLESS_TOTP_CODE supplies the code for the first step-up of a run.

  Breaking: users prepare-device-replacement now requires --proofing <in_person|remote_exception> and --evidence-ref <ref> (with an optional --approver <name>), because the auth server rejects a device replacement that does not record how the user's identity was established.

• 79590f0: New projects scaffold auth server v0.20.0, admin dashboard v0.11.0 and seamless-templates v0.21.0 (the v0.20 SDKs). These include the fixes for GHSA-qx82-28gf-w744, GHSA-9xg2-j8fg-427c, GHSA-v9q2-hcqj-ggqr, GHSA-v2q2-q246-8chm and GHSA-m5x9-cjv4-6q3w, first shipped in auth server v0.19.4 and seamless-templates v0.20.3.

  --auth=local now clones the auth server at the same v0.20.0 tag the Docker image is built from, instead of the tip of main.

• d0f5f9c: config set and config apply now write recovery_codes and account_recovery, which auth server v0.20 accepts (#310). Both are objects, and a field left out takes its default, so send the whole object, for example config set account_recovery '{"enabled":true,"delay":"24h"}'. An instance older than v0.20 rejects a patch that carries either key.

• 55a9fd2: seamless init keeps every secret out of the generated docker-compose.yml.

... (truncated)

Commits

• 1ff9552 Merge pull request #308 from fells-code/changeset-release/main
• 5ff1511 chore: version packages
• 214f9dd Merge pull request #313 from fells-code/chore/pin-v0-20
• 64925a0 test(e2e): step up admin writes with an authenticator app
• fc4595b chore: merge main
• bf31ba6 Merge pull request #315 from fells-code/feat/admin-step-up
• eca143f Merge pull request #314 from fells-code/feat/recovery-config-keys
• 02d9f0e feat(admin): step up admin writes with an authenticator app code
• d0f5f9c feat(config): write recovery_codes and account_recovery
• 79590f0 feat: scaffold auth server v0.20.0, dashboard v0.11.0 and templates v0.21.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions