2 Commits

Include renames

Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	3c3bb2e41c	feat(auth): offer native OAuth sign-in on servers like matrix.org ... The login page looked for an OAuth issuer in .well-known (m.authentication), which matrix.org no longer publishes, so its users got the password / SSO compatibility forms. Detect native OAuth the way the SDK finds the auth server for refresh: load /auth_metadata next to the login flows. When present: - Login shows "Continue with <server>" only (as Element does); a legacy SSO loginToken coming back from a redirect still completes. - Register opens the auth server's sign-up page (prompt=create, where prompt_values_supported says so) instead of the legacy forms. Servers without it (Lotus) are unchanged. Checked against the live servers: matrix.org login and register show "Continue with matrix.org" and no password form; matrix.lotusguild.org keeps its password form. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-24 16:15:24 -04:00
Lotus CIandClaude Opus 5.5	70206d6033	chore(deps): matrix-js-sdk 41.7 -> 44.0 (#201) ... Picks up three releases of MatrixRTC / delayed-event fixes and matrix-sdk-crypto-wasm 18.3.1 -> 18.9.0. SDK 43 moved OAuth (MSC3861) into the SDK and dropped oidc-client-ts, so the native-OAuth sign-in is ported: - login discovers the auth server via /auth_metadata, registers with OAuth2.registerClient, and keeps the PKCE verifier + device in its own sessionStorage entry keyed by `state` (single use; CSRF check); - refresh is done by the SDK (oauthClientId + onTokenRefresh); the #16 cross-tab protection is kept by a narrow guard on refresh-token grants (the SDK calls the global fetch for OAuth, not fetchFn), which serialises them with a Web Lock and adopts a sibling tab's tokens; - logout and forced logout revoke via mx.logout() (the SDK revokes at the auth server for OAuth sessions); - the callback page parsed its params on every render, re-running the single-use code exchange in a loop; parsed once now. Also: notification_type is deprecated in MSC4075 (ring in DMs, notify elsewhere when omitted), _onRTCSessionMemberUpdate -> ensureRecalculateSessionMembers, precache limit 6 -> 10 MB for the 7.8 MB crypto wasm. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-24 00:32:13 -04:00