3.8 Release Notes

Overview #

Elements 3.8’s headline feature is a generic, server-driven OIDC login flow: register any OIDC provider by its discovery URL and get the full authorization-code handshake, including the browser redirect and callback, handled entirely server-side, with no per-provider client code. Twitch ships as a fully worked reference provider. Alongside that, this release hardens username handling and closes a collision bug in User lookup, fixes several Element-loading/attribute-hierarchy issues, and switches the project’s license to MPL 2.0.

Highlights #

• Generic OIDC browser-redirect login — one integration path for any OIDC provider an admin registers; see OIDC Login for Thick Clients and Setting Up Twitch OIDC Login.
• OIDC provider-configuration admin UI — providers are now a server-side config change, not a client rebuild.
• Username validation and lookup hardening — tighter username rules and a fixed lookup collision (see below).
• Deployment editor attribute editing — set and adjust Element attributes directly from the deployment editor.
• License change — Elements is now licensed under MPL 2.0.

New Features #

Generic OIDC Browser-Redirect Login #

A full walkthrough lives in OIDC Login for Thick Clients and Setting Up Twitch OIDC Login; the summary:

• New OidcProviderConfiguration resource and admin console UI (Auth > OIDC Providers) for registering providers by discovery URL, replacing the previous hand-seeded default schemes for Google, Apple, and Twitch.
• New endpoints driving the full authorization-code flow server-side: POST /OIDC/Session to begin an attempt, a provider-facing callback, and GET /OIDC/Session/{id} for the client to poll for completion.
• Per-provider successRedirectUrl/errorRedirectUrl are now configured on the provider, not supplied by the client on each request.
• OIDC Profile claims (preferred_username, given_name, family_name) now backfill User.displayName/firstName/lastName on a new User’s first login, fail-soft — a malformed or missing claim doesn’t fail the login. Every provider’s full claim set is also snapshotted into User.linkedAccountProfiles, see Users and Profiles.
• Fixed a duplicate-key error that could occur on a User’s very first OIDC login.
• Renames: OidcProviderConfiguration.provider → name, User.preferredUsername → displayName, and the OIDC login attempt’s handle field → id.

Deployment Editor Attribute Editing #

The deployment editor can now set and adjust an Element’s attributes directly, backed by a new @ElementRequiredAttribute annotation Elements use to declare which attributes they expect.

Bug Fixes #

Username Validation and Lookup Collision #

Usernames are now validated against a dedicated pattern — no whitespace, no control characters, no Unicode formatting characters, 50 characters max — instead of a generic “no whitespace” check. Separately, User lookup by name/email no longer falls back to treating the input as a raw database id except as a last resort at read time, closing a collision where a username that happened to look like a valid id could resolve to the wrong account.

Element Load Ordering and Attribute Hierarchy #

• Fixed FilteredServiceLocator throwing when directory- and Maven-sourced Elements are mixed in the same deployment.
• Fixed GuiceSpiModule throwing on duplicate Service bindings.
• Fixed Element load ordering ignoring @ElementDependency, which could break deployments that mix .elm-packaged and Maven-sourced Elements.
• Fixed the attribute merge hierarchy so operator-set attributes take correct precedence.

Progress API Permission Fix #

Fixed the progress-update API improperly allowing client-level callers to create or update progress directly; this is now restricted to superusers, with client callers receiving a 501. Superuser update capability, which had been accidentally removed by an earlier fix, was restored alongside a regression test.

Admin Console Fixes #

• Fixed Element grouping and a Jakarta RS override issue in the installed-elements view.
• Forms that create or edit auth schemes now indicate when a User level is required, and a stuck “missing attributes” badge in the deployment editor now clears correctly once the missing attributes are added.

Other Changes #

• License change: Elements is now licensed under the Mozilla Public License 2.0.