oriolrius/pki-manager-web v3.14.0

v3.14.0 — OIDC roles via UserInfo + authenticated CA downloads

on GitHub

Highlights

• OIDC roles from UserInfo (#10, thanks @tilwegener) — new opt-in OIDC_ROLES_SOURCE=userinfo
  for providers (e.g. Pocket ID) that expose groups through UserInfo instead of access-token
  claims. The access token is still verified locally (signature, issuer, audience) first; the
  UserInfo endpoint must share the issuer origin and use HTTPS (loopback HTTP for dev only),
  redirects are refused, each lookup times out after 5 s, and any failure or subject mismatch
  rejects the request. Roles are not cached, so group changes apply on the next request.
  Default stays OIDC_ROLES_SOURCE=token — Keycloak setups are unchanged. Templates:
  backend/.env.oidc.example, frontend/.env.oidc.example, docker/.env.oidc.example,
  docker/config.oidc.example.json; guide in DEPLOYMENT.md.

Fixes

• CA certificate / truststore downloads with OIDC on (#12, thanks @tilwegener) — the CA
  detail page opened them as plain links without the bearer token (Missing or invalid Authorization header). A new Download button and the per-format links now fetch with the
  renewable OIDC token, decode the Base64 JSON envelope to exact file bytes (PEM/DER/P12/JKS),
  never save error responses, and never put tokens in URLs. Copyable API URLs remain.

Docs

• Agent guidance consolidated into AGENTS.md files (the CLAUDE.md duplicates were removed).

Full Changelog: v3.13.0...v3.14.0