Gotify 3.0.0 checklist

[jmattheis]

Checklist for the Gotify 3.0.0 release.

• Support OIDC for login #433
  • OIDC Server #941
  • OIDC Android android#444
  • OIDC Documentation website#100
  • OIDC link user by iss/sub #977
  • testing with multiple OIDC providers
• Step-Up auth #944
  • Client elevation #952
  • Document breaking API changes
• Periodically delete inactive client sessions #943
  • Delete inactive clients/sessions #959
• Security: Store api token hashed #325
  • feat: allow sending message with client/basic path #964
  • feat: EdDSA token for database leakage/index mitigation #971
  • feat(security): application token refresh #986
  • Documentation feat: token format redesign website#102
  • Android app: Authenticate with client token for pushing messages on gotify 3.0 android#449
    • fix: appid spec #990
    • Release android app v2.10.1
• Misc
  • Rework config parsing #967
  • fix: don't include scheme://host inside next #1000

Changelog draft:

Notable features:

* Add OIDC login support. See [OIDC Docs](https://gotify.net/docs/oidc) (#433 via #941, #977, #982)
  * Thanks to @KovachVL and @alanturing881 for reporting security issues for this feature.
* Add session elevation for sensitive actions in the web UI. [Session Elevation Docs](https://gotify.net/docs/session-elevation) (GHSA-3hcj-9m7p-wwm9, #944 via #952, #954).
* Automatically delete inactive clients/sessions (#943 via #959)

Breaking changes:

- The `config.yml` file is no longer supported, convert it to the new env format with [`migrate-config`](https://gotify.net/docs/migrate-to-3#migrating-your-config).
- If you set list or map environment variables, their syntax changed, see [List and map syntax](https://gotify.net/docs/migrate-to-3#environment-list-and-map-syntax).
- API tokens are no longer returned in the GET endpoints and are only exposed on creation or rotation. See [Tokens are only shown once](https://gotify.net/docs/migrate-to-3#tokens-are-only-shown-once).
- If you have scripts hitting client-token endpoints, they may now need [elevation](https://gotify.net/docs/migrate-to-3#step-up-authentication).
- The paging.next URL in message list responses is now a relative path. See [Paging next URL is relative](https://gotify.net/docs/migrate-to-3#paging-next-url-is-relative).

Miscellaneous changes:

* Rework configuration (#366, #392 via #967)
* Don't store tokens in plain text (#325 via #971 by @eternal-flame-AD)
* Publish a `gotify/server:master` docker image for testing unreleased changes. [Docs: Testing master](https://gotify.net/docs/testing-master) (#953, #956)
* Allow sending messages with a client token (#964)
* Allow refreshing application tokens (#985 via #986 by @eternal-flame-AD)
* Increase token keyspace to >128 bits (#936 via #939 by @eternal-flame-AD)
* Switch logging to zerolog (#962)
* Add OCI labels to docker images (#924 via #927 by @eternal-flame-AD)
* Use use HTTP-only session cookies instead of local storage for UI sessions (#941)
* Add `createdAt` to users, clients, applications and plugins (#959)
* Add a CLI with `gotify serve`, `gotify version` and `gotify migrate-config` commands (#967)
* Fix Messenger plugins that are added after init (#653 via #998 by @TowyTowy)
* Update dependencies

[jmattheis]

@eternal-flame-AD I think we have a good state for Gotify 3.0. Do you have anything left that has to be done before the release?

I plan to release this version end of next week or in ~ two weeks.

[eternal-flame-AD]

I say ship it. My todo list is (1) investigate #203 and (2) a SECURITY.md (3) get around to doing the V2 plugin design. All can be done incrementally.

[jmattheis]

Regarding the Authentication Plugin: I thought OIDC would be enough, with tools like https://github.com/dexidp/dex you can get ldap/saml over OIDC, so basically I'm not sure what else there is to support with an authentication plugin.

Looking at the Jellyfin auth plugins there isn't much else. https://github.com/awesome-jellyfin/awesome-jellyfin#-authentication