Skip to content

Authentication

31 August 2026

34 changes:

  • The half of OAuth discovery that was missing
  • Three components that were nearly accessible
  • The Model Context Protocol, over HTTP, for somebody else's assistant
  • Offering an MCP capability without writing a class
  • A page head that stops claiming things the page never said
  • What the site tells a machine that arrives uninvited
  • A keyboard can get past the navigation, and the consent screen stops phoning out
  • A token outlived the client that issued it, and kept working
  • An error log that was mostly not errors
  • A client secret nobody had to present
  • The SMTP password was readable to anyone who could read the database
  • The webhook signing key and the TOTP seed, likewise
  • A tenant scope that held until you asked for page 1
  • A grant on one record opened the whole collection
  • The session cookie lost its secure flag behind every TLS-terminating proxy
  • The legacy CSRF check compared tokens with ===
  • A LIMIT built by string concatenation
  • addslashes() as an escaping fallback, and as a PHP-literal encoder
  • The README described a framework this is not
  • The schema promised tenant isolation nobody implements
  • Joins on two columns, and aliases that survive resolution
  • Permissions can now be resolved within one organisation
  • Roles had two tables, a permissions screen, and no way to make one
  • The client secret is hashed, and the realtime key moves out of its way
  • A public client can say it is one
  • The roles screen had a menu entry and no address
  • A guard that read a variable that did not exist (FW-047)
  • A pager that could not be told to stop counting (FW-048)
  • Two components no theme could style
  • SchemaBuilder::hasIndex()
  • Tokens are encrypted at rest, and matched on a digest

14 August 2026

39 changes:

  • The server now says where its own time went
  • An API request is not a browser session
  • auth:unlock — lifting a lockout you gave yourself
  • The toolbar answers "who am I, and until when"
  • A parent class for services, and a tab that admits they exist
  • An Errors tab, for what the browser threw
  • A Client tab: what the browser thinks the world is
  • The page outranks the toolbar
  • An API playground in the toolbar — and a doubled slash it found
  • A WebSocket daemon that can read a Redis stream
  • The body of a DELETE request
  • A ? in a raw fragment now binds where it was written
  • init will not scaffold over your application
  • Debug data for an application that does not use the API layer
  • The other way to lose a page
  • The toolbar injects through the response, not an output buffer
  • Two build settings that failed quietly
  • Three dead stubs, and four corrections to older posts
  • scaffold:spa — a front end for an application that already exists
  • The MCP server says which project it is
  • Typed endpoints, generated from the document
  • Where the suite's fifteen minutes actually go
  • A shared document, seven eight-second tests, and a ? in the bar
  • A scaffolded application was set up to learn it the hard way
  • The suite was running composer update sixty-one times
  • The test database was afraid of losing data
  • TRUNCATE is slower than dropping the table
  • The comment said // product 1 = Apple
  • The same change made PostgreSQL slower
  • A suite that only passed in one order
  • The guide described an API nobody had built
  • The widget area that rendered nothing
  • maxRuntime was a range, and it read like a number
  • An empty ban list is still a ban list
  • The ingest dropped the id it had just read
  • Which rule said no
  • Four corrections from the other side of the boundary
  • "Minor variable name changes"
  • A blank page is not an error

17 July 2026

Account data export, admin fixes & scaffolding polish. Self-service GDPR data export with an app-extensible hook, consistent account navigation across all three themes, the admin Tokens/Token Actions fixes, the init admin-password prompt, project:switch-ui, and assorted DevPanel/email/cache fixes.

6 changes:

  • Self-service data export (GDPR) with an app-extensible hook
  • Consistent account navigation across all three themes
  • Admin Tokens & Token Actions pages fixed (all themes)
  • init prompts for the admin password (with a safe fallback)
  • New project:switch-ui command
  • Assorted fixes: DevPanel cache flush, email audit log, cache adapter

16 July 2026

Built-in login flow, account controller & passkey UI. The scaffoldable auth server takes shape: the overridable LoginFlow state machine, a built-in Account controller for login/verify/logout, branded built-in login views, passkey management + second-factor step-up, full auth-controller scaffolding, and the Upgrade Guide / DataTables BC note.

8 changes:

  • Account activity log, session tracking & active-device management
  • Account controller: built-in login / verify / logout
  • Built-in login views + branding seam
  • LoginFlow: the overridable password → step-up → session state machine
  • Passkey management page + reachable from the account UI
  • Passkey second-factor step-up + WebAuthn browser glue
  • Scaffolding exposes every auth controller
  • Upgrade Guide + DataTables aaData → data BC note

15 July 2026

Authorization core: capabilities, permissions & passkeys groundwork. The authorization stack lands: trusted-client silent consent, a client capabilities registry with manifest sync and push endpoint, the RBAC+ABAC permission grain and resolver with a live-fetch internal endpoint, instant permissions_changed webhook invalidation, feature-gated auto-migrations, and the passkey credential store + WebAuthn ceremonies.

10 changes:

  • Capabilities push endpoint
  • Client capabilities registry and manifest sync
  • Framework auto-migrations are now gated by enabled features
  • Internal permissions endpoint (live fetch)
  • Passkeys groundwork: credential store and WebAuthn library
  • Passkeys: WebAuthn registration & authentication ceremonies
  • Permission resolver (RBAC + ABAC, live-fetch read side)
  • Permissions grain: audience and ABAC conditions
  • Instant invalidation: permissions_changed webhook
  • Trusted clients: skip the OAuth2 consent screen (silent flow)