Changelog
5.3.3 - 2026-09-07
- The access token and authorization code tables are now indexed by user_login, so deleting a user no longer scans them in full.
- A plugin listening to OAuth2.deleteClientWithOwner.end that throws no longer stops the remaining removed clients from being reported. The clients themselves were already deleted before the event was posted, so only their activity log entries were affected.
5.3.2 - 2026-09-07
- Deleting a user now removes the OAuth 2.0 clients they own, together with the access tokens, refresh tokens and authorization codes issued for those clients. The credentials the deleted user was granted for clients owned by somebody else are removed as well, while those clients themselves are kept.
- Clients whose owner no longer exists are no longer accepted in any grant and their tokens no longer authenticate, so credentials left behind by an incomplete cleanup cannot start acting as a different user that is later given the same login.
- Clients removed because their owner was deleted are now reported in the activity log, and the new OAuth2.deleteClientWithOwner.end event reports them to other plugins.
5.3.1 - 2026-08-06 - Added code to harden authentication checks when a password confirmation is requested for an OAuth2 authenticated request
5.3.0 - 2026-08-03
- Authorize requests may now carry multiple scopes; the consent screen shows a radio group and the user grants exactly one scope (defaulting to the least privileged). Issued tokens still carry a single scope.
- Scopes offered on the consent screen are limited to those the authorizing user can actually grant. If the user's access level is too low for every requested scope, the error now says so and names the scopes, instead of reporting an invalid client scope mapping.
- Clients with an empty scope list now fall back to the globally allowed scopes during authorization (previously rejected), matching the token endpoint behaviour.
- The scope configured for a client is now applied as the maximum access level a user can grant it, as the setting has always been documented. A client configured with matomo:admin can therefore be granted matomo:write or matomo:read as well, which is what lets the user choose a scope on the consent screen. Clients can never be granted more than their configured scope. The client credentials grant is unchanged and still requires the exact configured scope, as no user is involved to choose a lower one.
- Added code to harden the consent decision handling on the authorize endpoint
- The OAuth2.authorize.decision.end event and the authorize activity keep reporting the granted scope in scopes, which is now empty when the request was denied, and add requestedScopes with everything the client asked for.
- The activity log entry for an authorization decision now names the granted scope and the scopes the client requested, instead of only naming the client.
- The activity log descriptions for OAuth 2.0 clients are now translatable, where they were previously always shown in English.
5.2.4 - 2026-07-27 - Added code to warn users if scope is downgraded
5.2.3 - 2026-07-20 - Added code to harden check and disallow update user action
5.2.2 - 2026-07-16 - Added code to harden check and disallow app specific token action
5.2.1 - 2026-07-13 - Added code to revoke tokens on client downgrade to public
5.2.0 - 2026-07-06
- Added support for the /.well-known/oauth-authorization-server discovery endpoint (RFC 8414), serving the authorization server metadata as JSON.
- Added the OAuth2.authorizationServerMetadata event so other plugins can extend the discovery document.
- Added code to improve grant policy check
5.1.1 - 2026-06-17 - Fixes scope-limited OAuth tokens owned by a super user failing all API requests with a "requires superuser access" error. - Added code to reconcile capability permission based on scope
5.1.0 - 2026-06-08 - Added password confirmation for add, edit, delete and rotate token action.
5.0.4 - 2026-05-25 - Added code to log activity on auth approve and deny - Added code to log warning on auth failure - Improved isRevoked checked to check for client status also
5.0.3 - 2026-05-11 - Added code to show token and authorize URL at the top of list screen - Added better validation check for redirect URL, setting values and show client secret along with success message
5.0.2 - 2026-04-27 - Updated API documentation - Added code to show scope in the list view - Updated and scoped dependencies to support lower and higher PHP (>=8.1) versions
5.0.1 - 2026-04-17 - Fixes README.md
5.0.0 - 2026-04-13 - Initial release to create OAuth 2.0 clients for token generation and API access