One Time Secret

Deployment notes

[!NOTE]
Includes an auth database migration (008_issuer_scoped_identities).
It runs automatically at boot when AUTHENTICATION_MODE=full so no manual step
required. PostgreSQL advisory locks prevent races when multiple processes start
concurrently.

Prerequisite: if your app database user lacks DDL privileges, set
AUTH_DATABASE_URL_MIGRATIONS to a connection string with a migration-capable
user before deploying, or the app will fail to boot. To apply the migration
ahead of the deploy instead, run bundle exec rake auth:migrate.

What's Changed

• Add colonel transfer-ownership endpoint over the shipped org op https://github.com/onetimesecret/onetimesecret/pull/3920
• Add design system readiness audit and rolling-wave plan https://github.com/onetimesecret/onetimesecret/pull/3860
• Add direct test coverage for MFA enforcement DB read and awaiting-MFA session flag https://github.com/onetimesecret/onetimesecret/pull/3881
• Add membership entitlement-override op, CLI, and colonel endpoints https://github.com/onetimesecret/onetimesecret/pull/3921
• Add regression test for the awaiting_mfa clear on MFA completion https://github.com/onetimesecret/onetimesecret/pull/3887
• Add specification for extracting Caddy on-demand TLS logic https://github.com/onetimesecret/onetimesecret/pull/3890
• Admin ops expansion + fix colonel customer-detail timeout and row-click bugs https://github.com/onetimesecret/onetimesecret/pull/3897
• chore(review): scope AI review bots to defects-only feedback https://github.com/onetimesecret/onetimesecret/pull/3909
• Close canonical-domain guard gaps in CustomDomain (#3841) https://github.com/onetimesecret/onetimesecret/pull/3842
• complete deferred SSO identity bind after MFA (link-sso interstitial) https://github.com/onetimesecret/onetimesecret/pull/3879
• Connected Identities: connect-provider panel + session-bound SSO linking https://github.com/onetimesecret/onetimesecret/pull/3851
• Delegate billing sync-org to the shared Org::Reconcile op https://github.com/onetimesecret/onetimesecret/pull/3924
• Deprecate homepage-config auth params + default-OFF resolver coverage (#3672) https://github.com/onetimesecret/onetimesecret/pull/3901
• docs(security): tidy audit reports and add container docs https://github.com/onetimesecret/onetimesecret/pull/3852
• Email-change follow-ups: landed-partial completion, index-claim release https://github.com/onetimesecret/onetimesecret/pull/3918
• Enforce AUTH_ENABLED master switch in SSO config https://github.com/onetimesecret/onetimesecret/pull/3925 #3930
• extract BindSsoIdentity shared bind primitive https://github.com/onetimesecret/onetimesecret/pull/3878
• feat(cli): route remaining colonel capabilities through shared Operations https://github.com/onetimesecret/onetimesecret/pull/3908
• Gate AUTH_ENABLED master switch over /auth surface and platform SSO fallback https://github.com/onetimesecret/onetimesecret/pull/3922
• Honor disabled-homepage variant defaults on custom domains https://github.com/onetimesecret/onetimesecret/pull/3846
• Issuer-scoped SSO identity key — close cross-tenant takeover (#3838 item 5) https://github.com/onetimesecret/onetimesecret/pull/3845
• mailbox-proof SSO linking for passwordless accounts https://github.com/onetimesecret/onetimesecret/pull/3882
• Make Rodauth reset-password-request path enumeration-safe https://github.com/onetimesecret/onetimesecret/pull/3862
• Make SSO connect-intent nonce single-use via short-TTL sidecar key https://github.com/onetimesecret/onetimesecret/pull/3874
• Move the deferred SSO bind stash onto SessionSidecar https://github.com/onetimesecret/onetimesecret/pull/3883
• Post-merge follow-ups for #3897: colonel/admin correctness fixes https://github.com/onetimesecret/onetimesecret/pull/3913
• Re-key SetCustomerVerification off bare email onto external_id https://github.com/onetimesecret/onetimesecret/pull/3917
• Remove inert periodic + visibility CSRF shrimp revalidation (Option B) https://github.com/onetimesecret/onetimesecret/pull/3847
• Remove issuerless google/github from tenant SSO provider surface https://github.com/onetimesecret/onetimesecret/pull/3931
• Ruby breadth cleanup: dead code, stale TODOs, and one reset-password fix https://github.com/onetimesecret/onetimesecret/pull/3923
• SessionSidecar: per-value session data as independent Redis keys with individual TTLs https://github.com/onetimesecret/onetimesecret/pull/3861
• Share org field-limit constants and write owner_id as objid https://github.com/onetimesecret/onetimesecret/pull/3919
• SSO account-linking remediation: Phases 0–4 (integration) https://github.com/onetimesecret/onetimesecret/pull/3900
• SSO sign-in interstitial (LinkSso challenge flow) https://github.com/onetimesecret/onetimesecret/pull/3870
• Tests: consolidate duplicated integration helpers into support modules https://github.com/onetimesecret/onetimesecret/pull/3898
• Trusted-IdP email-linking flag + boot guard (v0.26.2, unblocks #3836) https://github.com/onetimesecret/onetimesecret/pull/3844
• Update secret-manage.json by @HiBing0 in https://github.com/onetimesecret/onetimesecret/pull/3875
• Widen CSP form-action with active SSO IdP origins https://github.com/onetimesecret/onetimesecret/pull/3850

Fixed

• Fix CloseAccount session sweep skipping all encrypted sessions https://github.com/onetimesecret/onetimesecret/pull/3863
• Fix commit-msg hook mis-identifying version tokens as issue IDs (#3891) https://github.com/onetimesecret/onetimesecret/pull/3893
• Fix silently-dropped Secure session cookie behind TLS-terminating proxies (unify scheme detection + fail-loud diagnostics) https://github.com/onetimesecret/onetimesecret/pull/3843
• fix(docker): bump compose app-image pins to v0.26.1 + drift guards (#3892) https://github.com/onetimesecret/onetimesecret/pull/3894

Dependencies

• Pin dependency sharp to 0.34.5 [SECURITY] by @renovate[bot] in https://github.com/onetimesecret/onetimesecret/pull/3869
• Update CodeMirror by @renovate[bot] in https://github.com/onetimesecret/onetimesecret/pull/3865
• Update dependency @intlify/unplugin-vue-i18n to ^11.2.4 by @renovate[bot] in https://github.com/onetimesecret/onetimesecret/pull/3866
• Update dependency axios to ^1.18.0 by @renovate[bot] in https://github.com/onetimesecret/onetimesecret/pull/3864
• Update dependency dompurify to v3.4.12 [SECURITY] by @renovate[bot] in https://github.com/onetimesecret/onetimesecret/pull/3867
• Update dependency postcss to v8.5.12 [SECURITY] by @renovate[bot] in https://github.com/onetimesecret/onetimesecret/pull/3868
• Bump sharp from 0.34.5 to 0.35.3 in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/onetimesecret/onetimesecret/pull/3880

New Contributors

• @HiBing0 made their first contribution in https://github.com/onetimesecret/onetimesecret/pull/3875

Full Changelog: https://github.com/onetimesecret/onetimesecret/compare/v0.26.1...v0.26.2