release/1.12.0 - #99
Merged
Merged
Conversation
…roller and styling
Restore the ITK admin styling and use EasyAdmin's own components
…point # Conflicts: # CHANGELOG.md
Update twig-cs-fixer to 4.0
# Conflicts: # CHANGELOG.md # src/Controller/Admin/DashboardController.php
Feature/code owners
…form-addons # Conflicts: # src/Controller/Admin/SecurityContractCrudController.php
Show the Service Agreements amount in Danish kroner
…point # Conflicts: # .env # CHANGELOG.md
Add health endpoints for monitoring
…nect-bundle-6.0 # Conflicts: # CHANGELOG.md # composer.lock
The dev environment disabled the main firewall outright, because AAK's OIDC setup has no redirect URI for itksites.local.itkdev.dk. That meant no OpenID Connect code path was exercised until it reached a server — a broken callback path, a renamed claim or a login loop all stayed invisible locally — and the setting is easy to forget, so an authentication problem could be debugged for a long time against a firewall that was never running. A mock provider gives the whole authorization code flow locally instead. The container name is the external hostname on purpose, so the browser and the application reach it by the same name and the issuer matches. .env.dev carries the settings, so an ordinary setup needs nothing in .env.local. AZURE_AZ_OIDC_ALLOW_HTTP is true there and must not be anywhere else: from itk-dev/openid-connect 5.1 it governs every endpoint the discovery document announces, not only the metadata URL.
feat: run local development against a mock identity provider
The bundle now distinguishes a provider that refuses the authorization request — a cancelled login screen, an expired session at Azure, a tenant policy — from a callback that fails validation, and states the status the answer should have. Two changes here to make use of that: AzureOIDCAuthenticator chains the cause when it re-raises as Symfony's AuthenticationException. Without `previous` the bundle cannot tell the two apart and every failure arrives as a 500. OpenIdConnectFailureListener answers with the status the exception asks for — 403 where the user or a policy declined, 503 where Azure reports its own trouble, 500 otherwise — and the page says the login was declined rather than that something went wrong. It still repeats nothing the provider sent. PKCE comes with the bundle and needs no configuration. itk-dev/openid-connect moves to 5.1, which drops robrichards/xmlseclibs.
Update openid-connect-bundle to 6.1
Remove both from the admin menu and mark the entities, controllers, repositories and supporting classes @deprecated. The entities and their tables stay, so existing rows survive and remain reachable by URL; every page of the two now carries a warning saying so.
…rtificates Deprecate OIDC and Service certificates
API Specification - Non-breaking changesAPI Changelog 1.0.0 vs. 1.0.0API ChangesGET /api/servers
GET /api/sites
|
API Specification - Non-breaking changesAPI Changelog 1.0.0 vs. 1.0.0API ChangesGET /api/servers
GET /api/sites
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
1.12.0 — 2026-09-04
Cuts a minor release (last release was 1.11.2). The PRs accumulated under
[Unreleased]add health endpoints, the servers and sites API, service agreements and two openid-connect-bundle majors, so this is a MINOR bump per semver.Included PRs
--rmtodocker compose runin prod deploymentChanges in this PR
CHANGELOG.md— promote[Unreleased]to[1.12.0] - 2026-09-04, add new empty[Unreleased]section, add footer comparison link for 1.12.0, drop a duplicate Feature/5566 maintenance contract by martin #80 entry with a broken link.Deployment notes
AZURE_AZ_OIDC_CLIENT_SECRET_EXPIRES_ATin the prod environment./health/*;/health/detailsits behindITKBasicAuth.Test plan