99 lines (62 loc) · 3.5 KB

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

0.4.0 - 2026-07-27

Added translations (transifex)

French (fr) 100%

Fixed

Strip scheme and port from provisioning label host

0.3.2 - 2026-07-22

Added translations (transifex)

Swedish (sv) 100%

0.3.1 - 2026-07-21

Added translations (transifex)

English (United Kingdom) (en_GB) 100%
German (de) 100%
German (Germany) (de_DE) 100%
Portuguese (Brasil) (pt_PT) 100%
Chinese (Hong Kong) (zh_HK) 100%
Greek (el) 100%
Irish (ga) 100%

0.3.0 - 2026-07-17

Added

Derive a readable provisioning label for opaque user IDs
Let users edit the authenticator account label

Changed

Build system switched from webpack to Vite; building from source now requires Node 24 and npm 11

0.2.1 - 2026-07-13

Fixed

Prevent the app from being limited to groups

Added

German and Brazilian Portuguese translations

0.2.0 - 2026-07-06

Fixed

Include pending tokens in the CSV secret export
Adapt source strings from translation review

0.1.0 - 2026-06-25

Added

Initial release: an advanced OATH second-factor provider for Nextcloud.
TOTP (RFC 6238), HOTP (RFC 4226) and OCRA (RFC 6287) tokens, with a self-contained OCRA implementation verified against the RFC 6287 test vectors.
Per-token configuration: hash algorithm (SHA-1/224/256/384/512), digit count, period or counter, OCRA suite, and an optional predetermined secret.
Secret length chosen by byte-strength presets; pasted custom Base32 secrets validated for a clean byte boundary.
Secrets encrypted at rest with the Nextcloud instance key (ICrypto).
Strict RFC compliance UI guard for interoperable defaults.
QR code with a centered issuer icon (FreeOTP style) and a hardened reveal of an existing secret and QR (forced password confirmation, 60-second auto-hide).
Admin management: bulk provisioning, CSV paste import and CSV export, admin-locked tokens, managed and excluded groups, disable selected tokens, invert and shift-range selection, and live status banners.
Import of existing tokens from the bundled twofactor_totp app.
HOTP resynchronisation with two consecutive codes, at the login prompt and in personal settings.
Login setup and personal settings UI, plus a login challenge for TOTP, HOTP and OCRA.
Admin deactivation via occ twofactorauth:disable <uid> oath (IDeactivatableByAdmin).
Documentation (README, design, security, compatibility, admin guide, development) with screenshots, and internationalisation scaffolding (Transifex config, l10n/).