One Time Secret

What's Changed

• Add billing catalog sync command and extract progress renderer https://github.com/onetimesecret/onetimesecret/pull/3302
• Add billing orgs validate command to detect unresolvable plan IDs https://github.com/onetimesecret/onetimesecret/pull/3195
• Add billing sync-org CLI command and org ID display in user menu https://github.com/onetimesecret/onetimesecret/pull/3196
• Add comprehensive audit logger tests and integration proof https://github.com/onetimesecret/onetimesecret/pull/3262
• Add customer verification CLI commands and refactor verification logic https://github.com/onetimesecret/onetimesecret/pull/3194
• Add Ents and Org logging categories to structured logging system https://github.com/onetimesecret/onetimesecret/pull/3283
• Add ERB renderer field to all email locale files https://github.com/onetimesecret/onetimesecret/pull/3197
• Add ErrorResolver unit tests for I18n error message resolution https://github.com/onetimesecret/onetimesecret/pull/3208
• Add i18n error localization infrastructure for API errors https://github.com/onetimesecret/onetimesecret/pull/3207
• Add jobs configuration schema for async processing https://github.com/onetimesecret/onetimesecret/pull/3206
• Add network validation strategy tests for mx/smtp email verification https://github.com/onetimesecret/onetimesecret/pull/3214
• Add per-domain Sign Up / Sign In link toggles (#3219) https://github.com/onetimesecret/onetimesecret/pull/3224
• Add procps package and improve healthcheck logging https://github.com/onetimesecret/onetimesecret/pull/3276
• Add role-based authorization gate for custom domain creation (#3033) https://github.com/onetimesecret/onetimesecret/pull/3209
• Add role-specific member limits to plan schema (#3252) https://github.com/onetimesecret/onetimesecret/pull/3255
• Add Sign Up link to BrandedMastHead for custom domain users https://github.com/onetimesecret/onetimesecret/pull/3220
• Adds feedback rate limiter, using Rack::Request#ip for trusted proxy support https://github.com/onetimesecret/onetimesecret/pull/3247
• Apply redirect convention for OmniAuth auth errors https://github.com/onetimesecret/onetimesecret/pull/3213
• Document Auth::Config one-shot configuration and add test helpers https://github.com/onetimesecret/onetimesecret/pull/3293
• Enhance app loading fallback with tri-color orb spinner https://github.com/onetimesecret/onetimesecret/pull/3222
• Entitlement-gated account settings, OIDC runtime redirects, email logo toggle https://github.com/onetimesecret/onetimesecret/pull/3309
• Extract MaterializePlans operation from CLI command https://github.com/onetimesecret/onetimesecret/pull/3253
• Force fresh boot in suite setup to ensure Familia encryption config https://github.com/onetimesecret/onetimesecret/pull/3294
• Gracefully handle missing auth config in non-CLI modes https://github.com/onetimesecret/onetimesecret/pull/3295
• Handle silent failures in membership materialization cascade https://github.com/onetimesecret/onetimesecret/pull/3297
• Implement ADR-013 error shape for Auth and Billing routers https://github.com/onetimesecret/onetimesecret/pull/3261
• Implement targeted retry for membership re-materialization (ADR-012 Stage 3) https://github.com/onetimesecret/onetimesecret/pull/3301
• Include plan limits in entitlements staleness detection https://github.com/onetimesecret/onetimesecret/pull/3282
• Introduce config schema shapes with defaults/constraints/transforms https://github.com/onetimesecret/onetimesecret/pull/3223
• Make boot errors fatal in CLI mode unless SAFE_BOOT=1 https://github.com/onetimesecret/onetimesecret/pull/3193
• Membership-level materialized entitlements (ADR-012) https://github.com/onetimesecret/onetimesecret/pull/3248
• Migrate incoming-secrets recipients to single-state IncomingConfig model https://github.com/onetimesecret/onetimesecret/pull/3210
• Misc followup: signup config PATCH, omniauth domain fix, error shape tests, ADR-013 https://github.com/onetimesecret/onetimesecret/pull/3237
• Per-domain signup validation strategies https://github.com/onetimesecret/onetimesecret/pull/3204
• Prevent last-write-wins rodauth hooks override when billing enabled https://github.com/onetimesecret/onetimesecret/pull/3291
• Redesign access denied page with branded and unbranded modes https://github.com/onetimesecret/onetimesecret/pull/3219
• Refactor billing limit fields to use centralized registry https://github.com/onetimesecret/onetimesecret/pull/3254
• Refactor exception logging to use SemanticLogger exception field https://github.com/onetimesecret/onetimesecret/pull/3260
• Refactor logic classes to use category-aware loggers (tier 1) https://github.com/onetimesecret/onetimesecret/pull/3265
• refactor: Apply ADR-013 error shape to router fallbacks (#3221) https://github.com/onetimesecret/onetimesecret/pull/3241
• Remove legacy allow_public_homepage/api from BrandSettings (#3026) https://github.com/onetimesecret/onetimesecret/pull/3205
• Remove legacy encryption and simplify passphrase hashing https://github.com/onetimesecret/onetimesecret/pull/3314
• Remove legacy Redis data detection and migration tooling https://github.com/onetimesecret/onetimesecret/pull/3249
• Rename manage_orgs entitlement to manage_org (singular) https://github.com/onetimesecret/onetimesecret/pull/3298
• Replace .env.sh with direnv-based env switching https://github.com/onetimesecret/onetimesecret/pull/3304
• Replace OT::Problem with Onetime::Forbidden for access control https://github.com/onetimesecret/onetimesecret/pull/3264
• Require explicit user confirmation on org invite acceptance https://github.com/onetimesecret/onetimesecret/pull/3226
• Simplify database debug logging configuration https://github.com/onetimesecret/onetimesecret/pull/3277
• Skeleton loading components + authenticated /pricing redirect https://github.com/onetimesecret/onetimesecret/pull/3273
• Split billing logger: use ents_logger for entitlement operations https://github.com/onetimesecret/onetimesecret/pull/3307
• Split full-mode CI jobs into billing-enabled matrix https://github.com/onetimesecret/onetimesecret/pull/3303
• Standardize database logging configuration to DEBUG_DATABASE https://github.com/onetimesecret/onetimesecret/pull/3284
• Support DB-agnostic auth specs on PostgreSQL https://github.com/onetimesecret/onetimesecret/pull/3306
• UI polish: password reset flow, notifications, favicon fallback, entitlements https://github.com/onetimesecret/onetimesecret/pull/3199
• UI: Add per-domain signup validation configuration https://github.com/onetimesecret/onetimesecret/pull/3216
• Upgrade Vue, VueUse, and related dependencies https://github.com/onetimesecret/onetimesecret/pull/3236
• v4 §0a + §1: helper promotion + provisioning_source field (#3033) https://github.com/onetimesecret/onetimesecret/pull/3201

Fixes

• fix: stop shadowing Familia load() in CustomDomain https://github.com/onetimesecret/onetimesecret/pull/3278
• fix(#3130): check pending_plan_intent on login for cross-session redirect https://github.com/onetimesecret/onetimesecret/pull/3192
• Fix tenant-SSO users not joining domain org (issue #3114) https://github.com/onetimesecret/onetimesecret/pull/3191
• fix(#3218): wire disabled-homepage variant to per-domain config https://github.com/onetimesecret/onetimesecret/pull/3235
• fix(test): default billing disabled in test config via env var https://github.com/onetimesecret/onetimesecret/pull/3288
• fix(ci): handle customer creation race in SyncSession https://github.com/onetimesecret/onetimesecret/pull/3290
• Fix stale PostgreSQL tests https://github.com/onetimesecret/onetimesecret/pull/3285
• fix(ent): org-invite association, spec-runner repair, and test-DB isolation https://github.com/onetimesecret/onetimesecret/pull/3275
• Fix PostgreSQL test setup: self-healing schema + privilege separation https://github.com/onetimesecret/onetimesecret/pull/3300

Dependencies

• Bump js-cookie from 3.0.5 to 3.0.7 in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/onetimesecret/onetimesecret/pull/3175
• Update dependency axios to v1.16.0 [SECURITY] by @renovate[bot] in https://github.com/onetimesecret/onetimesecret/pull/3272
• Update dependency rubocop to v1.86.2 by @renovate[bot] in https://github.com/onetimesecret/onetimesecret/pull/3266
• Update TypeScript type definitions by @renovate[bot] in https://github.com/onetimesecret/onetimesecret/pull/3267
• Pin @types/estree to 1.0.9 https://github.com/onetimesecret/onetimesecret/pull/3279

Full Changelog: https://github.com/onetimesecret/onetimesecret/compare/v0.25.5...v0.25.6