[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"journal-post-summercms-0-3-0":3},{"author":4,"categories":8,"content":13,"content_html":14,"created_at":15,"excerpt":16,"featured_image_url":13,"featured_images":17,"id":18,"is_pinned":19,"metadata":13,"next_post":20,"previous_post":24,"published":28,"published_at":29,"reading_time":10,"related_posts":30,"slug":31,"sources":13,"tags":32,"title":33,"translations":13,"updated_at":34},{"first_name":5,"id":6,"last_name":5,"login":7},"",1,"jakubzych@gmail.com",[9],{"id":10,"name":11,"slug":12},2,"Framework","framework",null,"\u003Ch2>Highlights\u003C\u002Fh2>\n\u003Cp>SummerCMS can now be an OpenID Connect provider. The \u003Ccode>wristband\u003C\u002Fcode> module, which already ran the OAuth 2.1 authorization server for MCP clients, gains an OIDC flavour, so your app can be the \"Log in with …\" identity provider for your other sites and apps.\u003C\u002Fp>\n\u003Ch2>Added\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Cstrong>OpenID Connect provider in \u003Ccode>wristband\u003C\u002Fcode>\u003C\u002Fstrong> (\u003Ccode>wristband.NewOIDCServer\u003C\u002Fcode>):\n\u003Cul>\n\u003Cli>discovery at \u003Ccode>\u002F.well-known\u002Fopenid-configuration\u003C\u002Fcode>, and a JWKS with RS256 and ES256 keys\u003C\u002Fli>\n\u003Cli>key rotation with a grace window, so relying parties keep verifying old tokens\u003C\u002Fli>\n\u003Cli>\u003Ccode>id_token\u003C\u002Fcode> with \u003Ccode>nonce\u003C\u002Fcode> and \u003Ccode>at_hash\u003C\u002Fcode>, plus a userinfo endpoint\u003C\u002Fli>\n\u003Cli>an authorization request that waits while the user logs in, then continues\u003C\u002Fli>\n\u003Cli>a consent screen that remembers earlier approvals and lets the user switch accounts\u003C\u002Fli>\n\u003Cli>pairwise subject identifiers per client\u003C\u002Fli>\n\u003Cli>refresh tokens, off by default\u003C\u002Fli>\n\u003Cli>PKCE (S256) is required, and every authorization code is single-use\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\u003Cstrong>HTML response capture in \u003Ccode>tide\u003C\u002Fcode>\u003C\u002Fstrong>: a parity flow can pick a named form input (for example a CSRF or consent token) out of an HTML page and use it in the next step.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Changed\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Cstrong>\u003Ccode>wristband.Options.Resource\u003C\u002Fcode> no longer has a default.\u003C\u002Fstrong> Apps using the MCP flavour must set it to the URL of the resource their tokens are for. While it is empty, an authorization request that sends a \u003Ccode>resource\u003C\u002Fcode> parameter is refused with \u003Ccode>invalid_target\u003C\u002Fcode>. Requests without one are unaffected.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>The admin thumbnail routes now also serve public images\u003C\u002Fstrong> (JPEG, PNG, GIF, WebP) of records the admin can open. Download routes still refuse public files, and SVG and other non-image files still get no thumbnail.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Fixed\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Image previews in admin file uploads:\u003C\u002Fstrong> when a public image's URL fails to load (for example because the app doesn't serve its uploads itself), the preview now loads through the admin's own thumbnail route instead of showing \"Preview unavailable\".\u003C\u002Fli>\n\u003C\u002Ful>\n","2026-10-19T23:26:59+00:00","SummerCMS can now be an OpenID Connect provider: wristband gains an OIDC flavour with discovery, JWKS, id_token, userinfo and consent.",[],33,false,{"id":21,"slug":22,"title":23},32,"summercms-0-2-4","SummerCMS 0.2.4",{"id":25,"slug":26,"title":27},34,"summercms-0-3-1","SummerCMS 0.3.1",true,"2026-10-19T23:26:39+00:00",[],"summercms-0-3-0",[],"SummerCMS 0.3.0","2026-10-29T10:18:12+00:00"]