SummerCMS 0.3.0

Highlights

SummerCMS can now be an OpenID Connect provider. The wristband module, which already ran the OAuth 2.1 authorization server for MCP clients, gains an OIDC flavour, so your app can be the "Log in with …" identity provider for your other sites and apps.

Added

• OpenID Connect provider in wristband (wristband.NewOIDCServer):
  • discovery at /.well-known/openid-configuration, and a JWKS with RS256 and ES256 keys
  • key rotation with a grace window, so relying parties keep verifying old tokens
  • id_token with nonce and at_hash, plus a userinfo endpoint
  • an authorization request that waits while the user logs in, then continues
  • a consent screen that remembers earlier approvals and lets the user switch accounts
  • pairwise subject identifiers per client
  • refresh tokens, off by default
  • PKCE (S256) is required, and every authorization code is single-use
• HTML response capture in tide: a parity flow can pick a named form input (for example a CSRF or consent token) out of an HTML page and use it in the next step.

Changed

• wristband.Options.Resource no longer has a default. Apps using the MCP flavour must set it to the URL of the resource their tokens are for. While it is empty, an authorization request that sends a resource parameter is refused with invalid_target. Requests without one are unaffected.
• The admin thumbnail routes now also serve public images (JPEG, PNG, GIF, WebP) of records the admin can open. Download routes still refuse public files, and SVG and other non-image files still get no thumbnail.

Fixed

• Image previews in admin file uploads: when a public image's URL fails to load (for example because the app doesn't serve its uploads itself), the preview now loads through the admin's own thumbnail route instead of showing "Preview unavailable".