Highlights

• OIDC sign-in and provider administration
• Group member isolation and per-member category/tag grants
• API key scope enforcement and auth hardening
• Custom fields: update UI, group defaults, table columns, report grouping
• Receipts table: filtering, quick date filter, summary totals, duplication, DECLINED status
• Report enhancements: period date field, renamable headings, equal split across categories/tags
• Login via QR code on mobile
• Mobile scan improvements: photo library source, interactive image canvas
• New admin settings: refresh token lifetime, secure cookies, app time zone
• System tasks: filtering, update diff viewer, source file recovery
• Go 1.26 and Angular 21 upgrades

What's Changed

• Add end-to-end ingest tests for QuickScan and Magic Fill by @Noah231515 in #650
• Add server-side pagination for user list by @Noah231515 in #651
• Standardize list-page headers with app-table-header and app-add-button by @Noah231515 in #652
• Resolve AI category/tag IDs and record pre-transaction failures by @Noah231515 in #654
• Fix dashboards not loading on group switch via reactive effects by @Noah231515 in #655
• Add vertical rhythm to table-header component and update system-task-table by @Noah231515 in #656
• Member isolation (presence privacy) for groups by @Noah231515 in #657
• Add password generation feature to input component by @Noah231515 in #660
• Allow app roles to skip personal group creation for new users by @Noah231515 in #662
• Add per-member category/tag grant assignment by @Noah231515 in #661
• Login QR: set up the mobile app by scanning a code on the desktop login page by @Noah231515 in #663
• Fix Android login: ingest effective permissions as strings, not an enum by @Noah231515 in #665
• Add app.groups.delete permission for admin group cleanup by @Noah231515 in #666
• Remove Azure URL sniffing; use configured URLs verbatim by @Noah231515 in #667
• Extract login QR into shared component for reuse by @Noah231515 in #668
• Add a configurable comment field to quick scan by @Noah231515 in #669
• Add custom field update endpoint and UI by @Noah231515 in #670
• Support custom fields in report grouping and aggregation by @Noah231515 in #671
• Allow renaming grouping level column headings in reports by @Noah231515 in #672
• Make report columns section editable in both detail modes by @Noah231515 in #674
• Add group default custom fields feature by @Noah231515 in #673
• Add configurable refresh token lifetime settings by @Noah231515 in #675
• Make the mobile scan slot a direct action, and pin the AI flag in tests that need it off by @Noah231515 in #676
• Let the login password be revealed, as on desktop by @Noah231515 in #677
• Auto-seed receipt group when user has only one choice by @Noah231515 in #678
• Fix MultiSelectField tap target to cover entire decorated box by @Noah231515 in #679
• Add navigation arrows to multi-page scan carousel by @Noah231515 in #680
• Re-fetch AppData on every token refresh, not just at login by @Noah231515 in #681
• Fix multiselect sheet scrolling with large catalogs by @Noah231515 in #682
• Fix the receipts overflow menu's Quick Scan and gallery entries by @Noah231515 in #684
• Add DECLINED receipt status with distinct visual treatment by @Noah231515 in #683
• Upgrade Go to 1.26 and update dependencies by @Noah231515 in #685
• Fix npm ci failure on main by rebuilding the desktop lockfile incrementally by @Noah231515 in #686
• Add quick date filter to receipts table with month stepper by @Noah231515 in #687
• Add the photo library as a receipt image source; show only Group in Quick Scan until one is picked by @Noah231515 in #688
• Apply group default custom fields on load in every form state by @Noah231515 in #689
• Make quick date filter target selectable across date fields by @Noah231515 in #690
• Add custom field columns and sorting to receipts table by @Noah231515 in #691
• Fix form field subscript sizing to prevent hint overflow by @Noah231515 in #693
• Add confirmation dialog to receipt duplicate actions by @Noah231515 in #695
• Add remove button to MultiSelectField chips by @Noah231515 in #696
• Add receipt summary totals under receipts table by @Noah231515 in #694
• Fix keyboard inset handling for pinned bottom bars by @Noah231515 in #697
• Add interactive image canvas with direct manipulation controls by @Noah231515 in #698
• Make the image canvas's drag handles actually resize by @Noah231515 in #700
• Add receipt filtering UI with condition editor and filter screen by @Noah231515 in #699
• Add filtering to System Tasks table by @Noah231515 in #701
• Add quick date filter (month stepper + date field picker) by @Noah231515 in #702
• Fix failed login spinner and error message handling by @Noah231515 in #705
• Add receipt summary bar with configurable placement by @Noah231515 in #703
• Add close-on-select preference for multi-select chip pickers by @Noah231515 in #704
• Add Comment column to receipts table with first-comment sorting by @Noah231515 in #706
• Restyle the mobile receipt summary bar by @Noah231515 in #707
• Add receipt update diff viewer for system tasks by @Noah231515 in #708
• Add period date field selection to reports by @Noah231515 in #709
• Add source file recovery for failed activities and temp file retention by @Noah231515 in #710
• Harden authorization, authentication, and email→PDF rendering by @Noah231515 in #712
• Add receipt duplication and fix system task filtering for manual uploads by @Noah231515 in #713
• Add role-required receipt comment/image and single-call receipt create by @Noah231515 in #714
• Add report options to split amounts equally across categories/tags by @Noah231515 in #717
• Add app time zone system setting to control calendar boundaries by @Noah231515 in #718
• fix: wrap MCP list results in objects by @ryancbutler in #716
• Enforce API key scopes, and share the PKCE helpers by @Noah231515 in #720
• Add the OIDC relying party: data model, flow, contract and clients by @Noah231515 in #721
• Add OIDC sign-in and provider administration to both clients by @Noah231515 in #722
• Add secureCookies system setting to control cookie Secure attribute by @Noah231515 in #724
• Prevent password login for OIDC-only accounts and secure self-delete by @Noah231515 in #725
• Let OIDC-only accounts delete themselves by signing in at their provider by @Noah231515 in #726
• Upgrade Angular to 21.2.25, switch to @angular/build, update Go to 1.26.9 by @Noah231515 in #727

New Contributors

• @ryancbutler made their first contribution in #716

Full Changelog: v7.1.0...v7.2.0