CodeLogic.WebLogic.Testing 4.9.16-preview

• net10.0

  • CodeLogic.WebLogic (>= 4.9.16-preview)

# Changelog

## 4.9.16-preview (2026-10-30)

### Added

- **`Theme.AssetsBaseUrl` serves theme assets from a CDN or bucket.** When set to the absolute URL of an uploaded
 copy of the assets folder, `{asset:}` writes `{base}/{path}?v={fingerprint}` and the origin joins the CSP's script,
 style, font and image sources. The site still serves `/assets` (hard-coded links, plugin assets). Empty by default;
 follows live config changes. `WebSecuritySettings.BuildPolicy` builds a CSP with those sources plus a route's.

## 4.9.15-preview (2026-10-30)

The new features below are opt-in: with no configuration, existing apps behave and render as before.

### Security

- **`RequirePolicy` makes a route require sign-in.** It did not clear `AllowAnonymous`, so a route in an
 `AllowAnonymous()` group skipped its policy. Anonymous routes that still carry groups, permissions,
 policies or step-up now log a warning at startup.
- **Spent account links cannot be replayed.** One-time use was keyed on the token text, and DataProtection
 accepts the same token with extra whitespace or `=` padding, so a used magic link worked again.
- **No template values inside JavaScript template literals.** `|js` left `${…}` executable inside
 `` `…` ``; such values are now parse errors. Quotes in `//` and `/* */` comments no longer confuse the
 `|js` quote check.
- **`ChangePasswordAsync` needs a signed-in browser session** and checks the current password through the
 sign-in throttle and lockout. An API key or bearer token plus the password could change it and get a
 fresh session cookie without the second factor.
- **A locked account answers `LockedOut` for any password.** Only the right password said so, which made
 guessing during a lock free.
- **A user name may not equal another account's e-mail** (or the reverse); sign-in matched either and could
 pick the wrong account.
- **Steam** requires the identity fields in `openid.signed` and a response nonce at most five minutes old.
- **Widget placement rules hold everywhere.** A widget left at `Dashboard = true` skipped its placements'
 access rules at the widget endpoint and on dashboards; dashboard items may not reuse a placement's
 instance id.
- **Theme files behind a link in any folder below the theme root are refused** (only the file and its
 parent folder were checked).
- **Realtime:** `maxConnectionsPerClient` counts IPv6 clients per prefix like the rate limits, and revoking
 an API key closes the connections opened with it. Incoming WebSocket messages are limited per connection
 (`realtime.incomingMessagesPerMinute`, 120); a client sending more is closed with 1008.
- **Probe paths match whole segments** (`/health` no longer exempts `/healthcare`).
- **A response carrying a CSRF token is always `no-store`**, even when the handler set its own `Cache-Control`.
- **Uploads with an extension WebLogic has no signature for** (for example `.svg`, `.html`) refuse programs
 and anything that starts like markup, as the sniffer's documentation already promised.
- **Removing a passkey changes the security stamp**: sessions signed in with it end at their next check;
 `request.Auth.DeletePasskeyAsync` keeps the current one.
- **API key revocation is sticky**: both built-in stores keep `RevokedAt` when a concurrent "last used"
 update writes a stale copy. Custom `IWebApiKeyStore`s should do the same (see its docs).
- **Recovery code hashes use the password pepper** when one is set; codes stored earlier still redeem.
- **Client:** form commands only run when this site answered the form, and `navigate()` refuses
 `javascript:` and `data:` URLs.
- **Setup warnings:** a missing client address or ignored proxy headers (every visitor would share one
 rate-limit bucket) are logged once.

### Added

- **`security.ipRules.refuseUnknownCountry`** (default `false`): with a country allow-list, refuse clients
 whose country cannot be looked up instead of letting them in.

- **Validated JSON binding:** `request.BindJsonAsync<T>(ct)` reads a JSON body within the route's limit and
 validates its DataAnnotations (nested objects, collections, `IValidatableObject`). Failures come back as a
 binding (415 / 413 / 400) with field errors keyed by JSON path (`items[1].name`); return `ToProblem()`.
- **Response compression** (`compression.enabled`, off): Brotli/gzip through ASP.NET Core. Responses that are
 signed in, use a session, set cookies or carry a CSRF token are never compressed (BREACH);
 `WithoutCompression()` / `AllowPersonalCompression()` per route.
- **ETags for pages and JSON** (`cache.eTags` or `WithETag()`, off): weak ETags from the body hash and `304`
 for a matching `If-None-Match`; never on personal responses.
- **Localization** (`localization.enabled`, off): culture per request from query, cookie or `Accept-Language`
 (supported cultures only), `IWebTextResources` with theme JSON files (`theme/locales/{culture}.json`) and a
 fallback chain, `{t:key}` in the request culture, a culture switch endpoint, `Content-Language`, and output
 and fragment caches that vary by culture.
- **Webhook signatures:** `WebWebhookVerifier` checks HMAC-SHA256 signatures (hex/Base64, prefixes, timestamp
 window, several secrets for rotation, GitHub and Stripe presets) in constant time.
- **Pagination:** `WebPagination`, `WebPagedResult<T>` and `WebPageLinks` (clamped pages, links that keep the
 query string); MiniBlog uses them.
- **Sitemap and robots.txt:** `web.AddSitemap(...)` serves `/sitemap.xml` (anonymous parameterless pages plus an
 app `IWebSitemapProvider`, absolute URLs from `PublicBaseUrl`) and `/robots.txt`.
- **Metrics and tracing:** a `CodeLogic.WebLogic` meter and activity source (route requests and duration,
 security and rate-limit rejections, sign-ins, realtime connections, queue lengths; security-phase and
 template spans). Tags are low-cardinality and never hold IPs, user ids or query strings. See
 [Observability](docs/guides/observability.md).
- **Form ↔ entity mapper** (back from 0.x): the injectable `WebFormMapper` (`request.Forms.Mapper`) with
 `[WebFormMapFrom]` / `[WebFormMapIgnore]`; form → entity only writes the form's own fields.
- **Events:** `SecondFactorRequiredEvent`, and `UserSignedInEvent.IsRefresh` for re-sign-ins that are not new
 sign-ins.

### Docs

- New guides: Localization, Observability. The migration guide maps 0.x config keys to 4.9 and lists renamed
 contracts and events.

## 4.9.14-preview (2026-10-30)

### Changed

- **`HttpError` keeps the error body.** `error.data` is the parsed body as it came (JSON or text), so APIs whose
 errors are not ProblemDetails (`{ success: false, error, message }`) no longer lose their text; a string
 `message` field also fills `problem.detail` (and so the error's message) when there is no `detail`. Form posts
 sent through the upload path behave the same.

## 4.9.13-preview (2026-10-30)

### Fixed

- **External sign-ins and account links started from a POST form work.** Browsers apply the page's
 `form-action` to the redirect that follows a form post, so a form posting to a route that calls
 `WebExternalLoginFlow.ChallengeAsync` was blocked under the default `form-action 'self'` (the browser stayed on
 the page). The origins registered providers redirect to are now added to `form-action` on every page.

### Added

- **`IWebExternalLoginProvider.RedirectOrigins`** (default: none): the origins the challenge redirects to. Steam
 answers `https://steamcommunity.com/`; OAuth/OIDC providers the origins of `AuthorizationEndpoint` and
 `Authority` (an issuer whose discovered authorization endpoint is on another host needs `AuthorizationEndpoint`
 set, or the host in `headers.formActions`).
- **`headers.externalLoginFormActions`** (default `true`) turns this off.

## 4.9.12-preview (2026-10-30)

### Added

- **Deleting accounts.** `WebAccountService.DeleteAccountAsync(userId, byUserId, ct)` ends the user's sessions,
 removes their passkeys and recovery codes, deletes the user, and ends sessions again afterwards (a request
 running during the delete cannot leave one behind). Apps had to clear each store themselves, keyed by the exact
 `WebUser.Id`; a wrong id format left sessions working until the next security-stamp check. Fails with
 `weblogic.auth.delete_unsupported` or `weblogic.auth.user_not_found`.
- **`IWebUserDeletionStore`**, an optional user-store capability: `DeleteAsync(userId)` removes the user, their
 external-login links and the app's own data for the account. `InMemoryWebUserStore` and `MySqlWebUserStore`
 implement it (MySQL: user and login rows in one transaction).
- **`UserDeletedEvent(UserId, ByUserId)`**: audited as `auth.account` / `deleted` (with `by` for an administrator);
 realtime connections of the user close.

### Changed

- `WebAccountService` takes `IWebPasskeyStore` and `IWebRecoveryCodeStore` in its constructor (both are always
 registered; only code that constructs the service by hand needs to pass them).

## 4.9.11-preview (2026-10-30)

### Fixed

- **Form messages survive plain posts.** `FormResult.Success("Saved.", "/next")` only reached the user when the
 WebLogic client posted the form; a plain post (no `data-wl-form`, or no JavaScript) got the 303 and the message
 was lost. The message now travels to the next page as a one-shot flash and the client shows it as a toast.
- **Plain posts with errors and no fallback template go back to the form.** They used to get a bare 422 text page
 with the summary. When the post came from a page of this site (Referer, same scheme and host) they now get a 303
 back to it and the errors as a `danger` toast; without such a Referer the 422 text answer stays.

### Added

- **`WebFlash`** (DI singleton): `Set(http, message, variant)` before any redirect, `Take(http)` to read and clear.
 The message rides in the HttpOnly cookie `__Host-wl_flash` (no prefix over plain HTTP), protected with
 DataProtection, valid for two minutes and cut to 500 characters; forged or expired cookies are dropped.
 `{weblogic_scripts}` takes it into the client config as `flash: { message, variant }` (`success`, `info`,
 `warning`, `danger`), and the client shows it once at start and after partial navigation (as text, never HTML).
 Requests that carry the cookie skip the output cache so the message is not stuck behind a cached page.

## 4.9.10-preview (2026-10-29)

### Fixed

- **A foreach alias can no longer be a template keyword.** `{foreach:model:tabs as t}` followed by `{t:label}`
 printed the text key "label" (the `{t:…}` text directive wins over the alias) with no error, and an alias named
 `section` opened a section and failed later with an unrelated "Unexpected {empty}". The parser now refuses
 aliases that are directive or scope words (`section`, `rendersection`, `foreach`, `if`, `ifnot`, `elseif`,
 `switch`, `case`, `widgetarea`, `form`, `widget`, `partial`, `asset`, `t`, `raw`, `model`, `page`, `query`,
 `route`, `item`, `param`, `loop`, `user`) with a message naming the alias. ThemeCheck reports it the same way.
 The MiniBlog sample used `as t` and showed "url"/"name" instead of its tags; it now uses `tag`.

## 4.9.9-preview (2026-10-27)

### Added

- **Account changes are audited.** `WebAccountAuditRecorder` writes these to the audit log:
 - registration, password change and reset;
 - e-mail change;
 - two-factor on/off, recovery codes regenerated or used;
 - external logins linked or unlinked;
 - API keys created or revoked;
 - lockouts.
 Changes made during a request carry the request (IP hash, path, trace id); others carry only the user.
 Before, only sign-in/out, passkeys, re-authentication and session revokes were audited, so apps kept
 their own logs for the rest. `AddHttpContextAccessor` is now registered.
- **New events:**
 - `EmailChangedEvent`, raised after a confirmed address change, in addition to `EmailConfirmedEvent`;
 - `RecoveryCodesRegeneratedEvent`, which is not raised for the first codes created when two-factor is
   turned on;
 - `ExternalLoginChangedEvent`.
- **Unlinking external logins:**
 - `WebExternalLoginFlow.UnlinkAsync(user, provider)` fails with
   `weblogic.auth.external_login_not_found` when there is no link;
 - `IWebUserExternalLoginStore.RemoveExternalLoginAsync` is implemented by the in-memory and MySQL
   stores. It is a default interface method, so existing custom stores still compile; they throw
   `NotSupportedException` until they implement it;
 - `LinkAsync` now raises `ExternalLoginChangedEvent`.
- **`<img src>` accepts base64 raster `data:` images** (png, jpeg, gif, webp), for example a two-factor
 QR code from `WebTwoFactorEnrollment.QrCodeDataUri`. SVG data, other `data:` URLs and `data:` in every
 other URL attribute stay blocked. A new encoding context, `TemplateEncodingContext.ImageUrlAttribute`,
 handles this.

### Fixed

- **Partial navigation between layouts.**
 - **Before:** when a theme did not set `data-wl-layout` on its shells, a link to a page with another
   layout swapped that page's shell content into the current layout.
 - **Now:** WebLogic writes the document's outermost template into `wl-config` (`layout`), and the
   client loads the page in full when it differs. A `data-wl-layout` set by the theme still wins.
 - **API:** `ITemplateScriptProvider.GetScriptTags(httpContext, nonce, layout)` (default method) and
   `TemplateRenderContext.DocumentTemplatePath`.
- **Signing the same user in again kept dropping "remember me".** `SignInAsync` took `bool persistent`
 (default `false`), so signing the same user in again turned a persistent session into a browser
 session. It now takes `bool? persistent` (default `null`): null keeps the current choice for the same
 user and means "not persistent" for anyone else. Callers passing `true`/`false` are unchanged; code
 compiled against the old signature must be rebuilt.

### Docs

- `client.md`: requests (`wl.http.post` sends JSON; forms and uploads use `request(url, { method, form })`;
 errors throw `HttpError`) and partial navigation across layouts.
- `templates.md`: `<img src>` data images. The blocked-URL replacement is `about:blank#blocked`, not `#`.
- `security-pipeline.md`: audit categories.
- `external-logins.md`: linking and unlinking.
- `authentication.md`: `persistent: null`.

## 4.9.8-preview (2026-10-27)

### Fixed

- **Form binding matched posted names case-sensitively.** A field named after the property (`Image`,
 `Email`) did not bind from a client posting `image` or `email`: the field stayed empty, so a
 `[Required]` field failed and an optional one was silently ignored. Posted names now match
 case-insensitively, in `BindAsync`, remote field validation, wizard steps and repeater items (file
 fields already did). If a name is posted twice in different case, the values are merged in posted
 order and a single-value field takes the first, instead of the post failing. The internal `__wl_*`
 and CSRF fields are recognised in any case too.

### Changed

- A form model whose fields differ only in case (`Name` and `name`) is refused when it is registered
 (`InvalidOperationException`), because those fields could no longer be told apart.

## 4.9.7-preview (2026-10-27)

### Added

- `WebHtmlSanitizer`: opt-in `style` declarations and embed iframes, for rich text that resizes images or
 embeds videos.
 - `WebHtmlSanitizerOptions.AllowedStyleProperties`: property name → value check. The attribute is
   rebuilt from the allowed declarations only. Values with comments, escapes, quotes, `url()` or any
   function other than `rgb()`/`rgba()`/`hsl()`/`hsla()` are refused before the check, as are
   unknown properties; `!important` is stripped.
 - `WebCssValues`: `Length`, `Percentage`, `Color`, `OneOf(...)`, `Any(...)` value checks.
 - `WebHtmlSanitizerOptions.AllowedFrameSources` (`WebFrameSource(host, pathPrefix)`): https only,
   exact host, default port, no user info. A kept iframe is rebuilt with `src`, `width`, `height`,
   `title`, `loading` and the global attributes, plus `FrameSandbox`, `FrameAllow`, `allowfullscreen`
   and `referrerpolicy="strict-origin-when-cross-origin"`; its fallback content is dropped.
 - Defaults are unchanged: no `style` attributes, no iframes. Add the frame hosts to the CSP
   (`security.headers.frameSources`) as well.

## 4.9.6-preview (2026-10-27)

### Security

- New-device e-mails no longer carry the raw `User-Agent` header. When the browser was not
 recognised, the header (chosen by the client) went into the mail as the `device` value, and a CL.Mail
 HTML template using it could be injected into. Unrecognised browsers are now named "an unknown
 browser".

### Added

- `WebSignInResult.Error`: when `CompletePasswordChangeAsync` refuses the new password, the result keeps
 the token and carries the password policy's message ("Use at least 10 characters.", "The password
 must not contain your user name or e-mail."), so the page can say why.

### Changed

- `UseUserStore<T>()` and the other `Use…<T>()` registrations add `T` as a singleton of its own type and
 resolve the contract to that same instance. Apps can inject their store by type (for app-specific
 methods) without casting `IWebUserStore`, and a class registered for several contracts is one instance.

## 4.9.5-preview (2026-10-26)

### Added

- Step-up with alternatives: `RequireRecentSignInAnyOf(maxAge, ["pwd", "otp"], ["passkey"])` on routes,
 groups and policies accepts any one complete set of methods. `RecentSignInRequirement.Alternatives`
 replaces `Methods`, and `WebRouteSettings.RecentSignInAlternatives` replaces `RecentSignInMethods`.
- `WebUserAgent`: browser and system family of a user agent ("Chrome on Windows"), and
 `WebSessionInfo.Device`.
- `Realtime.SessionCheckSeconds` (30) and `SessionEndedEvent`.

### Fixed

- A revoked session kept its realtime connection. Signing a device out, the per-user session cap and
 password-reset sign-outs ended the session, but its SSE/WebSocket stream stayed open for up to
 `MaxConnectionMinutes` (60) and kept receiving that user's messages. Connections now record their
 session and close when it ends: at once on the same node, and within `SessionCheckSeconds` on others.
- New-device e-mails compared the exact user-agent string, so every browser update was mailed as a new
 sign-in. They now compare browser and system family and name the device ("Chrome on Windows").

### Changed

- CodeLogic.WebLogic.MySql uses only CL.MySQL2's typed API (now CodeLogic.MySQL2 4.9.101): the add-on
 contains no SQL text. Rate limits refill and charge a bucket with one atomic update-and-read, a
 sign-in failure is one upsert, a fresh one-time key is one round trip, and recovery code sets are
 replaced in one transaction.

## 4.9.4-preview (2026-10-26)

### Added

- Passkeys (WebAuthn), verified in-house: CBOR, COSE keys (ES256/384/512, RS256, PS256), authenticator
 data, signatures, and the `none`, `packed` and `fido-u2f` attestation formats.
 - **Three uses:** passwordless sign-in (`request.Auth.PasskeySignInAsync`, multi-factor, so no TOTP
   step), the second factor after a password (`CompleteTwoFactorWithPasskeyAsync`), and step-up
   (`ReauthenticateWithPasskeyAsync`).
 - **Registration and management:** `BeginPasskeyRegistrationAsync` and `CompletePasskeyRegistrationAsync`,
   plus list, rename and delete. Users are e-mailed when a passkey is added or removed.
 - **Safety:** ceremony state is sealed and each challenge is single-use (works across nodes).
   Origin, RP id, user presence and verification, backup flags and the user handle are checked.
   A signature counter that goes backwards refuses the sign-in (`PasskeyCloneSuspectedEvent`).
 - **Lockout:** the password lockout neither blocks passkeys nor counts passkey failures, because
   credential ids are not secret. Failures are throttled instead.
 - **Wiring:** `IWebPasskeyStore` (`web.UsePasskeyStore<T>()`, an in-memory store with
   `UseInMemoryAccounts`) and `Auth.Passkeys` configuration (RP id, origins, timeout, attestation,
   second factor without PIN, maximum per user).
- Client: `WebLogic.passkeys` (`signIn`, `register`, `verify`, passkey autofill) and declarative
 `data-wl-passkey` buttons.
- Testing: `WebTestAuthenticator`, a software authenticator for testing passkey endpoints. The suite
 also runs the client against a headless-Chrome virtual authenticator.
- CodeLogic.WebLogic.MySql: `wl_passkeys` (`WebMySqlStores.Passkeys`, included in `All`), with an
 atomic counter update.
- Starter sample: passkey sign-in with autofill, passkey as the second factor, and a Passkeys card on
 the account page.

### Fixed

- A suspended user's reason and end date were lost on the way back from password, magic-link and
 external sign-in (`WebSignInResult.Suspension` was null), so the suspension page could not show them.

## 4.9.3-preview (2026-10-26)

### Added

- App-managed IP rules and blocklists: `IWebIpRuleProvider` (`web.AddIpRuleProvider<T>()`) returns
 `WebIpRule`s (deny, allow or exempt; network or country; expiry; reason) merged with
 `Security.IpRules`, and `IWebReputationListProvider` returns DNSBL zones that replace the CL.NetUtils
 services. Cached for `IpRules.ProviderCacheSeconds` (60); `IWebSecurityRulesInvalidator.Invalidate()`
 applies edits at once; a failing provider keeps the last good rules. Exempt addresses skip the
 allow-list, country rules and the DNSBL check.
- `WebSecurityRejectedEvent.RuleId` (and `WebSecurityDecision.RuleId`): the matched rule
 (`ban-42`, `config.deny[0]`, `dnsbl:{zone}`) for hit counters, never the client address.
- DataProtection key ring in CL.Storage: `AddDataProtection().PersistKeysToCodeLogicStorage(connectionId, path)`
 (one file per key, never overwritten, storage errors fail instead of minting new keys), and
 `ProtectKeysWithSecret(variable, previousVariables...)` to encrypt keys at rest with AES-256-GCM
 from an environment secret, with rotation. Cluster checks accept the storage repository and warn
 about a plain folder.
- Plugin assets: `b.MapAssets(assembly, "assets/", name)` serves embedded files at
 `/_weblogic/plugins/{name}/...` (ETag, extension allowlist, path checks, removed with the plugin);
 `{asset:name:path}` gives a fingerprinted URL, and a theme file at `assets/plugins/{name}/{path}`
 overrides it.
- Group layouts: `WithLayout("admin/layout")` on routes and groups, used by page templates that
 declare no `{layout:...}` (`TemplateRenderRequest.DefaultLayout`).
- Account suspension: `WebUser.SuspendedUntil` and `SuspensionReason`. Sign-in returns
 `WebSignInStatus.Suspended` with `WebSignInResult.Suspension` (only after the credentials were
 proven); sessions end at the next stamp check and API keys stop working.
 `WebResult.AccountSuspended(suspension)` renders the theme's `errors/suspended` page (plain fallback,
 ProblemDetails for API clients). Both samples handle it; MiniBlog adds two user columns.
- Git theme credentials in `ThemeConfig`: `GitTokenEnvironmentVariable` (or the secret `GitToken`),
 `GitUserName`, `GitSshKeyPath` and `GitSshPassphraseEnvironmentVariable`.
- `WebThemeChecker.Check(folder)` lists templates that do not parse (file, line, column), and
 `tools/CL.WebLogic.ThemeCheck` runs it from the command line. CI checks both sample themes.

- New package **CodeLogic.WebLogic.MySql**: production stores on CL.MySQL2 for every contract
 (users with lockout, e-mail and external logins; sessions with device listing; API keys; recovery
 codes; one-time keys; login throttle; rate limits; audit; widget settings; dashboards) and the
 DataProtection key ring. `web.UseMySqlStores(connectionId, o => o.Stores = ...)`,
 `AddDataProtection().PersistKeysToMySql(connectionId)`. Schema sync at startup, a background sweep,
 and cross-node guarantees (single-use consumes, atomic lockout, exact rate-limit capacity, versioned
 dashboards). Tested against MySQL 8.4 in CI.
- New package **CodeLogic.WebLogic.ExternalLogins**: `AddSteamLogin()` (moved from the starter
 sample), `AddOAuthLogin(options)` for any OAuth 2.0 / OpenID Connect provider (authorization code +
 PKCE S256, nonce, discovery with issuer check, in-house JWT validation for RS/PS/ES 256-512 with
 JWKS rotation, `iss`/`aud`/`azp`/`exp`/`nbf`/`iat`, RFC 9207 `iss` check), and presets
 `AddGoogleLogin`, `AddMicrosoftLogin`, `AddGitHubLogin`, `AddDiscordLogin`.
- `WebExternalChallenge.CodeVerifier` and `CodeChallenge`: `WebExternalLoginFlow` now creates a PKCE
 verifier per sign-in and keeps it in its protected cookie.

### Changed

- Releases are manual only: the `promote.yml` workflow that merged `main` into `release` after green
 tests is removed. Publish with `git push origin main:prerelease` or `main:release`.
- `IpRulesStage` and `ReputationStage` take a `WebSecurityRules` (resolved from DI).
- MiniBlog uses `CodeLogic.WebLogic.MySql` for its stores and key ring (encrypted when
 `MINIBLOG_KEYRING_SECRET` is set); its own user, session, recovery-code, widget and dashboard
 stores are gone. The starter sample uses `CodeLogic.WebLogic.ExternalLogins` (Steam, plus Google,
 Microsoft, GitHub and Discord when `STARTER_{PROVIDER}_CLIENT_ID` and `_CLIENT_SECRET` are set).

## 4.9.2-preview (2026-10-26)

### Added

- `request.Auth.SignInExternalAsync(user, provider)`: sign-in for users an external provider vouched
 for. Applies the account rules (disabled, locked, other tenant) and asks users with two-factor
 authentication for their code, like a password sign-in. Recorded as `ext:{provider}`.
- Per-area sign-in pages: `WithLoginPath(path)` and `WithAccessDeniedPath(path)` on routes and
 groups (inherited; local paths only). Signed-in users without access are sent to the denied page
 instead of a 403 (pages only).
- Step-up: `RequireRecentSignIn(maxAge, methods...)` on routes and groups, and on policies
 (`RecentSignInRequirement`). Failing it asks the user to sign in again (`reauth=1` redirect, or
 `401` with `error="reauthentication_required"` for APIs) instead of forbidding.
 `request.Auth.ReauthenticateAsync(password, code)` proves the user again; sessions and
 `WebIdentity` record `AuthenticatedAt`.
- "Remember me": a `persistent` flag on every sign-in method, carried through the second factor
 and a required password change. `Session.PersistentIdleTimeoutDays` (30) and
 `Session.PersistentAbsoluteTimeoutDays` (90).
- Sessions as devices: records keep the user agent, authentication time and "remember me"; the
 optional store capability `IWebSessionListStore` enables `request.Auth.ListSessionsAsync()`,
 `RevokeSessionAsync(idHash)`, `Session.MaxPerUser` and new-device e-mails
 (`Auth.Notifications.NotifyNewDevice`, notification kind `NewDeviceSignIn`). The in-memory store
 and both samples implement it; the starter's account page lists signed-in devices.
- CSP: `MediaSources`, `WorkerSources`, `ManifestSources`, `FormActions` and `CspReportTo`
 (`Reporting-Endpoints` + `report-to`). Per-route additions with `WithCsp(c => c.AddFrameSource(...))`
 (validated: hosts, schemes and `'self'` only), built once per route.
- The explorer shows a route's login path, step-up requirement and CSP additions.
- `CodeLogic.WebLogic.Testing` ships a package readme (usage example and helper overview); the
 `CodeLogic.WebLogic` readme gains a quick start and links to the docs.

### Changed (breaking)

- `request.Auth.PasswordSignInAsync`, `SignInAsync` and `SignInWithMagicLinkAsync` take
 `persistent` before the cancellation token: callers passing the token positionally must name it
 (`cancellationToken: ct`). The matching `WebAuthService` methods changed the same way.
- Sessions signed in without "remember me" now use a browser-session cookie (no `Expires`); before,
 every session cookie lasted until the absolute timeout.
- Magic-link sign-in refuses users of another tenant, like password sign-in.
- `WebAuthService` takes a `WebSessionDevices` (resolved from DI).

### Fixed

- CI: golden template snapshots are found under deterministic (`/_/`) build paths, the Markdown
 pathological-input test compares scaling instead of wall-clock time, and parallel Docker builds
 lock the shared NuGet cache.

## 4.9.1-preview (2026-10-25)

First preview of the rebuild on nuget.org.

### Added

- New repository: CL.WebLogic rebuilt from the ground up on CodeLogic 4.9 and published as
 `CodeLogic.WebLogic`. Breaking with the 0.x line — see `docs/guides/migrating.md`.
- `WebLogicLibrary` implements `IConfigReloadable`: `weblogic` config changes are applied live
 through `WebLogicConfigHolder`; restart-only fields are flagged (`WebLogicRestartRequiredEvent`,
 Degraded health) instead of failing the change.
- `IWebLogicContext` decouples toolkit services from the static CodeLogic runtime.
- `CodeLogic.WebLogic.Testing` package with `FakeWebLogicContext` and `RecordingLogger`.
- Hosting: `AddCodeLogicWebLogic()` / `UseCodeLogicWebLogic()` / `MapCodeLogicWebLogic()`. Every
 WebLogic route is a real ASP.NET endpoint (templates and constraints such as `{id:int}`, 405 with
 `Allow`, HEAD for GET routes, per-endpoint CORS) and mixes freely with minimal APIs.
- Routing: `IWebContributor.ContributeAsync(WebContributionBuilder, ct)` with `MapPage`, `MapApi`,
 `MapFragment`, `MapSse`, `MapFallback` and nested `MapGroup` prefixes whose options (anonymous
 access, groups, permissions, policies, CORS, rate limit, body limit, middleware) are inherited.
 Routes are **secure by default**; anonymous routes are listed at registration.
- Contributions are all-or-nothing and removable: `WebContributionHandle`, `OnRemove` cleanups,
 ambiguity detection, a single fallback. CodeLogic plugins implementing `IWebContributor` are
 registered on load and removed on unload.

---

Release notes truncated to fit NuGet's 35 000 character limit. The complete changelog ships inside this package as CHANGELOG.md.