iam

Published automatically.

Repository: github.com/OpenG2P/iam · Container images: Container Registry

Releases

iam 1.4.2 — 2026-09-04

commit 410978d · changes since release 1.4.1

Same artifact as 1.4.2-rc.115 — built from the same commit and promoted (retagged), not rebuilt. No code changed between them.

Chart: openg2p-iam-service 1.4.2

Release notes

What's Changed

• G2P-5620 Refactor database session management to use get_async_session_maker across services by @vin0dkhichar in https://github.com/OpenG2P/iam/pull/6
• Bump FASTAPI_COMMON_REF to 1.2.1 and update version numbers to 1.4.2 … by @vin0dkhichar in https://github.com/OpenG2P/iam/pull/7

Full Changelog: https://github.com/OpenG2P/iam/compare/1.4.1...1.4.2

Summary

• Dependency updates: Bumped FASTAPI_COMMON_REF to 1.2.1 and updated version numbers to 1.4.2 across multiple files.
• Code refactor: Improved database session management by implementing get_async_session_maker across services.

Changes

• Bump FASTAPI_COMMON_REF to 1.2.1 and update version numbers to 1.4.2 across multiple files (a60d876)
• G2P-5620 Refactor database session management to use get_async_session_maker across services (13c0691)

iam 1.4.1 — 2026-09-02

commit 7398f88 · changes since release 1.4.0

Same artifact as 1.4.1-rc.111 — built from the same commit and promoted (retagged), not rebuilt. No code changed between them.

Chart: openg2p-iam-service 1.4.1

Release notes

What's Changed

• Separate agent vs staff auth cookies (agent- prefix) so shared cookie domains do not overwrite sessions
• Return 401 instead of 500 when a token cannot be verified against this portal’s JWKS
• Agent API auth now matches staff: GET /auth/logout (OIDC end-session), GET /auth/get_logged_in_user
• Enable CSRF on the agent API (the 1.4.0 Helm flag was unused)
• Seed the agent-realm login provider by issuer so agent tokens can be validated
• Seed staff login providers by issuer as well (shared login_providers table)
• Render Keycloak base URL with tpl (1.4.0 left a nested template in the pod env)
• Point the agent application URL at the agent portal host, not the IAM staff UI
• Add global.agentPortalHostname; derive redirect URI and CORS from it
• Remove keycloak-init from this chart (owned by commons)
• Bump image tags to 1.4.1; pin FASTAPI_COMMON_REF to 1.2.0
• Add tests for cookie prefix, agent data loader, and unverifiable-token 401

Summary

• Major: Keycloak integration: configured the agent app to connect to the Keycloak base URL and aligned the agent portal API with the staff portal's authentication surface.
• Security enhancements: separated agent and staff authentication cookies, implemented 401 responses for unverifiable tokens, and seeded the agent realm's login provider for token validation.
• CI improvements: transitioned to a single looping job for pre-commit checks without a local cache and established build and publish processes on GitHub.
• Code quality: applied black formatting across the repository to enforce a consistent 110-column line length.

Changes

• G2P-4929 Render the Keycloak base URL and point the agent app at the agent portal (6ebcbf3)
• G2P-5605 Build and publish on GitHub (8682df5)
• G2P-5575 applied the platform-service group change on iam service (0d0ba76)
• G2P-5348 Run pre-commit as a single looping job without a runner-local cache (4c9d599)
• G2P-4929 Match the staff portal's auth surface in the agent portal API (31250d7)
• G2P-4929 Keep agent and staff auth cookies apart and 401 on unverifiable tokens (2c74a91)
• G2P-4929 Apply black formatting at the repo's 110-column line length (29983b7)
• G2P-4929 Seed the agent realm's login provider so agent tokens validate (d6ecd80)

iam 1.4.0 — 2026-09-01

commit ebafe2e · changes since release v1.3.0

Same artifact as 1.4.0-rc.101 — built from the same commit and promoted (retagged), not rebuilt. No code changed between them.

Chart: openg2p-iam-service 1.4.0

Release notes

IAM 1.4.0 OpenG2P Identity and Access Management — first staff admin console, data-policy enforcement, and a production-ready agent portal.

Compared with 1.3.0, this release turns IAM from an auth backend into an operable identity platform: you can manage applications, roles, login providers, and row-level data policies in the UI, and agents get their own Keycloak realm and API.

Docs: Staff portal SSO login flow

Highlights

• IAM Staff UI — new Next.js 16 admin console (applications, roles, permissions, login providers, data policies).
• Data policies — ALLOW/DISALLOW filters on register records, geo, and attributes; published to Keycloak as DP_ client roles; evaluate API for PEPs.
• Application management APIs — CRUD for applications, roles, permissions, role-permission mappings, and login providers; roles sync to Keycloak.
• Agent portal API — shipped in Helm on by default, with an agent realm and agent-portal client (code existed in 1.3.0 but was not deployed).
• openg2p-fastapi-common 1.2.0 — partner JWT verification via CryptoFactory.
• Session TTLs tuned so refresh tokens outlive the access cookie.

Summary

• Major: CI overhaul: migrated from GitHub Actions to GitLab CI, implementing new workflows and dropping outdated configurations.
• Security enhancements: updated FastAPI common library to version 1.2.0, improved JWT validation using CryptoFactory, and added Keycloak initialization configuration.
• Session management improvements: updated Redis token TTLs and cache expiration settings for better performance.
• Feature additions: implemented data policy management and middleware, added roles and permissions management tabs, and enhanced application management with Keycloak integration.
• UI/UX refinements: refactored multiple components for consistency and accessibility, improved modal styling, and added reusable UI components.
• Cleanup and maintenance: removed unused SQL seed scripts and API URLs, fixed templating issues for Keycloak, and updated IAM_STAFF_UI_PERMISSIONS.
• Testing improvements: enhanced unit test coverage for IAM staff portal API components and core functionality, and updated middleware tests for accuracy.

Changes

• updated fastapi-commons to 1.2.0 (ebafe2e)
• G2P-5605 Align the 1.4 release line with GitHub (f8bccfe)
• G2P-5592 Update Redis token TTLs and cache expiration for improved session management (1a1ca2b)
• G2P-5587 Refactor GeoLocationPickerModal to use new utility functions for fetching geo levels and improve state management (b69ebd6)
• G2P-5581 Update FastAPI common library reference to version 1.2 and add Keycloak initialization configuration (bd43783)
• G2P-5581 Refactor JWT validation to use CryptoFactory and update tests for component registration (9d4d3c1)
• G2P-5578 Add registration for mds, awe, partner api (22af5d6)
• G2P-5576 Refactor DataPoliciesTab layout and comment out IconBase64Field in LoginProviderForm (6495993)
• Remove include_domains from request payload in attribute API calls (dafa801)
• Fix templating for Keycloak base URL in IAM Staff and Agent APIs (ed5741a)
• G2P-5572 Bump version to 1.4.0 and update image tags in values.yaml (1eb3a25)
• G2P-5335 Add iam-staff-ui to the build/publish pipeline and pin its chart image tag (d7fdd9c)
• G2P-5552 Fix pre-commit (a2157ea)
• G2P-5552 Remove registry API URL from env and add API URL to staff portal application (69495bf)
• G2P-4929 Enable the agent portal API by default and fix show_if conditions (da9db90)
• G2P-5537 Port attribute-management API routes and hooks from upstream develop; drop wrongly-ported role-permission caching (74c5879)
• G2P-5348 Complete GitLab migration: port GitHub workflows to CI guards, drop .github, and port pending upstream commits (e04966e)
• G2P-5335 Switch CI to GitLab (.gitlab-ci.yml); drop GitHub Actions build/publish (3ed9ea0)
• G2P-4929 Wire iam-agent-portal-api into the IAM chart behind a disabled-by-default switch (9de210b)
• Remove unused SQL seed script and login providers JSON; update IAM_STAFF_UI_PERMISSIONS to include delete permissions (1c5a6a6)
• Enhance values.yaml: Add backend API URLs for iam-staff-ui and update login provider ID (6d1d4f9)
• Refactor: Remove unused use client directives and implement ApplicationsPageClient component (a694c5d)
• G2P-5485 Enhance IconBase64Field with MIME type detection (2556ffa)
• G2P-5479 Add policy filter preview and view data policy modal components (5234a36)
• Test: Update data policy middleware tests for accuracy and coverage (35f3bd9)
• Feat: Implement data policy management and middleware (8a1c8cd)
• G2P-5431 Enhance application management with Keycloak integration (d7b1c7f)
• G2P-5431 Refactor UI components for consistency: update styles, improve accessibility, and enhance user experience across error, button, input, and modal components (0c1d936)
• G2P-5431 Add reusable UI components, improve modal styling, and refactor application and login provider pages (12956d8)
• G2P-5431 Refactor application and login provider components (b582d6f)
• G2P-5431 Add Roles, Permissions, and Role-Permissions management tabs with reusable modals, enhanced tables, login provider improvements, and loading skeletons (e70231c)
• G2P-5431 Refactor authentication and RBAC contexts, introduce reusable hooks/components, and add typed application and login provider data management (7ff270c)
• G2P-5431 Refactor ApplicationAccess, Applications, and LoginProviders controllers to use strongly typed response models (ab5686d)
• G2P-5431 Implement Application Management module in IAM Staff UI (235f138)
• G2P-5335 Fix chart-image-paths to .iamStaffPortalApi.image.tag (chart shipped unpinned) (947f58f)
• G2P-5335 New CI implemented (8109437)
• 0.0.0-develop.N versioning implemented. (a1579ba)
• G2P-5313 Add unit tests for IAM staff portal API components (8670822)
• G2P-5313 Improve unit test coverage for core IAM functionality (c762c7b)

Release candidates

iam 1.4.4-rc.125 — 2026-10-08

commit a073fa2 · changes since 1.4.4-rc.123

Chart: openg2p-iam-service 1.4.4-rc.125

Changes

• Add nameOverride for keycloak-init in values.yaml becuase it was conflicting with commons-services keycloak-init job. (3e6b362)

iam 1.4.4-rc.123 — 2026-10-07

commit 4969f08 · changes since 1.4.4-rc.121

Chart: openg2p-iam-service 1.4.4-rc.123

Changes

• Update FASTAPI_COMMON_REF to version 1.2 in Dockerfiles and workflow (3c5a49d)

iam 1.4.4-rc.121 — 2026-10-07

commit a1e1156 · changes since 1.4.4-rc.120

Chart: openg2p-iam-service 1.4.4-rc.121

Changes

• Clean up staff portal SSO login flow documentation (a1e1156)

iam 1.4.4-rc.120 — 2026-10-07

commit 052c1c4 · changes since 0.0.0-develop.98

Chart: openg2p-iam-service 1.4.4-rc.120

Summary

• Configuration updates: Added Keycloak initialization settings and updated redirect URI in values.yaml, along with IAM admin user settings.
• Dependency management: Bumped FASTAPI_COMMON_REF to 1.2.1 and updated fastapi-commons to 1.2.0, aligning version numbers across multiple files.
• Database improvements: Refactored session management to utilize get_async_session_maker across services and updated Redis token TTLs for better session management.
• UI enhancements: Added missing translations and updated translation keys for consistency, along with refactoring the GeoLocationPickerModal for improved state management.
• JWT validation: Refactored to use CryptoFactory and updated related tests for component registration.
• API adjustments: Removed include_domains from request payloads in attribute API calls and fixed templating for Keycloak base URL in IAM Staff and Agent APIs.

Changes

• Update keycloak-init redirect URI in values.yaml to use global application URL (fac8a03)
• G2P-5703 Add keycloak-init configuration and IAM admin user settings to values.yaml (273c34b)
• G2P-5699 Add missing translations and update translation keys for UI consistency (67ac82a)
• Bump FASTAPI_COMMON_REF to 1.2.1 and update version numbers to 1.4.2 across multiple files (a60d876)
• G2P-5620 Refactor database session management to use get_async_session_maker across services (13c0691)
• updated fastapi-commons to 1.2.0 (ebafe2e)
• G2P-5605 Align the 1.4 release line with GitHub (f8bccfe)
• G2P-5592 Update Redis token TTLs and cache expiration for improved session management (1a1ca2b)
• G2P-5587 Refactor GeoLocationPickerModal to use new utility functions for fetching geo levels and improve state management (b69ebd6)
• G2P-5581 Update FastAPI common library reference to version 1.2 and add Keycloak initialization configuration (bd43783)
• G2P-5581 Refactor JWT validation to use CryptoFactory and update tests for component registration (9d4d3c1)
• G2P-5578 Add registration for mds, awe, partner api (22af5d6)
• G2P-5576 Refactor DataPoliciesTab layout and comment out IconBase64Field in LoginProviderForm (6495993)
• Remove include_domains from request payload in attribute API calls (dafa801)
• Fix templating for Keycloak base URL in IAM Staff and Agent APIs (ed5741a)

iam 1.4.3-rc.118 — 2026-09-30

commit 174e30d · changes since 0.0.0-develop.98

Chart: openg2p-iam-service 1.4.3-rc.118

Summary

• Major: Refactor database session management to utilize get_async_session_maker across services, enhancing session handling.
• Keycloak integration: Added initialization configuration and IAM admin user settings, along with fixes for Keycloak base URL templating in IAM APIs.
• Dependency updates: Bumped FASTAPI_COMMON_REF to 1.2.1 and updated fastapi-commons to 1.2.0, aligning version numbers to 1.4.2.
• UI consistency improvements: Added missing translations and updated translation keys, alongside a refactor of GeoLocationPickerModal for better state management.
• Session management enhancements: Updated Redis token TTLs and cache expiration settings for improved performance.
• Miscellaneous changes: Removed include_domains from attribute API calls and refactored DataPoliciesTab layout.

Changes

• G2P-5703 Add keycloak-init configuration and IAM admin user settings to values.yaml (273c34b)
• G2P-5699 Add missing translations and update translation keys for UI consistency (67ac82a)
• Bump FASTAPI_COMMON_REF to 1.2.1 and update version numbers to 1.4.2 across multiple files (a60d876)
• G2P-5620 Refactor database session management to use get_async_session_maker across services (13c0691)
• updated fastapi-commons to 1.2.0 (ebafe2e)
• G2P-5605 Align the 1.4 release line with GitHub (f8bccfe)
• G2P-5592 Update Redis token TTLs and cache expiration for improved session management (1a1ca2b)
• G2P-5587 Refactor GeoLocationPickerModal to use new utility functions for fetching geo levels and improve state management (b69ebd6)
• G2P-5581 Update FastAPI common library reference to version 1.2 and add Keycloak initialization configuration (bd43783)
• G2P-5581 Refactor JWT validation to use CryptoFactory and update tests for component registration (9d4d3c1)
• G2P-5578 Add registration for mds, awe, partner api (22af5d6)
• G2P-5576 Refactor DataPoliciesTab layout and comment out IconBase64Field in LoginProviderForm (6495993)
• Remove include_domains from request payload in attribute API calls (dafa801)
• Fix templating for Keycloak base URL in IAM Staff and Agent APIs (ed5741a)

iam 1.4.2-rc.115 — 2026-09-04

commit 410978d · changes since 1.4.2-rc.113

Chart: openg2p-iam-service 1.4.2-rc.115

Changes

• Bump FASTAPI_COMMON_REF to 1.2.1 and update version numbers to 1.4.2 across multiple files (a60d876)

iam 1.4.2-rc.113 — 2026-09-04

commit a284b8b · changes since 0.0.0-develop.98

Chart: openg2p-iam-service 1.4.2-rc.113

Summary

• Major: Refactor database session management to utilize get_async_session_maker across services, enhancing session handling.
• Dependency updates: Upgraded fastapi-commons to version 1.2.0 and aligned the 1.4 release line with GitHub.
• Session management improvements: Updated Redis token TTLs and cache expiration for better performance.
• Refactorings: Improved GeoLocationPickerModal state management and utility function usage; refactored JWT validation to leverage CryptoFactory.
• API adjustments: Added registration for MDS, AWE, and partner APIs; removed include_domains from request payload in attribute API calls.
• Fixes: Corrected templating for Keycloak base URL in IAM Staff and Agent APIs.

Changes

• G2P-5620 Refactor database session management to use get_async_session_maker across services (13c0691)
• updated fastapi-commons to 1.2.0 (ebafe2e)
• G2P-5605 Align the 1.4 release line with GitHub (f8bccfe)
• G2P-5592 Update Redis token TTLs and cache expiration for improved session management (1a1ca2b)
• G2P-5587 Refactor GeoLocationPickerModal to use new utility functions for fetching geo levels and improve state management (b69ebd6)
• G2P-5581 Update FastAPI common library reference to version 1.2 and add Keycloak initialization configuration (bd43783)
• G2P-5581 Refactor JWT validation to use CryptoFactory and update tests for component registration (9d4d3c1)
• G2P-5578 Add registration for mds, awe, partner api (22af5d6)
• G2P-5576 Refactor DataPoliciesTab layout and comment out IconBase64Field in LoginProviderForm (6495993)
• Remove include_domains from request payload in attribute API calls (dafa801)
• Fix templating for Keycloak base URL in IAM Staff and Agent APIs (ed5741a)

iam 1.4.1-rc.111 — 2026-09-02

commit 7398f88 · changes since 0.0.0-develop.98

Chart: openg2p-iam-service 1.4.1-rc.111

Summary

• Major: Updated FastAPI common library to version 1.2.0, including Keycloak initialization configuration and refactored JWT validation to utilize CryptoFactory.
• Session management enhancements: Updated Redis token TTLs and cache expiration for improved performance.
• Refactoring: GeoLocationPickerModal now uses new utility functions for geo level fetching, and DataPoliciesTab layout has been adjusted.
• API modifications: Removed include_domains from request payload in attribute API calls and added registration for mds, awe, and partner API.
• Fixes: Corrected templating for Keycloak base URL in IAM Staff and Agent APIs.

Changes

• updated fastapi-commons to 1.2.0 (ebafe2e)
• G2P-5605 Align the 1.4 release line with GitHub (f8bccfe)
• G2P-5592 Update Redis token TTLs and cache expiration for improved session management (1a1ca2b)
• G2P-5587 Refactor GeoLocationPickerModal to use new utility functions for fetching geo levels and improve state management (b69ebd6)
• G2P-5581 Update FastAPI common library reference to version 1.2 and add Keycloak initialization configuration (bd43783)
• G2P-5581 Refactor JWT validation to use CryptoFactory and update tests for component registration (9d4d3c1)
• G2P-5578 Add registration for mds, awe, partner api (22af5d6)
• G2P-5576 Refactor DataPoliciesTab layout and comment out IconBase64Field in LoginProviderForm (6495993)
• Remove include_domains from request payload in attribute API calls (dafa801)
• Fix templating for Keycloak base URL in IAM Staff and Agent APIs (ed5741a)

iam 1.4.0-rc.101 — 2026-09-01

commit ebafe2e · changes since 1.4.0-rc.100

Chart: openg2p-iam-service 1.4.0-rc.101

Changes

• updated fastapi-commons to 1.2.0 (ebafe2e)

iam 1.4.0-rc.100 — 2026-08-28

commit f8bccfe · changes since v1.3.0

Chart: openg2p-iam-service 1.4.0-rc.100

Summary

• Major: CI migration to GitLab, dropping GitHub Actions, and implementing new CI workflows; completed GitLab migration by porting workflows and dropping unused scripts.
• Security enhancements: updated FastAPI library to version 1.2 and added Keycloak initialization configuration; refactored JWT validation using CryptoFactory.
• Session management improvements: updated Redis token TTLs and cache expiration settings for better session handling.
• Feature additions: implemented data policy management and middleware, added policy filter preview and view data policy modal components, and enhanced application management with Keycloak integration.
• UI/UX refinements: refactored application and login provider components for consistency, improved accessibility, and introduced reusable UI components; enhanced modal styling and user experience across various components.
• API updates: enabled agent portal API by default, wired iam-agent-portal-api into the IAM chart, and removed include_domains from attribute API calls.
• Testing improvements: updated data policy middleware tests for accuracy and coverage, added unit tests for IAM staff portal API components, and improved overall unit test coverage for core IAM functionality.
• Versioning and dependency updates: bumped version to 1.4.0, aligned release line with GitHub, and updated image tags in values.yaml.

Changes

• G2P-5605 Align the 1.4 release line with GitHub (f8bccfe)
• G2P-5592 Update Redis token TTLs and cache expiration for improved session management (1a1ca2b)
• G2P-5587 Refactor GeoLocationPickerModal to use new utility functions for fetching geo levels and improve state management (b69ebd6)
• G2P-5581 Update FastAPI common library reference to version 1.2 and add Keycloak initialization configuration (bd43783)
• G2P-5581 Refactor JWT validation to use CryptoFactory and update tests for component registration (9d4d3c1)
• G2P-5578 Add registration for mds, awe, partner api (22af5d6)
• G2P-5576 Refactor DataPoliciesTab layout and comment out IconBase64Field in LoginProviderForm (6495993)
• Remove include_domains from request payload in attribute API calls (dafa801)
• Fix templating for Keycloak base URL in IAM Staff and Agent APIs (ed5741a)
• G2P-5572 Bump version to 1.4.0 and update image tags in values.yaml (1eb3a25)
• G2P-5335 Add iam-staff-ui to the build/publish pipeline and pin its chart image tag (d7fdd9c)
• G2P-5552 Fix pre-commit (a2157ea)
• G2P-5552 Remove registry API URL from env and add API URL to staff portal application (69495bf)
• G2P-4929 Enable the agent portal API by default and fix show_if conditions (da9db90)
• G2P-5537 Port attribute-management API routes and hooks from upstream develop; drop wrongly-ported role-permission caching (74c5879)
• G2P-5348 Complete GitLab migration: port GitHub workflows to CI guards, drop .github, and port pending upstream commits (e04966e)
• G2P-5335 Switch CI to GitLab (.gitlab-ci.yml); drop GitHub Actions build/publish (3ed9ea0)
• G2P-4929 Wire iam-agent-portal-api into the IAM chart behind a disabled-by-default switch (9de210b)
• Remove unused SQL seed script and login providers JSON; update IAM_STAFF_UI_PERMISSIONS to include delete permissions (1c5a6a6)
• Enhance values.yaml: Add backend API URLs for iam-staff-ui and update login provider ID (6d1d4f9)
• Refactor: Remove unused use client directives and implement ApplicationsPageClient component (a694c5d)
• G2P-5485 Enhance IconBase64Field with MIME type detection (2556ffa)
• G2P-5479 Add policy filter preview and view data policy modal components (5234a36)
• Test: Update data policy middleware tests for accuracy and coverage (35f3bd9)
• Feat: Implement data policy management and middleware (8a1c8cd)
• G2P-5431 Enhance application management with Keycloak integration (d7b1c7f)
• G2P-5431 Refactor UI components for consistency: update styles, improve accessibility, and enhance user experience across error, button, input, and modal components (0c1d936)
• G2P-5431 Add reusable UI components, improve modal styling, and refactor application and login provider pages (12956d8)
• G2P-5431 Refactor application and login provider components (b582d6f)
• G2P-5431 Add Roles, Permissions, and Role-Permissions management tabs with reusable modals, enhanced tables, login provider improvements, and loading skeletons (e70231c)
• G2P-5431 Refactor authentication and RBAC contexts, introduce reusable hooks/components, and add typed application and login provider data management (7ff270c)
• G2P-5431 Refactor ApplicationAccess, Applications, and LoginProviders controllers to use strongly typed response models (ab5686d)
• G2P-5431 Implement Application Management module in IAM Staff UI (235f138)
• G2P-5335 Fix chart-image-paths to .iamStaffPortalApi.image.tag (chart shipped unpinned) (947f58f)
• G2P-5335 New CI implemented (8109437)
• 0.0.0-develop.N versioning implemented. (a1579ba)
• G2P-5313 Add unit tests for IAM staff portal API components (8670822)
• G2P-5313 Improve unit test coverage for core IAM functionality (c762c7b)

Develop builds

iam — develop 0.0.0-develop.102 (2026-10-12)

commit 509f7ec · changes since 0.0.0-develop.101

Chart: openg2p-iam-service 0.0.0-develop.102

Changes

• G2P-4929 Verify signed userinfo responses and require their subject to match the ID token (509f7ec)

iam — develop 0.0.0-develop.101 (2026-10-08)

commit e421fb3 · changes since 0.0.0-develop.99

Chart: openg2p-iam-service 0.0.0-develop.101

Changes

• G2P-5719 IAM APIs: pin sqlalchemy[asyncio] >=2.0,<2.1 so greenlet is installed (SQLAlchemy 2.1 no longer pulls it in, and the APIs crash on start) (125fbe9)

iam — develop 0.0.0-develop.99 (2026-10-07)

commit c63bb04 · changes since 0.0.0-develop.98

Chart: openg2p-iam-service 0.0.0-develop.99

Changes

• Update staff-portal-sso-login-flow.md (c63bb04)

iam — develop 0.0.0-develop.98 (2026-09-02)

commit 6ebcbf3 · changes since 0.0.0-develop.97

Chart: openg2p-iam-service 0.0.0-develop.98

Changes

• G2P-4929 Render the Keycloak base URL and point the agent app at the agent portal (6ebcbf3)

iam — develop 0.0.0-develop.97 (2026-08-28)

commit 8682df5 · changes since the start (showing the latest 20 commits)

Chart: openg2p-iam-service 0.0.0-develop.97

Summary

• Major: CI transition: switched from GitHub Actions to GitLab CI, completing migration by porting workflows and dropping unused scripts.
• Security enhancements: separated agent and staff auth cookies, enforced 401 responses on unverifiable tokens, and seeded the agent realm's login provider for token validation.
• API updates: matched the staff portal's auth surface in the agent portal API and enabled the agent portal API by default with fixed conditions.
• Build improvements: added iam-staff-ui to the build pipeline, updated image tags, and applied black formatting across the repository.
• Dependency management: bumped version to 1.4.0 and enhanced values.yaml with backend API URLs and updated login provider IDs.
• Code cleanup: removed unused SQL seed scripts and login providers JSON, and refactored components to eliminate unused directives.

Changes

• G2P-5605 Build and publish on GitHub (8682df5)
• G2P-5575 applied the platform-service group change on iam service (0d0ba76)
• G2P-5348 Run pre-commit as a single looping job without a runner-local cache (4c9d599)
• G2P-4929 Match the staff portal's auth surface in the agent portal API (31250d7)
• G2P-4929 Keep agent and staff auth cookies apart and 401 on unverifiable tokens (2c74a91)
• G2P-4929 Apply black formatting at the repo's 110-column line length (29983b7)
• G2P-4929 Seed the agent realm's login provider so agent tokens validate (d6ecd80)
• G2P-5572 Bump version to 1.4.0 and update image tags in values.yaml (1eb3a25)
• G2P-5335 Add iam-staff-ui to the build/publish pipeline and pin its chart image tag (d7fdd9c)
• G2P-5552 Fix pre-commit (a2157ea)
• G2P-5552 Remove registry API URL from env and add API URL to staff portal application (69495bf)
• G2P-4929 Enable the agent portal API by default and fix show_if conditions (da9db90)
• G2P-5537 Port attribute-management API routes and hooks from upstream develop; drop wrongly-ported role-permission caching (74c5879)
• G2P-5348 Complete GitLab migration: port GitHub workflows to CI guards, drop .github, and port pending upstream commits (e04966e)
• G2P-5335 Switch CI to GitLab (.gitlab-ci.yml); drop GitHub Actions build/publish (3ed9ea0)
• G2P-4929 Wire iam-agent-portal-api into the IAM chart behind a disabled-by-default switch (9de210b)
• Remove unused SQL seed script and login providers JSON; update IAM_STAFF_UI_PERMISSIONS to include delete permissions (1c5a6a6)
• Enhance values.yaml: Add backend API URLs for iam-staff-ui and update login provider ID (6d1d4f9)
• Refactor: Remove unused use client directives and implement ApplicationsPageClient component (a694c5d)
• G2P-5485 Enhance IconBase64Field with MIME type detection (2556ffa)

What's shown here. This catalogue lists every stable release, plus the latest 20 develop builds and the latest 10 release candidates per release line -- candidates are KEPT after their release ships, as the audit trail of the release run. Older develop builds and release candidates are pruned as they are superseded. Those versions still exist in the container and Helm registries — they are simply not listed here. This page is generated automatically from commit history; do not edit it by hand.