Skip to main content

TideCloak 0.14.33

Summary​

TideCloak 0.14.33 focuses on the SDK developer experience: Next.js 16 support in the create-nextjs scaffolder (with the new proxy.ts pattern), new SDK helpers, improved logout behaviour, bundled documentation, and a substantial E2E test-suite hardening effort in the IdP extensions.

Key Features​

Next.js 16 Support (create-nextjs) : The scaffolder now generates Next.js 16-compatible projects, using proxy.ts instead of middleware.ts. tidecloak.json is written to the app root by the template's tcinit.sh. Generated apps no longer inherit .next, node_modules, or lockfiles from the template, and DPoP comments in the generated template are fixed.

SDK API Additions : tidecloak-react now exposes executeTideRequest, and initError receives the original error object rather than a stringified version. tidecloak-js adds getValueFromIdToken as an alias. Adapter-only fields in TidecloakConfig are now optional in tidecloak-nextjs.

Native-Mode Encrypt / Decrypt Policy Guard : Native-mode encrypt and decrypt now explicitly reject decryption policies. Policies are only valid in Forseti-contract mode where they carry signed policy bytes.

Logout Fix : Logging out now keeps the user logged out. Previously users were redirected back to the sign-in page after logout, effectively defeating the logout.

Deprecations & Cleanup : policy-react is deprecated. The @tidecloak/policy peer dependency has been removed, and an unused src/tidecloak-js.d.ts has been dropped.

Bundled Documentation : tidecloak-js, tidecloak-react, and tidecloak-nextjs packages now ship with their documentation. Includes fixes to event-handler shapes, configuration names, client imports, JSON import attributes, and type definitions in the JWT-verify docs.

E2E Test Suite Hardening (IdP Extensions) : Substantial rework of the IdP-extensions E2E suite — event-driven waits replace fixed sleeps, resilient form filling verifies values survive SPA re-renders, per-worker realms enable parallel execution, quorum tests verify signature counts, and credentials are now scrubbed from Playwright reports and traces. Adds test:smoke / test:full selections, JSON and Markdown CI summaries, and configurable ORK detection (HOME_ORK_ORIGIN, ORK_COUNT) with support for larger stacks (up to 20 ORKs). Internal quality investment — no runtime impact for consumers.

Enclave SRI : sha256-svDFLIJjtJaR8mxoPQkWkRjvaJRMpO+k6SwQobnmPtg=

Upgrade Notes​

  • policy-react is deprecated — plan migration to the built-in policy support in tidecloak-react.
  • @tidecloak/policy peer dependency removed — remove it from your package.json after upgrading if no other package requires it.
  • Next.js 16 projects now scaffold proxy.ts instead of middleware.ts. Existing apps on earlier Next.js versions continue to use middleware.
  • Native-mode encrypt/decrypt now reject decryption policies — if you were passing policies in native mode, calls will fail. Use Forseti-contract mode with signed policy bytes, or remove the policy argument.
  • Logout no longer redirects back to sign-in — add an explicit redirect if your app depended on that behaviour for post-logout navigation.

Detailed changelog​

For a granular per-repository breakdown of changes, see the detailed changelog.