A registration token can now be marked `passwordless`, which will let the
user register without picking a password: their identity is established by
the email verification code instead.
This only adds the column and plumbs it through the storage layer and the
admin API; the registration flow itself is unchanged for now.
A registration token can now optionally carry the username and/or the email
address the account it is used for has to be registered with. This only adds
the columns and plumbs them through the storage layer and the CLI; nothing
enforces them yet.
The new `unused_async_trait_impl` lint flags `async fn` trait impls without any `.await`. The `FromRequestParts` impls that only read from the request parts now return `std::future::ready(...)` directly. The GraphQL module gets a module-wide allow: async-graphql's `#[Object]` refuses non-async resolvers and its `Enum` derive emits async trait impls of its own.
Also drop the `?` on two `return Err(...)?` statements in the introspection handler, flagged by `needless_return_with_question_mark`.
The interactive playground page and its route/config option are gone; the GraphQL API itself (POST /graphql) is unaffected. External GraphQL usage is deprecated anyway in favour of the REST admin API.
Fixes#5572Fixes#2424
This makes it so that MAS binds on a temporary path on startup, sets
permissions and then moves it to the configured path. This means that we don't
error out anymore if there is a stale socket file, and that it is safe to
rollout a new process without killing the old one first, without breaking
connections.
MSC2965 changed the discovery mechanism to stop relying on .well-known
documents a while back. We removed references to this in the configuration
manual some time ago (see e3d1b8abfa) but
`mas-cli doctor` was still checking for it.
See element-hq/backend-internal#5 as well
We need to group the sentry and opentelemetry bumps together because they both
upgraded reqwest to 0.13.
- reqwest 0.12 -> 0.13: rename the rustls feature to rustls-no-provider,
add the now-opt-in 'form' feature.
- sentry 0.46 -> 0.48: add rustls-no-provider so Sentry's reqwest 0.13
transport reuses our process-wide aws-lc-rs provider.
- opentelemetry 0.31 -> 0.32 / tracing-opentelemetry 0.33: update the
get_otel_context call in mas-context for the new signature.
opentelemetry-jaeger-propagator 0.32 is deprecated upstream but still
published; we keep it for now (with an expect(deprecated)) and will
vendor it in-tree once it's actually removed.
Read the `GraphQlOperation` set by the GraphQL handler from the response
extensions in the logging middleware, and record the operation type and name
on the `http.server.response` log line when present.
Rust 1.96.0 enables several new clippy lints. Apply the machine-applicable
fixes (`duration_suboptimal_units`, `map_unwrap_or`, `manual_is_variant_and`,
`unnecessary_trailing_comma`, `while_let_loop`) and suppress the
`result_large_err` lint in the config test modules, where the closures passed to
`Jail::expect_with` are required to return the large `figment::Error`.
When syncing config to the database, a `forward_login_hint: true`
flag now injects a `login_hint: "{{ params.login_hint }}"` entry
into `additional_authorization_parameters` (unless one is already
present) and logs a deprecation warning. Operators can migrate by
removing the flag and adding the template entry themselves; until then
the existing behavior is preserved.
Quentin Gliech