Skip to content

v1.4.0

Choose a tag to compare

View all tags
@vcode-sh vcode-sh released this 01 Mar 23:35
· 12 commits to main since this release
v1.4.0
34cfe5f

OIDC actually works now

Full OAuth 2.0 Authorization Code flow with PKCE — tested end-to-end, consent screen to dashboard. The whole thing.

Fixed

  • OIDC invalid_client resolved (#11) — The Client Secret is NOT the bot token. BotFather provides a separate secret via Bot Settings > Web Login. Removed non-standard origin and bot_id params from the auth URL. Clean standard OIDC now.
  • OIDC cross-domain redirect (#12) — origin was derived from the backend redirectURI, breaking setups where frontend and backend live on different domains. Telegram redirected to api.example.com/#tgAuthResult=... instead of redirect_uri?code=.... Removed origin entirely — Telegram uses the standard redirect_uri now.
  • Login Widget / Mini App P2002 crash (#13) — /telegram/signin and /telegram/miniapp/signin crashed with Unique constraint failed on email when the user already existed via OIDC. Now checks for existing users by telegramId before attempting creation. Links the account instead of creating a duplicate.

Added

  • oidc.clientSecret option — Pass the Client Secret from BotFather's Web Login settings. Falls back to bot token with a warning if omitted, but OIDC won't work without the proper secret.
  • Step-by-step OIDC setup docs — Including the undocumented BotFather "remove URL, reopen, switch to OpenID Connect Login" ritual.

Changed

  • Test count: 225 → 235. Nine new tests for cross-provider account linking and auth URL regression guards. All verified as failing against v1.3.x.

Migration from v1.3.x

  • OIDC users: Add oidc.clientSecret from BotFather's Web Login settings (Bot Settings > Web Login). Register your Allowed URLs and Redirect URL there. See OIDC Prerequisites.
  • Login Widget and Mini App flows are unaffected.

Full changelog: CHANGELOG.md

Full Changelog: v1.3.3...v1.4.0

Assets 2
Loading