release: version packages

[silverhand-bot]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to master, this PR will be updated.

Releases

@logto/[email protected]

Minor Changes

• 6404254: add trustUnverifiedEmail setting for the Microsoft EntraID OIDC SSO connector

  Since we launched the EntraID OIDC SSO connector we have received several feedbacks that their customer's email address can not be populated to Logto's user profile when signing up through the EntraID OIDC SSO connector.
  This is because Logto only syncs verified email addresses, meaning the email_verified claim must be true in the user info response from the OIDC provider.

  However, based on Microsoft's documentation, since the user's email address in manually managed by the organization, they are not verified guaranteed. This means that the email_verified claim will not be included in their user info response.

  To address this issue, we have added a new trustUnverifiedEmail exclusively for the Microsoft EntraID OIDC SSO connector. When this setting is enabled, Logto will trust the email address provided by the Microsoft EntraID OIDC SSO connector even if the email_verified claim is not included in the user info response. This will allow users to sign up and log in to Logto using their email address without any issues. Please note this may introduce a security risk as the email address is not verified by the OIDC provider. You should only enable this setting if you trust the email address provided by the Microsoft EntraID OIDC SSO connector.

  You can configure this setting in the EntraID OIDC SSO connector settings page in the Logto console or through the management API.

• 6404254: display support email and website info on experience error pages.

  Added support email and website info to the error pages of the experience app. E.g. when a user tries to access a page that doesn't exist, or when the social session is not found in a social callback page. This will help users to contact support easily when they encounter an error.

  You may configure the support email and website info in the sign-in experience settings page in the Logto console or through the management API.

• 7ebef18: add account api

  Introduce the new Account API, designed to give end users direct API access without needing to go through the Management API, here is the highlights:

  1. Direct access: The Account API empowers end users to directly access and manage their own account profile without requiring the relay of Management API.
  2. User profile and identities management: Users can fully manage their profiles and security settings, including the ability to update identity information like email, phone, and password, as well as manage social connections. MFA and SSO support are coming soon.
  3. Global access control: Admin has full, global control over access settings, can customize each fields.
  4. Seamless authorization: Authorizing is easier than ever! Simply use client.getAccessToken() to obtain an opaque access token for OP (Logto), and attach it to the Authorization header as Bearer <access_token>.

  Get started

  ![Note]
  Go to the Logto Docs to find full API reference.

  1. Use /api/account-center endpoint to enable the feature, for security reason, it is disabled by default. And set fields permission for each field.
  2. Use client.getAccessToken() to get the access token.
  3. Attach the access token to the Authorization header of your request, and start interacting with the Account API directly from the frontend.
  4. You may need to setup logto-verification-id header as an additional verification for some requests related to identity verification.

  What you can do with Account API

  1. Get user account profile
  2. Update basic information including name, avatar, username and other profile information
  3. Update password
  4. Update primary email
  5. Update primary phone
  6. Manage social identities

• 6404254: add unknown session redirect url in the sign-in experience settings

  In certain cases, Logto may be unable to properly identify a user’s authentication session when they land on the sign-in page. This can happen if the session has expired, if the user bookmarks the sign-in URL for future access, or if they directly share the sign-in link. By default, an "unknown session" 404 error is displayed.

  To improve user experience, we have added a new unknownSessionRedirectUrl field in the sign-in experience settings.You can configure this field to redirect users to a custom URL when an unknown session is detected. This will help users to easily navigate to your client application or website and reinitiate the authentication process automatically.

@logto/[email protected]

Minor Changes

• 6404254: display support email and website info on experience error pages.

  Added support email and website info to the error pages of the experience app. E.g. when a user tries to access a page that doesn't exist, or when the social session is not found in a social callback page. This will help users to contact support easily when they encounter an error.

  You may configure the support email and website info in the sign-in experience settings page in the Logto console or through the management API.

@logto/[email protected]

Minor Changes

• 6404254: display support email and website info on experience error pages.

  Added support email and website info to the error pages of the experience app. E.g. when a user tries to access a page that doesn't exist, or when the social session is not found in a social callback page. This will help users to contact support easily when they encounter an error.

  You may configure the support email and website info in the sign-in experience settings page in the Logto console or through the management API.

• 7ebef18: add account api

  Introduce the new Account API, designed to give end users direct API access without needing to go through the Management API, here is the highlights:

  1. Direct access: The Account API empowers end users to directly access and manage their own account profile without requiring the relay of Management API.
  2. User profile and identities management: Users can fully manage their profiles and security settings, including the ability to update identity information like email, phone, and password, as well as manage social connections. MFA and SSO support are coming soon.
  3. Global access control: Admin has full, global control over access settings, can customize each fields.
  4. Seamless authorization: Authorizing is easier than ever! Simply use client.getAccessToken() to obtain an opaque access token for OP (Logto), and attach it to the Authorization header as Bearer <access_token>.

  Get started

  ![Note]
  Go to the Logto Docs to find full API reference.

  1. Use /api/account-center endpoint to enable the feature, for security reason, it is disabled by default. And set fields permission for each field.
  2. Use client.getAccessToken() to get the access token.
  3. Attach the access token to the Authorization header of your request, and start interacting with the Account API directly from the frontend.
  4. You may need to setup logto-verification-id header as an additional verification for some requests related to identity verification.

  What you can do with Account API

  1. Get user account profile
  2. Update basic information including name, avatar, username and other profile information
  3. Update password
  4. Update primary email
  5. Update primary phone
  6. Manage social identities

• 6404254: add unknown session redirect url in the sign-in experience settings

  In certain cases, Logto may be unable to properly identify a user’s authentication session when they land on the sign-in page. This can happen if the session has expired, if the user bookmarks the sign-in URL for future access, or if they directly share the sign-in link. By default, an "unknown session" 404 error is displayed.

  To improve user experience, we have added a new unknownSessionRedirectUrl field in the sign-in experience settings.You can configure this field to redirect users to a custom URL when an unknown session is detected. This will help users to easily navigate to your client application or website and reinitiate the authentication process automatically.

Patch Changes

• Updated dependencies [6404254]
• Updated dependencies [6404254]
• Updated dependencies [7ebef18]
• Updated dependencies [6404254]
  • @logto/[email protected]
  • @logto/[email protected]
  • @logto/[email protected]

@logto/[email protected]

Minor Changes

• 7ebef18: add account api

  Introduce the new Account API, designed to give end users direct API access without needing to go through the Management API, here is the highlights:

  1. Direct access: The Account API empowers end users to directly access and manage their own account profile without requiring the relay of Management API.
  2. User profile and identities management: Users can fully manage their profiles and security settings, including the ability to update identity information like email, phone, and password, as well as manage social connections. MFA and SSO support are coming soon.
  3. Global access control: Admin has full, global control over access settings, can customize each fields.
  4. Seamless authorization: Authorizing is easier than ever! Simply use client.getAccessToken() to obtain an opaque access token for OP (Logto), and attach it to the Authorization header as Bearer <access_token>.

  Get started

  ![Note]
  Go to the Logto Docs to find full API reference.

  1. Use /api/account-center endpoint to enable the feature, for security reason, it is disabled by default. And set fields permission for each field.
  2. Use client.getAccessToken() to get the access token.
  3. Attach the access token to the Authorization header of your request, and start interacting with the Account API directly from the frontend.
  4. You may need to setup logto-verification-id header as an additional verification for some requests related to identity verification.

  What you can do with Account API

  1. Get user account profile
  2. Update basic information including name, avatar, username and other profile information
  3. Update password
  4. Update primary email
  5. Update primary phone
  6. Manage social identities

@logto/[email protected]

Patch Changes

• Updated dependencies [6404254]
• Updated dependencies [7ebef18]
• Updated dependencies [6404254]
  • @logto/[email protected]
  • @logto/[email protected]

@logto/[email protected]

Patch Changes

• @logto/[email protected]

@logto/[email protected]

Minor Changes

• 6404254: add trustUnverifiedEmail setting for the Microsoft EntraID OIDC SSO connector

  Since we launched the EntraID OIDC SSO connector we have received several feedbacks that their customer's email address can not be populated to Logto's user profile when signing up through the EntraID OIDC SSO connector.
  This is because Logto only syncs verified email addresses, meaning the email_verified claim must be true in the user info response from the OIDC provider.

  However, based on Microsoft's documentation, since the user's email address in manually managed by the organization, they are not verified guaranteed. This means that the email_verified claim will not be included in their user info response.

  To address this issue, we have added a new trustUnverifiedEmail exclusively for the Microsoft EntraID OIDC SSO connector. When this setting is enabled, Logto will trust the email address provided by the Microsoft EntraID OIDC SSO connector even if the email_verified claim is not included in the user info response. This will allow users to sign up and log in to Logto using their email address without any issues. Please note this may introduce a security risk as the email address is not verified by the OIDC provider. You should only enable this setting if you trust the email address provided by the Microsoft EntraID OIDC SSO connector.

  You can configure this setting in the EntraID OIDC SSO connector settings page in the Logto console or through the management API.

• 6404254: display support email and website info on experience error pages.

  Added support email and website info to the error pages of the experience app. E.g. when a user tries to access a page that doesn't exist, or when the social session is not found in a social callback page. This will help users to contact support easily when they encounter an error.

  You may configure the support email and website info in the sign-in experience settings page in the Logto console or through the management API.

• 6404254: add unknown session redirect url in the sign-in experience settings

  In certain cases, Logto may be unable to properly identify a user’s authentication session when they land on the sign-in page. This can happen if the session has expired, if the user bookmarks the sign-in URL for future access, or if they directly share the sign-in link. By default, an "unknown session" 404 error is displayed.

  To improve user experience, we have added a new unknownSessionRedirectUrl field in the sign-in experience settings.You can configure this field to redirect users to a custom URL when an unknown session is detected. This will help users to easily navigate to your client application or website and reinitiate the authentication process automatically.

@logto/[email protected]

Minor Changes

• 6404254: add trustUnverifiedEmail setting for the Microsoft EntraID OIDC SSO connector

  Since we launched the EntraID OIDC SSO connector we have received several feedbacks that their customer's email address can not be populated to Logto's user profile when signing up through the EntraID OIDC SSO connector.
  This is because Logto only syncs verified email addresses, meaning the email_verified claim must be true in the user info response from the OIDC provider.

  However, based on Microsoft's documentation, since the user's email address in manually managed by the organization, they are not verified guaranteed. This means that the email_verified claim will not be included in their user info response.

  To address this issue, we have added a new trustUnverifiedEmail exclusively for the Microsoft EntraID OIDC SSO connector. When this setting is enabled, Logto will trust the email address provided by the Microsoft EntraID OIDC SSO connector even if the email_verified claim is not included in the user info response. This will allow users to sign up and log in to Logto using their email address without any issues. Please note this may introduce a security risk as the email address is not verified by the OIDC provider. You should only enable this setting if you trust the email address provided by the Microsoft EntraID OIDC SSO connector.

  You can configure this setting in the EntraID OIDC SSO connector settings page in the Logto console or through the management API.

• 6404254: display support email and website info on experience error pages.

  Added support email and website info to the error pages of the experience app. E.g. when a user tries to access a page that doesn't exist, or when the social session is not found in a social callback page. This will help users to contact support easily when they encounter an error.

  You may configure the support email and website info in the sign-in experience settings page in the Logto console or through the management API.

• 7ebef18: add account api

  Introduce the new Account API, designed to give end users direct API access without needing to go through the Management API, here is the highlights:

  1. Direct access: The Account API empowers end users to directly access and manage their own account profile without requiring the relay of Management API.
  2. User profile and identities management: Users can fully manage their profiles and security settings, including the ability to update identity information like email, phone, and password, as well as manage social connections. MFA and SSO support are coming soon.
  3. Global access control: Admin has full, global control over access settings, can customize each fields.
  4. Seamless authorization: Authorizing is easier than ever! Simply use client.getAccessToken() to obtain an opaque access token for OP (Logto), and attach it to the Authorization header as Bearer <access_token>.

  Get started

  ![Note]
  Go to the Logto Docs to find full API reference.

  1. Use /api/account-center endpoint to enable the feature, for security reason, it is disabled by default. And set fields permission for each field.
  2. Use client.getAccessToken() to get the access token.
  3. Attach the access token to the Authorization header of your request, and start interacting with the Account API directly from the frontend.
  4. You may need to setup logto-verification-id header as an additional verification for some requests related to identity verification.

  What you can do with Account API

  1. Get user account profile
  2. Update basic information including name, avatar, username and other profile information
  3. Update password
  4. Update primary email
  5. Update primary phone
  6. Manage social identities

• 6404254: add unknown session redirect url in the sign-in experience settings

  In certain cases, Logto may be unable to properly identify a user’s authentication session when they land on the sign-in page. This can happen if the session has expired, if the user bookmarks the sign-in URL for future access, or if they directly share the sign-in link. By default, an "unknown session" 404 error is displayed.

  To improve user experience, we have added a new unknownSessionRedirectUrl field in the sign-in experience settings.You can configure this field to redirect users to a custom URL when an unknown session is detected. This will help users to easily navigate to your client application or website and reinitiate the authentication process automatically.

Patch Changes

• Updated dependencies [6404254]
• Updated dependencies [6404254]
• Updated dependencies [7ebef18]
• Updated dependencies [6404254]
  • @logto/[email protected]
  • @logto/[email protected]
  • @logto/[email protected]
  • @logto/[email protected]
  • @logto/[email protected]
  • @logto/[email protected]
  • @logto/[email protected]
  • @logto/[email protected]

@logto/[email protected]

Minor Changes

• 6404254: display support email and website info on experience error pages.

  Added support email and website info to the error pages of the experience app. E.g. when a user tries to access a page that doesn't exist, or when the social session is not found in a social callback page. This will help users to contact support easily when they encounter an error.

  You may configure the support email and website info in the sign-in experience settings page in the Logto console or through the management API.

@logto/[email protected]

Minor Changes

• 6404254: display support email and website info on experience error pages.

  Added support email and website info to the error pages of the experience app. E.g. when a user tries to access a page that doesn't exist, or when the social session is not found in a social callback page. This will help users to contact support easily when they encounter an error.

  You may configure the support email and website info in the sign-in experience settings page in the Logto console or through the management API.

@logto/[email protected]

Minor Changes

• 7ebef18: add account api

  Introduce the new Account API, designed to give end users direct API access without needing to go through the Management API, here is the highlights:

  1. Direct access: The Account API empowers end users to directly access and manage their own account profile without requiring the relay of Management API.
  2. User profile and identities management: Users can fully manage their profiles and security settings, including the ability to update identity information like email, phone, and password, as well as manage social connections. MFA and SSO support are coming soon.
  3. Global access control: Admin has full, global control over access settings, can customize each fields.
  4. Seamless authorization: Authorizing is easier than ever! Simply use client.getAccessToken() to obtain an opaque access token for OP (Logto), and attach it to the Authorization header as Bearer <access_token>.

  Get started

  ![Note]
  Go to the Logto Docs to find full API reference.

  1. Use /api/account-center endpoint to enable the feature, for security reason, it is disabled by default. And set fields permission for each field.
  2. Use client.getAccessToken() to get the access token.
  3. Attach the access token to the Authorization header of your request, and start interacting with the Account API directly from the frontend.
  4. You may need to setup logto-verification-id header as an additional verification for some requests related to identity verification.

  What you can do with Account API

  1. Get user account profile
  2. Update basic information including name, avatar, username and other profile information
  3. Update password
  4. Update primary email
  5. Update primary phone
  6. Manage social identities

[github-actions]

COMPARE TO master

Total Size Diff ⚠️ 📈 +17.14 KB

Diff by File

Name	Diff
.changeset/early-numbers-attend.md	📈 +1.53 KB
.changeset/four-deers-divide.md	📈 +694 Bytes
.changeset/warm-pugs-divide.md	📈 +1.87 KB
.changeset/wet-nails-guess.md	📈 +855 Bytes
packages/cli/CHANGELOG.md	📈 +193 Bytes
packages/cli/package.json	0 Bytes
packages/console/CHANGELOG.md	📈 +2.77 KB
packages/console/package.json	0 Bytes
packages/core/CHANGELOG.md	📈 +4.93 KB
packages/core/package.json	0 Bytes
packages/create/CHANGELOG.md	📈 +51 Bytes
packages/create/package.json	0 Bytes
packages/experience-legacy/CHANGELOG.md	📈 +544 Bytes
packages/experience-legacy/package.json	📈 +1 Bytes
packages/experience/CHANGELOG.md	📈 +544 Bytes
packages/experience/package.json	📈 +1 Bytes
packages/integration-tests/CHANGELOG.md	📈 +1.81 KB
packages/integration-tests/package.json	📈 +1 Bytes
packages/phrases-experience/CHANGELOG.md	📈 +543 Bytes
packages/phrases-experience/package.json	0 Bytes
packages/phrases/CHANGELOG.md	📈 +4.55 KB
packages/phrases/package.json	0 Bytes
packages/schemas/CHANGELOG.md	📈 +3.32 KB
packages/schemas/alterations/1.22.0-1730689363-add-account-center.ts	📈 +965 Bytes
packages/schemas/alterations/1.22.0-1731054001-init-account-center.ts	📈 +1.22 KB
packages/schemas/alterations/1.22.0-1731304920-add-support-email-and-website-to-sie-table.ts	📈 +546 Bytes
packages/schemas/alterations/1.22.0-1731377260-add-unknown-session-redirect-url-to-sie.ts	📈 +490 Bytes
packages/schemas/alterations/1.22.0-1731900596-add-saml-application-type.ts	📈 +1.88 KB
packages/schemas/alterations/1.22.0-1731900631-add-saml-app-third-party-consistency-check.ts	📈 +569 Bytes
packages/schemas/alterations/1.22.0-1731901231-add-saml-application-secrets-table.ts	📈 +1.35 KB
packages/schemas/alterations/1.22.0-1731904029-add-saml-application-configs-table.ts	📈 +1.13 KB
packages/schemas/alterations/next-1730689363-add-account-center.ts	📈 +965 Bytes
packages/schemas/alterations/next-1731054001-init-account-center.ts	📈 +1.22 KB
packages/schemas/alterations/next-1731304920-add-support-email-and-website-to-sie-table.ts	📈 +546 Bytes
packages/schemas/alterations/next-1731377260-add-unknown-session-redirect-url-to-sie.ts	📈 +490 Bytes
packages/schemas/alterations/next-1731900596-add-saml-application-type.ts	📈 +1.88 KB
packages/schemas/alterations/next-1731900631-add-saml-app-third-party-consistency-check.ts	📈 +569 Bytes
packages/schemas/alterations/next-1731901231-add-saml-application-secrets-table.ts	📈 +1.35 KB
packages/schemas/alterations/next-1731904029-add-saml-application-configs-table.ts	📈 +1.13 KB
packages/schemas/package.json	0 Bytes
packages/toolkit/connector-kit/CHANGELOG.md	📈 +1.81 KB
packages/toolkit/connector-kit/package.json	0 Bytes
pnpm-lock.yaml	📈 +1.03 KB