[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"journal-post-summercms-0-5-2":3},{"author":4,"categories":8,"content":13,"content_html":14,"created_at":15,"excerpt":16,"featured_image_url":13,"featured_images":17,"id":18,"is_pinned":19,"metadata":13,"next_post":20,"previous_post":24,"published":28,"published_at":29,"reading_time":30,"related_posts":31,"slug":32,"sources":13,"tags":33,"title":34,"translations":13,"updated_at":35},{"first_name":5,"id":6,"last_name":5,"login":7},"",1,"jakubzych@gmail.com",[9],{"id":10,"name":11,"slug":12},2,"Framework","framework",null,"\u003Ch2>Highlights\u003C\u002Fh2>\n\u003Cp>SummerCMS 0.5.2 lets an MCP OAuth agent use the scopes a plugin declares, and lets a tool call see which subject invoked it. sm-user-plugin v0.1.16 applies read and write as implied scopes for OAuth subjects only. sm-oauthserver-plugin v0.1.4 stores one consent per MCP client, replaces it on a later allow, and backfills live grants. vue-oauth-layer v0.1.0 is the \u003Ccode>\u002Fconnect\u003C\u002Fcode> page for that consent. Together these versions close the three gaps sm-servers-app needs before MCP OAuth can be switched on: the same tool list as a personal token, attribution of the caller, and per-client revoke.\u003C\u002Fp>\n\u003Ch2>Added\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>One MCP scope list. Plugins publish member-token scopes, the OAuth server advertises that list (optionally filtered), and the protected-resource metadata uses the same names. An empty list still means the five fixed scopes, including backend. OIDC discovery is unchanged.\u003C\u002Fli>\n\u003Cli>An MCP call on the request context: guard, user, client, token, scopes, session and tool. A request that is not an MCP tool call has none.\u003C\u002Fli>\n\u003Cli>A pending consent view reports whether offline access was requested.\u003C\u002Fli>\n\u003Cli>sm-user-plugin v0.1.16 expands a declared scope when an OAuth grant holds the read or write that the scope marks as implied. A personal token is not expanded, write does not imply read, and the stored subject scopes stay as issued. The dispatch credential still carries the personal token id.\u003C\u002Fli>\n\u003Cli>sm-oauthserver-plugin v0.1.4 records MCP consent per client, shows scope details on the consent JSON, marks authorizations as mcp or oidc, and backfills a consent for each live grant. A second migrate inserts nothing.\u003C\u002Fli>\n\u003Cli>vue-oauth-layer v0.1.0 renders \u003Ccode>\u002Fconnect\u003C\u002Fcode> from that JSON: checkboxes, read locked, the administrator named as text, and a refetch when the backend link changed. The layer's git remote is not published yet, so an app cannot pin the tag until that repository exists.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Changed\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>A later MCP allow replaces the stored consent scopes. It does not merge them with the previous grant.\u003C\u002Fli>\n\u003Cli>Unticking offline access clears that flag on the issued code. Omitting the scopes field leaves the pending flag as it was.\u003C\u002Fli>\n\u003Cli>Revoking an authorized MCP client deletes its unused code and leaves the user's other clients in place.\u003C\u002Fli>\n\u003Cli>sm-oauthserver-plugin v0.1.4 requires SummerCMS v0.5.2 and sm-user-plugin v0.1.16.\u003C\u002Fli>\n\u003Cli>sm-user-plugin v0.1.16 is not a descendant of v0.1.15. It does not include the missing-scope and missing-permission fields from that tag. Build it with SummerCMS v0.5.2; its go.mod still states v0.5.0 and selects the newer framework only when the application does.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Fixed\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>A hidden relation field or partial field no longer keeps its routes after it is removed from the form.\u003C\u002Fli>\n\u003Cli>Record events fire when a hasMany child is linked, unlinked, or attached from a deferred commit, and the event locale is the request locale's primary tag.\u003C\u002Fli>\n\u003Cli>A widget action dispatched while the widget connects is delivered.\u003C\u002Fli>\n\u003Cli>Uploading through a form extension follows that extension's visibility.\u003C\u002Fli>\n\u003Cli>A required field that belongs to a form extension is checked on the extension's own value, so saving the host form no longer fails on a rule the owner model cannot satisfy.\u003C\u002Fli>\n\u003Cli>The additive API check compares the new release with the previous one after the tree is tagged.\u003C\u002Fli>\n\u003C\u002Ful>\n","2026-10-28T15:40:33+00:00","SummerCMS 0.5.2 advertises declared MCP scopes and records the caller. sm-user-plugin 0.1.16, sm-oauthserver-plugin 0.1.4 and vue-oauth-layer 0.1.0 close the same three gaps.",[],46,false,{"id":21,"slug":22,"title":23},49,"sm-user-plugin-0-1-15","sm-user-plugin 0.1.15",{"id":25,"slug":26,"title":27},50,"sm-user-plugin-0-1-16","sm-user-plugin 0.1.16",true,"2026-10-28T15:38:14+00:00",3,[],"summercms-0-5-2",[],"SummerCMS 0.5.2","2026-10-29T10:18:03+00:00"]