Cloud Codex 0.14.0

The Wave 6 release. Cloud Codex signs people in through Cloud City ID, signs them out of the issuer too, sends outbound webhooks, and wears the suite's shell, light theme and accents.

Highlights

• Sign-in through Cloud City ID (OIDC), one issuer per instance. Sign-out ends the issuer's session as well, and back-channel logout ends sessions the issuer closes.
• Hosted mode. AUTH_PROVIDERS=oidc makes OIDC the only human sign-in. Invitations bind on a verified email.
• Machine access. Machine JWTs are verified through the same seam as the static token, and membership endpoints let an automated sync add, change and remove members.
• Outbound webhooks. A durable outbox, a delivery worker with retries and a 72-hour dead-letter, redelivery, and a console under Admin, then Webhooks.
• The suite shell. A sidebar-led layout with the suite cluster, a search palette on Ctrl K, and a two-row strip on phones.
• Light and dark themes, and accents. An Appearance control in every page header, and the same theme and accent as the suite's other products.
• The suite preference contract. The theme and accent are stored in cc_suite_theme and cc_suite_accent, shared across a suite's hosts with SUITE_PREFERENCE_DOMAIN.
• Operations. /healthz and /readyz, a clean shutdown on SIGTERM, a lock that stops a second process on one database, a configuration contract (env-contract.js), backup and restore scripts with a drill, and a recipe for several instances on one MySQL server.
• Document images are served only to people who can read the document.

Breaking changes

• The top bar, the copyright footer and the bottom tab bar are gone in favour of the sidebar. The density control and the sidebar default are removed, and a stored value is dropped on load.
• Suite-managed accounts are read-only. In suite mode an account signed in through the issuer cannot change its name, email, password or two-factor here. The server refuses those writes with 403 managed_by_issuer, and such an account signs in only through the issuer: local password sign-in, password-reset mail and resets are refused for it.
• Hosted mode refuses local sign-in. With AUTH_PROVIDERS set to oidc alone, local sign-in, sign-up, password reset and Google sign-in are refused on the server. A boot that sets AUTH_PROVIDERS without oidc, or sets the Google variables, exits with a sentence naming the variable.
• Cookies. On https the session cookie is __Host-sessionToken, and a write authenticated by the session cookie alone must carry an accepted Origin. LEGACY_SESSION_COOKIE (default 1) keeps the older name working.

Upgrading from 0.13.0

Run the migrations before starting the new image:

docker compose -f docker-compose-release.yml run --rm app npm run migrate

Nine migrations are pending, all additive, and none drops data. The CHANGELOG lists them in order with the statement that undoes each. The app refuses to start while four of the new columns are missing; the other migrations are not checked at boot, so migrate first.

On a fresh install, init.sql builds the whole schema. Then run npm run migrate -- --adopt-fresh-install once.

Environment variables added

• Sign-in: OIDC_ISSUER_URL, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, OIDC_PROVIDER_NAME, OIDC_LINK_BY_VERIFIED_EMAIL, OIDC_SESSION_TTL_HOURS, OIDC_ACCOUNT_URL, AUTH_PROVIDERS
• Machine access: MACHINE_OIDC_AUDIENCE, MACHINE_OIDC_SUBJECTS
• Suite: SUITE_COMMAND_WORKSPACE_URL, SUITE_NAME, SUITE_PREFERENCE_DOMAIN
• Webhooks: WEBHOOK_URL, WEBHOOK_SECRET, WEBHOOK_WORKSPACE_ID, WEBHOOK_ALLOW_PRIVATE_TARGETS

.env.example lists them, and cloudcodex/env-contract.js states each one's behaviour.

Image

ghcr.io/cloud-city-computing/cloud-codex:0.14.0 (linux/amd64). It becomes latest for this release.

Full notes: CHANGELOG.md