- validate_config: reject multiple auth-host marks per domain;
sanitize_config clears extras (first wins) and coerces junk entry
values to presence-only
- origin_key: lowercase keys, strip trailing dots (bare hosts/wildcards)
- Passkey._allowlisted: tolerate trailing-dot wildcard bases
- wschat: stamp remote-flow sessions with the session host's domain,
not the approver's
- auth_host redirects: keep the port (redirect to the configured auth
host instead of the normalized, port-less current host)
- update_domain: required fields (wholesale replace) — no silent wipes
- admin: fix pre-existing lockout-guard order in org permission removal;
permission PATCH keeps domain restriction when omitted; 400 instead of
500 on unknown permission UUIDs
- Drop dead code: db.update_config/set_session_host/delete_reset_token,
Session.metadata, oidjwt.clear_key, background aliases,
avatar.current_avatar_url/media_root, wsutil.require_pow
- Prune stale/duplicated comments and docstrings
Finish the realm→domain terminology removal across source, tests, e2e
and docs. The stored config drops all lists: Config.domains is keyed by
rp-id, DomainConfig.origins/related are objects keyed by host (https://
omitted), values True or OriginEntry(auth_host=True). The default/primary
domain concept is gone; ordering is display-time. Tests and e2e updated
to the new API shapes (not run). Database re-migrated from the legacy
backup into the new format.
LeoVasanko