Merge remote-tracking branch 'origin/main'

chore: update AAGUIDs (#1511 )
Co-authored-by: stonith404 <58886915+stonith404@users.noreply.github.com>
2026-07-16 05:54:01 +03:00 · 2026-06-16 08:48:35 +02:00 · 2026-06-08 09:22:50 +02:00 · 2026-06-05 11:39:14 +02:00 · 2026-06-02 14:08:33 +02:00 · 2026-06-02 14:02:12 +02:00
224 changed files with 5827 additions and 3089 deletions
--- a/.github/ISSUE_TEMPLATE/feature.yml
+++ b/.github/ISSUE_TEMPLATE/feature.yml
@@ -1,7 +1,8 @@
 name: 🚀 Feature
 description: "Submit a proposal for a new feature"
 title: "🚀 Feature: "
-type: 'Feature'
+type: "Feature"
+labels: ["needs more upvotes"]
 body:
  - type: textarea
    id: feature-description
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,12 +1,86 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for more information:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-# https://containers.dev/guide/dependabot
-
 version: 2
+
+multi-ecosystem-groups:
+  all-dependencies:
+    schedule:
+      interval: "weekly"
+      day: "friday"
+      time: "17:00"
+      timezone: "Europe/Zurich"
+    labels:
+      - "dependencies"
+    open-pull-requests-limit: 2
+    pull-request-branch-name:
+      separator: "-"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+
 updates:
- - package-ecosystem: "devcontainers"
-   directory: "/"
-   schedule:
-     interval: weekly
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    patterns: ["*"]
+    multi-ecosystem-group: "all-dependencies"
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "gomod"
+    directory: "/backend"
+    patterns: ["*"]
+    multi-ecosystem-group: "all-dependencies"
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "npm"
+    directories:
+      - "/frontend"
+      - "/tests"
+      - "/email-templates"
+    patterns: ["*"]
+    multi-ecosystem-group: "all-dependencies"
+    versioning-strategy: "increase-if-necessary"
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "docker"
+    directories:
+      - "/docker"
+      - "/tests/setup"
+    patterns: ["*"]
+    multi-ecosystem-group: "all-dependencies"
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "docker-compose"
+    directories:
+      - "/"
+      - "/tests/setup"
+    patterns: ["*"]
+    multi-ecosystem-group: "all-dependencies"
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "devcontainers"
+    directory: "/"
+    patterns: ["*"]
+    multi-ecosystem-group: "all-dependencies"
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    cooldown:
+      default-days: 7
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -0,0 +1,12 @@
+## What does this PR do?
+
+## Screenshots
+
+## AI Usage
+
+## Contributing Guidelines
+
+Have you read the [Contributing Guidelines](https://github.com/pocket-id/pocket-id/blob/main/CONTRIBUTING.md)?
+
+- [ ] If I'm implementing a new feature, I have opened an issue first, or commented on an existing one, to discuss the implementation details.
+- [ ] I have read the [AI Usage Guidelines](https://github.com/pocket-id/pocket-id/blob/main/CONTRIBUTING.md#ai-usage-policy).
--- a/.github/workflows/backend-linter.yml
+++ b/.github/workflows/backend-linter.yml
@@ -17,14 +17,15 @@ permissions:
  pull-requests: read
  # Optional: allow write access to checks to allow the action to annotate code in the PR.
  checks: write
+  id-token: write

 jobs:
  golangci-lint:
    name: Run Golangci-lint
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-latest
    steps:
      - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v6
--- a/.github/workflows/build-next.yml
+++ b/.github/workflows/build-next.yml
@@ -9,43 +9,40 @@ concurrency:
  group: build-next-image
  cancel-in-progress: true

+permissions:
+  contents: read
+  packages: write
+  id-token: write
+  attestations: write
+  artifact-metadata: write
+
 jobs:
  build-next:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
-      attestations: write
+    runs-on: depot-ubuntu-latest
+
+    env:
+      CONTAINER_IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/pocket-id
+
    steps:
      - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6

      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v5

      - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
        with:
          node-version: 24
+          cache: "pnpm"

      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version-file: "backend/go.mod"

-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Set DOCKER_IMAGE_NAME
-        run: |
-          # Lowercase REPO_OWNER which is required for containers
-          REPO_OWNER=${{ github.repository_owner }}
-          DOCKER_IMAGE_NAME="ghcr.io/${REPO_OWNER,,}/pocket-id"
-          echo "DOCKER_IMAGE_NAME=${DOCKER_IMAGE_NAME}" >>${GITHUB_ENV}
+      - name: Set up Depot CLI
+        uses: depot/setup-action@v1

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
@@ -54,6 +51,40 @@ jobs:
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

+      - name: Container Image Metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.CONTAINER_IMAGE_NAME }}
+          tags: |
+            type=raw,value=next
+          labels: |
+            org.opencontainers.image.authors=Pocket ID
+            org.opencontainers.image.url=https://github.com/pocket-id/pocket-id
+            org.opencontainers.image.documentation=https://github.com/pocket-id/pocket-id/blob/main/README.md
+            org.opencontainers.image.source=https://github.com/pocket-id/pocket-id
+            org.opencontainers.image.version=next
+            org.opencontainers.image.licenses=BSD-2-Clause
+            org.opencontainers.image.ref.name=pocket-id
+            org.opencontainers.image.title=Pocket ID
+
+      - name: Container Image Metadata
+        id: distroless-meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.CONTAINER_IMAGE_NAME }}
+          tags: |
+            type=raw,value=next-distroless
+          labels: |
+            org.opencontainers.image.authors=Pocket ID
+            org.opencontainers.image.url=https://github.com/pocket-id/pocket-id
+            org.opencontainers.image.documentation=https://github.com/pocket-id/pocket-id/blob/main/README.md
+            org.opencontainers.image.source=https://github.com/pocket-id/pocket-id
+            org.opencontainers.image.version=next-distroless
+            org.opencontainers.image.licenses=BSD-2-Clause
+            org.opencontainers.image.ref.name=pocket-id
+            org.opencontainers.image.title=Pocket ID
+
      - name: Install frontend dependencies
        run: pnpm install --frozen-lockfile

@@ -66,31 +97,40 @@ jobs:

      - name: Build and push container image
        id: build-push-image
-        uses: docker/build-push-action@v6
+        uses: depot/build-push-action@v1
        with:
          context: .
+          file: docker/Dockerfile-prebuilt
          platforms: linux/amd64,linux/arm64
          push: true
-          tags: ${{ env.DOCKER_IMAGE_NAME }}:next
-          file: docker/Dockerfile-prebuilt
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          sbom: false
+          provenance: true
+
      - name: Build and push container image (distroless)
-        uses: docker/build-push-action@v6
+        uses: depot/build-push-action@v1
        id: container-build-push-distroless
        with:
          context: .
+          file: docker/Dockerfile-distroless
          platforms: linux/amd64,linux/arm64
          push: true
-          tags: ${{ env.DOCKER_IMAGE_NAME }}:next-distroless
-          file: docker/Dockerfile-distroless
+          tags: ${{ steps.distroless-meta.outputs.tags }}
+          labels: ${{ steps.distroless-meta.outputs.labels }}
+          sbom: false
+          provenance: true
+
      - name: Container image attestation
        uses: actions/attest-build-provenance@v2
        with:
-          subject-name: "${{ env.DOCKER_IMAGE_NAME }}"
+          subject-name: "${{ env.CONTAINER_IMAGE_NAME }}"
          subject-digest: ${{ steps.build-push-image.outputs.digest }}
          push-to-registry: true
+
      - name: Container image attestation (distroless)
        uses: actions/attest-build-provenance@v2
        with:
-          subject-name: "${{ env.DOCKER_IMAGE_NAME }}"
+          subject-name: "${{ env.CONTAINER_IMAGE_NAME }}"
          subject-digest: ${{ steps.container-build-push-distroless.outputs.digest }}
          push-to-registry: true
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -1,59 +1,27 @@
 name: E2E Tests
 on:
  push:
-    branches: [main]
+    branches: [ main ]
    paths-ignore:
      - "docs/**"
      - "**.md"
      - ".github/**"
  pull_request:
-    branches: [main, breaking/**]
+    branches: [ main, breaking/** ]
    paths-ignore:
      - "docs/**"
      - "**.md"
      - ".github/**"

+permissions:
+  contents: read
+  actions: write
+  id-token: write
+
 jobs:
-  build:
-    if: github.event.pull_request.head.ref != 'i18n_crowdin'
-    timeout-minutes: 20
-    permissions:
-      contents: read
-      actions: write
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build and export
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: docker/Dockerfile
-          push: false
-          load: false
-          tags: pocket-id:test
-          outputs: type=docker,dest=/tmp/docker-image.tar
-          build-args: BUILD_TAGS=e2etest
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-      - name: Upload Docker image artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: docker-image
-          path: /tmp/docker-image.tar
-          retention-days: 1
-
  test:
    if: github.event.pull_request.head.ref != 'i18n_crowdin'
-    permissions:
-      contents: read
-      actions: write
-    runs-on: ubuntu-latest
-    needs: build
+    runs-on: depot-ubuntu-24.04-32
    strategy:
      fail-fast: false
      matrix:
@@ -70,25 +38,33 @@ jobs:
            storage: database

    steps:
-      - uses: actions/checkout@v5
+      - name: Checkout code
+        uses: actions/checkout@v6

      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v5

      - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
        with:
          node-version: 24
+          cache: "pnpm"
+
+      - name: Set up Depot CLI
+        uses: depot/setup-action@v1
+
+      - name: Set up Depot Docker builder
+        run: depot configure-docker

      - name: Cache Playwright Browsers
-        uses: actions/cache@v4
+        uses: actions/cache@v5
        id: playwright-cache
        with:
          path: ~/.cache/ms-playwright
          key: ${{ runner.os }}-playwright-${{ hashFiles('pnpm-lock.yaml') }}

      - name: Cache PostgreSQL Docker image
-        uses: actions/cache@v4
+        uses: actions/cache@v5
        id: postgres-cache
        with:
          path: /tmp/postgres-image.tar
@@ -102,23 +78,8 @@ jobs:
        if: matrix.db == 'postgres' && steps.postgres-cache.outputs.cache-hit == 'true'
        run: docker load < /tmp/postgres-image.tar

-      - name: Cache LLDAP Docker image
-        uses: actions/cache@v4
-        id: lldap-cache
-        with:
-          path: /tmp/lldap-image.tar
-          key: lldap-stable-${{ runner.os }}
-      - name: Pull and save LLDAP image
-        if: steps.lldap-cache.outputs.cache-hit != 'true'
-        run: |
-          docker pull lldap/lldap:2025-05-19
-          docker save lldap/lldap:2025-05-19 > /tmp/lldap-image.tar
-      - name: Load LLDAP image
-        if: steps.lldap-cache.outputs.cache-hit == 'true'
-        run: docker load < /tmp/lldap-image.tar
-
      - name: Cache SCIM Test Server Docker image
-        uses: actions/cache@v4
+        uses: actions/cache@v5
        id: scim-cache
        with:
          path: /tmp/scim-test-server-image.tar
@@ -134,45 +95,20 @@ jobs:

      - name: Cache Localstack S3 Docker image
        if: matrix.storage == 's3'
-        uses: actions/cache@v4
+        uses: actions/cache@v5
        id: s3-cache
        with:
          path: /tmp/localstack-s3-image.tar
-          key: localstack-s3-latest-${{ runner.os }}
+          key: localstack-4.14.0-${{ runner.os }}
      - name: Pull and save Localstack S3 image
        if: matrix.storage == 's3' && steps.s3-cache.outputs.cache-hit != 'true'
        run: |
-          docker pull localstack/localstack:s3-latest
-          docker save localstack/localstack:s3-latest > /tmp/localstack-s3-image.tar
+          docker pull localstack/localstack:4.14.0
+          docker save localstack/localstack:4.14.0 > /tmp/localstack-s3-image.tar
      - name: Load Localstack S3 image
        if: matrix.storage == 's3' && steps.s3-cache.outputs.cache-hit == 'true'
        run: docker load < /tmp/localstack-s3-image.tar

-      - name: Cache AWS CLI Docker image
-        if: matrix.storage == 's3'
-        uses: actions/cache@v4
-        id: aws-cli-cache
-        with:
-          path: /tmp/aws-cli-image.tar
-          key: aws-cli-latest-${{ runner.os }}
-      - name: Pull and save AWS CLI image
-        if: matrix.storage == 's3' && steps.aws-cli-cache.outputs.cache-hit != 'true'
-        run: |
-          docker pull amazon/aws-cli:latest
-          docker save amazon/aws-cli:latest > /tmp/aws-cli-image.tar
-      - name: Load AWS CLI image
-        if: matrix.storage == 's3' && steps.aws-cli-cache.outputs.cache-hit == 'true'
-        run: docker load < /tmp/aws-cli-image.tar
-
-      - name: Download Docker image artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: docker-image
-          path: /tmp
-
-      - name: Load Docker image
-        run: docker load -i /tmp/docker-image.tar
-
      - name: Install test dependencies
        run: pnpm --filter pocket-id-tests install --frozen-lockfile

@@ -198,7 +134,7 @@ jobs:
            DOCKER_COMPOSE_FILE=docker-compose-s3.yml
          fi

-          docker compose -f "$DOCKER_COMPOSE_FILE" up -d
+          docker compose -f "$DOCKER_COMPOSE_FILE" up -d --build

          {
            LOG_FILE="/tmp/backend.log"
@@ -219,7 +155,7 @@ jobs:
        run: pnpm exec playwright test

      - name: Upload Test Report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        if: always() && github.event.pull_request.head.ref != 'i18n_crowdin'
        with:
          name: playwright-report-${{ matrix.db }}-${{ matrix.storage }}
@@ -228,7 +164,7 @@ jobs:
          retention-days: 15

      - name: Upload Backend Test Report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        if: always() && github.event.pull_request.head.ref != 'i18n_crowdin'
        with:
          name: backend-${{ matrix.db }}-${{ matrix.storage }}
--- a/.github/workflows/pr-quality.yml
+++ b/.github/workflows/pr-quality.yml
@@ -42,7 +42,7 @@ jobs:

                  # PR Template Checks
                  require-pr-template: true
-                  strict-pr-template-sections: ""
+                  strict-pr-template-sections: "Contributing Guidelines"
                  optional-pr-template-sections: "Issues"
                  max-additional-pr-template-sections: 3

--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,105 +5,140 @@ on:
    tags:
      - "v*.*.*"

+permissions:
+  contents: write
+  packages: write
+  attestations: write
+  id-token: write
+  artifact-metadata: write
+
 jobs:
  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      packages: write
-      attestations: write
-      id-token: write
+    runs-on: depot-ubuntu-24.04-16
+
+    env:
+      CONTAINER_IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/pocket-id
+
    steps:
      - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
+
      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v5
+
+      - name: Set up Depot CLI
+        uses: depot/setup-action@v1
+
      - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
        with:
          node-version: 24
+          cache: "pnpm"
+
      - uses: actions/setup-go@v6
        with:
          go-version-file: "backend/go.mod"
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Set DOCKER_IMAGE_NAME
-        run: |
-          # Lowercase REPO_OWNER which is required for containers
-          REPO_OWNER=${{ github.repository_owner }}
-          DOCKER_IMAGE_NAME="ghcr.io/${REPO_OWNER,,}/pocket-id"
-          echo "DOCKER_IMAGE_NAME=${DOCKER_IMAGE_NAME}" >>${GITHUB_ENV}
+
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{github.repository_owner}}
          password: ${{secrets.GITHUB_TOKEN}}
+
      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
-            ${{ env.DOCKER_IMAGE_NAME }}
+            ${{ env.CONTAINER_IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}},prefix=v
            type=semver,pattern={{major}}.{{minor}},prefix=v
            type=semver,pattern={{major}},prefix=v
+          labels: |
+            org.opencontainers.image.authors=Pocket ID
+            org.opencontainers.image.url=https://github.com/pocket-id/pocket-id
+            org.opencontainers.image.documentation=https://github.com/pocket-id/pocket-id/blob/main/README.md
+            org.opencontainers.image.source=https://github.com/pocket-id/pocket-id
+            org.opencontainers.image.version=next
+            org.opencontainers.image.licenses=BSD-2-Clause
+            org.opencontainers.image.ref.name=pocket-id
+            org.opencontainers.image.title=Pocket ID
+
      - name: Docker metadata (distroless)
        id: meta-distroless
        uses: docker/metadata-action@v5
        with:
          images: |
-            ${{ env.DOCKER_IMAGE_NAME }}
+            ${{ env.CONTAINER_IMAGE_NAME }}
          flavor: |
            suffix=-distroless,onlatest=true
          tags: |
            type=semver,pattern={{version}},prefix=v
            type=semver,pattern={{major}}.{{minor}},prefix=v
            type=semver,pattern={{major}},prefix=v
+          labels: |
+            org.opencontainers.image.authors=Pocket ID
+            org.opencontainers.image.url=https://github.com/pocket-id/pocket-id
+            org.opencontainers.image.documentation=https://github.com/pocket-id/pocket-id/blob/main/README.md
+            org.opencontainers.image.source=https://github.com/pocket-id/pocket-id
+            org.opencontainers.image.version=next-distroless
+            org.opencontainers.image.licenses=BSD-2-Clause
+            org.opencontainers.image.ref.name=pocket-id
+            org.opencontainers.image.title=Pocket ID
+
      - name: Install frontend dependencies
        run: pnpm --filter pocket-id-frontend install --frozen-lockfile
+
      - name: Build frontend
        run: pnpm --filter pocket-id-frontend build

      - name: Build binaries
        run: sh scripts/development/build-binaries.sh
+
      - name: Build and push container image
-        uses: docker/build-push-action@v6
+        uses: depot/build-push-action@v1
        id: container-build-push
        with:
          context: .
+          file: docker/Dockerfile-prebuilt
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
-          file: docker/Dockerfile-prebuilt
+          sbom: false
+          provenance: true
+
      - name: Build and push container image (distroless)
-        uses: docker/build-push-action@v6
+        uses: depot/build-push-action@v1
        id: container-build-push-distroless
        with:
          context: .
+          file: docker/Dockerfile-distroless
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta-distroless.outputs.tags }}
          labels: ${{ steps.meta-distroless.outputs.labels }}
-          file: docker/Dockerfile-distroless
+          sbom: false
+          provenance: true
+
      - name: Binary attestation
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: "backend/.bin/pocket-id-**"
+
      - name: Container image attestation
        uses: actions/attest-build-provenance@v2
        with:
-          subject-name: "${{ env.DOCKER_IMAGE_NAME }}"
+          subject-name: "${{ env.CONTAINER_IMAGE_NAME }}"
          subject-digest: ${{ steps.container-build-push.outputs.digest }}
          push-to-registry: true
+
      - name: Container image attestation (distroless)
        uses: actions/attest-build-provenance@v2
        with:
-          subject-name: "${{ env.DOCKER_IMAGE_NAME }}"
+          subject-name: "${{ env.CONTAINER_IMAGE_NAME }}"
          subject-digest: ${{ steps.container-build-push-distroless.outputs.digest }}
          push-to-registry: true
      - name: Upload binaries to release
@@ -112,14 +147,12 @@ jobs:
        run: gh release upload ${{ github.ref_name }} backend/.bin/*

  publish-release:
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-latest
    needs: [build]
-    permissions:
-      contents: write
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
      - name: Mark release as published
        run: gh release edit ${{ github.ref_name }} --draft=false
--- a/.github/workflows/svelte-check.yml
+++ b/.github/workflows/svelte-check.yml
@@ -21,28 +21,31 @@ on:
      - "frontend/svelte.config.js"
  workflow_dispatch:

+permissions:
+  contents: read
+  checks: write
+  pull-requests: write
+  id-token: write
+
 jobs:
  type-check:
    name: Run Svelte Check
    # Don't run on dependabot branches
    if: github.actor != 'dependabot[bot]'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      checks: write
-      pull-requests: write
+    runs-on: depot-ubuntu-latest

    steps:
      - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6

      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v5

      - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
        with:
          node-version: 24
+          cache: "pnpm"

      - name: Install dependencies
        run: pnpm --filter pocket-id-frontend install --frozen-lockfile
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -1,22 +1,24 @@
 name: Unit Tests
 on:
  push:
-    branches: [main]
+    branches: [ main ]
    paths:
      - "backend/**"
  pull_request:
-    branches: [main]
+    branches: [ main ]
    paths:
      - "backend/**"

+permissions:
+  contents: read
+  id-token: write
+  actions: write
+
 jobs:
  test-backend:
-    permissions:
-      contents: read
-      actions: write
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version-file: "backend/go.mod"
@@ -30,7 +32,7 @@ jobs:
        run: |
          set -e -o pipefail
          go test -tags=exclude_frontend -v ./... | tee /tmp/TestResults.log
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: backend-unit-tests
--- a/.github/workflows/update-aaguids.yml
+++ b/.github/workflows/update-aaguids.yml
@@ -8,14 +8,15 @@ on:
 permissions:
  contents: write
  pull-requests: write
+  id-token: write

 jobs:
  update-aaguids:
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-latest

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6

      - name: Fetch JSON data
        run: |
--- a/.version
+++ b/.version
@@ -1 +1 @@
-2.6.2
+2.8.0
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,74 @@
+## v2.8.0
+
+### Bug Fixes
+
+- delete refresh tokens on end-session to prevent reuse after logout ([#1458](https://github.com/pocket-id/pocket-id/pull/1458) by @wucm667)
+- return 404 status code for `.well-known` routes if not found ([714b5b3](https://github.com/pocket-id/pocket-id/commit/714b5b3307bb012b94e66e8dcb1de93a2d62eceb) by @stonith404)
+- add `email_verified` to reserved claims list ([8b22fca](https://github.com/pocket-id/pocket-id/commit/8b22fcaaa475984bb4c42306487035073d7c47e3) by @stonith404)
+- reject unknown PKCE code challenge methods ([ce6bdb9](https://github.com/pocket-id/pocket-id/commit/ce6bdb9d7e6c0f1eaaa21ddb6d808e41088a38b8) by @stonith404)
+- make stream of downloaded logos seekable for S3 checksum calculation ([cc9163f](https://github.com/pocket-id/pocket-id/commit/cc9163f577280d7c278dc744e20d0505dbe83ede) by @stonith404)
+- scope confirmation wasn't shown if account selection was prompted ([272d147](https://github.com/pocket-id/pocket-id/commit/272d1479bd64b4a068bfe4dfa5ba4cd3c5e90505) by @stonith404)
+- add support for unix socket mode in healthcheck ([a712196](https://github.com/pocket-id/pocket-id/commit/a71219637af1746e9faba5274b6095da676ec555) by @stonith404)
+- restore cross-platform binary builds ([7027296](https://github.com/pocket-id/pocket-id/commit/7027296632ab82cd9930f2fbe60054c2421688c4) by @stonith404)
+
+### Documentation
+
+- update SECURITY.md ([bb5a111](https://github.com/pocket-id/pocket-id/commit/bb5a111e3d51ad56fc074df7083022e3d4e25369) by @stonith404)
+
+### Features
+
+- delete OAuth refresh token on RP initiated logout ([#1480](https://github.com/pocket-id/pocket-id/pull/1480) by @stonith404)
+- remove EXIF/XMP metadata from uploaded images ([#1477](https://github.com/pocket-id/pocket-id/pull/1477) by @stonith404)
+- add support for `response_mode=fragment` ([0c95b7c](https://github.com/pocket-id/pocket-id/commit/0c95b7c3cc171ed77b51f236009b5ff659da0bec) by @stonith404)
+- add support for systemd socket activation ([#1479](https://github.com/pocket-id/pocket-id/pull/1479) by @deviant)
+- improve design trough the whole application ([b3d40a4](https://github.com/pocket-id/pocket-id/commit/b3d40a476b35cfa2451749e9a3d307b7babaeb6b) by @stonith404)
+
+### Other
+
+- update AAGUIDs ([#1476](https://github.com/pocket-id/pocket-id/pull/1476) by @github-actions[bot])
+- upgrade dependencies ([91c2ea2](https://github.com/pocket-id/pocket-id/commit/91c2ea2a6616a500922365d1789f1fa1ba66c112) by @stonith404)
+- remove deprecated http2 package ([e56dc12](https://github.com/pocket-id/pocket-id/commit/e56dc124cee4d3c176c89e7d574ddfde089bcbd1) by @stonith404)
+- apply go 1.26.0 syntax updated ([8ad95b8](https://github.com/pocket-id/pocket-id/commit/8ad95b8af17ba8cbb62168ed0bb54c87e3df379c) by @stonith404)
+- delete refresh tokens on end-session to prevent reuse after logout ([b27a52a](https://github.com/pocket-id/pocket-id/commit/b27a52a5915228383dbdbf0a2c353452cd351d0f) by @stonith404)
+- use dependabot for automatic dependency upgrades ([b9fdd53](https://github.com/pocket-id/pocket-id/commit/b9fdd530c0f370f2fccb6251d700aa6f9bdf4124) by @stonith404)
+- fix invalid schema ([e8c398f](https://github.com/pocket-id/pocket-id/commit/e8c398ffbd6545f76c983f01556bb3b73d40a728) by @stonith404)
+- update AAGUIDs ([#1487](https://github.com/pocket-id/pocket-id/pull/1487) by @github-actions[bot])
+- use custom Playwright route for callback URL checks ([f134247](https://github.com/pocket-id/pocket-id/commit/f13424720b7f5da3978988f0f9169cf303971a13) by @stonith404)
+- fix linter issues ([bc4f75c](https://github.com/pocket-id/pocket-id/commit/bc4f75c44f12a71380042ad4c140d41f4dddc7dd) by @stonith404)
+- don't compare hashes of profile pictures ([9ad2bfc](https://github.com/pocket-id/pocket-id/commit/9ad2bfc7b30e0eb2d7ae1406874b8caba5a1f121) by @stonith404)
+- run formatter ([0616aba](https://github.com/pocket-id/pocket-id/commit/0616abaf7f079d0a35543258e13aa5b4acb4adc0) by @stonith404)
+- use fixed minor version of Go ([e046a03](https://github.com/pocket-id/pocket-id/commit/e046a03364f00001f8699aaa7e902b33c2661118) by @stonith404)
+
+**Full Changelog**: https://github.com/pocket-id/pocket-id/compare/v2.7.0...v2.8.0
+
+## v2.7.0
+
+### Bug Fixes
+
+- add `_FILE` support for `S3_SECRET_ACCESS_KEY_FILE` env var ([#1452](https://github.com/pocket-id/pocket-id/pull/1452) by @ItalyPaleAle)
+- invalidate cache when changing image ([#1462](https://github.com/pocket-id/pocket-id/pull/1462) by @GameTec-live)
+- fall back to Basic auth when PKCE puts client_id in body ([#1466](https://github.com/pocket-id/pocket-id/pull/1466) by @mgabor3141)
+
+### Documentation
+
+- add missing /api prefix to app config swagger routes ([#1454](https://github.com/pocket-id/pocket-id/pull/1454) by @aclerici38)
+
+### Features
+
+- add support for response_mode=form_post ([#1360](https://github.com/pocket-id/pocket-id/pull/1360) by @Johnwulp)
+- add support for "select_account" prompt ([#1453](https://github.com/pocket-id/pocket-id/pull/1453) by @ItalyPaleAle)
+
+### Other
+
+- add script to update deps ([f9f93f0](https://github.com/pocket-id/pocket-id/commit/f9f93f0ef164426d4d4cfb58fcf59ce30b686130) by @stonith404)
+- upgrade dependencies ([20df033](https://github.com/pocket-id/pocket-id/commit/20df033c1fc3d737927447206b4f5e65d3ab4a40) by @stonith404)
+- post dependency upgrade fixes ([e33a9b8](https://github.com/pocket-id/pocket-id/commit/e33a9b8c888988f7b2e6c500e72d53b57db01f34) by @stonith404)
+- migrate github actions runners to depot  runners ([#1329](https://github.com/pocket-id/pocket-id/pull/1329) by @kmendell)
+- fix caching of ldap-cli e2e tests docker build ([#1457](https://github.com/pocket-id/pocket-id/pull/1457) by @kmendell)
+- fix incorrect container name variable ([5c7e5f6](https://github.com/pocket-id/pocket-id/commit/5c7e5f680bb70d3056b11f1a33669cc4bd9a1e17) by @kmendell)
+
+**Full Changelog**: https://github.com/pocket-id/pocket-id/compare/v2.6.2...v2.7.0
+
 ## v2.6.2

 ### Bug Fixes
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,12 +1,35 @@
 # Contributing

-I am happy that you want to contribute to Pocket ID and help to make it better! All contributions are welcome, including issues, suggestions, pull requests and more.
+We are happy that you want to contribute to Pocket ID and help to make it better!
+
+## Before you start
+
+Before starting to work on a new feature, please open an issue first, or comment on an existing one, to discuss the implementation details. This saves you time and avoids the disappointment of having a PR closed later because the change doesn't fit the project's direction.
+
+### AI Usage Policy
+
+We have nothing against using AI tools to assist your development. But we've seen a growing number of pull requests that appear to be fully or largely AI-generated and submitted without genuine human review. These are difficult and time-consuming for maintainers to review, and they often waste everyone's time.
+
+To keep contributions reviewable and high-quality, please follow these guidelines when using AI tools.
+
+#### Guidelines for Using AI Tools
+
+1. **Understand every line.** You must be able to explain what your code does and why, in your own words. "The AI wrote it" is not an acceptable answer to a reviewer's question.
+2. **Test before submitting.** Review and test all code manually, as a human, before opening a PR. Don't trust the AI's claim that it works.
+3. **Write your own words.** Don't paste AI-generated text into issues, comments, or PR descriptions. Walls of generated text make discussions harder, not easier.
+4. **Disclose your usage.** Note in the PR description how you used AI (see below).
+
+PRs that appear to be low effort AI output may be closed without a detailed review.
+
+#### Example disclosure
+
+> Used GitHub Copilot for autocomplete, and asked an LLM to help draft the test cases in `parser_test.go`. I reviewed, edited, and tested everything myself and understand how it works.
+
+> Used an LLM to generate the initial implementation of the new API endpoint, but I manually reviewed and tested it before submitting.

 ## Getting started

-You've found a bug, have suggestion or something else, just create an issue on GitHub and we can get in touch.
-
-## Submit a Pull Request
+### Submit a Pull Request

 Before you submit the pull request for review please ensure that

@@ -29,15 +52,15 @@ Before you submit the pull request for review please ensure that
 - Your pull request has a detailed description
 - You run `pnpm format` to format the code

-## Development Environment
+### Development Environment

 Pocket ID consists of a frontend and backend. In production the frontend gets statically served by the backend, but in development they run as separate processes to enable hot reloading.

 There are two ways to get the development environment setup:

-### 1. Install required tools
+#### 1. Install required tools

-#### With Dev Containers
+##### With Dev Containers

 If you use [Dev Containers](https://code.visualstudio.com/docs/remote/containers) in VS Code, you don't need to install anything manually, just follow the steps below.

@@ -46,7 +69,7 @@ If you use [Dev Containers](https://code.visualstudio.com/docs/remote/containers
 3. VS Code will detect .devcontainer and will prompt you to open the folder in devcontainer
 4. If the auto prompt does not work, hit `F1` and select `Dev Containers: Open Folder in Container.`, then select the pocket-id repo root folder and it'll open in container.

-#### Without Dev Containers
+##### Without Dev Containers

 If you don't use Dev Containers, you need to install the following tools manually:

@@ -54,9 +77,9 @@ If you don't use Dev Containers, you need to install the following tools manuall
 - [Go](https://golang.org/doc/install) >= 1.26
 - [Git](https://git-scm.com/downloads)

-### 2. Setup
+#### 2. Setup

-#### Backend
+##### Backend

 The backend is built with [Gin](https://gin-gonic.com) and written in Go. To set it up, follow these steps:

@@ -64,7 +87,7 @@ The backend is built with [Gin](https://gin-gonic.com) and written in Go. To set
 2. Copy the `.env.development-example` file to `.env` and edit the variables as needed
 3. Start the backend with `go run -tags exclude_frontend ./cmd`

-### Frontend
+##### Frontend

 The frontend is built with [SvelteKit](https://kit.svelte.dev) and written in TypeScript. To set it up, follow these steps:

@@ -77,9 +100,13 @@ You're all set! The application is now listening on `localhost:3000`. The backen

 ### Testing

+If you are contributing to a new feature please ensure that you add tests for it.
+
+#### End-to-end tests
+
 We are using [Playwright](https://playwright.dev) for end-to-end testing.

-If you are contributing to a new feature please ensure that you add tests for it. The tests are located in the `tests` folder at the root of the project.
+The tests are located in the `tests` folder at the root of the project.

 The tests can be run like this:

@@ -93,3 +120,9 @@ The tests can be run like this:
 5. Run the tests with `pnpm dlx playwright test` or from the root project folder `pnpm test`

 If you make any changes to the application, you have to rebuild the test environment by running `docker compose up -d --build` again.
+
+#### Unit tests
+
+In the backend we are using unit tests with the built-in Go testing framework. The tests are located in the same folder as the code they are testing and have the `_test.go` suffix.
+
+To run the tests, simply run `go test ./...` from the root of the `backend` folder.
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -2,8 +2,11 @@

 ## Supported Versions

-As Pocket ID is in its early stages, older versions don't get security updates. Please consider to update Pocket ID regularly. Updates can be automated with e.g [Watchtower](https://github.com/containrrr/watchtower).
+It's recommended to always use the latest version of Pocket ID. We will provide security updates for the latest version.
+
+> [!NOTE]  
+> Updates can be automated with e.g [Watchtower](https://github.com/nicholas-fedor/watchtower/). Upgrading between non major versions is safe but you shouldn't upgrade between major versions before checking the release notes.

 ## Reporting a Vulnerability

-Thank you for taking the time to report a vulnerability. Please DO NOT create an issue on GitHub because the vulnerability could get exploited. Instead please write an email to [elias@eliasschneider.com](mailto:elias@eliasschneider.com).
+Thank you for taking the time to report a vulnerability. Please DO NOT create an issue on GitHub because the vulnerability could get exploited. Instead please create a Security Advisory [here](https://github.com/pocket-id/pocket-id/security/advisories/new). You can learn more about how to report a vulnerability in the [GitHub Security Advisories documentation](https://docs.github.com/en/code-security/security-advisories/creating-a-security-advisory).
--- a/backend/.env.development-example
+++ b/backend/.env.development-example
@@ -6,4 +6,7 @@ APP_ENV=development
 # In the development environment the backend gets proxied by the frontend
 APP_URL=http://localhost:3000
 PORT=1411
-MAXMIND_LICENSE_KEY=your_license_key
+MAXMIND_LICENSE_KEY=your_license_key
+
+# Set the ENCRYPTION_KEY to a random sequence of characters, for example generated with `openssl rand -base64 32`
+ENCRYPTION_KEY=
--- a/backend/frontend/frontend_excluded.go
+++ b/backend/frontend/frontend_excluded.go
@@ -2,8 +2,11 @@

 package frontend

-import "github.com/gin-gonic/gin"
+import (
+	"github.com/gin-gonic/gin"
+	"github.com/pocket-id/pocket-id/backend/internal/service"
+)

-func RegisterFrontend(router *gin.Engine, rateLimitMiddleware gin.HandlerFunc) error {
+func RegisterFrontend(router *gin.Engine, oidcService *service.OidcService) error {
 	return ErrFrontendNotIncluded
 }
--- a/backend/frontend/frontend_included.go
+++ b/backend/frontend/frontend_included.go
@@ -10,13 +10,14 @@ import (
 	"io/fs"
 	"mime"
 	"net/http"
-	"os"
 	"path"
 	"strings"
 	"time"

 	"github.com/gin-gonic/gin"
 	"github.com/pocket-id/pocket-id/backend/internal/middleware"
+	"github.com/pocket-id/pocket-id/backend/internal/service"
+	"golang.org/x/time/rate"
 )

 //go:embed all:dist/*
@@ -54,7 +55,7 @@ func init() {
 	}
 }

-func RegisterFrontend(router *gin.Engine, rateLimitMiddleware gin.HandlerFunc) error {
+func RegisterFrontend(router *gin.Engine, oidcService *service.OidcService) error {
 	distFS, err := fs.Sub(frontendFS, "dist")
 	if err != nil {
 		return fmt.Errorf("failed to create sub FS: %w", err)
@@ -78,21 +79,27 @@ func RegisterFrontend(router *gin.Engine, rateLimitMiddleware gin.HandlerFunc) e
 			return
 		}

-		if strings.HasPrefix(path, "api/") {
+		if strings.HasPrefix(path, "api/") || strings.HasPrefix(path, ".well-known/") {
 			c.JSON(http.StatusNotFound, gin.H{"error": "API endpoint not found"})
 			return
 		}

-		// If path is / or does not exist, serve index.html
-		if path == "" {
-			path = "index.html"
-		} else if _, err := fs.Stat(distFS, path); os.IsNotExist(err) {
-			path = "index.html"
-		}
-
-		if path == "index.html" {
+		if isSPARequest(path, distFS) {
 			nonce := middleware.GetCSPNonce(c)

+			// For an authorization request that responds via response_mode=form_post, the
+			// consent page auto-submits a form to the client's callback, so that callback
+			// must be allowed in the CSP form-action directive
+			isAuthPostRequest, redirectURI := isOAuth2AuthorizationPostRequest(c, oidcService)
+			if isAuthPostRequest {
+				clientID := c.Query("client_id")
+				// In that case, we need to validate and allow form submissions to the redirect_uri
+				validatedRedirectURI, err := oidcService.ResolveAllowedCallbackURL(c.Request.Context(), clientID, redirectURI)
+				if err == nil {
+					c.Header("Content-Security-Policy", middleware.BuildCSP(nonce, validatedRedirectURI))
+				}
+			}
+
 			// Do not cache the HTML shell, as it embeds a per-request nonce
 			c.Header("Content-Type", "text/html; charset=utf-8")
 			c.Header("Cache-Control", "no-store")
@@ -108,11 +115,67 @@ func RegisterFrontend(router *gin.Engine, rateLimitMiddleware gin.HandlerFunc) e
 		fileServer.ServeHTTP(c.Writer, c.Request)
 	}

-	router.NoRoute(rateLimitMiddleware, handler)
+	rateLimitMiddleware := middleware.NewRateLimitMiddleware().Add(rate.Every(300*time.Millisecond), 50)
+	router.NoRoute(rateLimitOnlyForOAuth2AuthorizationPostRequest(rateLimitMiddleware, oidcService, distFS), handler)

 	return nil
 }

+func rateLimitOnlyForOAuth2AuthorizationPostRequest(rateLimitMiddleware gin.HandlerFunc, oidcService *service.OidcService, distFS fs.FS) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		path := strings.TrimPrefix(c.Request.URL.Path, "/")
+
+		if isSPARequest(path, distFS) {
+			isAuthPostRequest, _ := isOAuth2AuthorizationPostRequest(c, oidcService)
+			if isAuthPostRequest {
+				rateLimitMiddleware(c)
+				return
+			}
+		}
+
+		c.Next()
+	}
+}
+
+// isOAuth2AuthorizationRequest checks if this is an OAuth2 authorization request with response_mode=form_post
+// In that case, we need to validate and allow form submissions to the redirect_uri
+func isOAuth2AuthorizationPostRequest(c *gin.Context, oidcService *service.OidcService) (bool, string) {
+	responseMode := c.Query("response_mode")
+	redirectURI := c.Query("redirect_uri")
+	clientID := c.Query("client_id")
+	requestUri := c.Query("request_uri")
+
+	if c.Request.URL.Path != "/authorize" {
+		return false, ""
+	}
+
+	if requestUri != "" && clientID != "" {
+		par, err := oidcService.GetPushedAuthorizationRequest(c.Request.Context(), clientID, requestUri)
+		if err != nil {
+			return false, ""
+		}
+
+		responseMode = par.Parameters.ResponseMode
+		redirectURI = par.Parameters.RedirectURI
+
+	}
+
+	ok := responseMode == "form_post" && redirectURI != "" && clientID != ""
+	return ok, redirectURI
+}
+
+func isSPARequest(path string, distFS fs.FS) bool {
+	if path == "" {
+		return true
+	}
+
+	if _, err := fs.Stat(distFS, path); err != nil {
+		return true
+	}
+
+	return false
+}
+
 // FileServerWithCaching wraps http.FileServer to add caching headers
 type FileServerWithCaching struct {
 	root                    http.FileSystem
--- a/backend/frontend/frontend_included_test.go
+++ b/backend/frontend/frontend_included_test.go
@@ -0,0 +1,137 @@
+//go:build !exclude_frontend
+
+package frontend
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"testing/fstest"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIsSPARequest(t *testing.T) {
+	distFS := fstest.MapFS{
+		"assets/app.js": &fstest.MapFile{Data: []byte("console.log('test')")},
+	}
+
+	t.Run("root path is spa request", func(t *testing.T) {
+		assert.True(t, isSPARequest("", distFS))
+	})
+
+	t.Run("existing bundled asset is not spa request", func(t *testing.T) {
+		assert.False(t, isSPARequest("assets/app.js", distFS))
+	})
+
+	t.Run("unknown path is spa request", func(t *testing.T) {
+		assert.True(t, isSPARequest("authorize", distFS))
+	})
+}
+
+func TestRateLimitOnlyForOAuth2AuthorizationPostRequest(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+
+	distFS := fstest.MapFS{
+		"assets/app.js": &fstest.MapFile{Data: []byte("console.log('test')")},
+	}
+
+	t.Run("rate limits spa form_post request", func(t *testing.T) {
+		rateLimited := false
+		nextCalled := false
+		middleware := rateLimitOnlyForOAuth2AuthorizationPostRequest(func(c *gin.Context) {
+			rateLimited = true
+			c.Abort()
+		}, nil, distFS)
+
+		router := gin.New()
+		router.NoRoute(
+			middleware,
+			func(c *gin.Context) {
+				nextCalled = true
+			},
+		)
+
+		recorder := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, "/authorize?response_mode=form_post&client_id=test&redirect_uri=https://example.com/callback", nil)
+		router.ServeHTTP(recorder, req)
+
+		assert.True(t, rateLimited)
+		assert.False(t, nextCalled)
+	})
+
+	t.Run("does not rate limit page request with no form_post params", func(t *testing.T) {
+		rateLimited := false
+		nextCalled := false
+		middleware := rateLimitOnlyForOAuth2AuthorizationPostRequest(func(c *gin.Context) {
+			rateLimited = true
+			c.Abort()
+		}, nil, distFS)
+
+		router := gin.New()
+		router.NoRoute(
+			middleware,
+			func(c *gin.Context) {
+				nextCalled = true
+			},
+		)
+
+		recorder := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, "/authorize", nil)
+		router.ServeHTTP(recorder, req)
+
+		assert.False(t, rateLimited)
+		assert.True(t, nextCalled)
+	})
+
+	t.Run("does not rate limit static asset request with form_post params", func(t *testing.T) {
+		rateLimited := false
+		nextCalled := false
+		middleware := rateLimitOnlyForOAuth2AuthorizationPostRequest(func(c *gin.Context) {
+			rateLimited = true
+			c.Abort()
+		}, nil, distFS)
+
+		router := gin.New()
+		router.NoRoute(
+			middleware,
+			func(c *gin.Context) {
+				nextCalled = true
+			},
+		)
+
+		recorder := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, "/assets/app.js?response_mode=form_post&client_id=test&redirect_uri=https://example.com/callback", nil)
+		router.ServeHTTP(recorder, req)
+
+		assert.False(t, rateLimited)
+		assert.True(t, nextCalled)
+	})
+
+	t.Run("does not rate limit non-authorize spa path with form_post params", func(t *testing.T) {
+		rateLimited := false
+		nextCalled := false
+		// oidcService is nil: a non-/authorize path is rejected by the path guard
+		// before the request_uri branch that would dereference it.
+		middleware := rateLimitOnlyForOAuth2AuthorizationPostRequest(func(c *gin.Context) {
+			rateLimited = true
+			c.Abort()
+		}, nil, distFS)
+
+		router := gin.New()
+		router.NoRoute(
+			middleware,
+			func(c *gin.Context) {
+				nextCalled = true
+			},
+		)
+
+		recorder := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, "/settings?response_mode=form_post&client_id=test&redirect_uri=https://example.com/callback", nil)
+		router.ServeHTTP(recorder, req)
+
+		assert.False(t, rateLimited)
+		assert.True(t, nextCalled)
+	})
+}
--- a/backend/go.mod
+++ b/backend/go.mod
@@ -1,43 +1,45 @@
 module github.com/pocket-id/pocket-id/backend

-go 1.26.0
+go 1.26

 require (
-	github.com/aws/aws-sdk-go-v2 v1.41.5
-	github.com/aws/aws-sdk-go-v2/config v1.32.14
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.14
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0
-	github.com/aws/smithy-go v1.24.3
-	github.com/caarlos0/env/v11 v11.4.0
+	github.com/aws/aws-sdk-go-v2 v1.41.7
+	github.com/aws/aws-sdk-go-v2/config v1.32.17
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.16
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0
+	github.com/aws/smithy-go v1.25.1
+	github.com/caarlos0/env/v11 v11.4.1
 	github.com/cenkalti/backoff/v5 v5.0.3
+	github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
 	github.com/disintegration/imageorient v0.0.0-20180920195336-8147d86e83ec
 	github.com/disintegration/imaging v1.6.2
 	github.com/dunglas/go-urlpattern v0.0.0-20241020164140-716dfa1c80b1
 	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6
 	github.com/emersion/go-smtp v0.24.0
-	github.com/fsnotify/fsnotify v1.8.0
+	github.com/fsnotify/fsnotify v1.10.1
 	github.com/gin-contrib/slog v1.2.1
 	github.com/gin-gonic/gin v1.12.0
 	github.com/glebarez/go-sqlite v1.22.0
 	github.com/glebarez/sqlite v1.11.0
-	github.com/go-co-op/gocron/v2 v2.20.0
+	github.com/go-co-op/gocron/v2 v2.21.1
 	github.com/go-ldap/ldap/v3 v3.4.13
 	github.com/go-playground/validator/v10 v10.30.2
-	github.com/go-webauthn/webauthn v0.16.4
+	github.com/go-webauthn/webauthn v0.17.3
 	github.com/golang-migrate/migrate/v4 v4.19.1
 	github.com/google/uuid v1.6.0
 	github.com/hashicorp/go-uuid v1.0.3
 	github.com/jinzhu/copier v0.4.0
 	github.com/joho/godotenv v1.5.1
 	github.com/lestrrat-go/httprc/v3 v3.0.5
-	github.com/lestrrat-go/jwx/v3 v3.0.13
+	github.com/lestrrat-go/jwx/v3 v3.1.1
 	github.com/lmittmann/tint v1.1.3
-	github.com/mattn/go-isatty v0.0.21
+	github.com/mattn/go-isatty v0.0.22
 	github.com/mileusna/useragent v1.3.5
 	github.com/orandin/slog-gorm v1.4.0
-	github.com/oschwald/maxminddb-golang/v2 v2.1.1
+	github.com/oschwald/maxminddb-golang/v2 v2.2.0
 	github.com/spf13/cobra v1.10.2
 	github.com/stretchr/testify v1.11.1
+	github.com/zitadel/exifremove v0.1.0
 	go.opentelemetry.io/contrib/bridges/otelslog v0.18.0
 	go.opentelemetry.io/contrib/exporters/autoexport v0.68.0
 	go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin v0.68.0
@@ -49,11 +51,10 @@ require (
 	go.opentelemetry.io/otel/sdk/log v0.19.0
 	go.opentelemetry.io/otel/sdk/metric v1.43.0
 	go.opentelemetry.io/otel/trace v1.43.0
-	golang.org/x/crypto v0.50.0
-	golang.org/x/image v0.39.0
-	golang.org/x/net v0.53.0
+	golang.org/x/crypto v0.51.0
+	golang.org/x/image v0.40.0
 	golang.org/x/sync v0.20.0
-	golang.org/x/text v0.36.0
+	golang.org/x/text v0.37.0
 	golang.org/x/time v0.15.0
 	gorm.io/driver/postgres v1.6.0
 	gorm.io/gorm v1.31.1
@@ -61,20 +62,19 @@ require (

 require (
 	github.com/Azure/go-ntlmssp v0.1.0 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.21 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.0.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.30.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.19 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.41.10 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.23 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.0.11 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.30.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.42.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bits-and-blooms/bitset v1.24.4 // indirect
 	github.com/bytedance/gopkg v0.1.4 // indirect
@@ -85,25 +85,37 @@ require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
 	github.com/disintegration/gift v1.2.1 // indirect
+	github.com/dsoprea/go-exif v0.0.0-20230826092837-6579e82b732d // indirect
+	github.com/dsoprea/go-exif/v2 v2.0.0-20230826092837-6579e82b732d // indirect
+	github.com/dsoprea/go-iptc v0.0.0-20200610044640-bc9ca208b413 // indirect
+	github.com/dsoprea/go-jpeg-image-structure v0.0.0-20221012074422-4f3f7e934102 // indirect
+	github.com/dsoprea/go-logging v0.0.0-20200710184922-b02d349568dd // indirect
+	github.com/dsoprea/go-photoshop-info-format v0.0.0-20200610045659-121dd752914d // indirect
+	github.com/dsoprea/go-png-image-structure v0.0.0-20210512210324-29b889a6093d // indirect
+	github.com/dsoprea/go-utility v0.0.0-20221003172846-a3e1774ef349 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.2 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
 	github.com/gin-contrib/sse v1.1.1 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
+	github.com/go-errors/errors v1.5.1 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
-	github.com/go-webauthn/x v0.2.3 // indirect
+	github.com/go-webauthn/x v0.2.5 // indirect
+	github.com/go-xmlfmt/xmlfmt v1.1.3 // indirect
 	github.com/goccy/go-json v0.10.6 // indirect
 	github.com/goccy/go-yaml v1.19.2 // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
+	github.com/golang/geo v0.0.0-20250319145452-ed1c8b99c3d7 // indirect
 	github.com/google/go-github/v39 v39.2.0 // indirect
 	github.com/google/go-querystring v1.2.0 // indirect
 	github.com/google/go-tpm v0.9.8 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
+	github.com/h2non/filetype v1.1.3 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
@@ -141,7 +153,7 @@ require (
 	github.com/robfig/cron/v3 v3.0.1 // indirect
 	github.com/segmentio/asm v1.2.1 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
-	github.com/tinylib/msgp v1.6.3 // indirect
+	github.com/tinylib/msgp v1.6.4 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.3.1 // indirect
 	github.com/valyala/fastjson v1.6.10 // indirect
@@ -164,12 +176,14 @@ require (
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	golang.org/x/arch v0.26.0 // indirect
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
+	golang.org/x/net v0.54.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/sys v0.44.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260406210006-6f92a3bedf2d // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d // indirect
 	google.golang.org/grpc v1.80.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	modernc.org/libc v1.71.0 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
--- a/backend/go.sum
+++ b/backend/go.sum
@@ -6,44 +6,42 @@ github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERo
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e h1:4dAU9FXIyQktpoUAgOJK3OTFc/xug0PCXYCqU0FgDKI=
 github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
-github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV/yY=
-github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 h1:eBMB84YGghSocM7PsjmmPffTa+1FBUeNvGvFou6V/4o=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8/go.mod h1:lyw7GFp3qENLh7kwzf7iMzAxDn+NzjXEAGjKS2UOKqI=
-github.com/aws/aws-sdk-go-v2/config v1.32.14 h1:opVIRo/ZbbI8OIqSOKmpFaY7IwfFUOCCXBsUpJOwDdI=
-github.com/aws/aws-sdk-go-v2/config v1.32.14/go.mod h1:U4/V0uKxh0Tl5sxmCBZ3AecYny4UNlVmObYjKuuaiOo=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.14 h1:n+UcGWAIZHkXzYt87uMFBv/l8THYELoX6gVcUvgl6fI=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.14/go.mod h1:cJKuyWB59Mqi0jM3nFYQRmnHVQIcgoxjEMAbLkpr62w=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.21 h1:NUS3K4BTDArQqNu2ih7yeDLaS3bmHD0YndtA6UP884g=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.21/go.mod h1:YWNWJQNjKigKY1RHVJCuupeWDrrHjRqHm0N9rdrWzYI=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 h1:Rgg6wvjjtX8bNHcvi9OnXWwcE0a2vGpbwmtICOsvcf4=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21/go.mod h1:A/kJFst/nm//cyqonihbdpQZwiUhhzpqTsdbhDdRF9c=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 h1:PEgGVtPoB6NTpPrBgqSE5hE/o47Ij9qk/SEZFbUOe9A=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21/go.mod h1:p+hz+PRAYlY3zcpJhPwXlLC4C+kqn70WIHwnzAfs6ps=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 h1:qYQ4pzQ2Oz6WpQ8T3HvGHnZydA72MnLuFK9tJwmrbHw=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6/go.mod h1:O3h0IK87yXci+kg6flUKzJnWeziQUKciKrLjcatSNcY=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 h1:rWyie/PxDRIdhNf4DzRk0lvjVOqFJuNnO8WwaIRVxzQ=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22/go.mod h1:zd/JsJ4P7oGfUhXn1VyLqaRZwPmZwg44Jf2dS84Dm3Y=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 h1:JRaIgADQS/U6uXDqlPiefP32yXTda7Kqfx+LgspooZM=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13/go.mod h1:CEuVn5WqOMilYl+tbccq8+N2ieCy0gVn3OtRb0vBNNM=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 h1:c31//R3xgIJMSC8S6hEVq+38DcvUlgFY0FM6mSI5oto=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21/go.mod h1:r6+pf23ouCB718FUxaqzZdbpYFyDtehyZcmP5KL9FkA=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 h1:ZlvrNcHSFFWURB8avufQq9gFsheUgjVD9536obIknfM=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21/go.mod h1:cv3TNhVrssKR0O/xxLJVRfd2oazSnZnkUeTf6ctUwfQ=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0 h1:hlSuz394kV0vhv9drL5lhuEFbEOEP1VyQpy15qWh1Pk=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0/go.mod h1:uoA43SdFwacedBfSgfFSjjCvYe8aYBS7EnU5GZ/YKMM=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.9 h1:QKZH0S178gCmFEgst8hN0mCX1KxLgHBKKY/CLqwP8lg=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.9/go.mod h1:7yuQJoT+OoH8aqIxw9vwF+8KpvLZ8AWmvmUWHsGQZvI=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.15 h1:lFd1+ZSEYJZYvv9d6kXzhkZu07si3f+GQ1AaYwa2LUM=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.15/go.mod h1:WSvS1NLr7JaPunCXqpJnWk1Bjo7IxzZXrZi1QQCkuqM=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.19 h1:dzztQ1YmfPrxdrOiuZRMF6fuOwWlWpD2StNLTceKpys=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.19/go.mod h1:YO8TrYtFdl5w/4vmjL8zaBSsiNp3w0L1FfKVKenZT7w=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.10 h1:p8ogvvLugcR/zLBXTXrTkj0RYBUdErbMnAFFp12Lm/U=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.10/go.mod h1:60dv0eZJfeVXfbT1tFJinbHrDfSJ2GZl4Q//OSSNAVw=
-github.com/aws/smithy-go v1.24.3 h1:XgOAaUgx+HhVBoP4v8n6HCQoTRDhoMghKqw4LNHsDNg=
-github.com/aws/smithy-go v1.24.3/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/aws-sdk-go-v2 v1.41.7 h1:DWpAJt66FmnnaRIOT/8ASTucrvuDPZASqhhLey6tLY8=
+github.com/aws/aws-sdk-go-v2 v1.41.7/go.mod h1:4LAfZOPHNVNQEckOACQx60Y8pSRjIkNZQz1w92xpMJc=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 h1:gx1AwW1Iyk9Z9dD9F4akX5gnN3QZwUB20GGKH/I+Rho=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10/go.mod h1:qqY157uZoqm5OXq/amuaBJyC9hgBCBQnsaWnPe905GY=
+github.com/aws/aws-sdk-go-v2/config v1.32.17 h1:FpL4/758/diKwqbytU0prpuiu60fgXKUWCpDJtApclU=
+github.com/aws/aws-sdk-go-v2/config v1.32.17/go.mod h1:OXqUMzgXytfoF9JaKkhrOYsyh72t9G+MJH8mMRaexOE=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.16 h1:r3RJBuU7X9ibt8RHbMjWE6y60QbKBiII6wSrXnapxSU=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.16/go.mod h1:6cx7zqDENJDbBIIWX6P8s0h6hqHC8Avbjh9Dseo27ug=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23 h1:UuSfcORqNSz/ey3VPRS8TcVH2Ikf0/sC+Hdj400QI6U=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23/go.mod h1:+G/OSGiOFnSOkYloKj/9M35s74LgVAdJBSD5lsFfqKg=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 h1:GpT/TrnBYuE5gan2cZbTtvP+JlHsutdmlV2YfEyNde0=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23/go.mod h1:xYWD6BS9ywC5bS3sz9Xh04whO/hzK2plt2Zkyrp4JuA=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 h1:bpd8vxhlQi2r1hiueOw02f/duEPTMK59Q4QMAoTTtTo=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23/go.mod h1:15DfR2nw+CRHIk0tqNyifu3G1YdAOy68RftkhMDDwYk=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 h1:OQqn11BtaYv1WLUowvcA30MpzIu8Ti4pcLPIIyoKZrA=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24/go.mod h1:X5ZJyfwVrWA96GzPmUCWFQaEARPR7gCrpq2E92PJwAE=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 h1:FLudkZLt5ci0ozzgkVo8BJGwvqNaZbTWb3UcucAateA=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9/go.mod h1:w7wZ/s9qK7c8g4al+UyoF1Sp/Z45UwMGcqIzLWVQHWk=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.15 h1:ieLCO1JxUWuxTZ1cRd0GAaeX7O6cIxnwk7tc1LsQhC4=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.15/go.mod h1:e3IzZvQ3kAWNykvE0Tr0RDZCMFInMvhku3qNpcIQXhM=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 h1:pbrxO/kuIwgEsOPLkaHu0O+m4fNgLU8B3vxQ+72jTPw=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23/go.mod h1:/CMNUqoj46HpS3MNRDEDIwcgEnrtZlKRaHNaHxIFpNA=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.23 h1:03xatSQO4+AM1lTAbnRg5OK528EUg744nW7F73U8DKw=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.23/go.mod h1:M8l3mwgx5ToK7wot2sBBce/ojzgnPzZXUV445gTSyE8=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0 h1:etqBTKY581iwLL/H/S2sVgk3C9lAsTJFeXWFDsDcWOU=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0/go.mod h1:L2dcoOgS2VSgbPLvpak2NyUPsO1TBN7M45Z4H7DlRc4=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.11 h1:TdJ+HdzOBhU8+iVAOGUTU63VXopcumCOF1paFulHWZc=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.11/go.mod h1:R82ZRExE/nheo0N+T8zHPcLRTcH8MGsnR3BiVGX0TwI=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.17 h1:7byT8HUWrgoRp6sXjxtZwgOKfhss5fW6SkLBtqzgRoE=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.17/go.mod h1:xNWknVi4Ezm1vg1QsB/5EWpAJURq22uqd38U8qKvOJc=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21 h1:+1Kl1zx6bWi4X7cKi3VYh29h8BvsCoHQEQ6ST9X8w7w=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21/go.mod h1:4vIRDq+CJB2xFAXZ+YgGUTiEft7oAQlhIs71xcSeuVg=
+github.com/aws/aws-sdk-go-v2/service/sts v1.42.1 h1:F/M5Y9I3nwr2IEpshZgh1GeHpOItExNM9L1euNuh/fk=
+github.com/aws/aws-sdk-go-v2/service/sts v1.42.1/go.mod h1:mTNxImtovCOEEuD65mKW7DCsL+2gjEH+RPEAexAzAio=
+github.com/aws/smithy-go v1.25.1 h1:J8ERsGSU7d+aCmdQur5Txg6bVoYelvQJgtZehD12GkI=
+github.com/aws/smithy-go v1.25.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bits-and-blooms/bitset v1.20.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
@@ -55,8 +53,8 @@ github.com/bytedance/sonic v1.15.0 h1:/PXeWFaR5ElNcVE84U0dOHjiMHQOwNIx3K4ymzh/uS
 github.com/bytedance/sonic v1.15.0/go.mod h1:tFkWrPz0/CUCLEF4ri4UkHekCIcdnkqXw9VduqpJh0k=
 github.com/bytedance/sonic/loader v0.5.1 h1:Ygpfa9zwRCCKSlrp5bBP/b/Xzc3VxsAW+5NIYXrOOpI=
 github.com/bytedance/sonic/loader v0.5.1/go.mod h1:AR4NYCk5DdzZizZ5djGqQ92eEhCCcdf5x77udYiSJRo=
-github.com/caarlos0/env/v11 v11.4.0 h1:Kcb6t5kIIr4XkoQC9AF2j+8E1Jsrl3Wz/hhm1LtoGAc=
-github.com/caarlos0/env/v11 v11.4.0/go.mod h1:qupehSf/Y0TUTsxKywqRt/vJjN5nz6vauiYEUUr8P4U=
+github.com/caarlos0/env/v11 v11.4.1 h1:fYwH0sWEsBSMPG7t4e/PEfTFzrWrpjyygXyUnWiSwEw=
+github.com/caarlos0/env/v11 v11.4.1/go.mod h1:qupehSf/Y0TUTsxKywqRt/vJjN5nz6vauiYEUUr8P4U=
 github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
@@ -67,6 +65,8 @@ github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG
 github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
 github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
+github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf h1:iW4rZ826su+pqaw19uhpSCzhj44qo35pNgKFGqzDKkU=
+github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -91,6 +91,32 @@ github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj
 github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/dsoprea/go-exif v0.0.0-20230826092837-6579e82b732d h1:ygcRCGNKuEiA98k7X35hknEN8RIRUF1jrz7k1rZCvsk=
+github.com/dsoprea/go-exif v0.0.0-20230826092837-6579e82b732d/go.mod h1:lOaOt7+UEppOgyvRy749v3do836U/hw0YVJNjoyPaEs=
+github.com/dsoprea/go-exif/v2 v2.0.0-20200321225314-640175a69fe4/go.mod h1:Lm2lMM2zx8p4a34ZemkaUV95AnMl4ZvLbCUbwOvLC2E=
+github.com/dsoprea/go-exif/v2 v2.0.0-20200604193436-ca8584a0e1c4/go.mod h1:9EXlPeHfblFFnwu5UOqmP2eoZfJyAZ2Ri/Vki33ajO0=
+github.com/dsoprea/go-exif/v2 v2.0.0-20230826092837-6579e82b732d h1:yeH8wrJa3+8uKKDAdURHUK1ds2UvKhMqX2MiOdVeKPs=
+github.com/dsoprea/go-exif/v2 v2.0.0-20230826092837-6579e82b732d/go.mod h1:oKrjk2kb3rAR5NbtSTLUMvMSbc+k8ZosI3MaVH47noc=
+github.com/dsoprea/go-exif/v3 v3.0.0-20200717053412-08f1b6708903/go.mod h1:0nsO1ce0mh5czxGeLo4+OCZ/C6Eo6ZlMWsz7rH/Gxv8=
+github.com/dsoprea/go-exif/v3 v3.0.0-20210512043655-120bcdb2a55e/go.mod h1:cg5SNYKHMmzxsr9X6ZeLh/nfBRHHp5PngtEPcujONtk=
+github.com/dsoprea/go-iptc v0.0.0-20200609062250-162ae6b44feb/go.mod h1:kYIdx9N9NaOyD7U6D+YtExN7QhRm+5kq7//yOsRXQtM=
+github.com/dsoprea/go-iptc v0.0.0-20200610044640-bc9ca208b413 h1:YDRiMEm32T60Kpm35YzOK9ZHgjsS1Qrid+XskNcsdp8=
+github.com/dsoprea/go-iptc v0.0.0-20200610044640-bc9ca208b413/go.mod h1:kYIdx9N9NaOyD7U6D+YtExN7QhRm+5kq7//yOsRXQtM=
+github.com/dsoprea/go-jpeg-image-structure v0.0.0-20221012074422-4f3f7e934102 h1:P1dsxzctGkmG6Zf7gH2xrZhNXWP5/FuLDI7xbCGsWTo=
+github.com/dsoprea/go-jpeg-image-structure v0.0.0-20221012074422-4f3f7e934102/go.mod h1:6+tQXZ+I62x13UZ+hemLVoZIuq/usVzvau7bqwUo9P0=
+github.com/dsoprea/go-logging v0.0.0-20190624164917-c4f10aab7696/go.mod h1:Nm/x2ZUNRW6Fe5C3LxdY1PyZY5wmDv/s5dkPJ/VB3iA=
+github.com/dsoprea/go-logging v0.0.0-20200517223158-a10564966e9d/go.mod h1:7I+3Pe2o/YSU88W0hWlm9S22W7XI1JFNJ86U0zPKMf8=
+github.com/dsoprea/go-logging v0.0.0-20200710184922-b02d349568dd h1:l+vLbuxptsC6VQyQsfD7NnEC8BZuFpz45PgY+pH8YTg=
+github.com/dsoprea/go-logging v0.0.0-20200710184922-b02d349568dd/go.mod h1:7I+3Pe2o/YSU88W0hWlm9S22W7XI1JFNJ86U0zPKMf8=
+github.com/dsoprea/go-photoshop-info-format v0.0.0-20200609050348-3db9b63b202c/go.mod h1:pqKB+ijp27cEcrHxhXVgUUMlSDRuGJJp1E+20Lj5H0E=
+github.com/dsoprea/go-photoshop-info-format v0.0.0-20200610045659-121dd752914d h1:dg6UMHa50VI01WuPWXPbNJpO8QSyvIF5T5n2IZiqX3A=
+github.com/dsoprea/go-photoshop-info-format v0.0.0-20200610045659-121dd752914d/go.mod h1:pqKB+ijp27cEcrHxhXVgUUMlSDRuGJJp1E+20Lj5H0E=
+github.com/dsoprea/go-png-image-structure v0.0.0-20210512210324-29b889a6093d h1:8+qI8ant/vZkNSsbwSjIR6XJfWcDVTg/qx/3pRUUZNA=
+github.com/dsoprea/go-png-image-structure v0.0.0-20210512210324-29b889a6093d/go.mod h1:yTR3tKgyk20phAFg6IE9ulMA5NjEDD2wyx+okRFLVtw=
+github.com/dsoprea/go-utility v0.0.0-20200711062821-fab8125e9bdf/go.mod h1:95+K3z2L0mqsVYd6yveIv1lmtT3tcQQ3dVakPySffW8=
+github.com/dsoprea/go-utility v0.0.0-20221003172846-a3e1774ef349 h1:/py11NlxDaOxkT9OKN+gXgT+QOH5xj1ZRoyusfRIlo4=
+github.com/dsoprea/go-utility v0.0.0-20221003172846-a3e1774ef349/go.mod h1:KVK+/Hul09ujXAGq+42UBgCTnXkiJZRnLYdURGjQUwo=
+github.com/dsoprea/go-utility/v2 v2.0.0-20200717064901-2fccff4aa15e/go.mod h1:uAzdkPTub5Y9yQwXe8W4m2XuP0tK4a9Q/dantD0+uaU=
 github.com/dunglas/go-urlpattern v0.0.0-20241020164140-716dfa1c80b1 h1:RW22Y3QjGrb97NUA8yupdFcaqg//+hMI2fZrETBvQ4s=
 github.com/dunglas/go-urlpattern v0.0.0-20241020164140-716dfa1c80b1/go.mod h1:mnVcdqOeYg0HvT6veRo7wINa1mJ+lC/R4ig2lWcapSI=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
@@ -101,10 +127,10 @@ github.com/emersion/go-smtp v0.24.0 h1:g6AfoF140mvW0vLNPD/LuCBLEAdlxOjIXqbIkJIS6
 github.com/emersion/go-smtp v0.24.0/go.mod h1:ZtRRkbTyp2XTHCA+BmyTFTrj8xY4I+b4McvHxCU2gsQ=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
-github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
-github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
+github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
+github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78=
+github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM=
 github.com/gabriel-vasile/mimetype v1.4.13/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/gin-contrib/slog v1.2.1 h1:tQbsmllW/PNgtvHRdVlI38jLfpN4IFLS7Pb4HgTeiYw=
@@ -119,8 +145,13 @@ github.com/glebarez/sqlite v1.11.0 h1:wSG0irqzP6VurnMEpFGer5Li19RpIRi2qvQz++w0GM
 github.com/glebarez/sqlite v1.11.0/go.mod h1:h8/o8j5wiAsqSPoWELDUdJXhjAhsVliSn7bWZjOhrgQ=
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
-github.com/go-co-op/gocron/v2 v2.20.0 h1:9IMrnnVSWjfSh3E54gWmWCHbloQJLh6f9+nwyKfLNpc=
-github.com/go-co-op/gocron/v2 v2.20.0/go.mod h1:5lEiCKk1oVJV39Zg7/YG10OnaVrDAV5GGR6O0663k6U=
+github.com/go-co-op/gocron/v2 v2.21.1 h1:QYOK6iOQVCut+jDcs4zRdWRTBHRxRCEeeFi1TnAmgbU=
+github.com/go-co-op/gocron/v2 v2.21.1/go.mod h1:5lEiCKk1oVJV39Zg7/YG10OnaVrDAV5GGR6O0663k6U=
+github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
+github.com/go-errors/errors v1.0.2/go.mod h1:psDX2osz5VnTOnFWbDeWwS7yejl+uV3FEWEp4lssFEs=
+github.com/go-errors/errors v1.1.1/go.mod h1:psDX2osz5VnTOnFWbDeWwS7yejl+uV3FEWEp4lssFEs=
+github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
+github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-ldap/ldap/v3 v3.4.13 h1:+x1nG9h+MZN7h/lUi5Q3UZ0fJ1GyDQYbPvbuH38baDQ=
 github.com/go-ldap/ldap/v3 v3.4.13/go.mod h1:LxsGZV6vbaK0sIvYfsv47rfh4ca0JXokCoKjZxsszv0=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -138,10 +169,13 @@ github.com/go-playground/validator/v10 v10.30.2 h1:JiFIMtSSHb2/XBUbWM4i/MpeQm9ZK
 github.com/go-playground/validator/v10 v10.30.2/go.mod h1:mAf2pIOVXjTEBrwUMGKkCWKKPs9NheYGabeB04txQSc=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
-github.com/go-webauthn/webauthn v0.16.4 h1:R9jqR/cYZa7hRquFF7Za/8qoH/K/TIs1/Q/4CyGN+1Q=
-github.com/go-webauthn/webauthn v0.16.4/go.mod h1:SU2ljAgToTV/YLPI0C05QS4qn+e04WpB5g1RMfcZfS4=
-github.com/go-webauthn/x v0.2.3 h1:8oArS+Rc1SWFLXhE17KZNx258Z4kUSyaDgsSncCO5RA=
-github.com/go-webauthn/x v0.2.3/go.mod h1:tM04GF3V6VYq79AZMl7vbj4q6pz9r7L2criWRzbWhPk=
+github.com/go-webauthn/webauthn v0.17.3 h1:XHZ0TXV7k8vChcE4TFgPitOPJ5cb7h1dpAeFDS0cjCo=
+github.com/go-webauthn/webauthn v0.17.3/go.mod h1:PlkMgmuL9McCT7dvgBj/Sz/fgs3V6ZID6/KnFkEcPvQ=
+github.com/go-webauthn/x v0.2.5 h1:wEVTfU04XFyPTXGQbKOQwMKhcDWfDAkdsDDBsDaG9yY=
+github.com/go-webauthn/x v0.2.5/go.mod h1:Qna/yJz9rV6lRzwl5BfYbmTJpVGxcBIds3gJtw2tlGg=
+github.com/go-xmlfmt/xmlfmt v0.0.0-20191208150333-d5b6f63a941b/go.mod h1:aUCEOzzezBEjDBbFBoSiya/gduyIiWYRP6CnSFIV8AM=
+github.com/go-xmlfmt/xmlfmt v1.1.3 h1:t8Ey3Uy7jDSEisW2K3somuMKIpzktkWptA0iFCnRUWY=
+github.com/go-xmlfmt/xmlfmt v1.1.3/go.mod h1:aUCEOzzezBEjDBbFBoSiya/gduyIiWYRP6CnSFIV8AM=
 github.com/goccy/go-json v0.10.6 h1:p8HrPJzOakx/mn/bQtjgNjdTcN+/S6FcG2CTtQOrHVU=
 github.com/goccy/go-json v0.10.6/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
@@ -152,6 +186,10 @@ github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63Y
 github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang-migrate/migrate/v4 v4.19.1 h1:OCyb44lFuQfYXYLx1SCxPZQGU7mcaZ7gH9yH4jSFbBA=
 github.com/golang-migrate/migrate/v4 v4.19.1/go.mod h1:CTcgfjxhaUtsLipnLoQRWCrjYXycRz/g5+RWDuYgPrE=
+github.com/golang/geo v0.0.0-20190916061304-5b978397cfec/go.mod h1:QZ0nwyI2jOfgRAoBvP+ab5aRr7c9x7lhGEJrKvBwjWI=
+github.com/golang/geo v0.0.0-20200319012246-673a6f80352d/go.mod h1:QZ0nwyI2jOfgRAoBvP+ab5aRr7c9x7lhGEJrKvBwjWI=
+github.com/golang/geo v0.0.0-20250319145452-ed1c8b99c3d7 h1:kG/6mhO8OwbQrA/0XEPwKJs3D3jG0m1rNH/ZRKDA/pQ=
+github.com/golang/geo v0.0.0-20250319145452-ed1c8b99c3d7/go.mod h1:J+F9/3Ofc8ysEOY2/cNjxTMl2eB1gvPIywEHUplPgDA=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
@@ -177,6 +215,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c=
+github.com/h2non/filetype v1.1.3 h1:FKkx9QbD7HR/zjK1Ia5XiBsq9zdLi5Kf3zGyFTAFkGg=
+github.com/h2non/filetype v1.1.3/go.mod h1:319b3zT68BvV+WRj7cwy856M2ehB3HqNOt6sy1HndBY=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
@@ -203,6 +243,7 @@ github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh6
 github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
 github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
 github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
+github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
 github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
@@ -237,16 +278,16 @@ github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZ
 github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E=
 github.com/lestrrat-go/httprc/v3 v3.0.5 h1:S+Mb4L2I+bM6JGTibLmxExhyTOqnXjqx+zi9MoXw/TM=
 github.com/lestrrat-go/httprc/v3 v3.0.5/go.mod h1:mSMtkZW92Z98M5YoNNztbRGxbXHql7tSitCvaxvo9l0=
-github.com/lestrrat-go/jwx/v3 v3.0.13 h1:AdHKiPIYeCSnOJtvdpipPg/0SuFh9rdkN+HF3O0VdSk=
-github.com/lestrrat-go/jwx/v3 v3.0.13/go.mod h1:2m0PV1A9tM4b/jVLMx8rh6rBl7F6WGb3EG2hufN9OQU=
+github.com/lestrrat-go/jwx/v3 v3.1.1 h1:yd9AdPmZ4INnQ7k42IrzXYpnEG803+SrQ6hdMvzHJzw=
+github.com/lestrrat-go/jwx/v3 v3.1.1/go.mod h1:uw/MN2M/Xiu4FhwcIwH11Zsh9JWx9SWzgALl7/uIEkU=
 github.com/lestrrat-go/option/v2 v2.0.0 h1:XxrcaJESE1fokHy3FpaQ/cXW8ZsIdWcdFzzLOcID3Ss=
 github.com/lestrrat-go/option/v2 v2.0.0/go.mod h1:oSySsmzMoR0iRzCDCaUfsCzxQHUEuhOViQObyy7S6Vg=
 github.com/lib/pq v1.12.3 h1:tTWxr2YLKwIvK90ZXEw8GP7UFHtcbTtty8zsI+YjrfQ=
 github.com/lib/pq v1.12.3/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
 github.com/lmittmann/tint v1.1.3 h1:Hv4EaHWXQr+GTFnOU4VKf8UvAtZgn0VuKT+G0wFlO3I=
 github.com/lmittmann/tint v1.1.3/go.mod h1:HIS3gSy7qNwGCj+5oRjAutErFBl4BzdQP6cJZ0NfMwE=
-github.com/mattn/go-isatty v0.0.21 h1:xYae+lCNBP7QuW4PUnNG61ffM4hVIfm+zUzDuSzYLGs=
-github.com/mattn/go-isatty v0.0.21/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
+github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
+github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
 github.com/mattn/go-sqlite3 v1.14.42 h1:MigqEP4ZmHw3aIdIT7T+9TLa90Z6smwcthx+Azv4Cgo=
 github.com/mattn/go-sqlite3 v1.14.42/go.mod h1:pjEuOr8IwzLJP2MfGeTb0A35jauH+C2kbHKBr7yXKVQ=
 github.com/mileusna/useragent v1.3.5 h1:SJM5NzBmh/hO+4LGeATKpaEX9+b4vcGg2qXGLiNGDws=
@@ -274,8 +315,8 @@ github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQ
 github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
 github.com/orandin/slog-gorm v1.4.0 h1:FgA8hJufF9/jeNSYoEXmHPPBwET2gwlF3B85JdpsTUU=
 github.com/orandin/slog-gorm v1.4.0/go.mod h1:MoZ51+b7xE9lwGNPYEhxcUtRNrYzjdcKvA8QXQQGEPA=
-github.com/oschwald/maxminddb-golang/v2 v2.1.1 h1:lA8FH0oOrM4u7mLvowq8IT6a3Q/qEnqRzLQn9eH5ojc=
-github.com/oschwald/maxminddb-golang/v2 v2.1.1/go.mod h1:PLdx6PR+siSIoXqqy7C7r3SB3KZnhxWr1Dp6g0Hacl8=
+github.com/oschwald/maxminddb-golang/v2 v2.2.0 h1:/2khmIiNvFxgfwGxitper3XBJBs5qTCPQ/H1iR9MgBw=
+github.com/oschwald/maxminddb-golang/v2 v2.2.0/go.mod h1:n/ctYVTFYQypkn5uO1CZnTmj8jdQKIVh/LX7gSaIl0w=
 github.com/pelletier/go-toml/v2 v2.3.0 h1:k59bC/lIZREW0/iVaQR8nDHxVq8OVlIzYCOJf421CaM=
 github.com/pelletier/go-toml/v2 v2.3.0/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
@@ -325,8 +366,8 @@ github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXl
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/tinylib/msgp v1.6.3 h1:bCSxiTz386UTgyT1i0MSCvdbWjVW+8sG3PjkGsZQt4s=
-github.com/tinylib/msgp v1.6.3/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
+github.com/tinylib/msgp v1.6.4 h1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ=
+github.com/tinylib/msgp v1.6.4/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
 github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY=
@@ -336,6 +377,8 @@ github.com/valyala/fastjson v1.6.10/go.mod h1:e6FubmQouUNP73jtMLmcbxS6ydWIpOfhz3
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/zitadel/exifremove v0.1.0 h1:qD50ezWsfeeqfcvs79QyyjVfK+snN12v0U0deaU8aKg=
+github.com/zitadel/exifremove v0.1.0/go.mod h1:rzKJ3woL/Rz2KthVBiSBKIBptNTvgmk9PLaeUKTm+ek=
 go.mongodb.org/mongo-driver/v2 v2.5.0 h1:yXUhImUjjAInNcpTcAlPHiT7bIXhshCTL3jVBkF3xaE=
 go.mongodb.org/mongo-driver/v2 v2.5.0/go.mod h1:yOI9kBsufol30iFsl1slpdq1I0eHPzybRWdyYUs8K/0=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
@@ -408,13 +451,13 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
-golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
-golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
+golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.39.0 h1:skVYidAEVKgn8lZ602XO75asgXBgLj9G/FE3RbuPFww=
-golang.org/x/image v0.39.0/go.mod h1:sIbmppfU+xFLPIG0FoVUTvyBMmgng1/XAMhQ2ft0hpA=
+golang.org/x/image v0.40.0 h1:Tw4GyDXMo+daZN1znreBRC3VayR1aLFUyUEOLUdW1a8=
+golang.org/x/image v0.40.0/go.mod h1:uIc348UZMSvS5Z65CVZ7iDPaNobNFEPeJ4kbqTOszmA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
@@ -424,6 +467,11 @@ golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
 golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200320220750-118fecf932d8/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
@@ -432,8 +480,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
-golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
-golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
+golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
@@ -447,6 +495,7 @@ golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -457,8 +506,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
+golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -478,8 +527,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -506,6 +555,10 @@ google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
--- a/backend/internal/bootstrap/router_bootstrap.go
+++ b/backend/internal/bootstrap/router_bootstrap.go
@@ -9,7 +9,6 @@ import (
 	"net"
 	"net/http"
 	"os"
-	"strconv"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -19,8 +18,6 @@ import (
 	sloggin "github.com/gin-contrib/slog"
 	"github.com/gin-gonic/gin"
 	"go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin"
-	"golang.org/x/net/http2"
-	"golang.org/x/net/http2/h2c"
 	"golang.org/x/time/rate"
 	"gorm.io/gorm"

@@ -40,7 +37,10 @@ func initRouter(db *gorm.DB, svc *services) (utils.Service, error) {
 	if err != nil {
 		return nil, err
 	}
-	registerRoutes(r, db, svc)
+	err = registerRoutes(r, db, svc)
+	if err != nil {
+		return nil, err
+	}

 	serverConfig, err := initServer(r)
 	if err != nil {
@@ -70,15 +70,6 @@ func initEngine() (*gin.Engine, error) {
 	configureEngine(r)
 	registerGlobalMiddleware(r)

-	frontendRateLimitMiddleware := middleware.NewRateLimitMiddleware().Add(rate.Every(100*time.Millisecond), 300)
-	if err := frontend.RegisterFrontend(r, frontendRateLimitMiddleware); err != nil {
-		if errors.Is(err, frontend.ErrFrontendNotIncluded) {
-			slog.Warn("Frontend is not included in the build. Skipping frontend registration.")
-			return r, nil
-		}
-		return nil, fmt.Errorf("failed to register frontend: %w", err)
-	}
-
 	return r, nil
 }

@@ -116,7 +107,16 @@ func registerGlobalMiddleware(r *gin.Engine) {
 	r.Use(middleware.NewErrorHandlerMiddleware().Add())
 }

-func registerRoutes(r *gin.Engine, db *gorm.DB, svc *services) {
+func registerRoutes(r *gin.Engine, db *gorm.DB, svc *services) error {
+
+	err := frontend.RegisterFrontend(r, svc.oidcService)
+	if errors.Is(err, frontend.ErrFrontendNotIncluded) {
+		slog.Warn("Frontend is not included in the build. Skipping frontend registration.")
+	} else if err != nil {
+		return fmt.Errorf("failed to register frontend: %w", err)
+	}
+
+	// Initialize middleware for specific routes
 	authMiddleware := middleware.NewAuthMiddleware(svc.apiKeyService, svc.userService, svc.jwtService)
 	fileSizeLimitMiddleware := middleware.NewFileSizeLimitMiddleware()
 	apiRateLimitMiddleware := middleware.NewRateLimitMiddleware().Add(rate.Every(time.Second), 100)
@@ -142,6 +142,8 @@ func registerRoutes(r *gin.Engine, db *gorm.DB, svc *services) {

 	// These are not rate-limited.
 	controller.NewHealthzController(r)
+
+	return nil
 }

 func registerTestRoutes(apiGroup *gin.RouterGroup, db *gorm.DB, svc *services) {
@@ -160,24 +162,26 @@ func initServer(r *gin.Engine) (*serverConfig, error) {
 		return nil, err
 	}

-	network, addr := listenerNetworkAndAddr()
-	listener, err := net.Listen(network, addr) //nolint:noctx
-	if err != nil {
-		return nil, fmt.Errorf("failed to create %s listener: %w", network, err)
+	var socketFn func() (*socket, error)
+	switch {
+	case common.EnvConfig.SystemdSocket:
+		socketFn = systemdSocket
+	case common.EnvConfig.UnixSocket != "":
+		socketFn = unixSocket
+	default:
+		socketFn = tcpSocket
 	}

-	if err := setUnixSocketMode(network, addr); err != nil {
-		listener.Close()
+	socket, err := socketFn()
+	if err != nil {
 		return nil, err
 	}

-	return &serverConfig{
-		addr:         addr,
-		certProvider: certProvider,
-		listener:     listener,
-		server:       newHTTPServer(r, protocols),
-		tlsConfig:    tlsConfig,
-	}, nil
+	addr := socket.addr
+	listener := socket.listener
+	server := newHTTPServer(r, protocols)
+
+	return &serverConfig{addr, certProvider, listener, server, tlsConfig}, nil
 }

 func initServerProtocols() (*http.Protocols, *tls.Config, *tlsCertProvider, error) {
@@ -210,7 +214,7 @@ func newHTTPServer(r *gin.Engine, protocols *http.Protocols) *http.Server {
 		MaxHeaderBytes:    1 << 20,
 		ReadHeaderTimeout: 10 * time.Second,
 		Protocols:         protocols,
-		Handler: h2c.NewHandler(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		Handler: http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
 			// HEAD requests don't get matched by Gin routes, so we convert them to GET
 			// middleware.HeadMiddleware will convert them back to HEAD later
 			if req.Method == http.MethodHead {
@@ -220,37 +224,10 @@ func newHTTPServer(r *gin.Engine, protocols *http.Protocols) *http.Server {
 			}

 			r.ServeHTTP(w, req)
-		}), &http2.Server{}),
+		}),
 	}
 }

-func listenerNetworkAndAddr() (string, string) {
-	if common.EnvConfig.UnixSocket == "" {
-		return "tcp", net.JoinHostPort(common.EnvConfig.Host, common.EnvConfig.Port)
-	}
-
-	addr := common.EnvConfig.UnixSocket
-	os.Remove(addr) // remove dangling the socket file to avoid file-exist error
-	return "unix", addr
-}
-
-func setUnixSocketMode(network, addr string) error {
-	if network != "unix" || common.EnvConfig.UnixSocketMode == "" {
-		return nil
-	}
-
-	mode, err := strconv.ParseUint(common.EnvConfig.UnixSocketMode, 8, 32)
-	if err != nil {
-		return fmt.Errorf("failed to parse UNIX socket mode '%s': %w", common.EnvConfig.UnixSocketMode, err)
-	}
-
-	if err := os.Chmod(addr, os.FileMode(mode)); err != nil {
-		return fmt.Errorf("failed to set UNIX socket mode '%s': %w", common.EnvConfig.UnixSocketMode, err)
-	}
-
-	return nil
-}
-
 func runServer(ctx context.Context, config *serverConfig) error {
 	slog.Info("Server listening", slog.String("addr", config.addr), slog.Bool("tls", config.tlsConfig != nil))

--- a/backend/internal/bootstrap/socket.go
+++ b/backend/internal/bootstrap/socket.go
@@ -0,0 +1,51 @@
+package bootstrap
+
+import (
+	"fmt"
+	"net"
+	"os"
+	"strconv"
+
+	"github.com/pocket-id/pocket-id/backend/internal/common"
+)
+
+type socket struct {
+	addr     string
+	listener net.Listener
+}
+
+func unixSocket() (*socket, error) {
+	addr := common.EnvConfig.UnixSocket
+	os.Remove(addr) // remove dangling the socket file to avoid file-exist error
+
+	listener, err := net.Listen("unix", addr) //nolint:noctx
+	if err != nil {
+		return nil, fmt.Errorf("failed to create UNIX socket: %w", err)
+	}
+
+	if common.EnvConfig.UnixSocketMode != "" {
+		mode, err := strconv.ParseUint(common.EnvConfig.UnixSocketMode, 8, 32)
+		if err != nil {
+			listener.Close()
+			return nil, fmt.Errorf("failed to parse UNIX socket mode '%s': %w", common.EnvConfig.UnixSocketMode, err)
+		}
+
+		if err := os.Chmod(addr, os.FileMode(mode)); err != nil {
+			listener.Close()
+			return nil, fmt.Errorf("failed to set UNIX socket mode '%s': %w", common.EnvConfig.UnixSocketMode, err)
+		}
+	}
+
+	return &socket{addr, listener}, nil
+}
+
+func tcpSocket() (*socket, error) {
+	addr := net.JoinHostPort(common.EnvConfig.Host, common.EnvConfig.Port)
+
+	listener, err := net.Listen("tcp", addr) //nolint:noctx
+	if err != nil {
+		return nil, fmt.Errorf("failed to create TCP socket: %w", err)
+	}
+
+	return &socket{addr, listener}, nil
+}
--- a/backend/internal/bootstrap/systemd_socket_linux.go
+++ b/backend/internal/bootstrap/systemd_socket_linux.go
@@ -0,0 +1,27 @@
+//go:build linux
+
+package bootstrap
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/coreos/go-systemd/activation"
+)
+
+func systemdSocket() (*socket, error) {
+	listeners, err := activation.Listeners()
+	if err != nil {
+		return nil, fmt.Errorf("failed to receive socket from systemd: %w", err)
+	}
+
+	if len(listeners) == 0 {
+		return nil, errors.New("did not receive any sockets from systemd")
+	}
+
+	if len(listeners) > 1 {
+		return nil, errors.New("received too many sockets from systemd")
+	}
+
+	return &socket{"(systemd)", listeners[0]}, nil
+}
--- a/backend/internal/bootstrap/systemd_socket_nonlinux.go
+++ b/backend/internal/bootstrap/systemd_socket_nonlinux.go
@@ -0,0 +1,9 @@
+//go:build !linux
+
+package bootstrap
+
+import "errors"
+
+func systemdSocket() (*socket, error) {
+	return nil, errors.New("systemd socket activation is only supported on Linux")
+}
--- a/backend/internal/cmds/healthcheck.go
+++ b/backend/internal/cmds/healthcheck.go
@@ -2,9 +2,12 @@ package cmds

 import (
 	"context"
+	"fmt"
 	"log/slog"
+	"net"
 	"net/http"
 	"os"
+	"strings"
 	"time"

 	"github.com/spf13/cobra"
@@ -13,8 +16,14 @@ import (
 )

 type healthcheckFlags struct {
-	Endpoint string
-	Verbose  bool
+	Endpoint   string
+	UnixSocket string
+	Verbose    bool
+}
+
+type healthcheckResult struct {
+	StatusCode int
+	URL        string
 }

 func init() {
@@ -29,47 +38,26 @@ func init() {
 			ctx, cancel := context.WithTimeout(cmd.Context(), 5*time.Second)
 			defer cancel()

-			url := flags.Endpoint + "/healthz"
-			req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+			if flags.UnixSocket == "" && !cmd.Flags().Changed("endpoint") {
+				flags.UnixSocket = common.EnvConfig.UnixSocket
+			}
+
+			result, err := healthcheck(ctx, flags)
 			if err != nil {
 				slog.ErrorContext(ctx,
-					"Failed to create request object",
+					"Healthcheck failed",
 					"error", err,
-					"url", url,
 					"ms", time.Since(start).Milliseconds(),
 				)
 				os.Exit(1)
 			}

-			res, err := http.DefaultClient.Do(req)
-			if err != nil {
-				slog.ErrorContext(ctx,
-					"Failed to perform request",
-					"error", err,
-					"url", url,
-					"ms", time.Since(start).Milliseconds(),
-				)
-				os.Exit(1)
-			}
-			defer res.Body.Close()
-
-			if res.StatusCode < 200 || res.StatusCode >= 300 {
-				if err != nil {
-					slog.ErrorContext(ctx,
-						"Healthcheck failed",
-						"status", res.StatusCode,
-						"url", url,
-						"ms", time.Since(start).Milliseconds(),
-					)
-					os.Exit(1)
-				}
-			}
-
 			if flags.Verbose {
 				slog.InfoContext(ctx,
 					"Healthcheck succeeded",
-					"status", res.StatusCode,
-					"url", url,
+					"status", result.StatusCode,
+					"url", result.URL,
+					"unixSocket", flags.UnixSocket,
 					"ms", time.Since(start).Milliseconds(),
 				)
 			}
@@ -77,7 +65,42 @@ func init() {
 	}

 	healthcheckCmd.Flags().StringVarP(&flags.Endpoint, "endpoint", "e", "http://localhost:"+common.EnvConfig.Port, "Endpoint for Pocket ID")
+	healthcheckCmd.Flags().StringVar(&flags.UnixSocket, "unix-socket", "", "UNIX socket path for Pocket ID")
 	healthcheckCmd.Flags().BoolVarP(&flags.Verbose, "verbose", "v", false, "Enable verbose mode")

 	rootCmd.AddCommand(healthcheckCmd)
 }
+
+func healthcheck(ctx context.Context, flags healthcheckFlags) (*healthcheckResult, error) {
+	url := strings.TrimRight(flags.Endpoint, "/") + "/healthz"
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request object for %q: %w", url, err)
+	}
+
+	client := http.DefaultClient
+	if flags.UnixSocket != "" {
+		transport := http.DefaultTransport.(*http.Transport).Clone()
+		transport.Proxy = nil
+		transport.DialContext = func(ctx context.Context, network, addr string) (net.Conn, error) {
+			dialer := net.Dialer{}
+			return dialer.DialContext(ctx, "unix", flags.UnixSocket)
+		}
+		client = &http.Client{Transport: transport}
+	}
+
+	res, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to perform request to %q: %w", url, err)
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode < 200 || res.StatusCode >= 300 {
+		return nil, fmt.Errorf("unexpected status %d from %q", res.StatusCode, url)
+	}
+
+	return &healthcheckResult{
+		StatusCode: res.StatusCode,
+		URL:        url,
+	}, nil
+}
--- a/backend/internal/cmds/healthcheck_test.go
+++ b/backend/internal/cmds/healthcheck_test.go
@@ -0,0 +1,79 @@
+package cmds
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestHealthcheckTCPSuccess(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/healthz", r.URL.Path)
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	defer server.Close()
+
+	result, err := healthcheck(t.Context(), healthcheckFlags{
+		Endpoint: server.URL,
+	})
+
+	require.NoError(t, err)
+	require.Equal(t, http.StatusNoContent, result.StatusCode)
+	require.Equal(t, server.URL+"/healthz", result.URL)
+}
+
+func TestHealthcheckFailsOnUnexpectedStatus(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer server.Close()
+
+	_, err := healthcheck(t.Context(), healthcheckFlags{
+		Endpoint: server.URL,
+	})
+
+	require.Error(t, err)
+	require.ErrorContains(t, err, "unexpected status 500")
+}
+
+func TestHealthcheckUnixSocket(t *testing.T) {
+	socketPath := filepath.Join(t.TempDir(), "pocket-id.sock")
+	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "unix", socketPath)
+	require.NoError(t, err)
+
+	server := &http.Server{
+		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, "/healthz", r.URL.Path)
+			w.WriteHeader(http.StatusNoContent)
+		}),
+		ReadHeaderTimeout: time.Second,
+	}
+
+	errCh := make(chan error, 1)
+	go func() {
+		errCh <- server.Serve(listener)
+	}()
+
+	t.Cleanup(func() {
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		require.NoError(t, server.Shutdown(ctx))
+		require.ErrorIs(t, <-errCh, http.ErrServerClosed)
+	})
+
+	result, err := healthcheck(t.Context(), healthcheckFlags{
+		Endpoint:   "http://localhost:1411",
+		UnixSocket: socketPath,
+	})
+
+	require.NoError(t, err)
+	require.Equal(t, http.StatusNoContent, result.StatusCode)
+	require.Equal(t, "http://localhost:1411/healthz", result.URL)
+}
--- a/backend/internal/common/env_config.go
+++ b/backend/internal/common/env_config.go
@@ -60,7 +60,7 @@ type EnvConfigSchema struct {
 	S3Region                        string `env:"S3_REGION"`
 	S3Endpoint                      string `env:"S3_ENDPOINT"`
 	S3AccessKeyID                   string `env:"S3_ACCESS_KEY_ID"`
-	S3SecretAccessKey               string `env:"S3_SECRET_ACCESS_KEY"`
+	S3SecretAccessKey               string `env:"S3_SECRET_ACCESS_KEY" options:"file"`
 	S3ForcePathStyle                bool   `env:"S3_FORCE_PATH_STYLE"`
 	S3DisableDefaultIntegrityChecks bool   `env:"S3_DISABLE_DEFAULT_INTEGRITY_CHECKS"`

@@ -68,6 +68,7 @@ type EnvConfigSchema struct {
 	Host            string `env:"HOST" options:"toLower"`
 	UnixSocket      string `env:"UNIX_SOCKET"`
 	UnixSocketMode  string `env:"UNIX_SOCKET_MODE"`
+	SystemdSocket   bool   `env:"SYSTEMD_SOCKET"`
 	LocalIPv6Ranges string `env:"LOCAL_IPV6_RANGES"`

 	TLSCertFile string `env:"TLS_CERT" options:"file"`
@@ -153,6 +154,9 @@ func ValidateEnvConfig(config *EnvConfigSchema) error {
 	if err := validateFileBackend(config); err != nil {
 		return err
 	}
+	if config.SystemdSocket && config.UnixSocket != "" {
+		return errors.New("SYSTEMD_SOCKET and UNIX_SOCKET are mutually exclusive")
+	}
 	if err := validateLocalIPv6Ranges(config.LocalIPv6Ranges); err != nil {
 		return err
 	}
--- a/backend/internal/common/errors.go
+++ b/backend/internal/common/errors.go
@@ -8,21 +8,28 @@ import (

 type AppError interface {
 	error
+
 	HttpStatusCode() int
 }

+type AppErrorDescription interface {
+	AppError
+
+	Description() string
+}
+
 // Custom error types for various conditions

 type AlreadyInUseError struct {
 	Property string
 }

-func (e *AlreadyInUseError) Error() string {
+func (e AlreadyInUseError) Error() string {
 	return e.Property + " is already in use"
 }
-func (e *AlreadyInUseError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e AlreadyInUseError) HttpStatusCode() int { return http.StatusBadRequest }

-func (e *AlreadyInUseError) Is(target error) bool {
+func (e AlreadyInUseError) Is(target error) bool {
 	// Ignore the field property when checking if an error is of the type AlreadyInUseError
 	x := &AlreadyInUseError{}
 	return errors.As(target, &x)
@@ -30,445 +37,380 @@ func (e *AlreadyInUseError) Is(target error) bool {

 type SetupNotAvailableError struct{}

-func (e *SetupNotAvailableError) Error() string       { return "not found" }
-func (e *SetupNotAvailableError) HttpStatusCode() int { return http.StatusNotFound }
+func (e SetupNotAvailableError) Error() string       { return "not found" }
+func (e SetupNotAvailableError) HttpStatusCode() int { return http.StatusNotFound }

 type TokenInvalidOrExpiredError struct{}

-func (e *TokenInvalidOrExpiredError) Error() string       { return "token is invalid or expired" }
-func (e *TokenInvalidOrExpiredError) HttpStatusCode() int { return http.StatusUnauthorized }
+func (e TokenInvalidOrExpiredError) Error() string       { return "token is invalid or expired" }
+func (e TokenInvalidOrExpiredError) HttpStatusCode() int { return http.StatusUnauthorized }

 type DeviceCodeInvalid struct{}

-func (e *DeviceCodeInvalid) Error() string {
+func (e DeviceCodeInvalid) Error() string {
 	return "one time access code must be used on the device it was generated for"
 }
-func (e *DeviceCodeInvalid) HttpStatusCode() int { return http.StatusUnauthorized }
+func (e DeviceCodeInvalid) HttpStatusCode() int { return http.StatusUnauthorized }

 type TokenInvalidError struct{}

-func (e *TokenInvalidError) Error() string {
-	return "Token is invalid"
-}
-func (e *TokenInvalidError) HttpStatusCode() int { return http.StatusUnauthorized }
+func (e TokenInvalidError) Error() string       { return "Token is invalid" }
+func (e TokenInvalidError) HttpStatusCode() int { return http.StatusUnauthorized }

 type OidcMissingAuthorizationError struct{}

-func (e *OidcMissingAuthorizationError) Error() string       { return "missing authorization" }
-func (e *OidcMissingAuthorizationError) HttpStatusCode() int { return http.StatusForbidden }
+func (e OidcMissingAuthorizationError) Error() string       { return "missing authorization" }
+func (e OidcMissingAuthorizationError) HttpStatusCode() int { return http.StatusForbidden }

 type OidcGrantTypeNotSupportedError struct{}

-func (e *OidcGrantTypeNotSupportedError) Error() string       { return "grant type not supported" }
-func (e *OidcGrantTypeNotSupportedError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e OidcGrantTypeNotSupportedError) Error() string       { return "grant type not supported" }
+func (e OidcGrantTypeNotSupportedError) HttpStatusCode() int { return http.StatusBadRequest }

 type OidcMissingClientCredentialsError struct{}

-func (e *OidcMissingClientCredentialsError) Error() string       { return "client id or secret not provided" }
-func (e *OidcMissingClientCredentialsError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e OidcMissingClientCredentialsError) Error() string       { return "client id or secret not provided" }
+func (e OidcMissingClientCredentialsError) HttpStatusCode() int { return http.StatusBadRequest }

 type OidcClientSecretInvalidError struct{}

-func (e *OidcClientSecretInvalidError) Error() string       { return "invalid client secret" }
-func (e *OidcClientSecretInvalidError) HttpStatusCode() int { return http.StatusUnauthorized }
+func (e OidcClientSecretInvalidError) Error() string       { return "invalid client secret" }
+func (e OidcClientSecretInvalidError) HttpStatusCode() int { return http.StatusUnauthorized }

 type OidcClientAssertionInvalidError struct{}

-func (e *OidcClientAssertionInvalidError) Error() string       { return "invalid client assertion" }
-func (e *OidcClientAssertionInvalidError) HttpStatusCode() int { return http.StatusUnauthorized }
+func (e OidcClientAssertionInvalidError) Error() string       { return "invalid client assertion" }
+func (e OidcClientAssertionInvalidError) HttpStatusCode() int { return http.StatusUnauthorized }

 type OidcInvalidAuthorizationCodeError struct{}

-func (e *OidcInvalidAuthorizationCodeError) Error() string       { return "invalid authorization code" }
-func (e *OidcInvalidAuthorizationCodeError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e OidcInvalidAuthorizationCodeError) Error() string       { return "invalid authorization code" }
+func (e OidcInvalidAuthorizationCodeError) HttpStatusCode() int { return http.StatusBadRequest }

 type OidcClientNotFoundError struct{}

-func (e *OidcClientNotFoundError) Error() string       { return "client not found" }
-func (e *OidcClientNotFoundError) HttpStatusCode() int { return http.StatusNotFound }
+func (e OidcClientNotFoundError) Error() string       { return "client not found" }
+func (e OidcClientNotFoundError) HttpStatusCode() int { return http.StatusNotFound }

 type OidcMissingCallbackURLError struct{}

-func (e *OidcMissingCallbackURLError) Error() string {
+func (e OidcMissingCallbackURLError) Error() string {
 	return "unable to detect callback url, it might be necessary for an admin to fix this"
 }
-func (e *OidcMissingCallbackURLError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e OidcMissingCallbackURLError) HttpStatusCode() int { return http.StatusBadRequest }

 type OidcInvalidCallbackURLError struct{}

-func (e *OidcInvalidCallbackURLError) Error() string {
+func (e OidcInvalidCallbackURLError) Error() string {
 	return "invalid callback URL, it might be necessary for an admin to fix this"
 }
-func (e *OidcInvalidCallbackURLError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e OidcInvalidCallbackURLError) HttpStatusCode() int { return http.StatusBadRequest }

 type FileTypeNotSupportedError struct{}

-func (e *FileTypeNotSupportedError) Error() string       { return "file type not supported" }
-func (e *FileTypeNotSupportedError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e FileTypeNotSupportedError) Error() string       { return "file type not supported" }
+func (e FileTypeNotSupportedError) HttpStatusCode() int { return http.StatusBadRequest }

 type FileTooLargeError struct {
 	MaxSize string
 }

-func (e *FileTooLargeError) Error() string {
+func (e FileTooLargeError) Error() string {
 	return fmt.Sprintf("The file can't be larger than %s", e.MaxSize)
 }
-func (e *FileTooLargeError) HttpStatusCode() int { return http.StatusRequestEntityTooLarge }
+func (e FileTooLargeError) HttpStatusCode() int { return http.StatusRequestEntityTooLarge }

 type NotSignedInError struct{}

-func (e *NotSignedInError) Error() string       { return "You are not signed in" }
-func (e *NotSignedInError) HttpStatusCode() int { return http.StatusUnauthorized }
+func (e NotSignedInError) Error() string       { return "You are not signed in" }
+func (e NotSignedInError) HttpStatusCode() int { return http.StatusUnauthorized }

 type MissingAccessToken struct{}

-func (e *MissingAccessToken) Error() string       { return "Missing access token" }
-func (e *MissingAccessToken) HttpStatusCode() int { return http.StatusUnauthorized }
+func (e MissingAccessToken) Error() string       { return "Missing access token" }
+func (e MissingAccessToken) HttpStatusCode() int { return http.StatusUnauthorized }

 type MissingPermissionError struct{}

-func (e *MissingPermissionError) Error() string {
+func (e MissingPermissionError) Error() string {
 	return "You don't have permission to perform this action"
 }
-func (e *MissingPermissionError) HttpStatusCode() int { return http.StatusForbidden }
+func (e MissingPermissionError) HttpStatusCode() int { return http.StatusForbidden }

 type TooManyRequestsError struct{}

-func (e *TooManyRequestsError) Error() string {
-	return "Too many requests"
-}
-func (e *TooManyRequestsError) HttpStatusCode() int { return http.StatusTooManyRequests }
+func (e TooManyRequestsError) Error() string       { return "Too many requests" }
+func (e TooManyRequestsError) HttpStatusCode() int { return http.StatusTooManyRequests }

 type UserIdNotProvidedError struct{}

-func (e *UserIdNotProvidedError) Error() string {
-	return "User id not provided"
-}
-func (e *UserIdNotProvidedError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e UserIdNotProvidedError) Error() string       { return "User id not provided" }
+func (e UserIdNotProvidedError) HttpStatusCode() int { return http.StatusBadRequest }

 type UserNotFoundError struct{}

-func (e *UserNotFoundError) Error() string {
-	return "User not found"
-}
-func (e *UserNotFoundError) HttpStatusCode() int { return http.StatusNotFound }
+func (e UserNotFoundError) Error() string       { return "User not found" }
+func (e UserNotFoundError) HttpStatusCode() int { return http.StatusNotFound }

 type ClientIdOrSecretNotProvidedError struct{}

-func (e *ClientIdOrSecretNotProvidedError) Error() string {
-	return "Client id or secret not provided"
-}
-func (e *ClientIdOrSecretNotProvidedError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e ClientIdOrSecretNotProvidedError) Error() string       { return "Client id or secret not provided" }
+func (e ClientIdOrSecretNotProvidedError) HttpStatusCode() int { return http.StatusBadRequest }

 type WrongFileTypeError struct {
 	ExpectedFileType string
 }

-func (e *WrongFileTypeError) Error() string {
+func (e WrongFileTypeError) Error() string {
 	return fmt.Sprintf("File must be of type %s", e.ExpectedFileType)
 }
-func (e *WrongFileTypeError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e WrongFileTypeError) HttpStatusCode() int { return http.StatusBadRequest }

 type MissingSessionIdError struct{}

-func (e *MissingSessionIdError) Error() string {
-	return "Missing session id"
-}
-func (e *MissingSessionIdError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e MissingSessionIdError) Error() string       { return "Missing session id" }
+func (e MissingSessionIdError) HttpStatusCode() int { return http.StatusBadRequest }

 type ReservedClaimError struct {
 	Key string
 }

-func (e *ReservedClaimError) Error() string {
+func (e ReservedClaimError) Error() string {
 	return fmt.Sprintf("Claim %s is reserved and can't be used", e.Key)
 }
-func (e *ReservedClaimError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e ReservedClaimError) HttpStatusCode() int { return http.StatusBadRequest }

 type DuplicateClaimError struct {
 	Key string
 }

-func (e *DuplicateClaimError) Error() string {
+func (e DuplicateClaimError) Error() string {
 	return fmt.Sprintf("Claim %s is already defined", e.Key)
 }
-func (e *DuplicateClaimError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e DuplicateClaimError) HttpStatusCode() int { return http.StatusBadRequest }

 type OidcInvalidCodeVerifierError struct{}

-func (e *OidcInvalidCodeVerifierError) Error() string {
-	return "Invalid code verifier"
-}
-func (e *OidcInvalidCodeVerifierError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e OidcInvalidCodeVerifierError) Error() string       { return "Invalid code verifier" }
+func (e OidcInvalidCodeVerifierError) HttpStatusCode() int { return http.StatusBadRequest }

 type OidcMissingCodeChallengeError struct{}

-func (e *OidcMissingCodeChallengeError) Error() string {
-	return "Missing code challenge"
-}
-func (e *OidcMissingCodeChallengeError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e OidcMissingCodeChallengeError) Error() string       { return "Missing code challenge" }
+func (e OidcMissingCodeChallengeError) HttpStatusCode() int { return http.StatusBadRequest }

 type LdapUserUpdateError struct{}

-func (e *LdapUserUpdateError) Error() string {
-	return "LDAP users can't be updated"
-}
-func (e *LdapUserUpdateError) HttpStatusCode() int { return http.StatusForbidden }
+func (e LdapUserUpdateError) Error() string       { return "LDAP users can't be updated" }
+func (e LdapUserUpdateError) HttpStatusCode() int { return http.StatusForbidden }

 type LdapUserGroupUpdateError struct{}

-func (e *LdapUserGroupUpdateError) Error() string {
-	return "LDAP user groups can't be updated"
-}
-func (e *LdapUserGroupUpdateError) HttpStatusCode() int { return http.StatusForbidden }
+func (e LdapUserGroupUpdateError) Error() string       { return "LDAP user groups can't be updated" }
+func (e LdapUserGroupUpdateError) HttpStatusCode() int { return http.StatusForbidden }

 type OidcAccessDeniedError struct{}

-func (e *OidcAccessDeniedError) Error() string {
-	return "You're not allowed to access this service"
-}
-func (e *OidcAccessDeniedError) HttpStatusCode() int { return http.StatusForbidden }
+func (e OidcAccessDeniedError) Error() string       { return "You're not allowed to access this service" }
+func (e OidcAccessDeniedError) HttpStatusCode() int { return http.StatusForbidden }

 type OidcClientIdNotMatchingError struct{}

-func (e *OidcClientIdNotMatchingError) Error() string {
+func (e OidcClientIdNotMatchingError) Error() string {
 	return "Client id in request doesn't match client id in token"
 }
-func (e *OidcClientIdNotMatchingError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e OidcClientIdNotMatchingError) HttpStatusCode() int { return http.StatusBadRequest }

 type OidcNoCallbackURLError struct{}

-func (e *OidcNoCallbackURLError) Error() string {
+func (e OidcNoCallbackURLError) Error() string {
 	return "No callback URL provided"
 }
-func (e *OidcNoCallbackURLError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e OidcNoCallbackURLError) HttpStatusCode() int { return http.StatusBadRequest }

 type UiConfigDisabledError struct{}

-func (e *UiConfigDisabledError) Error() string {
+func (e UiConfigDisabledError) Error() string {
 	return "The configuration can't be changed since the UI configuration is disabled"
 }
-func (e *UiConfigDisabledError) HttpStatusCode() int { return http.StatusForbidden }
+func (e UiConfigDisabledError) HttpStatusCode() int { return http.StatusForbidden }

 type InvalidUUIDError struct{}

-func (e *InvalidUUIDError) Error() string {
-	return "Invalid UUID"
-}
-func (e *InvalidUUIDError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e InvalidUUIDError) Error() string       { return "Invalid UUID" }
+func (e InvalidUUIDError) HttpStatusCode() int { return http.StatusBadRequest }

 type OneTimeAccessDisabledError struct{}

-func (e *OneTimeAccessDisabledError) Error() string {
-	return "One-time access is disabled"
-}
-func (e *OneTimeAccessDisabledError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e OneTimeAccessDisabledError) Error() string       { return "One-time access is disabled" }
+func (e OneTimeAccessDisabledError) HttpStatusCode() int { return http.StatusBadRequest }

 type InvalidAPIKeyError struct{}

-func (e *InvalidAPIKeyError) Error() string {
-	return "Invalid Api Key"
-}
-func (e *InvalidAPIKeyError) HttpStatusCode() int { return http.StatusUnauthorized }
+func (e InvalidAPIKeyError) Error() string       { return "Invalid Api Key" }
+func (e InvalidAPIKeyError) HttpStatusCode() int { return http.StatusUnauthorized }

 type NoAPIKeyProvidedError struct{}

-func (e *NoAPIKeyProvidedError) Error() string {
-	return "No API Key Provided"
-}
-func (e *NoAPIKeyProvidedError) HttpStatusCode() int { return http.StatusUnauthorized }
+func (e NoAPIKeyProvidedError) Error() string       { return "No API Key Provided" }
+func (e NoAPIKeyProvidedError) HttpStatusCode() int { return http.StatusUnauthorized }

 type APIKeyNotFoundError struct{}

-func (e *APIKeyNotFoundError) Error() string {
-	return "API Key Not Found"
-}
-func (e *APIKeyNotFoundError) HttpStatusCode() int { return http.StatusUnauthorized }
+func (e APIKeyNotFoundError) Error() string       { return "API Key Not Found" }
+func (e APIKeyNotFoundError) HttpStatusCode() int { return http.StatusUnauthorized }

 type APIKeyNotExpiredError struct{}

-func (e *APIKeyNotExpiredError) Error() string {
-	return "API Key is not expired yet"
-}
-func (e *APIKeyNotExpiredError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e APIKeyNotExpiredError) Error() string       { return "API Key is not expired yet" }
+func (e APIKeyNotExpiredError) HttpStatusCode() int { return http.StatusBadRequest }

 type APIKeyExpirationDateError struct{}

-func (e *APIKeyExpirationDateError) Error() string {
+func (e APIKeyExpirationDateError) Error() string {
 	return "API Key expiration time must be in the future"
 }
-func (e *APIKeyExpirationDateError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e APIKeyExpirationDateError) HttpStatusCode() int { return http.StatusBadRequest }

 type APIKeyAuthNotAllowedError struct{}

-func (e *APIKeyAuthNotAllowedError) Error() string {
+func (e APIKeyAuthNotAllowedError) Error() string {
 	return "API key authentication is not allowed for this endpoint"
 }
-func (e *APIKeyAuthNotAllowedError) HttpStatusCode() int { return http.StatusForbidden }
+func (e APIKeyAuthNotAllowedError) HttpStatusCode() int { return http.StatusForbidden }

 type OidcInvalidRefreshTokenError struct{}

-func (e *OidcInvalidRefreshTokenError) Error() string {
-	return "refresh token is invalid or expired"
-}
-func (e *OidcInvalidRefreshTokenError) HttpStatusCode() int {
-	return http.StatusBadRequest
-}
+func (e OidcInvalidRefreshTokenError) Error() string       { return "refresh token is invalid or expired" }
+func (e OidcInvalidRefreshTokenError) HttpStatusCode() int { return http.StatusBadRequest }

 type OidcMissingRefreshTokenError struct{}

-func (e *OidcMissingRefreshTokenError) Error() string {
-	return "refresh token is required"
-}
-func (e *OidcMissingRefreshTokenError) HttpStatusCode() int {
-	return http.StatusBadRequest
-}
+func (e OidcMissingRefreshTokenError) Error() string       { return "refresh token is required" }
+func (e OidcMissingRefreshTokenError) HttpStatusCode() int { return http.StatusBadRequest }

 type OidcMissingAuthorizationCodeError struct{}

-func (e *OidcMissingAuthorizationCodeError) Error() string {
-	return "authorization code is required"
-}
-func (e *OidcMissingAuthorizationCodeError) HttpStatusCode() int {
-	return http.StatusBadRequest
-}
+func (e OidcMissingAuthorizationCodeError) Error() string       { return "authorization code is required" }
+func (e OidcMissingAuthorizationCodeError) HttpStatusCode() int { return http.StatusBadRequest }

 type UserDisabledError struct{}

-func (e *UserDisabledError) Error() string {
-	return "User account is disabled"
-}
-func (e *UserDisabledError) HttpStatusCode() int {
-	return http.StatusForbidden
-}
+func (e UserDisabledError) Error() string       { return "User account is disabled" }
+func (e UserDisabledError) HttpStatusCode() int { return http.StatusForbidden }

-type ValidationError struct {
-	Message string
-}
+type ValidationError struct{ Message string }

-func (e *ValidationError) Error() string {
-	return e.Message
-}
+func (e ValidationError) Error() string { return e.Message }

-func (e *ValidationError) HttpStatusCode() int {
-	return http.StatusBadRequest
-}
+func (e ValidationError) HttpStatusCode() int { return http.StatusBadRequest }

 type OidcDeviceCodeExpiredError struct{}

-func (e *OidcDeviceCodeExpiredError) Error() string {
-	return "device code has expired"
-}
-func (e *OidcDeviceCodeExpiredError) HttpStatusCode() int {
-	return http.StatusBadRequest
-}
+func (e OidcDeviceCodeExpiredError) Error() string       { return "device code has expired" }
+func (e OidcDeviceCodeExpiredError) HttpStatusCode() int { return http.StatusBadRequest }

 type OidcInvalidDeviceCodeError struct{}

-func (e *OidcInvalidDeviceCodeError) Error() string {
-	return "invalid device code"
-}
-func (e *OidcInvalidDeviceCodeError) HttpStatusCode() int {
-	return http.StatusBadRequest
-}
+func (e OidcInvalidDeviceCodeError) Error() string       { return "invalid device code" }
+func (e OidcInvalidDeviceCodeError) HttpStatusCode() int { return http.StatusBadRequest }

 type OidcSlowDownError struct{}

-func (e *OidcSlowDownError) Error() string {
-	return "polling too frequently"
-}
-func (e *OidcSlowDownError) HttpStatusCode() int {
-	return http.StatusTooManyRequests
-}
+func (e OidcSlowDownError) Error() string       { return "polling too frequently" }
+func (e OidcSlowDownError) HttpStatusCode() int { return http.StatusTooManyRequests }

 type OidcAuthorizationPendingError struct{}

-func (e *OidcAuthorizationPendingError) Error() string {
-	return "authorization is still pending"
-}
-func (e *OidcAuthorizationPendingError) HttpStatusCode() int {
-	return http.StatusBadRequest
-}
+func (e OidcAuthorizationPendingError) Error() string       { return "authorization is still pending" }
+func (e OidcAuthorizationPendingError) HttpStatusCode() int { return http.StatusBadRequest }

 type ReauthenticationRequiredError struct{}

-func (e *ReauthenticationRequiredError) Error() string {
-	return "reauthentication required"
-}
-func (e *ReauthenticationRequiredError) HttpStatusCode() int {
-	return http.StatusUnauthorized
-}
+func (e ReauthenticationRequiredError) Error() string       { return "reauthentication required" }
+func (e ReauthenticationRequiredError) HttpStatusCode() int { return http.StatusUnauthorized }

 type OpenSignupDisabledError struct{}

-func (e *OpenSignupDisabledError) Error() string {
-	return "Open user signup is not enabled"
-}
+func (e OpenSignupDisabledError) Error() string { return "Open user signup is not enabled" }

-func (e *OpenSignupDisabledError) HttpStatusCode() int {
-	return http.StatusForbidden
-}
+func (e OpenSignupDisabledError) HttpStatusCode() int { return http.StatusForbidden }

 type ClientIdAlreadyExistsError struct{}

-func (e *ClientIdAlreadyExistsError) Error() string {
-	return "Client ID already in use"
-}
+func (e ClientIdAlreadyExistsError) Error() string { return "Client ID already in use" }

-func (e *ClientIdAlreadyExistsError) HttpStatusCode() int {
-	return http.StatusBadRequest
-}
+func (e ClientIdAlreadyExistsError) HttpStatusCode() int { return http.StatusBadRequest }

 type UserEmailNotSetError struct{}

-func (e *UserEmailNotSetError) Error() string {
-	return "The user does not have an email address set"
-}
+func (e UserEmailNotSetError) Error() string { return "The user does not have an email address set" }

-func (e *UserEmailNotSetError) HttpStatusCode() int {
-	return http.StatusBadRequest
-}
+func (e UserEmailNotSetError) HttpStatusCode() int { return http.StatusBadRequest }

 type ImageNotFoundError struct{}

-func (e *ImageNotFoundError) Error() string {
-	return "Image not found"
+func (e ImageNotFoundError) Error() string { return "Image not found" }
+
+func (e ImageNotFoundError) HttpStatusCode() int { return http.StatusNotFound }
+
+type OidcPARNotSupportedForPublicClientsError struct{}
+
+func (e OidcPARNotSupportedForPublicClientsError) Error() string {
+	return "pushed authorization requests are not supported for public clients"
+}
+func (e OidcPARNotSupportedForPublicClientsError) HttpStatusCode() int {
+	return http.StatusBadRequest
 }

-func (e *ImageNotFoundError) HttpStatusCode() int {
-	return http.StatusNotFound
+type OidcInvalidRequestURIError struct{}
+
+func (e OidcInvalidRequestURIError) Error() string {
+	return "invalid or expired request_uri"
 }
+func (e OidcInvalidRequestURIError) HttpStatusCode() int { return http.StatusBadRequest }
+
+type OidcPARRequiredError struct{}
+
+func (e OidcPARRequiredError) Error() string {
+	return "this client requires pushed authorization requests"
+}
+func (e OidcPARRequiredError) HttpStatusCode() int { return http.StatusBadRequest }

 type InvalidEmailVerificationTokenError struct{}

-func (e *InvalidEmailVerificationTokenError) Error() string {
-	return "Invalid email verification token"
-}
+func (e InvalidEmailVerificationTokenError) Error() string { return "Invalid email verification token" }

-func (e *InvalidEmailVerificationTokenError) HttpStatusCode() int {
-	return http.StatusBadRequest
-}
+func (e InvalidEmailVerificationTokenError) HttpStatusCode() int { return http.StatusBadRequest }

 // OIDC prompt parameter errors - used for redirect error responses

 type OidcLoginRequiredError struct{}

-func (e *OidcLoginRequiredError) Error() string       { return "login_required" }
-func (e *OidcLoginRequiredError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e OidcLoginRequiredError) Error() string       { return "login_required" }
+func (e OidcLoginRequiredError) HttpStatusCode() int { return http.StatusBadRequest }

 type OidcConsentRequiredError struct{}

-func (e *OidcConsentRequiredError) Error() string       { return "consent_required" }
-func (e *OidcConsentRequiredError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e OidcConsentRequiredError) Error() string       { return "consent_required" }
+func (e OidcConsentRequiredError) HttpStatusCode() int { return http.StatusBadRequest }

 type OidcInteractionRequiredError struct{}

-func (e *OidcInteractionRequiredError) Error() string       { return "interaction_required" }
-func (e *OidcInteractionRequiredError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e OidcInteractionRequiredError) Error() string       { return "interaction_required" }
+func (e OidcInteractionRequiredError) HttpStatusCode() int { return http.StatusBadRequest }
+
+type OidcInvalidRequestError struct{ description string }
+
+func NewOidcInvalidRequestError(description string) *OidcInvalidRequestError {
+	return &OidcInvalidRequestError{description: description}
+}
+
+func (e OidcInvalidRequestError) Error() string       { return "invalid_request" }
+func (e OidcInvalidRequestError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e OidcInvalidRequestError) Description() string { return e.description }

 type OidcAccountSelectionRequiredError struct{}

-func (e *OidcAccountSelectionRequiredError) Error() string {
-	return "account_selection_required"
-}
-func (e *OidcAccountSelectionRequiredError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e OidcAccountSelectionRequiredError) Error() string       { return "account_selection_required" }
+func (e OidcAccountSelectionRequiredError) HttpStatusCode() int { return http.StatusBadRequest }
--- a/backend/internal/controller/app_config_controller.go
+++ b/backend/internal/controller/app_config_controller.go
@@ -49,7 +49,7 @@ type AppConfigController struct {
 // @Accept json
 // @Produce json
 // @Success 200 {array} dto.PublicAppConfigVariableDto
-// @Router /application-configuration [get]
+// @Router /api/application-configuration [get]
 func (acc *AppConfigController) listAppConfigHandler(c *gin.Context) {
 	configuration := acc.appConfigService.ListAppConfig(false)

@@ -76,7 +76,7 @@ func (acc *AppConfigController) listAppConfigHandler(c *gin.Context) {
 // @Accept json
 // @Produce json
 // @Success 200 {array} dto.AppConfigVariableDto
-// @Router /application-configuration/all [get]
+// @Router /api/application-configuration/all [get]
 func (acc *AppConfigController) listAllAppConfigHandler(c *gin.Context) {
 	configuration := acc.appConfigService.ListAppConfig(true)

--- a/backend/internal/controller/oidc_controller.go
+++ b/backend/internal/controller/oidc_controller.go
@@ -33,8 +33,10 @@ func NewOidcController(group *gin.RouterGroup, authMiddleware *middleware.AuthMi

 	group.POST("/oidc/authorize", authMiddleware.WithAdminNotRequired().Add(), oc.authorizeHandler)
 	group.POST("/oidc/authorization-required", authMiddleware.WithAdminNotRequired().Add(), oc.authorizationConfirmationRequiredHandler)
+	group.GET("/oidc/par-request-info", authMiddleware.WithAdminNotRequired().Add(), oc.parRequestInfoHandler)

 	group.POST("/oidc/token", oc.createTokensHandler)
+	group.POST("/oidc/par", oc.pushedAuthorizationRequestHandler)
 	group.GET("/oidc/userinfo", oc.userInfoHandler)
 	group.POST("/oidc/userinfo", oc.userInfoHandler)
 	group.POST("/oidc/end-session", authMiddleware.WithAdminNotRequired().WithSuccessOptional().Add(), oc.EndSessionHandler)
@@ -154,13 +156,50 @@ func (oc *OidcController) authorizationConfirmationRequiredHandler(c *gin.Contex
 		return
 	}

-	hasAuthorizedClient, err := oc.oidcService.HasAuthorizedClient(c.Request.Context(), input.ClientID, c.GetString("userID"), input.Scope)
+	authorizationRequired, scope, err := oc.oidcService.AuthorizationRequired(c.Request.Context(), input.ClientID, c.GetString("userID"), input.Scope, input.RequestURI)
 	if err != nil {
 		_ = c.Error(err)
 		return
 	}

-	c.JSON(http.StatusOK, gin.H{"authorizationRequired": !hasAuthorizedClient})
+	c.JSON(http.StatusOK, gin.H{"authorizationRequired": authorizationRequired, "scope": scope})
+}
+
+// parRequestInfoHandler godoc
+// @Summary Resolve stored authorization request parameters
+// @Description Resolve the parameters of a stored request_uri request so the consent page can render the requested scope and build the final redirect. Does not consume the request.
+// @Tags OIDC
+// @Produce json
+// @Param client_id query string true "Client ID"
+// @Param request_uri query string true "Request URI returned from the PAR endpoint"
+// @Success 200 {object} dto.OidcAuthorizeRequestInfoDto "Resolved authorization request parameters"
+// @Router /api/oidc/par-request-info [get]
+func (oc *OidcController) parRequestInfoHandler(c *gin.Context) {
+	clientID := c.Query("client_id")
+	requestURI := c.Query("request_uri")
+	if clientID == "" {
+		_ = c.Error(&common.ValidationError{Message: "client_id is required"})
+		return
+	}
+	if requestURI == "" {
+		_ = c.Error(&common.ValidationError{Message: "request_uri is required"})
+		return
+	}
+
+	info, err := oc.oidcService.GetPushedAuthorizationRequest(c.Request.Context(), clientID, requestURI)
+	if err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	var infoDto dto.OidcAuthorizeRequestInfoDto
+	err = dto.MapStruct(info.Parameters, &infoDto)
+	if err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	c.JSON(http.StatusOK, infoDto)
 }

 // createTokensHandler godoc
@@ -202,10 +241,8 @@ func (oc *OidcController) createTokensHandler(c *gin.Context) {
 		return
 	}

-	// Client id and secret can also be passed over the Authorization header
-	if input.ClientID == "" && input.ClientSecret == "" {
-		input.ClientID, input.ClientSecret, _ = utils.OAuthClientBasicAuth(c.Request)
-	}
+	// Check if the client ID / secret are passed in the Authorization header (RFC 6749)
+	parseBasicAuth(c.Request, &input.ClientSecret, &input.ClientID)

 	tokens, err := oc.createTokens(c.Request.Context(), input)

@@ -234,6 +271,49 @@ func (oc *OidcController) createTokensHandler(c *gin.Context) {
 	})
 }

+// pushedAuthorizationRequestHandler godoc
+// @Summary Pushed Authorization Request (PAR)
+// @Description RFC 9126: Push authorization request parameters and receive a request_uri. Only confidential clients may use this endpoint.
+// @Tags OIDC
+// @Accept application/x-www-form-urlencoded
+// @Produce json
+// @Success 201 {object} dto.OidcPARResponseDto
+// @Router /api/oidc/par [post]
+func (oc *OidcController) pushedAuthorizationRequestHandler(c *gin.Context) {
+	// Per RFC 9126, parameters MUST be passed in the request body
+	c.Request.URL.RawQuery = ""
+
+	var input dto.OidcPARRequestDto
+	if err := c.ShouldBind(&input); err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	// Client id and secret can also be passed over the Authorization header
+	if input.ClientID == "" && input.ClientSecret == "" {
+		input.ClientID, input.ClientSecret, _ = utils.OAuthClientBasicAuth(c.Request)
+	}
+
+	creds := service.ClientAuthCredentials{
+		ClientID:            input.ClientID,
+		ClientSecret:        input.ClientSecret,
+		ClientAssertion:     input.ClientAssertion,
+		ClientAssertionType: input.ClientAssertionType,
+	}
+
+	requestURI, expiresIn, err := oc.oidcService.CreatePushedAuthorizationRequest(c.Request.Context(), creds, input)
+	if err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	// RFC 9126 §2.2 requires HTTP 201 Created for successful PAR responses
+	c.JSON(http.StatusCreated, dto.OidcPARResponseDto{
+		RequestURI: requestURI,
+		ExpiresIn:  expiresIn,
+	})
+}
+
 // userInfoHandler godoc
 // @Summary Get user information
 // @Description Get user information based on the access token
@@ -313,6 +393,12 @@ func (oc *OidcController) EndSessionHandler(c *gin.Context) {
 	// The validation was successful, so we can log out and redirect the user to the callback URL without confirmation
 	cookie.AddAccessTokenCookie(c, 0, "")

+	// Callback URL can be empty if none is configured
+	if callbackURL == "" {
+		c.Redirect(http.StatusFound, common.EnvConfig.AppURL+"/logout")
+		return
+	}
+
 	logoutCallbackURL, _ := url.Parse(callbackURL)
 	if input.State != "" {
 		q := logoutCallbackURL.Query()
@@ -692,6 +778,22 @@ func (oc *OidcController) updateAllowedUserGroupsHandler(c *gin.Context) {
 	c.JSON(http.StatusOK, oidcClientDto)
 }

+// This method can modify the value of clientSecret and clientID
+func parseBasicAuth(r *http.Request, clientSecret *string, clientID *string) {
+	// Client id and secret can also be passed via the Authorization header (RFC 6749, section 2.3.1 "client_secret_basic")
+	// When PKCE is used, some libraries send client_id in the body for the code_verifier binding while keeping the secret only in the Authorization header
+	// We therefore fall back to Basic auth whenever the secret is missing, not only when both fields are empty
+	if *clientSecret == "" {
+		basicID, basicSecret, ok := utils.OAuthClientBasicAuth(r)
+		if ok {
+			if *clientID == "" {
+				*clientID = basicID
+			}
+			*clientSecret = basicSecret
+		}
+	}
+}
+
 func (oc *OidcController) deviceAuthorizationHandler(c *gin.Context) {
 	// Per RFC 8628 (OAuth 2.0 Device Authorization Grant), parameters for the device authorization request MUST be sent in the body of the POST request
 	// Gin's "ShouldBind" by default reads from the query string too, so we need to reset all query string args before invoking ShouldBind
@@ -704,10 +806,8 @@ func (oc *OidcController) deviceAuthorizationHandler(c *gin.Context) {
 		return
 	}

-	// Client id and secret can also be passed over the Authorization header
-	if input.ClientID == "" && input.ClientSecret == "" {
-		input.ClientID, input.ClientSecret, _ = utils.OAuthClientBasicAuth(c.Request)
-	}
+	// Check if the client ID / secret are passed in the Authorization header (RFC 6749)
+	parseBasicAuth(c.Request, &input.ClientSecret, &input.ClientID)

 	response, err := oc.oidcService.CreateDeviceAuthorization(c.Request.Context(), input)
 	if err != nil {
--- a/backend/internal/controller/oidc_controller_test.go
+++ b/backend/internal/controller/oidc_controller_test.go
@@ -146,6 +146,43 @@ func TestCreateTokensHandler(t *testing.T) {
 		assert.Equal(t, 120, response.ExpiresIn)
 	})

+	t.Run("Uses Basic Auth Secret When Body Has Only Client ID (PKCE)", func(t *testing.T) {
+		// Some OIDC libraries (e.g. jumbojett/openid-connect-php) combine client_secret_basic with PKCE by sending client_id in the body alongside code_verifier while keeping the secret only in the Authorization header
+		// RFC 6749 §2.3.1 permits this; the body client_id must not block the Basic auth fallback for the secret.
+		var capturedInput dto.OidcCreateTokensDto
+		oc := &OidcController{
+			createTokens: func(_ context.Context, input dto.OidcCreateTokensDto) (service.CreatedTokens, error) {
+				capturedInput = input
+				return service.CreatedTokens{
+					AccessToken:  "access-token",
+					IdToken:      "id-token",
+					RefreshToken: "refresh-token",
+					ExpiresIn:    2 * time.Minute,
+				}, nil
+			},
+		}
+
+		basicAuth := "Basic " + base64.StdEncoding.EncodeToString([]byte("client-id:client-secret"))
+		c, recorder := createTestContext(
+			t,
+			"http://example.com/oidc/token",
+			url.Values{
+				"grant_type":    {service.GrantTypeRefreshToken},
+				"refresh_token": {"input-refresh-token"},
+				"client_id":     {"client-id"},
+			},
+			basicAuth,
+			false,
+		)
+
+		oc.createTokensHandler(c)
+
+		require.Empty(t, c.Errors)
+		assert.Equal(t, "client-id", capturedInput.ClientID)
+		assert.Equal(t, "client-secret", capturedInput.ClientSecret)
+		require.Equal(t, http.StatusOK, recorder.Code)
+	})
+
 	t.Run("Maps Authorization Pending Error", func(t *testing.T) {
 		oc := &OidcController{
 			createTokens: func(context.Context, dto.OidcCreateTokensDto) (service.CreatedTokens, error) {
--- a/backend/internal/controller/well_known_controller.go
+++ b/backend/internal/controller/well_known_controller.go
@@ -91,8 +91,10 @@ func (wkc *WellKnownController) computeOIDCConfiguration() ([]byte, error) {
 		"id_token_signing_alg_values_supported":          []string{alg.String()},
 		"authorization_response_iss_parameter_supported": true,
 		"code_challenge_methods_supported":               []string{"plain", "S256"},
-		"prompt_values_supported":                        []string{"none", "login", "consent"},
-		"token_endpoint_auth_methods_supported":          []string{"client_secret_basic", "client_secret_post", "none"},
+		"prompt_values_supported":                        []string{"none", "login", "consent", "select_account"},
+		"token_endpoint_auth_methods_supported":          []string{"client_secret_basic", "client_secret_post", "private_key_jwt", "none"},
+		"pushed_authorization_request_endpoint":          internalAppUrl + "/api/oidc/par",
+		"require_pushed_authorization_requests":          false,
 	}
 	return json.Marshal(config)
 }
--- a/backend/internal/dto/oidc_dto.go
+++ b/backend/internal/dto/oidc_dto.go
@@ -13,12 +13,13 @@ type OidcClientMetaDataDto struct {

 type OidcClientDto struct {
 	OidcClientMetaDataDto
-	CallbackURLs       []string                 `json:"callbackURLs"`
-	LogoutCallbackURLs []string                 `json:"logoutCallbackURLs"`
-	IsPublic           bool                     `json:"isPublic"`
-	PkceEnabled        bool                     `json:"pkceEnabled"`
-	Credentials        OidcClientCredentialsDto `json:"credentials"`
-	IsGroupRestricted  bool                     `json:"isGroupRestricted"`
+	CallbackURLs                        []string                 `json:"callbackURLs"`
+	LogoutCallbackURLs                  []string                 `json:"logoutCallbackURLs"`
+	IsPublic                            bool                     `json:"isPublic"`
+	PkceEnabled                         bool                     `json:"pkceEnabled"`
+	RequiresPushedAuthorizationRequests bool                     `json:"requiresPushedAuthorizationRequests"`
+	Credentials                         OidcClientCredentialsDto `json:"credentials"`
+	IsGroupRestricted                   bool                     `json:"isGroupRestricted"`
 }

 type OidcClientWithAllowedUserGroupsDto struct {
@@ -32,19 +33,20 @@ type OidcClientWithAllowedGroupsCountDto struct {
 }

 type OidcClientUpdateDto struct {
-	Name                     string                   `json:"name" binding:"required,max=50" unorm:"nfc"`
-	CallbackURLs             []string                 `json:"callbackURLs" binding:"omitempty,dive,callback_url_pattern"`
-	LogoutCallbackURLs       []string                 `json:"logoutCallbackURLs" binding:"omitempty,dive,callback_url_pattern"`
-	IsPublic                 bool                     `json:"isPublic"`
-	PkceEnabled              bool                     `json:"pkceEnabled"`
-	RequiresReauthentication bool                     `json:"requiresReauthentication"`
-	Credentials              OidcClientCredentialsDto `json:"credentials"`
-	LaunchURL                *string                  `json:"launchURL" binding:"omitempty,url"`
-	HasLogo                  bool                     `json:"hasLogo"`
-	HasDarkLogo              bool                     `json:"hasDarkLogo"`
-	LogoURL                  *string                  `json:"logoUrl"`
-	DarkLogoURL              *string                  `json:"darkLogoUrl"`
-	IsGroupRestricted        bool                     `json:"isGroupRestricted"`
+	Name                                string                   `json:"name" binding:"required,max=50" unorm:"nfc"`
+	CallbackURLs                        []string                 `json:"callbackURLs" binding:"omitempty,dive,callback_url_pattern"`
+	LogoutCallbackURLs                  []string                 `json:"logoutCallbackURLs" binding:"omitempty,dive,callback_url_pattern"`
+	IsPublic                            bool                     `json:"isPublic"`
+	PkceEnabled                         bool                     `json:"pkceEnabled"`
+	RequiresReauthentication            bool                     `json:"requiresReauthentication"`
+	RequiresPushedAuthorizationRequests bool                     `json:"requiresPushedAuthorizationRequests"`
+	Credentials                         OidcClientCredentialsDto `json:"credentials"`
+	LaunchURL                           *string                  `json:"launchURL" binding:"omitempty,url"`
+	HasLogo                             bool                     `json:"hasLogo"`
+	HasDarkLogo                         bool                     `json:"hasDarkLogo"`
+	LogoURL                             *string                  `json:"logoUrl"`
+	DarkLogoURL                         *string                  `json:"darkLogoUrl"`
+	IsGroupRestricted                   bool                     `json:"isGroupRestricted"`
 }

 type OidcClientCreateDto struct {
@@ -65,13 +67,36 @@ type OidcClientFederatedIdentityDto struct {

 type AuthorizeOidcClientRequestDto struct {
 	ClientID              string `json:"clientID" binding:"required"`
-	Scope                 string `json:"scope" binding:"required"`
-	CallbackURL           string `json:"callbackURL" binding:"omitempty,callback_url"`
+	Scope                 string `json:"scope" binding:"required_without=RequestURI"`
+	CallbackURL           string `json:"callbackURL"`
 	Nonce                 string `json:"nonce"`
 	CodeChallenge         string `json:"codeChallenge"`
 	CodeChallengeMethod   string `json:"codeChallengeMethod"`
 	ReauthenticationToken string `json:"reauthenticationToken"`
 	Prompt                string `json:"prompt"`
+	ResponseMode          string `json:"responseMode" binding:"omitempty,response_mode"`
+	RequestURI            string `json:"requestURI"`
+}
+
+type OidcPARRequestDto struct {
+	ClientID            string `form:"client_id"`
+	ClientSecret        string `form:"client_secret"`
+	ClientAssertion     string `form:"client_assertion"`
+	ClientAssertionType string `form:"client_assertion_type"`
+	ResponseType        string `form:"response_type" binding:"required"`
+	Scope               string `form:"scope" binding:"required"`
+	RedirectURI         string `form:"redirect_uri"`
+	State               string `form:"state"`
+	Nonce               string `form:"nonce"`
+	CodeChallenge       string `form:"code_challenge"`
+	CodeChallengeMethod string `form:"code_challenge_method"`
+	Prompt              string `form:"prompt"`
+	ResponseMode        string `form:"response_mode" binding:"omitempty,response_mode"`
+}
+
+type OidcPARResponseDto struct {
+	RequestURI string `json:"request_uri"`
+	ExpiresIn  int    `json:"expires_in"`
 }

 type AuthorizeOidcClientResponseDto struct {
@@ -81,8 +106,18 @@ type AuthorizeOidcClientResponseDto struct {
 }

 type AuthorizationRequiredDto struct {
-	ClientID string `json:"clientID" binding:"required"`
-	Scope    string `json:"scope" binding:"required"`
+	ClientID   string `json:"clientID" binding:"required"`
+	Scope      string `json:"scope"`
+	RequestURI string `json:"requestURI"`
+}
+
+type OidcAuthorizeRequestInfoDto struct {
+	Scope        string `json:"scope"`
+	RedirectURI  string `json:"redirectURI"`
+	State        string `json:"state,omitempty"`
+	Nonce        string `json:"nonce,omitempty"`
+	ResponseMode string `json:"responseMode,omitempty"`
+	Prompt       string `json:"prompt,omitempty"`
 }

 type OidcCreateTokensDto struct {
--- a/backend/internal/dto/validations.go
+++ b/backend/internal/dto/validations.go
@@ -47,6 +47,9 @@ func init() {
 		"callback_url_pattern": func(fl validator.FieldLevel) bool {
 			return ValidateCallbackURLPattern(fl.Field().String())
 		},
+		"response_mode": func(fl validator.FieldLevel) bool {
+			return ValidateResponseMode(fl.Field().String())
+		},
 	}
 	for k, v := range validators {
 		err := engine.RegisterValidation(k, v)
@@ -87,3 +90,17 @@ func ValidateCallbackURLPattern(raw string) bool {
 	err := utils.ValidateCallbackURLPattern(raw)
 	return err == nil
 }
+
+// ValidateResponseMode validates response_mode parameter
+// If responseMode is present, it must be "form_post", "query", or "fragment"
+// Empty responseMode is allowed (field not provided, use default)
+func ValidateResponseMode(responseMode string) bool {
+	switch responseMode {
+	case "form_post", "query", "fragment":
+		return true
+	case "":
+		return true
+	default:
+		return false
+	}
+}
--- a/backend/internal/dto/validations_test.go
+++ b/backend/internal/dto/validations_test.go
@@ -58,6 +58,26 @@ func TestValidateClientID(t *testing.T) {
 	}
 }

+func TestValidateResponseMode(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected bool
+	}{
+		{"valid form_post", "form_post", true},
+		{"valid query", "query", true},
+		{"valid fragment", "fragment", true},
+		{"valid empty", "", true},
+		{"invalid unknown", "unknown", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.expected, ValidateResponseMode(tt.input))
+		})
+	}
+}
+
 func TestValidateCallbackURL(t *testing.T) {
 	tests := []struct {
 		name     string
--- a/backend/internal/job/db_cleanup_job.go
+++ b/backend/internal/job/db_cleanup_job.go
@@ -38,6 +38,7 @@ func (s *Scheduler) RegisterDbCleanupJobs(ctx context.Context, db *gorm.DB) erro
 		s.RegisterJob(ctx, "ClearOidcRefreshTokens", jobDefWithJitter(24*time.Hour), jobs.clearOidcRefreshTokens, service.RegisterJobOpts{RunImmediately: true, BackOff: newBackOff()}),
 		s.RegisterJob(ctx, "ClearReauthenticationTokens", jobDefWithJitter(24*time.Hour), jobs.clearReauthenticationTokens, service.RegisterJobOpts{RunImmediately: true, BackOff: newBackOff()}),
 		s.RegisterJob(ctx, "ClearAuditLogs", jobDefWithJitter(24*time.Hour), jobs.clearAuditLogs, service.RegisterJobOpts{RunImmediately: true, BackOff: newBackOff()}),
+		s.RegisterJob(ctx, "ClearOidcPushedAuthorizationRequests", jobDefWithJitter(24*time.Hour), jobs.clearOidcPushedAuthorizationRequests, service.RegisterJobOpts{RunImmediately: true, BackOff: newBackOff()}),
 	)
 }

@@ -146,6 +147,20 @@ func (j *DbCleanupJobs) clearAuditLogs(ctx context.Context) error {
 	return nil
 }

+// clearOidcPushedAuthorizationRequests deletes PAR records that have expired without being consumed
+func (j *DbCleanupJobs) clearOidcPushedAuthorizationRequests(ctx context.Context) error {
+	st := j.db.
+		WithContext(ctx).
+		Delete(&model.OidcPushedAuthorizationRequest{}, "expires_at < ?", datatype.DateTime(time.Now()))
+	if st.Error != nil {
+		return fmt.Errorf("failed to clean expired pushed authorization requests: %w", st.Error)
+	}
+
+	slog.InfoContext(ctx, "Cleaned expired pushed authorization requests", slog.Int64("count", st.RowsAffected))
+
+	return nil
+}
+
 // ClearEmailVerificationTokens deletes email verification tokens that have expired
 func (j *DbCleanupJobs) clearEmailVerificationTokens(ctx context.Context) error {
 	st := j.db.
--- a/backend/internal/middleware/auth_middleware_test.go
+++ b/backend/internal/middleware/auth_middleware_test.go
@@ -88,10 +88,9 @@ func TestWithApiKeyAuthDisabled(t *testing.T) {
 func createUserForAuthMiddlewareTest(t *testing.T, db *gorm.DB) model.User {
 	t.Helper()

-	email := "auth@example.com"
 	user := model.User{
 		Username:    "auth-user",
-		Email:       &email,
+		Email:       new("auth@example.com"),
 		FirstName:   "Auth",
 		LastName:    "User",
 		DisplayName: "Auth User",
--- a/backend/internal/middleware/csp_middleware.go
+++ b/backend/internal/middleware/csp_middleware.go
@@ -3,6 +3,7 @@ package middleware
 import (
 	"crypto/rand"
 	"encoding/base64"
+	"strings"

 	"github.com/gin-gonic/gin"
 )
@@ -28,22 +29,39 @@ func (m *CspMiddleware) Add() gin.HandlerFunc {
 		// Generate a random base64 nonce for this request
 		nonce := generateNonce()
 		c.Set("csp_nonce", nonce)
+		c.Writer.Header().Set("Content-Security-Policy", BuildCSP(nonce))

-		csp := "default-src 'self'; " +
-			"base-uri 'self'; " +
-			"object-src 'none'; " +
-			"frame-ancestors 'none'; " +
-			"form-action 'self'; " +
-			"img-src * blob:;" +
-			"font-src 'self'; " +
-			"style-src 'self' 'unsafe-inline'; " +
-			"script-src 'self' 'nonce-" + nonce + "'"
-
-		c.Writer.Header().Set("Content-Security-Policy", csp)
 		c.Next()
 	}
 }

+func BuildCSP(nonce string, formActionExtra ...string) string {
+	formAction := "'self'"
+
+	if len(formActionExtra) > 0 {
+		b := strings.Builder{}
+
+		for _, extra := range formActionExtra {
+			if extra != "" {
+				b.WriteByte(' ')
+				b.WriteString(extra)
+			}
+		}
+
+		formAction += b.String()
+	}
+
+	return "default-src 'self'; " +
+		"base-uri 'self'; " +
+		"object-src 'none'; " +
+		"frame-ancestors 'none'; " +
+		"form-action " + formAction + "; " +
+		"img-src * blob:;" +
+		"font-src 'self'; " +
+		"style-src 'self' 'unsafe-inline'; " +
+		"script-src 'self' 'nonce-" + nonce + "'"
+}
+
 func generateNonce() string {
 	b := make([]byte, 16)
 	if _, err := rand.Read(b); err != nil {
--- a/backend/internal/middleware/csp_middleware_test.go
+++ b/backend/internal/middleware/csp_middleware_test.go
@@ -0,0 +1,24 @@
+package middleware
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestBuildCSP(t *testing.T) {
+	t.Run("uses self form action by default", func(t *testing.T) {
+		csp := BuildCSP("test-nonce")
+
+		assert.Contains(t, csp, "form-action 'self';")
+		assert.Contains(t, csp, "script-src 'self' 'nonce-test-nonce'")
+	})
+
+	t.Run("adds validated form action targets", func(t *testing.T) {
+		csp := BuildCSP("test-nonce", "https://example.com/callback")
+
+		assert.Contains(t, csp, "form-action 'self' https://example.com/callback;")
+		assert.Equal(t, 1, strings.Count(csp, "form-action"))
+	})
+}
--- a/backend/internal/middleware/error_handler.go
+++ b/backend/internal/middleware/error_handler.go
@@ -23,7 +23,6 @@ func (m *ErrorHandlerMiddleware) Add() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		c.Next()
 		for _, err := range c.Errors {
-
 			// Check for record not found errors
 			if errors.Is(err, gorm.ErrRecordNotFound) {
 				errorResponse(c, http.StatusNotFound, "Record not found")
@@ -39,30 +38,56 @@ func (m *ErrorHandlerMiddleware) Add() gin.HandlerFunc {
 			}

 			// Check for slice validation errors
-			var sliceValidationErrors binding.SliceValidationError
-			if errors.As(err, &sliceValidationErrors) {
-				if errors.As(sliceValidationErrors[0], &validationErrors) {
+			svErr, ok := errors.AsType[binding.SliceValidationError](err)
+			if ok {
+				if errors.As(svErr[0], &validationErrors) {
 					message := handleValidationError(validationErrors)
 					errorResponse(c, http.StatusBadRequest, message)
 					return
 				}
 			}

-			var appErr common.AppError
-			if errors.As(err, &appErr) {
+			// AppError with description
+			appDescErr, ok := errors.AsType[common.AppErrorDescription](err)
+			if ok {
+				errorResponseWithDescription(c, appDescErr.HttpStatusCode(), appDescErr.Error(), appDescErr.Description())
+				return
+			}
+
+			// AppError (without description)
+			appErr, ok := errors.AsType[common.AppError](err)
+			if ok {
 				errorResponse(c, appErr.HttpStatusCode(), appErr.Error())
 				return
 			}

-			c.JSON(http.StatusInternalServerError, gin.H{"error": "Something went wrong"})
+			c.JSON(http.StatusInternalServerError, errorResponseBody{
+				Error: "Something went wrong",
+			})
 		}
 	}
 }

+type errorResponseBody struct {
+	Error            string `json:"error"`
+	ErrorDescription string `json:"error_description,omitempty"`
+}
+
 func errorResponse(c *gin.Context, statusCode int, message string) {
 	// Capitalize the first letter of the message
 	message = strings.ToUpper(message[:1]) + message[1:]
-	c.JSON(statusCode, gin.H{"error": message})
+	c.JSON(statusCode, errorResponseBody{
+		Error: message,
+	})
+}
+
+func errorResponseWithDescription(c *gin.Context, statusCode int, message string, description string) {
+	// Capitalize the first letter of the message
+	message = strings.ToUpper(message[:1]) + message[1:]
+	c.JSON(statusCode, errorResponseBody{
+		Error:            message,
+		ErrorDescription: description,
+	})
 }

 func handleValidationError(validationErrors validator.ValidationErrors) string {
--- a/backend/internal/model/oidc.go
+++ b/backend/internal/model/oidc.go
@@ -48,18 +48,19 @@ type OidcAuthorizationCode struct {
 type OidcClient struct {
 	Base

-	Name                     string `sortable:"true"`
-	Secret                   string
-	CallbackURLs             UrlList
-	LogoutCallbackURLs       UrlList
-	ImageType                *string
-	DarkImageType            *string
-	IsPublic                 bool
-	PkceEnabled              bool `sortable:"true" filterable:"true"`
-	RequiresReauthentication bool `sortable:"true" filterable:"true"`
-	Credentials              OidcClientCredentials
-	LaunchURL                *string
-	IsGroupRestricted        bool `sortable:"true" filterable:"true"`
+	Name                                string `sortable:"true"`
+	Secret                              string
+	CallbackURLs                        UrlList
+	LogoutCallbackURLs                  UrlList
+	ImageType                           *string
+	DarkImageType                       *string
+	IsPublic                            bool
+	PkceEnabled                         bool `sortable:"true" filterable:"true"`
+	RequiresReauthentication            bool `sortable:"true" filterable:"true"`
+	RequiresPushedAuthorizationRequests bool `sortable:"true" filterable:"true"`
+	Credentials                         OidcClientCredentials
+	LaunchURL                           *string
+	IsGroupRestricted                   bool `sortable:"true" filterable:"true"`

 	AllowedUserGroups         []UserGroup `gorm:"many2many:oidc_clients_allowed_user_groups;"`
 	CreatedByID               *string
@@ -79,6 +80,7 @@ type OidcRefreshToken struct {
 	Base

 	Token                string
+	IdTokenJti           *string
 	ExpiresAt            datatype.DateTime
 	Scope                string
 	AuthenticationMethod string
@@ -156,3 +158,32 @@ type OidcDeviceCode struct {
 	ClientID string
 	Client   OidcClient
 }
+
+type OidcPushedAuthorizationRequest struct {
+	Base
+
+	RequestURI string
+	ClientID   string
+	Parameters OidcAuthorizationRequestParameters
+	ExpiresAt  datatype.DateTime
+}
+
+type OidcAuthorizationRequestParameters struct { //nolint:recvcheck
+	Scope               string `json:"scope,omitempty"`
+	RedirectURI         string `json:"redirect_uri,omitempty"`
+	State               string `json:"state,omitempty"`
+	Nonce               string `json:"nonce,omitempty"`
+	CodeChallenge       string `json:"code_challenge,omitempty"`
+	CodeChallengeMethod string `json:"code_challenge_method,omitempty"`
+	ResponseType        string `json:"response_type,omitempty"`
+	Prompt              string `json:"prompt,omitempty"`
+	ResponseMode        string `json:"response_mode,omitempty"`
+}
+
+func (p *OidcAuthorizationRequestParameters) Scan(value any) error {
+	return utils.UnmarshalJSONFromDatabase(p, value)
+}
+
+func (p OidcAuthorizationRequestParameters) Value() (driver.Value, error) {
+	return json.Marshal(p)
+}
--- a/backend/internal/service/app_images_service.go
+++ b/backend/internal/service/app_images_service.go
@@ -12,6 +12,7 @@ import (
 	"github.com/pocket-id/pocket-id/backend/internal/common"
 	"github.com/pocket-id/pocket-id/backend/internal/storage"
 	"github.com/pocket-id/pocket-id/backend/internal/utils"
+	imageutil "github.com/pocket-id/pocket-id/backend/internal/utils/image"
 )

 type AppImagesService struct {
@@ -68,7 +69,12 @@ func (s *AppImagesService) UpdateImage(ctx context.Context, file *multipart.File
 	}
 	defer fileReader.Close()

-	if err := s.storage.Save(ctx, imagePath, fileReader); err != nil {
+	strippedReader, err := imageutil.StripMetadata(fileReader, fileType)
+	if err != nil {
+		return err
+	}
+
+	if err := s.storage.Save(ctx, imagePath, strippedReader); err != nil {
 		return err
 	}

--- a/backend/internal/service/app_images_service_test.go
+++ b/backend/internal/service/app_images_service_test.go
@@ -3,6 +3,7 @@ package service
 import (
 	"bytes"
 	"context"
+	"encoding/binary"
 	"io"
 	"io/fs"
 	"mime/multipart"
@@ -56,6 +57,29 @@ func TestAppImagesService_UpdateImage(t *testing.T) {
 	require.ErrorIs(t, err, fs.ErrNotExist)
 }

+func TestAppImagesService_UpdateImageStripsMetadata(t *testing.T) {
+	store, err := storage.NewFilesystemStorage(t.TempDir())
+	require.NoError(t, err)
+
+	service := NewAppImagesService(map[string]string{}, store)
+
+	fileHeader := newFileHeader(t, "logo.webp", webpFile(
+		webpChunk("VP8 ", []byte{1, 2, 3, 4}),
+		webpChunk("EXIF", []byte("secret")),
+	))
+
+	require.NoError(t, service.UpdateImage(context.Background(), fileHeader, "logoLight"))
+
+	reader, _, err := store.Open(context.Background(), path.Join("application-images", "logoLight.webp"))
+	require.NoError(t, err)
+	defer reader.Close()
+
+	payload, err := io.ReadAll(reader)
+	require.NoError(t, err)
+	assert.NotContains(t, string(payload), "secret")
+	assert.Contains(t, string(payload), "VP8 ")
+}
+
 func TestAppImagesService_ErrorsAndFlags(t *testing.T) {
 	store, err := storage.NewFilesystemStorage(t.TempDir())
 	require.NoError(t, err)
@@ -112,3 +136,26 @@ func newFileHeader(t *testing.T, filename string, content []byte) *multipart.Fil

 	return fileHeader
 }
+
+func webpFile(chunks ...[]byte) []byte {
+	var out bytes.Buffer
+	out.WriteString("RIFF")
+	out.Write([]byte{0, 0, 0, 0})
+	out.WriteString("WEBP")
+	for _, chunk := range chunks {
+		out.Write(chunk)
+	}
+	binary.LittleEndian.PutUint32(out.Bytes()[4:8], uint32(out.Len()-8)) //nolint:gosec
+	return out.Bytes()
+}
+
+func webpChunk(chunkType string, data []byte) []byte {
+	var out bytes.Buffer
+	out.WriteString(chunkType)
+	_ = binary.Write(&out, binary.LittleEndian, uint32(len(data))) //nolint:gosec
+	out.Write(data)
+	if len(data)%2 == 1 {
+		out.WriteByte(0)
+	}
+	return out.Bytes()
+}
--- a/backend/internal/service/app_lock_service_test.go
+++ b/backend/internal/service/app_lock_service_test.go
@@ -154,8 +154,7 @@ func TestAppLockServiceAcquire(t *testing.T) {
 		db := testutils.NewDatabaseForTest(t)
 		service := newTestAppLockService(t, db)

-		raw := "this-is-not-json"
-		err := db.Create(&model.KV{Key: lockKey, Value: &raw}).Error
+		err := db.Create(&model.KV{Key: lockKey, Value: new("this-is-not-json")}).Error
 		require.NoError(t, err)

 		_, err = service.Acquire(context.Background(), false)
--- a/backend/internal/service/custom_claim_service.go
+++ b/backend/internal/service/custom_claim_service.go
@@ -24,6 +24,7 @@ func isReservedClaim(key string) bool {
 		"family_name",
 		"name",
 		"email",
+		"email_verified",
 		"preferred_username",
 		"display_name",
 		"groups",
--- a/backend/internal/service/e2etest_service.go
+++ b/backend/internal/service/e2etest_service.go
@@ -236,6 +236,15 @@ func (s *TestService) SeedDatabase(baseURL string) error {
 					userGroups[1],
 				},
 			},
+			{
+				Base: model.Base{
+					ID: "a1b2c3d4-e5f6-7890-abcd-ef0000000001",
+				},
+				Name:         "PAR Test Client",
+				Secret:       "$2a$10$9dypwot8nGuCjT6wQWWpJOckZfRprhe2EkwpKizxS/fpVHrOLEJHC", // w2mUeZISmEvIDMEDvpY0PnxQIpj1m3zY
+				CallbackURLs: model.UrlList{"http://par-client/auth/callback"},
+				CreatedByID:  new(users[0].ID),
+			},
 		}
 		for _, client := range oidcClients {
 			if err := tx.Create(&client).Error; err != nil {
@@ -271,6 +280,7 @@ func (s *TestService) SeedDatabase(baseURL string) error {

 		refreshToken := model.OidcRefreshToken{
 			Token:                utils.CreateSha256Hash("ou87UDg249r1StBLYkMEqy9TXDbV5HmGuDpMcZDo"),
+			IdTokenJti:           new("dd75f6f6-ce0a-44b7-a645-7de390ccd2fa"),
 			AuthenticationMethod: AuthenticationMethodPhishingResistant,
 			ExpiresAt:            datatype.DateTime(time.Now().Add(24 * time.Hour)),
 			Scope:                "openid profile email",
@@ -309,6 +319,12 @@ func (s *TestService) SeedDatabase(baseURL string) error {
 				ClientID:   oidcClients[3].ID,
 				LastUsedAt: datatype.DateTime(time.Date(2025, 8, 12, 12, 0, 0, 0, time.UTC)),
 			},
+			{
+				Scope:      "openid profile email",
+				UserID:     users[0].ID,
+				ClientID:   oidcClients[5].ID,
+				LastUsedAt: datatype.DateTime(time.Date(2024, 1, 1, 0, 0, 0, 0, time.UTC)),
+			},
 		}
 		for _, userAuthorizedClient := range userAuthorizedClients {
 			if err := tx.Create(&userAuthorizedClient).Error; err != nil {
--- a/backend/internal/service/jwt_service.go
+++ b/backend/internal/service/jwt_service.go
@@ -258,64 +258,65 @@ func (s *JwtService) VerifyAccessToken(tokenString string) (jwt.Token, error) {
 }

 // BuildIDToken creates an ID token with all claims
-func (s *JwtService) BuildIDToken(userClaims map[string]any, clientID string, nonce string, authenticationMethod string) (jwt.Token, error) {
+func (s *JwtService) BuildIDToken(userClaims map[string]any, clientID string, nonce string, authenticationMethod string) (jwt.Token, string, error) {
 	now := time.Now()
+	jti := uuid.New().String()
 	token, err := jwt.NewBuilder().
 		Expiration(now.Add(1 * time.Hour)).
 		IssuedAt(now).
 		Issuer(s.envConfig.AppURL).
-		JwtID(uuid.New().String()).
+		JwtID(jti).
 		Build()
 	if err != nil {
-		return nil, fmt.Errorf("failed to build token: %w", err)
+		return nil, "", fmt.Errorf("failed to build token: %w", err)
 	}

 	err = SetAudienceString(token, clientID)
 	if err != nil {
-		return nil, fmt.Errorf("failed to set 'aud' claim in token: %w", err)
+		return nil, "", fmt.Errorf("failed to set 'aud' claim in token: %w", err)
 	}

 	err = SetTokenType(token, IDTokenJWTType)
 	if err != nil {
-		return nil, fmt.Errorf("failed to set 'type' claim in token: %w", err)
+		return nil, "", fmt.Errorf("failed to set 'type' claim in token: %w", err)
 	}

 	err = SetAuthenticationMethods(token, authenticationMethod)
 	if err != nil {
-		return nil, fmt.Errorf("failed to set '%s' claim in token: %w", AuthenticationMethodsClaim, err)
+		return nil, "", fmt.Errorf("failed to set '%s' claim in token: %w", AuthenticationMethodsClaim, err)
 	}

 	for k, v := range userClaims {
 		err = token.Set(k, v)
 		if err != nil {
-			return nil, fmt.Errorf("failed to set claim '%s': %w", k, err)
+			return nil, "", fmt.Errorf("failed to set claim '%s': %w", k, err)
 		}
 	}

 	if nonce != "" {
 		err = token.Set("nonce", nonce)
 		if err != nil {
-			return nil, fmt.Errorf("failed to set claim 'nonce': %w", err)
+			return nil, "", fmt.Errorf("failed to set claim 'nonce': %w", err)
 		}
 	}

-	return token, nil
+	return token, jti, nil
 }

 // GenerateIDToken creates and signs an ID token
-func (s *JwtService) GenerateIDToken(userClaims map[string]any, clientID string, nonce string, authenticationMethod string) (string, error) {
-	token, err := s.BuildIDToken(userClaims, clientID, nonce, authenticationMethod)
+func (s *JwtService) GenerateIDToken(userClaims map[string]any, clientID string, nonce string, authenticationMethod string) (signedToken, jti string, err error) {
+	token, jti, err := s.BuildIDToken(userClaims, clientID, nonce, authenticationMethod)
 	if err != nil {
-		return "", err
+		return "", "", err
 	}

 	alg, _ := s.privateKey.Algorithm()
 	signed, err := jwt.Sign(token, jwt.WithKey(alg, s.privateKey))
 	if err != nil {
-		return "", fmt.Errorf("failed to sign token: %w", err)
+		return "", "", fmt.Errorf("failed to sign token: %w", err)
 	}

-	return string(signed), nil
+	return string(signed), jti, nil
 }

 func (s *JwtService) VerifyIdToken(tokenString string, acceptExpiredTokens bool) (jwt.Token, error) {
--- a/backend/internal/service/jwt_service_test.go
+++ b/backend/internal/service/jwt_service_test.go
@@ -530,9 +530,10 @@ func TestGenerateVerifyIdToken(t *testing.T) {
 		}
 		const clientID = "test-client-123"

-		tokenString, err := service.GenerateIDToken(userClaims, clientID, "", "")
+		tokenString, jti, err := service.GenerateIDToken(userClaims, clientID, "", "")
 		require.NoError(t, err, "Failed to generate ID token")
 		assert.NotEmpty(t, tokenString, "Token should not be empty")
+		assert.Regexp(t, uuidRegexPattern, jti, "Returned JWT ID is not a UUID")

 		claims, err := service.VerifyIdToken(tokenString, false)
 		require.NoError(t, err, "Failed to verify generated ID token")
@@ -549,6 +550,7 @@ func TestGenerateVerifyIdToken(t *testing.T) {
 		jwtID, ok := claims.JwtID()
 		_ = assert.True(t, ok, "JWT ID not found in token") &&
 			assert.Regexp(t, uuidRegexPattern, jwtID, "JWT ID is not a UUID")
+		assert.Equal(t, jti, jwtID, "Returned JWT ID should match token claim")

 		expectedExp := time.Now().Add(1 * time.Hour)
 		expiration, ok := claims.Expiration()
@@ -615,7 +617,7 @@ func TestGenerateVerifyIdToken(t *testing.T) {
 		const clientID = "test-client-456"
 		nonce := "random-nonce-value"

-		tokenString, err := service.GenerateIDToken(userClaims, clientID, nonce, "")
+		tokenString, _, err := service.GenerateIDToken(userClaims, clientID, nonce, "")
 		require.NoError(t, err, "Failed to generate ID token with nonce")

 		publicKey, err := service.GetPublicJWK()
@@ -636,7 +638,7 @@ func TestGenerateVerifyIdToken(t *testing.T) {
 		userClaims := map[string]any{
 			"sub": "user789",
 		}
-		tokenString, err := service.GenerateIDToken(userClaims, "client-789", "", "")
+		tokenString, _, err := service.GenerateIDToken(userClaims, "client-789", "", "")
 		require.NoError(t, err, "Failed to generate ID token")

 		service.envConfig.AppURL = "https://wrong-issuer.com"
@@ -662,7 +664,7 @@ func TestGenerateVerifyIdToken(t *testing.T) {
 		}
 		const clientID = "eddsa-client-123"

-		tokenString, err := service.GenerateIDToken(userClaims, clientID, "", "")
+		tokenString, _, err := service.GenerateIDToken(userClaims, clientID, "", "")
 		require.NoError(t, err, "Failed to generate ID token with key")
 		assert.NotEmpty(t, tokenString, "Token should not be empty")

@@ -699,7 +701,7 @@ func TestGenerateVerifyIdToken(t *testing.T) {
 		}
 		const clientID = "ecdsa-client-123"

-		tokenString, err := service.GenerateIDToken(userClaims, clientID, "", "")
+		tokenString, _, err := service.GenerateIDToken(userClaims, clientID, "", "")
 		require.NoError(t, err, "Failed to generate ID token with key")
 		assert.NotEmpty(t, tokenString, "Token should not be empty")

@@ -737,7 +739,7 @@ func TestGenerateVerifyIdToken(t *testing.T) {
 		}
 		const clientID = "rsa-client-123"

-		tokenString, err := service.GenerateIDToken(userClaims, clientID, "", "")
+		tokenString, _, err := service.GenerateIDToken(userClaims, clientID, "", "")
 		require.NoError(t, err, "Failed to generate ID token with key")
 		assert.NotEmpty(t, tokenString, "Token should not be empty")

--- a/backend/internal/service/ldap_service.go
+++ b/backend/internal/service/ldap_service.go
@@ -583,8 +583,7 @@ func (s *LdapService) reconcileUsers(ctx context.Context, tx *gorm.DB, desiredUs

 		err = s.userService.deleteUserInternal(ctx, tx, user.ID, true)
 		if err != nil {
-			target := &common.LdapUserUpdateError{}
-			if errors.As(err, &target) {
+			if _, ok := errors.AsType[*common.LdapUserUpdateError](err); ok {
 				return nil, nil, fmt.Errorf("failed to delete user %s: LDAP user must be disabled before deletion", user.Username)
 			}
 			return nil, nil, fmt.Errorf("failed to delete user %s: %w", user.Username, err)
--- a/backend/internal/service/oidc_service.go
+++ b/backend/internal/service/oidc_service.go
@@ -34,6 +34,7 @@ import (
 	datatype "github.com/pocket-id/pocket-id/backend/internal/model/types"
 	"github.com/pocket-id/pocket-id/backend/internal/storage"
 	"github.com/pocket-id/pocket-id/backend/internal/utils"
+	imageutil "github.com/pocket-id/pocket-id/backend/internal/utils/image"
 )

 const (
@@ -47,6 +48,9 @@ const (
 	AccessTokenDuration  = time.Hour
 	RefreshTokenDuration = 30 * 24 * time.Hour // 30 days
 	DeviceCodeDuration   = 15 * time.Minute
+	PARDuration          = 90 * time.Second
+
+	parRequestURIPrefix = "urn:ietf:params:oauth:request_uri:"
 )

 type OidcService struct {
@@ -137,6 +141,18 @@ func (s *OidcService) Authorize(ctx context.Context, input dto.AuthorizeOidcClie
 		return "", "", err
 	}

+	// If the client requires PAR, a request_uri must be provided
+	if client.RequiresPushedAuthorizationRequests && input.RequestURI == "" {
+		return "", "", &common.OidcPARRequiredError{}
+	}
+
+	// If a request_uri is provided, consume the stored PAR and overwrite input fields
+	if input.RequestURI != "" {
+		if err := s.applyPushedAuthorizationRequest(ctx, tx, &input); err != nil {
+			return "", "", err
+		}
+	}
+
 	// If the client is not public, the code challenge must be provided
 	if client.IsPublic && input.CodeChallenge == "" {
 		return "", "", &common.OidcMissingCodeChallengeError{}
@@ -151,22 +167,20 @@ func (s *OidcService) Authorize(ctx context.Context, input dto.AuthorizeOidcClie

 	// Parse prompt parameter (space-delimited list per OIDC spec)
 	promptValues := parsePromptParameter(input.Prompt)
-	hasPromptNone := contains(promptValues, "none")
-	hasPromptLogin := contains(promptValues, "login")
-	hasPromptConsent := contains(promptValues, "consent")
-	hasPromptSelectAccount := contains(promptValues, "select_account")
+	hasPromptNone := slices.Contains(promptValues, "none")
+	hasPromptLogin := slices.Contains(promptValues, "login")
+	hasPromptConsent := slices.Contains(promptValues, "consent")
+	hasPromptSelectAccount := slices.Contains(promptValues, "select_account")

 	// Validate prompt parameter conflicts early.
 	// Per OIDC Core §3.1.2.6, prompt=none must not be combined with any
 	// value that requires user interaction.
 	if hasPromptNone && (hasPromptConsent || hasPromptLogin || hasPromptSelectAccount) {
-		return "", "", &common.OidcInteractionRequiredError{}
+		return "", "", common.NewOidcInvalidRequestError("prompt type 'none' cannot be combined with others")
 	}

-	// Handle prompt=select_account early (not supported)
-	if hasPromptSelectAccount {
-		return "", "", &common.OidcInteractionRequiredError{}
-	}
+	// prompt=select_account is handled entirely in the UI
+	// Pocket ID holds one session per browser, so the frontend renders the current user as the sole selectable account and then calls Authorize normally.

 	// If prompt=login is specified or the client requires reauthentication, check the reauthentication token
 	if hasPromptLogin || client.RequiresReauthentication {
@@ -219,24 +233,71 @@ func (s *OidcService) Authorize(ctx context.Context, input dto.AuthorizeOidcClie

 	// Log the authorization event
 	if hasAlreadyAuthorizedClient {
-		s.auditLogService.Create(ctx, model.AuditLogEventClientAuthorization, ipAddress, userAgent, userID, model.AuditLogData{"clientName": client.Name}, tx)
+		s.auditLogService.Create(
+			ctx, model.AuditLogEventClientAuthorization,
+			ipAddress, userAgent, userID,
+			model.AuditLogData{"clientName": client.Name},
+			tx,
+		)
 	} else {
-		s.auditLogService.Create(ctx, model.AuditLogEventNewClientAuthorization, ipAddress, userAgent, userID, model.AuditLogData{"clientName": client.Name}, tx)
+		s.auditLogService.Create(
+			ctx, model.AuditLogEventNewClientAuthorization,
+			ipAddress, userAgent, userID,
+			model.AuditLogData{"clientName": client.Name},
+			tx,
+		)
 	}

 	err = tx.Commit().Error
 	if err != nil {
-		return "", "", err
+		return "", "", fmt.Errorf("failed to commit transaction: %w", err)
 	}

 	return code, callbackURL, nil
 }

+// applyPushedAuthorizationRequest consumes the stored PAR for the given request_uri
+// and overwrites the corresponding fields on input.
+func (s *OidcService) applyPushedAuthorizationRequest(ctx context.Context, tx *gorm.DB, input *dto.AuthorizeOidcClientRequestDto) error {
+	parMeta, err := s.getAndConsumePushedAuthorizationRequest(ctx, tx, input.ClientID, input.RequestURI)
+	if err != nil {
+		return err
+	}
+	par := parMeta.Parameters
+
+	input.Scope = par.Scope
+	input.CallbackURL = par.RedirectURI
+	input.Nonce = par.Nonce
+	input.Prompt = par.Prompt
+	input.CodeChallenge = par.CodeChallenge
+	input.CodeChallengeMethod = par.CodeChallengeMethod
+
+	return nil
+}
+
 // HasAuthorizedClient checks if the user has already authorized the client with the given scope
 func (s *OidcService) HasAuthorizedClient(ctx context.Context, clientID, userID, scope string) (bool, error) {
 	return s.hasAuthorizedClientInternal(ctx, clientID, userID, scope, s.db)
 }

+// AuthorizationRequired reports whether the user must confirm authorization for the client.
+func (s *OidcService) AuthorizationRequired(ctx context.Context, clientID, userID, scope, requestURI string) (required bool, resolvedScope string, err error) {
+	if requestURI != "" {
+		par, err := s.getPushedAuthorizationRequestInternal(ctx, s.db, clientID, requestURI)
+		if err != nil {
+			return false, "", err
+		}
+		scope = par.Parameters.Scope
+	}
+
+	hasAuthorized, err := s.hasAuthorizedClientInternal(ctx, clientID, userID, scope, s.db)
+	if err != nil {
+		return false, "", err
+	}
+
+	return !hasAuthorized, scope, nil
+}
+
 func (s *OidcService) hasAuthorizedClientInternal(ctx context.Context, clientID, userID, scope string, tx *gorm.DB) (bool, error) {
 	var userAuthorizedOidcClient model.UserAuthorizedOidcClient
 	err := tx.
@@ -345,12 +406,12 @@ func (s *OidcService) createTokenFromDeviceCode(ctx context.Context, input dto.O
 	}

 	// Explicitly use the input clientID for the audience claim to ensure consistency
-	idToken, err := s.jwtService.GenerateIDToken(userClaims, input.ClientID, deviceAuth.Nonce, deviceAuth.AuthenticationMethod)
+	idToken, idTokenJti, err := s.jwtService.GenerateIDToken(userClaims, input.ClientID, deviceAuth.Nonce, deviceAuth.AuthenticationMethod)
 	if err != nil {
 		return CreatedTokens{}, err
 	}

-	refreshToken, err := s.createRefreshToken(ctx, input.ClientID, *deviceAuth.UserID, deviceAuth.Scope, deviceAuth.AuthenticationMethod, tx)
+	refreshToken, err := s.createRefreshToken(ctx, input.ClientID, *deviceAuth.UserID, deviceAuth.Scope, deviceAuth.AuthenticationMethod, idTokenJti, tx)
 	if err != nil {
 		return CreatedTokens{}, err
 	}
@@ -446,13 +507,13 @@ func (s *OidcService) createTokenFromAuthorizationCode(ctx context.Context, inpu

 	authenticationMethod := authorizationCodeMetaData.AuthenticationMethod

-	idToken, err := s.jwtService.GenerateIDToken(userClaims, input.ClientID, authorizationCodeMetaData.Nonce, authenticationMethod)
+	idToken, idTokenJti, err := s.jwtService.GenerateIDToken(userClaims, input.ClientID, authorizationCodeMetaData.Nonce, authenticationMethod)
 	if err != nil {
 		return CreatedTokens{}, err
 	}

 	// Generate a refresh token
-	refreshToken, err := s.createRefreshToken(ctx, input.ClientID, authorizationCodeMetaData.UserID, authorizationCodeMetaData.Scope, authenticationMethod, tx)
+	refreshToken, err := s.createRefreshToken(ctx, input.ClientID, authorizationCodeMetaData.UserID, authorizationCodeMetaData.Scope, authenticationMethod, idTokenJti, tx)
 	if err != nil {
 		return CreatedTokens{}, err
 	}
@@ -586,13 +647,13 @@ func (s *OidcService) createTokenFromRefreshToken(ctx context.Context, input dto

 	// Generate a new ID token
 	// There's no nonce here because we don't have one with the refresh token, but that's not required
-	idToken, err := s.jwtService.GenerateIDToken(userClaims, input.ClientID, "", authenticationMethods)
+	idToken, idTokenJti, err := s.jwtService.GenerateIDToken(userClaims, input.ClientID, "", authenticationMethods)
 	if err != nil {
 		return CreatedTokens{}, err
 	}

 	// Generate a new refresh token and invalidate the old one
-	newRefreshToken, err := s.createRefreshToken(ctx, input.ClientID, storedRefreshToken.UserID, storedRefreshToken.Scope, authenticationMethods, tx)
+	newRefreshToken, err := s.createRefreshToken(ctx, input.ClientID, storedRefreshToken.UserID, storedRefreshToken.Scope, authenticationMethods, idTokenJti, tx)
 	if err != nil {
 		return CreatedTokens{}, err
 	}
@@ -737,11 +798,10 @@ func (s *OidcService) introspectRefreshToken(ctx context.Context, clientID strin
 		).
 		First(&storedRefreshToken).
 		Error
-	if err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			introspectDto.Active = false
-			return introspectDto, nil
-		}
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		introspectDto.Active = false
+		return introspectDto, nil
+	} else if err != nil {
 		return introspectDto, err
 	}

@@ -754,6 +814,27 @@ func (s *OidcService) GetClient(ctx context.Context, clientID string) (model.Oid
 	return s.getClientInternal(ctx, clientID, s.db, false)
 }

+func (s *OidcService) ResolveAllowedCallbackURL(ctx context.Context, clientID, inputCallbackURL string) (string, error) {
+	client, err := s.GetClient(ctx, clientID)
+	if err != nil {
+		return "", err
+	}
+
+	if inputCallbackURL == "" || len(client.CallbackURLs) == 0 {
+		return "", &common.OidcMissingCallbackURLError{}
+	}
+
+	matched, err := utils.GetCallbackURLFromList(client.CallbackURLs, inputCallbackURL)
+	if err != nil {
+		return "", err
+	}
+	if matched == "" {
+		return "", &common.OidcInvalidCallbackURLError{}
+	}
+
+	return matched, nil
+}
+
 func (s *OidcService) getClientInternal(ctx context.Context, clientID string, tx *gorm.DB, forUpdate bool) (model.OidcClient, error) {
 	var client model.OidcClient
 	q := tx.
@@ -896,6 +977,8 @@ func updateOIDCClientModelFromDto(client *model.OidcClient, input *dto.OidcClien
 	// PKCE is required for public clients
 	client.PkceEnabled = input.IsPublic || input.PkceEnabled
 	client.RequiresReauthentication = input.RequiresReauthentication
+	// PAR is not available for public clients, so ignore the flag if the client is public
+	client.RequiresPushedAuthorizationRequests = !input.IsPublic && input.RequiresPushedAuthorizationRequests
 	client.LaunchURL = input.LaunchURL
 	client.IsGroupRestricted = input.IsGroupRestricted

@@ -1034,7 +1117,12 @@ func (s *OidcService) UpdateClientLogo(ctx context.Context, clientID string, fil
 		return err
 	}
 	defer reader.Close()
-	err = s.fileStorage.Save(ctx, imagePath, reader)
+	strippedReader, err := imageutil.StripMetadata(reader, fileType)
+	if err != nil {
+		return err
+	}
+
+	err = s.fileStorage.Save(ctx, imagePath, strippedReader)
 	if err != nil {
 		return err
 	}
@@ -1167,7 +1255,7 @@ func (s *OidcService) UpdateAllowedUserGroups(ctx context.Context, id string, in
 }

 // ValidateEndSession returns the logout callback URL for the client if all the validations pass
-func (s *OidcService) ValidateEndSession(ctx context.Context, input dto.OidcLogoutDto, userID string) (string, error) {
+func (s *OidcService) ValidateEndSession(ctx context.Context, input dto.OidcLogoutDto, userID string) (callbackURL string, err error) {
 	// If no ID token hint is provided, return an error
 	if input.IdTokenHint == "" {
 		return "", &common.TokenInvalidError{}
@@ -1189,9 +1277,22 @@ func (s *OidcService) ValidateEndSession(ctx context.Context, input dto.OidcLogo
 		return "", &common.OidcClientIdNotMatchingError{}
 	}

+	subject, ok := token.Subject()
+	if !ok || subject != userID {
+		return "", &common.TokenInvalidError{}
+	}
+
+	idTokenJti, ok := token.JwtID()
+	if !ok {
+		return "", &common.TokenInvalidError{}
+	}
+
+	tx := s.db.Begin()
+	defer tx.Rollback()
+
 	// Check if the user has authorized the client before
 	var userAuthorizedOIDCClient model.UserAuthorizedOidcClient
-	err = s.db.
+	err = tx.
 		WithContext(ctx).
 		Preload("Client").
 		First(&userAuthorizedOIDCClient, "client_id = ? AND user_id = ?", clientID[0], userID).
@@ -1200,16 +1301,27 @@ func (s *OidcService) ValidateEndSession(ctx context.Context, input dto.OidcLogo
 		return "", &common.OidcMissingAuthorizationError{}
 	}

-	// If the client has no logout callback URLs, return an error
-	if len(userAuthorizedOIDCClient.Client.LogoutCallbackURLs) == 0 {
-		return "", &common.OidcNoCallbackURLError{}
+	// If the client has a callback URL, validate it
+	if len(userAuthorizedOIDCClient.Client.LogoutCallbackURLs) > 0 {
+		callbackURL, err = s.getLogoutCallbackURL(&userAuthorizedOIDCClient.Client, input.PostLogoutRedirectUri)
+		if err != nil {
+			return "", err
+		}
 	}

-	callbackURL, err := s.getLogoutCallbackURL(&userAuthorizedOIDCClient.Client, input.PostLogoutRedirectUri)
+	err = tx.
+		WithContext(ctx).
+		Where("user_id = ? AND client_id = ? AND id_token_jti = ?", userID, clientID[0], idTokenJti).
+		Delete(&model.OidcRefreshToken{}).
+		Error
 	if err != nil {
 		return "", err
 	}

+	if err := tx.Commit().Error; err != nil {
+		return "", fmt.Errorf("failed to commit transaction: %w", err)
+	}
+
 	return callbackURL, nil
 }

@@ -1219,7 +1331,10 @@ func (s *OidcService) createAuthorizationCode(ctx context.Context, clientID stri
 		return "", err
 	}

-	codeChallengeMethodSha256 := strings.ToUpper(codeChallengeMethod) == "S256"
+	codeChallengeMethodSha256, err := codeChallengeMethodIsSha256(codeChallengeMethod)
+	if err != nil {
+		return "", err
+	}

 	oidcAuthorizationCode := model.OidcAuthorizationCode{
 		ExpiresAt:                 datatype.DateTime(time.Now().Add(15 * time.Minute)),
@@ -1244,6 +1359,129 @@ func (s *OidcService) createAuthorizationCode(ctx context.Context, clientID stri
 	return randomString, nil
 }

+func codeChallengeMethodIsSha256(codeChallengeMethod string) (bool, error) {
+	switch strings.ToUpper(codeChallengeMethod) {
+	case "":
+		return false, nil
+	case "PLAIN":
+		return false, nil
+	case "S256":
+		return true, nil
+	default:
+		return false, common.NewOidcInvalidRequestError("code challenge method not supported")
+	}
+}
+
+// CreatePushedAuthorizationRequest validates and stores authorization parameters for PAR (RFC 9126).
+// Only confidential clients (non-public) may use this endpoint.
+func (s *OidcService) CreatePushedAuthorizationRequest(ctx context.Context, creds ClientAuthCredentials, input dto.OidcPARRequestDto) (requestURI string, expiresIn int, err error) {
+	// Public clients are not allowed, but we allow them in this step for better error messages
+	client, err := s.verifyClientCredentialsInternal(ctx, s.db, creds, true)
+	if err != nil {
+		return "", 0, err
+	}
+
+	// Reject public clients here
+	if client.IsPublic {
+		return "", 0, &common.OidcPARNotSupportedForPublicClientsError{}
+	}
+
+	if input.ResponseType != "code" {
+		return "", 0, common.NewOidcInvalidRequestError("unsupported response_type: only 'code' is supported")
+	}
+
+	// Validate redirect_uri at push time (BCP requirement)
+	if _, err = s.getCallbackURL(client, input.RedirectURI, s.db, ctx); err != nil {
+		return "", 0, err
+	}
+
+	randomSuffix, err := utils.GenerateRandomAlphanumericString(32)
+	if err != nil {
+		return "", 0, fmt.Errorf("failed to generate request URI: %w", err)
+	}
+	requestURI = parRequestURIPrefix + randomSuffix
+
+	par := model.OidcPushedAuthorizationRequest{
+		RequestURI: requestURI,
+		ClientID:   client.ID,
+		ExpiresAt:  datatype.DateTime(time.Now().Add(PARDuration)),
+		Parameters: model.OidcAuthorizationRequestParameters{
+			Scope:               input.Scope,
+			RedirectURI:         input.RedirectURI,
+			State:               input.State,
+			Nonce:               input.Nonce,
+			CodeChallenge:       input.CodeChallenge,
+			CodeChallengeMethod: input.CodeChallengeMethod,
+			ResponseType:        input.ResponseType,
+			Prompt:              input.Prompt,
+			ResponseMode:        input.ResponseMode,
+		},
+	}
+
+	if err = s.db.WithContext(ctx).Create(&par).Error; err != nil {
+		return "", 0, fmt.Errorf("failed to store pushed authorization request: %w", err)
+	}
+
+	return requestURI, int(PARDuration.Seconds()), nil
+}
+
+// GetPushedAuthorizationRequest retrieves a PAR record without consuming it.
+func (s *OidcService) GetPushedAuthorizationRequest(ctx context.Context, clientID, requestURI string) (model.OidcPushedAuthorizationRequest, error) {
+	return s.getPushedAuthorizationRequestInternal(ctx, s.db, clientID, requestURI)
+}
+
+// getPushedAuthorizationRequestInternal retrieves a PAR record without consuming it.
+func (s *OidcService) getPushedAuthorizationRequestInternal(ctx context.Context, tx *gorm.DB, clientID, requestURI string) (model.OidcPushedAuthorizationRequest, error) {
+	var par model.OidcPushedAuthorizationRequest
+	err := tx.
+		WithContext(ctx).
+		Where(
+			"request_uri = ? AND client_id = ? AND expires_at > ?",
+			requestURI,
+			clientID,
+			datatype.DateTime(time.Now()),
+		).
+		First(&par).
+		Error
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return par, &common.OidcInvalidRequestURIError{}
+		}
+		return par, err
+	}
+
+	return par, nil
+}
+
+// getAndConsumePushedAuthorizationRequest atomically retrieves and deletes a PAR record.
+// Returns OidcInvalidRequestURIError if the record is not found, expired, or belongs to a different client.
+func (s *OidcService) getAndConsumePushedAuthorizationRequest(ctx context.Context, tx *gorm.DB, clientID, requestURI string) (model.OidcPushedAuthorizationRequest, error) {
+	var par model.OidcPushedAuthorizationRequest
+	err := tx.
+		WithContext(ctx).
+		Clauses(clause.Returning{}).
+		Where(
+			"request_uri = ? AND client_id = ? AND expires_at > ?",
+			requestURI,
+			clientID,
+			datatype.DateTime(time.Now()),
+		).
+		Delete(&par).
+		Error
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return par, &common.OidcInvalidRequestURIError{}
+		}
+		return par, err
+	}
+	// After DELETE … RETURNING, check if a row was actually deleted
+	if par.ID == "" {
+		return par, &common.OidcInvalidRequestURIError{}
+	}
+
+	return par, nil
+}
+
 func validateCodeVerifier(codeVerifier, codeChallenge string, codeChallengeMethodSha256 bool) bool {
 	if codeVerifier == "" || codeChallenge == "" {
 		return false
@@ -1633,7 +1871,7 @@ func (s *OidcService) ListAccessibleOidcClients(ctx context.Context, userID stri
 	return dtos, response, err
 }

-func (s *OidcService) createRefreshToken(ctx context.Context, clientID string, userID string, scope string, authenticationMethod string, tx *gorm.DB) (string, error) {
+func (s *OidcService) createRefreshToken(ctx context.Context, clientID string, userID string, scope string, authenticationMethod string, idTokenJti string, tx *gorm.DB) (string, error) {
 	refreshToken, err := utils.GenerateRandomAlphanumericString(40)
 	if err != nil {
 		return "", err
@@ -1646,6 +1884,7 @@ func (s *OidcService) createRefreshToken(ctx context.Context, clientID string, u
 	m := model.OidcRefreshToken{
 		ExpiresAt:            datatype.DateTime(time.Now().Add(RefreshTokenDuration)),
 		Token:                refreshTokenHash,
+		IdTokenJti:           &idTokenJti,
 		ClientID:             clientID,
 		UserID:               userID,
 		Scope:                scope,
@@ -1779,14 +2018,18 @@ func (s *OidcService) jwkSetForURL(ctx context.Context, url string) (set jwk.Set
 		// We set a timeout because otherwise Register will keep trying in case of errors
 		registerCtx, registerCancel := context.WithTimeout(ctx, 15*time.Second)
 		defer registerCancel()
-		// We need to register the URL
-		err = s.jwkCache.Register(
-			registerCtx,
-			url,
-			jwk.WithMaxInterval(24*time.Hour),
-			jwk.WithMinInterval(15*time.Minute),
+
+		registerOptions := []jwk.RegisterOption{
+			jwk.WithMaxInterval(24 * time.Hour),
+			jwk.WithMinInterval(15 * time.Minute),
 			jwk.WithWaitReady(true),
-		)
+		}
+		if s.httpClient != nil {
+			registerOptions = append(registerOptions, jwk.WithHTTPClient(s.httpClient))
+		}
+
+		// We need to register the URL
+		err = s.jwkCache.Register(registerCtx, url, registerOptions...)
 		// In case of race conditions (two goroutines calling jwkCache.Register at the same time), it's possible we can get a conflict anyways, so we ignore that error
 		if err != nil && !errors.Is(err, httprc.ErrResourceAlreadyExists()) {
 			return nil, fmt.Errorf("failed to register JWK set: %w", err)
@@ -1901,7 +2144,7 @@ func (s *OidcService) GetClientPreview(ctx context.Context, clientID string, use
 		return nil, err
 	}

-	idToken, err := s.jwtService.BuildIDToken(userClaims, clientID, "", authenticationMethod)
+	idToken, _, err := s.jwtService.BuildIDToken(userClaims, clientID, "", authenticationMethod)
 	if err != nil {
 		return nil, err
 	}
@@ -2105,8 +2348,16 @@ func (s *OidcService) downloadAndSaveLogoFromURL(parentCtx context.Context, clie
 		darkSuffix = "-dark"
 	}

+	limitReader := utils.NewLimitReader(resp.Body, maxLogoSize+1)
+	strippedReader, err := imageutil.StripMetadata(limitReader, ext)
+	if errors.Is(err, utils.ErrSizeExceeded) {
+		return errLogoTooLarge
+	} else if err != nil {
+		return err
+	}
+
 	imagePath := path.Join("oidc-client-images", clientID+darkSuffix+"."+ext)
-	err = s.fileStorage.Save(ctx, imagePath, utils.NewLimitReader(resp.Body, maxLogoSize+1))
+	err = s.fileStorage.Save(ctx, imagePath, strippedReader)
 	if errors.Is(err, utils.ErrSizeExceeded) {
 		return errLogoTooLarge
 	} else if err != nil {
@@ -2194,13 +2445,3 @@ func parsePromptParameter(prompt string) []string {
 	}
 	return strings.Fields(prompt)
 }
-
-// contains checks if a string slice contains a specific value
-func contains(slice []string, value string) bool {
-	for _, item := range slice {
-		if item == value {
-			return true
-		}
-	}
-	return false
-}
--- a/backend/internal/service/oidc_service_test.go
+++ b/backend/internal/service/oidc_service_test.go
@@ -10,6 +10,7 @@ import (
 	"encoding/json"
 	"io"
 	"net/http"
+	"slices"
 	"strconv"
 	"strings"
 	"testing"
@@ -25,6 +26,7 @@ import (
 	"github.com/pocket-id/pocket-id/backend/internal/common"
 	"github.com/pocket-id/pocket-id/backend/internal/dto"
 	"github.com/pocket-id/pocket-id/backend/internal/model"
+	datatype "github.com/pocket-id/pocket-id/backend/internal/model/types"
 	"github.com/pocket-id/pocket-id/backend/internal/storage"
 	testutils "github.com/pocket-id/pocket-id/backend/internal/utils/testing"
 )
@@ -582,10 +584,9 @@ func TestOidcServiceRefreshTokenAuthorizationState(t *testing.T) {
 			appConfigService: mockConfig,
 		}

-		email := "refresh-token-user@example.com"
 		user := model.User{
 			Username:      "refresh-token-user",
-			Email:         &email,
+			Email:         new("refresh-token-user@example.com"),
 			EmailVerified: true,
 			FirstName:     "Refresh",
 			LastName:      "User",
@@ -623,7 +624,7 @@ func TestOidcServiceRefreshTokenAuthorizationState(t *testing.T) {
 			Scope:    scope,
 		}).Error)

-		refreshToken, err := service.createRefreshToken(t.Context(), client.ID, user.ID, scope, AuthenticationMethodPhishingResistant, db)
+		refreshToken, err := service.createRefreshToken(t.Context(), client.ID, user.ID, scope, AuthenticationMethodPhishingResistant, "03f94e54-53c4-42f8-afe5-918ffd97a30e", db)
 		require.NoError(t, err)

 		return service, db, user, client, clientSecret, refreshToken, userGroup
@@ -728,7 +729,7 @@ func TestOidcServiceAuthenticationMethodsPersistence(t *testing.T) {
 	})

 	t.Run("stores authentication methods on refresh tokens", func(t *testing.T) {
-		_, err := service.createRefreshToken(t.Context(), "amr-client", "amr-user", "openid profile", authenticationMethod, db)
+		_, err := service.createRefreshToken(t.Context(), "amr-client", "amr-user", "openid profile", authenticationMethod, "03f94e54-53c4-42f8-afe5-918ffd97a30e", db)
 		require.NoError(t, err)

 		var refreshToken model.OidcRefreshToken
@@ -762,6 +763,61 @@ func TestValidateCodeVerifier_Plain(t *testing.T) {
 	})
 }

+func TestCodeChallengeMethodIsSha256(t *testing.T) {
+	tests := []struct {
+		name       string
+		method     string
+		wantSha256 bool
+		wantErr    bool
+	}{
+		{
+			name:       "omitted defaults to plain",
+			method:     "",
+			wantSha256: false,
+		},
+		{
+			name:       "plain",
+			method:     "plain",
+			wantSha256: false,
+		},
+		{
+			name:       "plain case insensitive",
+			method:     "PLAIN",
+			wantSha256: false,
+		},
+		{
+			name:       "s256",
+			method:     "S256",
+			wantSha256: true,
+		},
+		{
+			name:       "s256 case insensitive",
+			method:     "s256",
+			wantSha256: true,
+		},
+		{
+			name:    "unknown method",
+			method:  "S384",
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := codeChallengeMethodIsSha256(tt.method)
+			if tt.wantErr {
+				require.Error(t, err)
+				var invalidRequest *common.OidcInvalidRequestError
+				require.ErrorAs(t, err, &invalidRequest)
+				return
+			}
+
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantSha256, got)
+		})
+	}
+}
+
 func TestOidcService_updateClientLogoType(t *testing.T) {
 	// Create a test database
 	db := testutils.NewDatabaseForTest(t)
@@ -895,6 +951,8 @@ func TestOidcService_updateClientLogoType(t *testing.T) {
 }

 func TestOidcService_downloadAndSaveLogoFromURL(t *testing.T) {
+	const publicLogoHost = "https://8.8.8.8"
+
 	// Create a test database
 	db := testutils.NewDatabaseForTest(t)

@@ -940,7 +998,7 @@ func TestOidcService_downloadAndSaveLogoFromURL(t *testing.T) {
 		// Create a mock HTTP client with responses
 		mockResponses := map[string]*http.Response{
 			//nolint:bodyclose
-			"https://example.com/logo.png": pngResponse,
+			publicLogoHost + "/logo.png": pngResponse,
 		}
 		httpClient := &http.Client{
 			Transport: &testutils.MockRoundTripper{
@@ -956,7 +1014,7 @@ func TestOidcService_downloadAndSaveLogoFromURL(t *testing.T) {
 		}

 		// Download and save the logo
-		err := s.downloadAndSaveLogoFromURL(t.Context(), client.ID, "https://example.com/logo.png", true)
+		err := s.downloadAndSaveLogoFromURL(t.Context(), client.ID, publicLogoHost+"/logo.png", true)
 		require.NoError(t, err)

 		// Verify the file was saved
@@ -985,7 +1043,7 @@ func TestOidcService_downloadAndSaveLogoFromURL(t *testing.T) {

 		mockResponses := map[string]*http.Response{
 			//nolint:bodyclose
-			"https://example.com/dark-logo.webp": webpResponse,
+			publicLogoHost + "/dark-logo.webp": webpResponse,
 		}
 		httpClient := &http.Client{
 			Transport: &testutils.MockRoundTripper{
@@ -1000,7 +1058,7 @@ func TestOidcService_downloadAndSaveLogoFromURL(t *testing.T) {
 		}

 		// Download and save the dark logo
-		err := s.downloadAndSaveLogoFromURL(t.Context(), client.ID, "https://example.com/dark-logo.webp", false)
+		err := s.downloadAndSaveLogoFromURL(t.Context(), client.ID, publicLogoHost+"/dark-logo.webp", false)
 		require.NoError(t, err)

 		// Verify the dark logo file was saved
@@ -1024,7 +1082,7 @@ func TestOidcService_downloadAndSaveLogoFromURL(t *testing.T) {

 		mockResponses := map[string]*http.Response{
 			//nolint:bodyclose
-			"https://example.com/icon.svg": testutils.NewMockResponse(http.StatusOK, string(svgContent)),
+			publicLogoHost + "/icon.svg": testutils.NewMockResponse(http.StatusOK, string(svgContent)),
 		}
 		httpClient := &http.Client{
 			Transport: &testutils.MockRoundTripper{
@@ -1038,7 +1096,7 @@ func TestOidcService_downloadAndSaveLogoFromURL(t *testing.T) {
 			httpClient:  httpClient,
 		}

-		err := s.downloadAndSaveLogoFromURL(t.Context(), client.ID, "https://example.com/icon.svg", true)
+		err := s.downloadAndSaveLogoFromURL(t.Context(), client.ID, publicLogoHost+"/icon.svg", true)
 		require.NoError(t, err)

 		// Verify SVG file was saved
@@ -1055,7 +1113,7 @@ func TestOidcService_downloadAndSaveLogoFromURL(t *testing.T) {

 		mockResponses := map[string]*http.Response{
 			//nolint:bodyclose
-			"https://example.com/logo": jpgResponse,
+			publicLogoHost + "/logo": jpgResponse,
 		}
 		httpClient := &http.Client{
 			Transport: &testutils.MockRoundTripper{
@@ -1069,7 +1127,7 @@ func TestOidcService_downloadAndSaveLogoFromURL(t *testing.T) {
 			httpClient:  httpClient,
 		}

-		err := s.downloadAndSaveLogoFromURL(t.Context(), client.ID, "https://example.com/logo", true)
+		err := s.downloadAndSaveLogoFromURL(t.Context(), client.ID, publicLogoHost+"/logo", true)
 		require.NoError(t, err)

 		// Verify JPG file was saved (jpeg extension is normalized to jpg)
@@ -1091,7 +1149,7 @@ func TestOidcService_downloadAndSaveLogoFromURL(t *testing.T) {
 	t.Run("Returns error for non-200 status code", func(t *testing.T) {
 		mockResponses := map[string]*http.Response{
 			//nolint:bodyclose
-			"https://example.com/not-found.png": testutils.NewMockResponse(http.StatusNotFound, "Not Found"),
+			publicLogoHost + "/not-found.png": testutils.NewMockResponse(http.StatusNotFound, "Not Found"),
 		}
 		httpClient := &http.Client{
 			Transport: &testutils.MockRoundTripper{
@@ -1105,7 +1163,7 @@ func TestOidcService_downloadAndSaveLogoFromURL(t *testing.T) {
 			httpClient:  httpClient,
 		}

-		err := s.downloadAndSaveLogoFromURL(t.Context(), client.ID, "https://example.com/not-found.png", true)
+		err := s.downloadAndSaveLogoFromURL(t.Context(), client.ID, publicLogoHost+"/not-found.png", true)
 		require.Error(t, err)
 		require.ErrorContains(t, err, "failed to fetch logo")
 	})
@@ -1121,7 +1179,7 @@ func TestOidcService_downloadAndSaveLogoFromURL(t *testing.T) {

 		mockResponses := map[string]*http.Response{
 			//nolint:bodyclose
-			"https://example.com/large.png": largeResponse,
+			publicLogoHost + "/large.png": largeResponse,
 		}
 		httpClient := &http.Client{
 			Transport: &testutils.MockRoundTripper{
@@ -1135,7 +1193,7 @@ func TestOidcService_downloadAndSaveLogoFromURL(t *testing.T) {
 			httpClient:  httpClient,
 		}

-		err := s.downloadAndSaveLogoFromURL(t.Context(), client.ID, "https://example.com/large.png", true)
+		err := s.downloadAndSaveLogoFromURL(t.Context(), client.ID, publicLogoHost+"/large.png", true)
 		require.Error(t, err)
 		require.ErrorIs(t, err, errLogoTooLarge)
 	})
@@ -1147,7 +1205,7 @@ func TestOidcService_downloadAndSaveLogoFromURL(t *testing.T) {

 		mockResponses := map[string]*http.Response{
 			//nolint:bodyclose
-			"https://example.com/file.txt": textResponse,
+			publicLogoHost + "/file.txt": textResponse,
 		}
 		httpClient := &http.Client{
 			Transport: &testutils.MockRoundTripper{
@@ -1161,7 +1219,7 @@ func TestOidcService_downloadAndSaveLogoFromURL(t *testing.T) {
 			httpClient:  httpClient,
 		}

-		err := s.downloadAndSaveLogoFromURL(t.Context(), client.ID, "https://example.com/file.txt", true)
+		err := s.downloadAndSaveLogoFromURL(t.Context(), client.ID, publicLogoHost+"/file.txt", true)
 		require.Error(t, err)
 		var fileTypeErr *common.FileTypeNotSupportedError
 		require.ErrorAs(t, err, &fileTypeErr)
@@ -1174,7 +1232,7 @@ func TestOidcService_downloadAndSaveLogoFromURL(t *testing.T) {

 		mockResponses := map[string]*http.Response{
 			//nolint:bodyclose
-			"https://example.com/logo.png": pngResponse,
+			publicLogoHost + "/logo.png": pngResponse,
 		}
 		httpClient := &http.Client{
 			Transport: &testutils.MockRoundTripper{
@@ -1188,12 +1246,121 @@ func TestOidcService_downloadAndSaveLogoFromURL(t *testing.T) {
 			httpClient:  httpClient,
 		}

-		err := s.downloadAndSaveLogoFromURL(t.Context(), "non-existent-client-id", "https://example.com/logo.png", true)
+		err := s.downloadAndSaveLogoFromURL(t.Context(), "non-existent-client-id", publicLogoHost+"/logo.png", true)
 		require.Error(t, err)
 		require.ErrorContains(t, err, "failed to look up client")
 	})
 }

+func TestOidcService_ValidateEndSessionDeletesMatchingRefreshToken(t *testing.T) {
+	db := testutils.NewDatabaseForTest(t)
+	common.EnvConfig.EncryptionKey = []byte("0123456789abcdef0123456789abcdef")
+	mockConfig := NewTestAppConfigService(&model.AppConfig{
+		SessionDuration: model.AppConfigVariable{Value: "60"},
+	})
+	mockJwtService, err := NewJwtService(t.Context(), db, mockConfig)
+	require.NoError(t, err)
+
+	oidcService := &OidcService{
+		db:         db,
+		jwtService: mockJwtService,
+	}
+
+	userID := "test-user-123"
+	clientID := "test-client-456"
+	otherClientID := "other-client-789"
+	otherIDTokenJti := "ac653f42-4781-49f2-bc7c-cc44503c3a1a" //nolint:gosec
+	userEmail := "test@example.com"
+
+	user := model.User{
+		Base:  model.Base{ID: userID},
+		Email: &userEmail,
+	}
+	require.NoError(t, db.Create(&user).Error)
+
+	client := model.OidcClient{
+		Base:               model.Base{ID: clientID},
+		Name:               "Test Client",
+		LogoutCallbackURLs: []string{"https://example.com/logout"},
+	}
+	require.NoError(t, db.Create(&client).Error)
+
+	otherClient := model.OidcClient{
+		Base:               model.Base{ID: otherClientID},
+		Name:               "Other Client",
+		LogoutCallbackURLs: []string{"https://other.example.com/logout"},
+	}
+	require.NoError(t, db.Create(&otherClient).Error)
+
+	require.NoError(t, db.Create(&model.UserAuthorizedOidcClient{
+		UserID:   userID,
+		ClientID: clientID,
+	}).Error)
+
+	userClaims := map[string]any{
+		"sub":   userID,
+		"name":  "Test User",
+		"email": userEmail,
+	}
+	idToken, idTokenJti, err := mockJwtService.GenerateIDToken(userClaims, clientID, "", "")
+	require.NoError(t, err)
+
+	refreshTokens := []model.OidcRefreshToken{
+		{
+			Token:      "matching-refresh-token",
+			UserID:     userID,
+			ClientID:   clientID,
+			IdTokenJti: &idTokenJti,
+			ExpiresAt:  datatype.DateTime(time.Now().Add(time.Hour)),
+			Scope:      "openid profile",
+		},
+		{
+			Token:      "same-client-different-session",
+			UserID:     userID,
+			ClientID:   clientID,
+			IdTokenJti: &otherIDTokenJti,
+			ExpiresAt:  datatype.DateTime(time.Now().Add(time.Hour)),
+			Scope:      "openid profile",
+		},
+		{
+			Token:      "other-client-same-jti",
+			UserID:     userID,
+			ClientID:   otherClientID,
+			IdTokenJti: &idTokenJti,
+			ExpiresAt:  datatype.DateTime(time.Now().Add(time.Hour)),
+			Scope:      "openid profile",
+		},
+		{
+			Token:     "legacy-refresh-token",
+			UserID:    userID,
+			ClientID:  clientID,
+			ExpiresAt: datatype.DateTime(time.Now().Add(time.Hour)),
+			Scope:     "openid profile",
+		},
+	}
+	require.NoError(t, db.Create(&refreshTokens).Error)
+
+	callbackURL, err := oidcService.ValidateEndSession(t.Context(), dto.OidcLogoutDto{
+		IdTokenHint:           idToken,
+		ClientId:              clientID,
+		PostLogoutRedirectUri: "https://example.com/logout",
+	}, userID)
+	require.NoError(t, err)
+	assert.Equal(t, "https://example.com/logout", callbackURL)
+
+	var remainingTokens []model.OidcRefreshToken
+	require.NoError(t, db.Order("token").Find(&remainingTokens).Error)
+	remainingTokenValues := make([]string, len(remainingTokens))
+	for i, token := range remainingTokens {
+		remainingTokenValues[i] = token.Token
+	}
+	assert.ElementsMatch(t, []string{
+		"legacy-refresh-token",
+		"other-client-same-jti",
+		"same-client-different-session",
+	}, remainingTokenValues)
+}
+
 // Tests for prompt parameter parsing and handling
 func TestParsePromptParameter(t *testing.T) {
 	t.Run("empty prompt returns empty slice", func(t *testing.T) {
@@ -1236,30 +1403,13 @@ func TestPromptParameterConflicts(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			values := parsePromptParameter(tt.prompt)
-			hasNone := contains(values, "none")
-			hasConsent := contains(values, "consent")
-			hasLogin := contains(values, "login")
-			hasSelectAccount := contains(values, "select_account")
+			hasNone := slices.Contains(values, "none")
+			hasConsent := slices.Contains(values, "consent")
+			hasLogin := slices.Contains(values, "login")
+			hasSelectAccount := slices.Contains(values, "select_account")

 			conflict := hasNone && (hasConsent || hasLogin || hasSelectAccount)
 			assert.Equal(t, tt.expectConflict, conflict)
 		})
 	}
 }
-
-func TestContains(t *testing.T) {
-	t.Run("finds value in slice", func(t *testing.T) {
-		slice := []string{"none", "login", "consent"}
-		assert.True(t, contains(slice, "login"))
-	})
-
-	t.Run("returns false for missing value", func(t *testing.T) {
-		slice := []string{"none", "login"}
-		assert.False(t, contains(slice, "consent"))
-	})
-
-	t.Run("returns false for empty slice", func(t *testing.T) {
-		slice := []string{}
-		assert.False(t, contains(slice, "none"))
-	})
-}
--- a/backend/internal/service/version_service.go
+++ b/backend/internal/service/version_service.go
@@ -69,8 +69,7 @@ func (s *VersionService) GetLatestVersion(ctx context.Context) (string, error) {
 		return strings.TrimPrefix(payload.TagName, "v"), nil
 	})

-	var staleErr *utils.ErrStale
-	if errors.As(err, &staleErr) {
+	if staleErr, ok := errors.AsType[*utils.ErrStale](err); ok {
 		slog.Warn("Failed to fetch latest version, returning stale cache", "error", staleErr.Err)
 		return version, nil
 	}
--- a/backend/internal/storage/s3.go
+++ b/backend/internal/storage/s3.go
@@ -186,8 +186,7 @@ func (s *s3Storage) buildObjectKey(p string) string {
 }

 func isS3NotFound(err error) bool {
-	var apiErr smithy.APIError
-	if errors.As(err, &apiErr) {
+	if apiErr, ok := errors.AsType[smithy.APIError](err); ok {
 		if apiErr.ErrorCode() == "NotFound" || apiErr.ErrorCode() == "NoSuchKey" {
 			return true
 		}
--- a/backend/internal/utils/image/metadata.go
+++ b/backend/internal/utils/image/metadata.go
@@ -0,0 +1,106 @@
+package profilepicture
+
+import (
+	"bytes"
+	"encoding/binary"
+	"io"
+	"strings"
+
+	"github.com/zitadel/exifremove/pkg/exifremove"
+)
+
+const maxRIFFSize = ^uint32(0)
+
+// StripMetadata removes EXIF/XMP metadata from JPG, PNG and WEBP images
+// Returns a *bytes.Reader so that storage backends receive a seekable reader with a known content length,
+// which is required for correct checksum calculation on S3-compatible services
+func StripMetadata(file io.Reader, ext string) (*bytes.Reader, error) {
+	data, err := io.ReadAll(file)
+	if err != nil {
+		return nil, err
+	}
+
+	switch strings.ToLower(ext) {
+	case "jpg", "jpeg":
+		stripped, err := exifremove.Remove(data)
+		if err == nil {
+			return bytes.NewReader(stripped), nil
+		}
+		return bytes.NewReader(data), nil
+	case "png":
+		stripped, err := exifremove.Remove(data)
+		if err == nil {
+			return bytes.NewReader(stripped), nil
+		}
+		return bytes.NewReader(data), nil
+	case "webp":
+		return bytes.NewReader(stripWEBPMetadata(data)), nil
+	default:
+		return bytes.NewReader(data), nil
+	}
+}
+
+func stripWEBPMetadata(data []byte) []byte {
+	// Check if the file contains the RIFF...WEBP header
+	if len(data) < 12 || string(data[:4]) != "RIFF" || string(data[8:12]) != "WEBP" {
+		return data
+	}
+
+	var out bytes.Buffer
+	// Build the WEBP header
+	out.WriteString("RIFF")
+	out.Write([]byte{0, 0, 0, 0}) // Size will be filled at the end
+	out.WriteString("WEBP")
+
+	for pos := 12; pos < len(data); {
+		// Each RIFF chunk needs an 8 byte header
+		if pos+8 > len(data) {
+			return data
+		}
+
+		// Read the chunk type and payload size from the header
+		chunkType := string(data[pos : pos+4])
+		chunkSize := int(binary.LittleEndian.Uint32(data[pos+4 : pos+8]))
+		chunkEnd := pos + 8 + chunkSize
+		// Chunks with odd payload sizes include one additional byte at the end
+		if chunkSize%2 == 1 {
+			chunkEnd++
+		}
+
+		// End of chunk can't be more than the actual image data length
+		if chunkEnd > len(data) {
+			return data
+		}
+
+		// Remove chunks with the EXIF or XMP data type
+		if chunkType == "EXIF" || chunkType == "XMP " {
+			pos = chunkEnd
+			continue
+		}
+
+		// In the VP8X chunk there is a feature flag if the file contains any EXIF or XMP data
+		if chunkType == "VP8X" && chunkSize >= 10 {
+			// Copy the chunk because we don't want to modify the original one
+			chunk := make([]byte, chunkEnd-pos)
+			copy(chunk, data[pos:chunkEnd])
+
+			// Clear the Exif and XMP feature flags
+			chunk[8] &^= 0x0c
+			out.Write(chunk)
+		} else {
+			out.Write(data[pos:chunkEnd])
+		}
+
+		pos = chunkEnd
+	}
+
+	// WEBP image can max be 4GB in size
+	riffSize := out.Len() - 8
+	if riffSize < 0 || uint64(riffSize) > uint64(maxRIFFSize) {
+		return data
+	}
+
+	// Set the size in the header (byte 4-7)
+	binary.LittleEndian.PutUint32(out.Bytes()[4:8], uint32(riffSize))
+	return out.Bytes()
+}
--- a/backend/internal/utils/image/metadata_test.go
+++ b/backend/internal/utils/image/metadata_test.go
@@ -0,0 +1,81 @@
+package profilepicture
+
+import (
+	"bytes"
+	"encoding/binary"
+	"io"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestStripMetadata(t *testing.T) {
+	t.Run("removes WEBP EXIF and XMP chunks", func(t *testing.T) {
+		input := webpFile(
+			webpChunk("VP8X", []byte{0x0c, 0, 0, 0, 0, 0, 0, 0, 0, 0}),
+			webpChunk("VP8 ", []byte{1, 2, 3, 4}),
+			webpChunk("EXIF", []byte("gps")),
+			webpChunk("XMP ", []byte("xmp")),
+			webpChunk("ICCP", []byte("profile")),
+		)
+
+		output := stripReader(t, input, "webp")
+
+		assert.Contains(t, string(output), "VP8 ")
+		assert.NotContains(t, string(output), "gps")
+		assert.NotContains(t, string(output), "xmp")
+		assert.Contains(t, string(output), "profile")
+		assert.Equal(t, byte(0), output[20]&0x0c)
+	})
+
+	t.Run("leaves non photo metadata formats unchanged", func(t *testing.T) {
+		input := []byte(`<svg><metadata>secret</metadata><path d="M0 0"/></svg>`)
+
+		output := stripReader(t, input, "svg")
+
+		assert.Equal(t, input, output)
+	})
+
+	t.Run("leaves malformed photo data unchanged", func(t *testing.T) {
+		input := []byte("fake-png-content")
+
+		output := stripReader(t, input, "png")
+
+		assert.Equal(t, input, output)
+	})
+}
+
+func stripReader(t *testing.T, input []byte, ext string) []byte {
+	t.Helper()
+
+	reader, err := StripMetadata(bytes.NewReader(input), ext)
+	require.NoError(t, err)
+
+	output, err := io.ReadAll(reader)
+	require.NoError(t, err)
+	return output
+}
+
+func webpFile(chunks ...[]byte) []byte {
+	var out bytes.Buffer
+	out.WriteString("RIFF")
+	out.Write([]byte{0, 0, 0, 0})
+	out.WriteString("WEBP")
+	for _, chunk := range chunks {
+		out.Write(chunk)
+	}
+	binary.LittleEndian.PutUint32(out.Bytes()[4:8], uint32(out.Len()-8)) //nolint:gosec
+	return out.Bytes()
+}
+
+func webpChunk(chunkType string, data []byte) []byte {
+	var out bytes.Buffer
+	out.WriteString(chunkType)
+	_ = binary.Write(&out, binary.LittleEndian, uint32(len(data))) //nolint:gosec
+	out.Write(data)
+	if len(data)%2 == 1 {
+		out.WriteByte(0)
+	}
+	return out.Bytes()
+}
--- a/backend/internal/utils/image/profile_picture.go
+++ b/backend/internal/utils/image/profile_picture.go
@@ -54,7 +54,7 @@ func CreateDefaultProfilePicture(initials string) (*bytes.Buffer, error) {
 	img := imaging.New(profilePictureSize, profilePictureSize, color.RGBA{R: 255, G: 255, B: 255, A: 255})

 	// Load the font
-	fontBytes, err := resources.FS.ReadFile("fonts/PlayfairDisplay-Bold.ttf")
+	fontBytes, err := resources.FS.ReadFile("fonts/Gloock.ttf")
 	if err != nil {
 		return nil, fmt.Errorf("failed to read font file: %w", err)
 	}
@@ -84,7 +84,7 @@ func CreateDefaultProfilePicture(initials string) (*bytes.Buffer, error) {

 	// Center the initials
 	x := (profilePictureSize - font.MeasureString(face, initials).Ceil()) / 2
-	y := (profilePictureSize-face.Metrics().Height.Ceil())/2 + face.Metrics().Ascent.Ceil() - 10
+	y := (profilePictureSize-face.Metrics().Height.Ceil())/2 + face.Metrics().Ascent.Ceil()
 	drawer.Dot = fixed.P(x, y)

 	// Draw the initials
--- a/backend/internal/utils/jwk/key_provider_database.go
+++ b/backend/internal/utils/jwk/key_provider_database.go
@@ -86,12 +86,10 @@ func (f *KeyProviderDatabase) SaveKey(ctx context.Context, key jwk.Key) error {
 	if err != nil {
 		return fmt.Errorf("failed to encrypt key: %w", err)
 	}
-	encB64 := base64.StdEncoding.EncodeToString(enc)
-
 	// Save to database
 	row := model.KV{
 		Key:   PrivateKeyDBKey,
-		Value: &encB64,
+		Value: new(base64.StdEncoding.EncodeToString(enc)),
 	}

 	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
--- a/backend/internal/utils/jwk/key_provider_database_test.go
+++ b/backend/internal/utils/jwk/key_provider_database_test.go
@@ -106,10 +106,9 @@ func TestKeyProviderDatabase_LoadKey(t *testing.T) {
 		require.NoError(t, err)

 		// Insert invalid base64 data
-		invalidBase64 := "not-valid-base64"
 		err = db.Create(&model.KV{
 			Key:   PrivateKeyDBKey,
-			Value: &invalidBase64,
+			Value: new("not-valid-base64"),
 		}).Error
 		require.NoError(t, err)

@@ -132,10 +131,9 @@ func TestKeyProviderDatabase_LoadKey(t *testing.T) {
 		require.NoError(t, err)

 		// Insert valid base64 but invalid encrypted data
-		invalidData := base64.StdEncoding.EncodeToString([]byte("not-valid-encrypted-data"))
 		err = db.Create(&model.KV{
 			Key:   PrivateKeyDBKey,
-			Value: &invalidData,
+			Value: new(base64.StdEncoding.EncodeToString([]byte("not-valid-encrypted-data"))),
 		}).Error
 		require.NoError(t, err)

@@ -195,13 +193,10 @@ func TestKeyProviderDatabase_LoadKey(t *testing.T) {
 		encryptedData, err := cryptoutils.Encrypt(kek, invalidKeyData, nil)
 		require.NoError(t, err)

-		// Base64 encode the encrypted data
-		encodedData := base64.StdEncoding.EncodeToString(encryptedData)
-
 		// Save to database
 		err = db.Create(&model.KV{
 			Key:   PrivateKeyDBKey,
-			Value: &encodedData,
+			Value: new(base64.StdEncoding.EncodeToString(encryptedData)),
 		}).Error
 		require.NoError(t, err)

--- a/backend/internal/utils/testing/round_tripper.go
+++ b/backend/internal/utils/testing/round_tripper.go
@@ -3,9 +3,11 @@
 package testing

 import (
+	"bytes"
 	"io"
 	"net/http"
 	"strings"
+	"sync"

 	_ "github.com/golang-migrate/migrate/v4/source/file"
 )
@@ -14,25 +16,62 @@ import (
 type MockRoundTripper struct {
 	Err       error
 	Responses map[string]*http.Response
+
+	mu             sync.Mutex
+	responseBodies map[string][]byte
 }

 // RoundTrip implements the http.RoundTripper interface
 func (m *MockRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	if m.Err != nil {
+		return nil, m.Err
+	}
+
 	// Check if we have a specific response for this URL
 	for url, resp := range m.Responses {
 		if req.URL.String() == url {
-			return resp, nil
+			return m.cloneResponse(url, resp)
 		}
 	}

 	return NewMockResponse(http.StatusNotFound, ""), nil
 }

+func (m *MockRoundTripper) cloneResponse(url string, resp *http.Response) (*http.Response, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	if m.responseBodies == nil {
+		m.responseBodies = make(map[string][]byte, len(m.Responses))
+	}
+
+	body, ok := m.responseBodies[url]
+	if !ok {
+		var err error
+		body, err = io.ReadAll(resp.Body)
+		if err != nil {
+			return nil, err
+		}
+
+		m.responseBodies[url] = body
+		resp.Body = io.NopCloser(bytes.NewReader(body))
+	}
+
+	cloned := new(http.Response)
+	*cloned = *resp
+	cloned.Header = resp.Header.Clone()
+	cloned.Body = io.NopCloser(bytes.NewReader(body))
+	cloned.ContentLength = int64(len(body))
+
+	return cloned, nil
+}
+
 // NewMockResponse creates an http.Response with the given status code and body
 func NewMockResponse(statusCode int, body string) *http.Response {
 	return &http.Response{
-		StatusCode: statusCode,
-		Body:       io.NopCloser(strings.NewReader(body)),
-		Header:     make(http.Header),
+		StatusCode:    statusCode,
+		Body:          io.NopCloser(strings.NewReader(body)),
+		Header:        make(http.Header),
+		ContentLength: int64(len(body)),
 	}
 }
--- a/backend/resources/aaguids.json
+++ b/backend/resources/aaguids.json
--- a/backend/resources/fonts/Gloock.ttf
+++ b/backend/resources/fonts/Gloock.ttf
--- a/backend/resources/fonts/PlayfairDisplay-Bold.ttf
+++ b/backend/resources/fonts/PlayfairDisplay-Bold.ttf
--- a/backend/resources/migrations/postgres/20260518222000_oidc_refresh_token_id_token_jti.down.sql
+++ b/backend/resources/migrations/postgres/20260518222000_oidc_refresh_token_id_token_jti.down.sql
@@ -0,0 +1,4 @@
+DROP INDEX IF EXISTS idx_oidc_refresh_tokens_id_token_jti;
+
+ALTER TABLE oidc_refresh_tokens
+    DROP COLUMN id_token_jti;
--- a/backend/resources/migrations/postgres/20260518222000_oidc_refresh_token_id_token_jti.up.sql
+++ b/backend/resources/migrations/postgres/20260518222000_oidc_refresh_token_id_token_jti.up.sql
@@ -0,0 +1,5 @@
+ALTER TABLE oidc_refresh_tokens
+    ADD COLUMN id_token_jti UUID;
+
+CREATE INDEX idx_oidc_refresh_tokens_id_token_jti
+    ON oidc_refresh_tokens(user_id, client_id, id_token_jti);
--- a/backend/resources/migrations/postgres/20260601154900_par.down.sql
+++ b/backend/resources/migrations/postgres/20260601154900_par.down.sql
@@ -0,0 +1,3 @@
+DROP TABLE IF EXISTS oidc_pushed_authorization_requests;
+
+ALTER TABLE oidc_clients DROP COLUMN requires_pushed_authorization_requests;
--- a/backend/resources/migrations/postgres/20260601154900_par.up.sql
+++ b/backend/resources/migrations/postgres/20260601154900_par.up.sql
@@ -0,0 +1,12 @@
+CREATE TABLE oidc_pushed_authorization_requests (
+    id UUID NOT NULL PRIMARY KEY,
+    created_at TIMESTAMPTZ NOT NULL,
+    request_uri TEXT NOT NULL UNIQUE,
+    client_id TEXT NOT NULL REFERENCES oidc_clients(id) ON DELETE CASCADE,
+    parameters JSONB NOT NULL DEFAULT '{}',
+    expires_at TIMESTAMPTZ NOT NULL
+);
+
+CREATE INDEX idx_oidc_par_expires_at ON oidc_pushed_authorization_requests (expires_at);
+
+ALTER TABLE oidc_clients ADD COLUMN requires_pushed_authorization_requests BOOLEAN NOT NULL DEFAULT FALSE;
--- a/backend/resources/migrations/sqlite/20260418120000_oidc_amr_claim.down.sql
+++ b/backend/resources/migrations/sqlite/20260418120000_oidc_amr_claim.down.sql
@@ -1,3 +1,10 @@
+PRAGMA foreign_keys= OFF;
+BEGIN;
+
 ALTER TABLE oidc_authorization_codes DROP COLUMN authentication_method;
 ALTER TABLE oidc_refresh_tokens DROP COLUMN authentication_method;
 ALTER TABLE oidc_device_codes DROP COLUMN authentication_method;
+
+COMMIT;
+PRAGMA foreign_keys= ON;
+
--- a/backend/resources/migrations/sqlite/20260418120000_oidc_amr_claim.up.sql
+++ b/backend/resources/migrations/sqlite/20260418120000_oidc_amr_claim.up.sql
@@ -1,6 +1,12 @@
+PRAGMA foreign_keys= OFF;
+BEGIN;
+
 ALTER TABLE oidc_authorization_codes
    ADD COLUMN authentication_method TEXT NOT NULL DEFAULT '';
 ALTER TABLE oidc_refresh_tokens
    ADD COLUMN authentication_method TEXT NOT NULL DEFAULT '';
 ALTER TABLE oidc_device_codes
    ADD COLUMN authentication_method TEXT NOT NULL DEFAULT '';
+
+COMMIT;
+PRAGMA foreign_keys= ON;
--- a/backend/resources/migrations/sqlite/20260518222000_oidc_refresh_token_id_token_jti.down.sql
+++ b/backend/resources/migrations/sqlite/20260518222000_oidc_refresh_token_id_token_jti.down.sql
@@ -0,0 +1,10 @@
+PRAGMA foreign_keys= OFF;
+BEGIN;
+
+DROP INDEX IF EXISTS idx_oidc_refresh_tokens_id_token_jti;
+
+ALTER TABLE oidc_refresh_tokens
+    DROP COLUMN id_token_jti;
+
+COMMIT;
+PRAGMA foreign_keys= ON;
--- a/backend/resources/migrations/sqlite/20260518222000_oidc_refresh_token_id_token_jti.up.sql
+++ b/backend/resources/migrations/sqlite/20260518222000_oidc_refresh_token_id_token_jti.up.sql
@@ -0,0 +1,11 @@
+PRAGMA foreign_keys= OFF;
+BEGIN;
+
+ALTER TABLE oidc_refresh_tokens
+    ADD COLUMN id_token_jti TEXT;
+
+CREATE INDEX idx_oidc_refresh_tokens_id_token_jti
+    ON oidc_refresh_tokens(user_id, client_id, id_token_jti);
+
+COMMIT;
+PRAGMA foreign_keys= ON;
--- a/backend/resources/migrations/sqlite/20260601154900_par.down.sql
+++ b/backend/resources/migrations/sqlite/20260601154900_par.down.sql
@@ -0,0 +1,3 @@
+DROP TABLE IF EXISTS oidc_pushed_authorization_requests;
+
+ALTER TABLE oidc_clients DROP COLUMN requires_pushed_authorization_requests;
--- a/backend/resources/migrations/sqlite/20260601154900_par.up.sql
+++ b/backend/resources/migrations/sqlite/20260601154900_par.up.sql
@@ -0,0 +1,12 @@
+CREATE TABLE oidc_pushed_authorization_requests (
+    id TEXT NOT NULL PRIMARY KEY,
+    created_at INTEGER NOT NULL,
+    request_uri TEXT NOT NULL UNIQUE,
+    client_id TEXT NOT NULL REFERENCES oidc_clients(id) ON DELETE CASCADE,
+    parameters TEXT NOT NULL DEFAULT '{}',
+    expires_at INTEGER NOT NULL
+);
+
+CREATE INDEX idx_oidc_par_expires_at ON oidc_pushed_authorization_requests (expires_at);
+
+ALTER TABLE oidc_clients ADD COLUMN requires_pushed_authorization_requests BOOLEAN NOT NULL DEFAULT FALSE;
--- a/depot.json
+++ b/depot.json
@@ -0,0 +1 @@
+{ "id": "c36t29j6bz" }
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1.7
+
 # This file uses multi-stage builds to build the application from source, including the front-end

 # Tags passed to "go build"
@@ -9,27 +11,33 @@ RUN corepack enable

 WORKDIR /build

-COPY pnpm-workspace.yaml pnpm-lock.yaml ./
+COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
 COPY frontend/package.json ./frontend/
-RUN pnpm --filter pocket-id-frontend install --frozen-lockfile
+RUN --mount=type=cache,target=/root/.local/share/pnpm/store \
+  pnpm --filter pocket-id-frontend install --frozen-lockfile

 COPY ./frontend ./frontend/

-RUN BUILD_OUTPUT_PATH=dist pnpm --filter pocket-id-frontend run build
+RUN --mount=type=cache,target=/build/frontend/node_modules/.vite \
+  --mount=type=cache,target=/build/frontend/.svelte-kit \
+  BUILD_OUTPUT_PATH=dist pnpm --filter pocket-id-frontend run build

 # Stage 2: Build Backend
 FROM golang:1.26-alpine AS backend-builder
 ARG BUILD_TAGS
 WORKDIR /build
 COPY ./backend/go.mod ./backend/go.sum ./
-RUN go mod download
+RUN --mount=type=cache,target=/go/pkg/mod \
+  go mod download

 COPY ./backend ./
 COPY --from=frontend-builder /build/frontend/dist ./frontend/dist
 COPY .version .version

 WORKDIR /build/cmd
-RUN VERSION=$(cat /build/.version) \ 
+RUN --mount=type=cache,target=/go/pkg/mod \
+  --mount=type=cache,target=/root/.cache/go-build \
+  VERSION=$(cat /build/.version) && \
  CGO_ENABLED=0 \
  GOOS=linux \
  go build \
--- a/email-templates/package.json
+++ b/email-templates/package.json
@@ -9,17 +9,17 @@
    "export": "email export"
  },
  "dependencies": {
-    "@react-email/components": "1.0.1",
-    "react": "^19.2.5",
-    "react-dom": "^19.2.5",
-    "tailwind-merge": "^3.5.0"
+    "@react-email/components": "1.0.12",
+    "react": "^19.2.6",
+    "react-dom": "^19.2.6",
+    "tailwind-merge": "^3.6.0"
  },
  "devDependencies": {
-    "@react-email/preview-server": "5.0.7",
-    "@types/node": "^24.12.2",
+    "@react-email/preview-server": "5.2.10",
+    "@types/node": "^25.9.0",
    "@types/react": "^19.2.14",
    "@types/react-dom": "^19.2.3",
-    "react-email": "5.0.7",
-    "tsx": "^4.21.0"
+    "react-email": "6.1.4",
+    "tsx": "^4.22.2"
  }
 }
--- a/frontend/messages/ca.json
+++ b/frontend/messages/ca.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "Les claus d'accés no són compatibles amb aquest navegador. Utilitza un mètode alternatiu per iniciar la sessió.",
 	"critical_error_occurred_contact_administrator": "S'ha produït un error crític. Contacta amb l'administrador.",
 	"sign_in_to": "Inicia la sessió a {name}",
+	"account_selection_signin_confirmation": "Vols utilitzar el compte següent per continuar a <b>{name}</b>?",
+	"use_a_different_account": "Utilitza un compte diferent",
 	"client_not_found": "Client no trobat",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> vol accedir a la informació següent:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "Vols iniciar la sessió a <b>{client}</b> amb el teu compte de {appName}?",
@@ -433,7 +435,7 @@
 	"active": "Actiu",
 	"usage": "Ús",
 	"created": "Creat",
-	"token": "Token",
+	"token": "Token\n",
 	"loading": "Carregant",
 	"delete_signup_token": "Elimina token d'alta",
 	"are_you_sure_you_want_to_delete_this_signup_token": "Segur que vols eliminar aquest token d'alta? Aquesta acció no es pot desfer.",
--- a/frontend/messages/cs.json
+++ b/frontend/messages/cs.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "Tento prohlížeč nepodporuje přístupové klíče. Použijte prosím alternativní způsob přihlášení.",
 	"critical_error_occurred_contact_administrator": "Došlo k kritické chybě. Obraťte se na správce.",
 	"sign_in_to": "Přihlásit se k {name}",
+	"account_selection_signin_confirmation": "Chcete pokračovat pomocí následujícího účtu <b>{name}</b>?",
+	"use_a_different_account": "Použijte jiný účet",
 	"client_not_found": "Klient nebyl nalezen",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> chce získat přístup k následujícím informacím:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "Chcete se přihlásit do <b>{client}</b> s vaším {appName} účtem?",
--- a/frontend/messages/da.json
+++ b/frontend/messages/da.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "Passkeys understøttes ikke af denne browser. Brug en alternativ login-metode.",
 	"critical_error_occurred_contact_administrator": "En kritisk fejl opstod. Kontakt venligst din administrator.",
 	"sign_in_to": "Log ind på {name}",
+	"account_selection_signin_confirmation": "Vil du bruge følgende konto til at fortsætte <b>{name}</b>?",
+	"use_a_different_account": "Brug en anden konto",
 	"client_not_found": "Klient ikke fundet",
 	"client_wants_to_access_the_following_information": "{client} ønsker at få adgang til følgende oplysninger:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "Vil du logge ind på {client} med din {appName}-konto?",
--- a/frontend/messages/de.json
+++ b/frontend/messages/de.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "Passkeys werden von diesem Browser nicht unterstützt. Bitte probier eine andere Anmeldemethode aus.",
 	"critical_error_occurred_contact_administrator": "Ein kritischer Fehler ist aufgetreten. Bitte kontaktiere deinen Administrator.",
 	"sign_in_to": "Bei {name} anmelden",
+	"account_selection_signin_confirmation": "Möchtest du mit dem folgenden Konto fortfahren <b>{name}</b>?",
+	"use_a_different_account": "Verwende ein anderes Konto",
 	"client_not_found": "Client nicht gefunden",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> möchte auf die folgenden Informationen zugreifen:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "Möchtest du dich bei <b>{client}</b> mit deinem {appName} Konto anmelden?",
@@ -87,7 +89,7 @@
 	"enter_your_email_address_to_receive_an_email_with_a_login_code": "Gib deine E-Mail-Adresse ein, um eine E-Mail mit einem Login-Code zu erhalten.",
 	"your_email": "Deine E-Mail",
 	"submit": "Bestätigen",
-	"enter_the_code_you_received_to_sign_in": "Gebe den Code ein, den du erhalten hast, um dich anzumelden.",
+	"enter_the_code_you_received_to_sign_in": "Gib den Code ein, den du erhalten hast, um dich anzumelden.",
 	"code": "Code",
 	"invalid_redirect_url": "Ungültige Weiterleitungs-URL",
 	"audit_log": "Aktivitäts-Log",
@@ -106,7 +108,7 @@
 	"ip_address": "IP-Adresse",
 	"device": "Gerät",
 	"client": "Client",
-	"actor": "Schauspieler",
+	"actor": "Akteur",
 	"unknown": "unbekannt",
 	"account_details_updated_successfully": "Kontodetails erfolgreich aktualisiert",
 	"profile_picture_updated_successfully": "Profilbild erfolgreich aktualisiert. Die Aktualisierung kann einige Minuten dauern.",
@@ -343,7 +345,7 @@
 	"device_code_authorization": "Gerätecode-Autorisierung",
 	"new_device_code_authorization": "Neue Gerätecode-Autorisierung",
 	"passkey_added": "Passwort hinzugefügt",
-	"passkey_removed": "Passwort entfernt",
+	"passkey_removed": "Passkey entfernt",
 	"disable_animations": "Animationen deaktivieren",
 	"turn_off_ui_animations": "Deaktiviert alle Animationen in der Benutzeroberfläche.",
 	"user_disabled": "Account deaktiviert",
@@ -395,7 +397,7 @@
 	"select_an_accent_color_to_customize_the_appearance_of_pocket_id": "Wähl eine Akzentfarbe aus, um das Aussehen von Pocket ID anzupassen.",
 	"accent_color": "Akzentfarbe",
 	"custom_accent_color": "Benutzerdefinierte Akzentfarbe",
-	"custom_accent_color_description": "Geben Sie eine benutzerdefinierte Farbe mit gültigen CSS-Farbformaten ein (z.B. hex, rgb, hsl).",
+	"custom_accent_color_description": "Gib eine benutzerdefinierte Farbe mit gültigen CSS-Farbformaten ein (z.B. hex, rgb, hsl).",
 	"color_value": "Farbwert",
 	"apply": "Übernehmen",
 	"signup_token": "Anmeldungstoken",
--- a/frontend/messages/en.json
+++ b/frontend/messages/en.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "Passkeys are not supported by this browser. Please use an alternative sign in method.",
 	"critical_error_occurred_contact_administrator": "A critical error occurred. Please contact your administrator.",
 	"sign_in_to": "Sign in to {name}",
+	"account_selection_signin_confirmation": "Do you want to use the following account to continue to <b>{name}</b>?",
+	"use_a_different_account": "Use a different account",
 	"client_not_found": "Client not found",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> wants to access the following information:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "Do you want to sign in to <b>{client}</b> with your {appName} account?",
@@ -286,6 +288,9 @@
 	"public_key_code_exchange_is_a_security_feature_to_prevent_csrf_and_authorization_code_interception_attacks": "Public Key Code Exchange is a security feature to prevent CSRF and authorization code interception attacks.",
 	"requires_reauthentication": "Requires Re-Authentication",
 	"requires_users_to_authenticate_again_on_each_authorization": "Requires users to authenticate again on each authorization, even if already signed in",
+	"par": "PAR",
+	"requires_pushed_authorization_requests": "Requires Pushed Authorization Requests",
+	"requires_pushed_authorization_requests_description": "Requires clients to use the PAR endpoint (/api/oidc/par) to pre-register authorization parameters before initiating the flow. Not available for public clients.",
 	"name_logo": "{name} logo",
 	"change_logo": "Change Logo",
 	"upload_logo": "Upload Logo",
--- a/frontend/messages/es.json
+++ b/frontend/messages/es.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "Este navegador no admite claves de acceso. Utiliza otro método para iniciar sesión.",
 	"critical_error_occurred_contact_administrator": "Ha ocurrido un error crítico. Por favor, contacte a su administrador.",
 	"sign_in_to": "Iniciar sesión en {name}",
+	"account_selection_signin_confirmation": "¿Quieres usar la siguiente cuenta para seguir <b>{name}</b>?",
+	"use_a_different_account": "Usa otra cuenta",
 	"client_not_found": "Cliente no encontrado",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> quiere acceder a la siguiente información:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "¿Quieres iniciar sesión en <b>{client}</b> con tu cuenta {appName}?",
--- a/frontend/messages/et.json
+++ b/frontend/messages/et.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "Passkeys are not supported by this browser. Please use an alternative sign in method.",
 	"critical_error_occurred_contact_administrator": "A critical error occurred. Please contact your administrator.",
 	"sign_in_to": "Sign in to {name}",
+	"account_selection_signin_confirmation": "Kas soovite jätkata järgmise kontoga <b>{name}</b>?",
+	"use_a_different_account": "Kasuta teist kontot",
 	"client_not_found": "Client not found",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> wants to access the following information:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "Do you want to sign in to <b>{client}</b> with your {appName} account?",
--- a/frontend/messages/fi.json
+++ b/frontend/messages/fi.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "Tämä selain ei tue salasanan sijaan käytettäviä tunnuksia. Käytä vaihtoehtoista kirjautumistapaa.",
 	"critical_error_occurred_contact_administrator": "Kriittinen virhe tapahtui. Ota yhteyttä järjestelmänvalvojaan.",
 	"sign_in_to": "Kirjaudu palveluun {name}",
+	"account_selection_signin_confirmation": "Haluatko jatkaa seuraavalla tilillä <b>{name}</b>?",
+	"use_a_different_account": "Käytä toista tiliä",
 	"client_not_found": "Asiakasta ei löydy",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> haluaa käyttää seuraavia tietoja:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "Haluatko kirjautua sisään palveluun <b>{client}</b> {appName} -tililläsi?",
--- a/frontend/messages/fr.json
+++ b/frontend/messages/fr.json
@@ -48,11 +48,13 @@
 	"authenticator_does_not_support_any_of_the_requested_algorithms": "L'authentificateur ne supporte aucun des algorithmes requis",
 	"webauthn_error_invalid_rp_id": "L'ID de la partie de confiance configurée n'est pas valide.",
 	"webauthn_error_invalid_domain": "Le domaine configuré n'est pas valide.",
-	"contact_administrator_to_fix": "Contacte ton administrateur pour régler ce problème.",
+	"contact_administrator_to_fix": "Contactez votre administrateur pour régler ce problème.",
 	"webauthn_operation_not_allowed_or_timed_out": "L'opération n'a pas été autorisée ou a expiré.",
 	"webauthn_not_supported_by_browser": "Les clés d'accès ne sont pas prises en charge par ce navigateur. Essaie une autre méthode de connexion.",
 	"critical_error_occurred_contact_administrator": "Une erreur critique s'est produite. Veuillez contacter votre administrateur.",
 	"sign_in_to": "Connexion à {name}",
+	"account_selection_signin_confirmation": "Veux-tu utiliser le compte suivant pour continuer <b>{name}</b>?",
+	"use_a_different_account": "Utilise un autre compte",
 	"client_not_found": "Client introuvable",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> souhaite accéder aux informations suivantes :",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "Voulez-vous vous connecter à <b>{client}</b> avec votre compte {appName}?",
@@ -286,6 +288,9 @@
 	"public_key_code_exchange_is_a_security_feature_to_prevent_csrf_and_authorization_code_interception_attacks": "Le Public Key Code Exchange est une fonctionnalité de sécurité conçue pour prévenir les attaques CSRF et d’interception de code d’autorisation.",
 	"requires_reauthentication": "Nécessite une nouvelle authentification",
 	"requires_users_to_authenticate_again_on_each_authorization": "Demande aux utilisateurs de se connecter à nouveau à chaque autorisation, même s'ils sont déjà connectés.",
+	"par": "PAR",
+	"requires_pushed_authorization_requests": "Nécessite Pushed Authorization Requests (PAR)",
+	"requires_pushed_authorization_requests_description": "Les clients doivent utiliser le point de terminaison PAR (/api/oidc/par) pour préenregistrer les paramètres d'autorisation avant de démarrer le flux. Non disponible pour les clients publics.",
 	"name_logo": "Logo {name}",
 	"change_logo": "Changer le logo",
 	"upload_logo": "Télécharger un logo",
--- a/frontend/messages/it.json
+++ b/frontend/messages/it.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "Questo browser non supporta le passkey. Prova a usare un altro modo per accedere.",
 	"critical_error_occurred_contact_administrator": "Si è verificato un errore critico. Contatta il tuo amministratore.",
 	"sign_in_to": "Accedi a {name}",
+	"account_selection_signin_confirmation": "Vuoi usare il seguente account per continuare a <b>{name}</b>?",
+	"use_a_different_account": "Usa un altro account",
 	"client_not_found": "Client non trovato",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> vuole accedere alle seguenti informazioni:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "Vuoi accedere a <b>{client}</b> con il tuo account {appName}?",
--- a/frontend/messages/ja.json
+++ b/frontend/messages/ja.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "このブラウザではパスキーはサポートされていません。別のサインイン方法をご利用ください。",
 	"critical_error_occurred_contact_administrator": "重大なエラーが発生しました。管理者にお問い合わせください。",
 	"sign_in_to": "{name} にサインイン",
+	"account_selection_signin_confirmation": "以下のアカウントを使用して続行しますか <b>{name}</b>？",
+	"use_a_different_account": "別のアカウントを使用する",
 	"client_not_found": "クライアントが見つかりません",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> は以下の情報にアクセスしようとしています:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "{appName} アカウントで <b>{client}</b> にサインインしますか？",
@@ -106,14 +108,14 @@
 	"ip_address": "IPアドレス",
 	"device": "デバイス",
 	"client": "クライアント",
-	"actor": "俳優",
+	"actor": "実行者",
 	"unknown": "不明",
 	"account_details_updated_successfully": "アカウントの詳細が正常に更新されました",
 	"profile_picture_updated_successfully": "プロフィール画像が正常に更新されました。反映まで数分かかる場合があります。",
 	"account_settings": "アカウント設定",
 	"passkey_missing": "パスキーが見つかりません",
 	"please_provide_a_passkey_to_prevent_losing_access_to_your_account": "アカウントへのアクセスを失わないように、パスキーを追加してください。",
-	"single_passkey_configured": "Single Passkey Configured",
+	"single_passkey_configured": "シングルパスキーが設定済み",
 	"it_is_recommended_to_add_more_than_one_passkey": "アカウントへのアクセスを失わないように、複数のパスキーを追加することをお勧めします。",
 	"account_details": "アカウントの詳細",
 	"passkeys": "パスキー",
@@ -130,7 +132,7 @@
 	"username_must_start_with": "ユーザー名は英数字で始まる必要があります",
 	"username_must_end_with": "ユーザー名は英数字で終わる必要があります",
 	"sign_in_using_the_following_code_the_code_will_expire_in_minutes": "以下のコードを使用してサインインしてください。コードは15分後に失効します。",
-	"or_visit": "or visit",
+	"or_visit": "または次を訪問",
 	"added_on": "追加日",
 	"rename": "名前を変更",
 	"delete": "削除",
@@ -160,7 +162,7 @@
 	"api_key_revoked_successfully": "API キーが正常に削除されました",
 	"are_you_sure_you_want_to_revoke_the_api_key_apikeyname": "APIキー \"{apiKeyName}\" を本当に削除しますか？このAPI キーを使用しているすべての連携が停止します。",
 	"last_used": "最終使用日",
-	"actions": "Actions",
+	"actions": "操作",
 	"images_updated_successfully": "画像の更新が正常に完了しました。更新には数分かかる場合があります。",
 	"general": "一般",
 	"configure_smtp_to_send_emails": "新しいデバイスや場所からのログインが検出された際にユーザーに警告するメール通知を有効にします。",
@@ -203,15 +205,15 @@
 	"ldap_sync_finished": "LDAP同期が完了しました",
 	"client_configuration": "クライアントの設定",
 	"ldap_url": "LDAP URL",
-	"ldap_bind_dn": "LDAP Bind DN",
-	"ldap_bind_password": "LDAP Bind Password",
-	"ldap_base_dn": "LDAP Base DN",
+	"ldap_bind_dn": "LDAP バインド DN",
+	"ldap_bind_password": "LDAP バインドパスワード",
+	"ldap_base_dn": "LDAP ベース DN",
 	"user_search_filter": "ユーザー検索フィルター",
 	"the_search_filter_to_use_to_search_or_sync_users": "ユーザーの検索、同期に使用する検索フィルター。",
 	"groups_search_filter": "グループ検索フィルター",
 	"the_search_filter_to_use_to_search_or_sync_groups": "グループの検索、同期に使用する検索フィルター。",
 	"attribute_mapping": "属性マッピング",
-	"user_unique_identifier_attribute": "User Unique Identifier Attribute",
+	"user_unique_identifier_attribute": "ユーザー固有識別子属性",
 	"the_value_of_this_attribute_should_never_change": "この属性の値は決して変更されてはなりません。",
 	"username_attribute": "ユーザー名属性",
 	"user_mail_attribute": "ユーザーメール属性",
@@ -243,7 +245,7 @@
 	"admin": "管理者",
 	"user": "ユーザー",
 	"local": "ローカル",
-	"toggle_menu": "Toggle menu",
+	"toggle_menu": "メニューの表示/非表示を切り替える",
 	"edit": "編集",
 	"user_groups_updated_successfully": "ユーザーグループが正常に更新されました",
 	"user_updated_successfully": "ユーザーは正常に更新されました",
@@ -259,7 +261,7 @@
 	"add_group": "グループを追加",
 	"manage_user_groups": "ユーザーグループの管理",
 	"friendly_name": "Friendly Name",
-	"name_that_will_be_displayed_in_the_ui": "Name that will be displayed in the UI",
+	"name_that_will_be_displayed_in_the_ui": "UIに表示される名前",
 	"name_that_will_be_in_the_groups_claim": "Name that will be in the \"groups\" claim",
 	"delete_name": "{name} を削除",
 	"are_you_sure_you_want_to_delete_this_user_group": "このユーザーグループを削除しますか？",
@@ -280,12 +282,12 @@
 	"add": "追加",
 	"callback_urls": "Callback URLs",
 	"logout_callback_urls": "Logout Callback URLs",
-	"public_client": "Public Client",
-	"public_clients_description": "Public clients do not have a client secret. They are designed for mobile, web, and native applications where secrets cannot be securely stored.",
+	"public_client": "パブリッククライアント",
+	"public_clients_description": "パブリッククライアントにはクライアントシークレットがありません。これらは、シークレットを安全に保存できないモバイル、Web、およびネイティブアプリケーション向けに設計されています。",
 	"pkce": "PKCE",
-	"public_key_code_exchange_is_a_security_feature_to_prevent_csrf_and_authorization_code_interception_attacks": "Public Key Code Exchange is a security feature to prevent CSRF and authorization code interception attacks.",
+	"public_key_code_exchange_is_a_security_feature_to_prevent_csrf_and_authorization_code_interception_attacks": "公開鍵コード交換は、CSRFおよび認証コード傍受攻撃を防ぐためのセキュリティ機能です。",
 	"requires_reauthentication": "再認証が必要",
-	"requires_users_to_authenticate_again_on_each_authorization": "Requires users to authenticate again on each authorization, even if already signed in",
+	"requires_users_to_authenticate_again_on_each_authorization": "すでにログイン済みの場合でも、認証のたびにユーザーに再認証を求めます",
 	"name_logo": "{name} ロゴ",
 	"change_logo": "ロゴの変更",
 	"upload_logo": "ロゴをアップロード",
@@ -303,7 +305,7 @@
 	"oidc_client_updated_successfully": "OIDC クライアントが正常に更新されました",
 	"create_new_client_secret": "新しいクライアントシークレットを作成する",
 	"are_you_sure_you_want_to_create_a_new_client_secret": "新しいクライアントシークレットを作成してもよろしいですか？古いシークレットは無効化されます。",
-	"generate": "Generate",
+	"generate": "生成",
 	"new_client_secret_created_successfully": "新しいクライアントシークレットが正常に作成されました",
 	"oidc_client_name": "OIDC クライアント {name}",
 	"client_id": "Client ID",
@@ -329,8 +331,8 @@
 	"profile_picture_has_been_reset": "プロフィール画像がリセットされました。更新には数分かかる場合があります。",
 	"select_the_language_you_want_to_use": "使用する言語を選択してください。一部のテキストは自動翻訳により、不正確な場合がありますのでご注意ください。",
 	"contribute_to_translation": "問題が見つかった場合は、 <link href='https://crowdin.com/project/pocket-id'>Crowdin</link> で翻訳に貢献してください。",
-	"personal": "Personal",
-	"global": "Global",
+	"personal": "個人",
+	"global": "グローバル",
 	"all_users": "すべてのユーザー",
 	"all_events": "すべてのイベント",
 	"all_clients": "すべてのクライアント",
@@ -338,21 +340,21 @@
 	"global_audit_log": "グローバル監査ログ",
 	"see_all_recent_account_activities": "設定された保持期間中の全ユーザーのアカウント活動を閲覧する。",
 	"token_sign_in": "トークンサインイン",
-	"client_authorization": "Client Authorization",
-	"new_client_authorization": "New Client Authorization",
+	"client_authorization": "クライアント認証",
+	"new_client_authorization": "新規クライアント認証",
 	"device_code_authorization": "デバイスコード認証",
 	"new_device_code_authorization": "新規デバイス認証コード",
 	"passkey_added": "パスキー追加",
 	"passkey_removed": "パスキー削除済み",
 	"disable_animations": "アニメーションの無効化",
-	"turn_off_ui_animations": "Turn off animations throughout the UI.",
+	"turn_off_ui_animations": "UI全体のアニメーションを無効にします。",
 	"user_disabled": "アカウントの無効化",
 	"disabled_users_cannot_log_in_or_use_services": "無効化されたユーザーはログインやサービスを利用できません。",
 	"user_disabled_successfully": "ユーザーが正常に無効化されました。",
 	"user_enabled_successfully": "ユーザーが正常に有効化されました。",
-	"status": "Status",
+	"status": "ステータス",
 	"disable_firstname_lastname": "無効化 {firstName} {lastName}",
-	"are_you_sure_you_want_to_disable_this_user": "Are you sure you want to disable this user? They will not be able to log in or access any services.",
+	"are_you_sure_you_want_to_disable_this_user": "このユーザーを無効化してもよろしいですか？無効化すると、そのユーザーはログインやサービスの利用ができなくなります。",
 	"ldap_soft_delete_users": "LDAPから無効なユーザーを保持します。",
 	"ldap_soft_delete_users_description": "有効にすると、LDAPから削除されたユーザーはシステムから削除されるのではなく、無効化されます。",
 	"login_code_email_success": "ログインコードがユーザーに送信されました。",
@@ -365,38 +367,38 @@
 	"authorize_device": "デバイスの認証",
 	"the_device_has_been_authorized": "デバイスは認証されました。",
 	"enter_code_displayed_in_previous_step": "前のステップで表示されたコードを入力してください。",
-	"authorize": "Authorize",
+	"authorize": "承認",
 	"federated_client_credentials": "連携クライアントの資格情報",
 	"federated_client_credentials_description": "フェデレーテッドクライアント認証情報は、長期にわたるシークレットを管理せずにOIDCクライアントを認証することを可能にします。これらは、クライアントアサーション（例：ワークロードIDトークン）のためにサードパーティ機関が発行するJWTトークンを活用します。",
-	"add_federated_client_credential": "Add Federated Client Credential",
-	"add_another_federated_client_credential": "Add another federated client credential",
+	"add_federated_client_credential": "連携クライアントの資格情報を追加",
+	"add_another_federated_client_credential": "他の連携クライアントの資格情報を追加",
 	"oidc_allowed_group_count": "許可されたグループ数",
 	"unrestricted": "制限なし",
 	"show_advanced_options": "詳細設定を表示",
 	"hide_advanced_options": "詳細設定を隠す",
-	"oidc_data_preview": "OIDC Data Preview",
-	"preview_the_oidc_data_that_would_be_sent_for_different_users": "Preview the OIDC data that would be sent for different users",
-	"id_token": "ID Token",
-	"access_token": "Access Token",
-	"userinfo": "Userinfo",
-	"id_token_payload": "ID Token Payload",
-	"access_token_payload": "Access Token Payload",
-	"userinfo_endpoint_response": "Userinfo Endpoint Response",
+	"oidc_data_preview": "OIDC データプレビュー",
+	"preview_the_oidc_data_that_would_be_sent_for_different_users": "異なるユーザーに対して送信されるOIDCデータのプレビュー",
+	"id_token": "IDトークン",
+	"access_token": "アクセストークン",
+	"userinfo": "ユーザー情報",
+	"id_token_payload": "IDトークンのペイロード",
+	"access_token_payload": "アクセストークンのペイロード",
+	"userinfo_endpoint_response": "ユーザー情報エンドポイントのレスポンス",
 	"copy": "コピー",
-	"no_preview_data_available": "No preview data available",
+	"no_preview_data_available": "利用可能なプレビューデータがありません",
 	"copy_all": "すべてコピー",
 	"preview": "プレビュー",
 	"preview_for_user": "{name} のプレビュー",
-	"preview_the_oidc_data_that_would_be_sent_for_this_user": "Preview the OIDC data that would be sent for this user",
+	"preview_the_oidc_data_that_would_be_sent_for_this_user": "このユーザーに対して送信されるOIDCデータのプレビュー",
 	"show": "表示",
-	"select_an_option": "Select an option",
+	"select_an_option": "オプションを選択",
 	"select_user": "ユーザーを選択",
 	"error": "エラー",
 	"select_an_accent_color_to_customize_the_appearance_of_pocket_id": "アクセントカラーを選択して、Pocket IDの外観をカスタマイズしてください。",
 	"accent_color": "アクセントカラー",
 	"custom_accent_color": "カスタムアクセントカラー",
 	"custom_accent_color_description": "有効な CSS カラーフォーマット (例: hex, rgb, hsl) を使用してカスタムカラーを入力します。",
-	"color_value": "Color Value",
+	"color_value": "カラー値",
 	"apply": "適用",
 	"signup_token": "サインアップトークン",
 	"create_a_signup_token_to_allow_new_user_registration": "新規ユーザー登録を許可するためのサインアップトークンを作成する。",
@@ -430,7 +432,7 @@
 	"signup_token_deleted_successfully": "サインアップトークンが正常に削除されました。",
 	"expired": "Expired",
 	"used_up": "Used Up",
-	"active": "Active",
+	"active": "有効",
 	"usage": "Usage",
 	"created": "Created",
 	"token": "トークン",
@@ -450,24 +452,24 @@
 	"launch": "起動",
 	"client_launch_url": "Client Launch URL",
 	"client_launch_url_description": "ユーザーが「マイアプリ」ページからアプリを起動した際に開かれるURL。",
-	"client_name_description": "The name of the client that shows in the Pocket ID UI.",
+	"client_name_description": "Pocket ID UIに表示されるクライアント名。",
 	"revoke_access": "アクセスを取り消す",
 	"revoke_access_description": "<b>{clientName}</b>へのアクセスを取り消します。 <b>{clientName}</b> はあなたのアカウント情報にアクセスできなくなります。",
 	"revoke_access_successful": "{clientName} へのアクセスは正常に取り消されました。",
-	"last_signed_in_ago": "Last signed in {time} ago",
-	"invalid_client_id": "Client ID can only contain letters, numbers, underscores, and hyphens",
-	"custom_client_id_description": "Set a custom client ID if this is required by your application. Otherwise, leave it blank to generate a random one.",
+	"last_signed_in_ago": "最終ログイン {time} 前",
+	"invalid_client_id": "クライアントIDには、英字、数字、アンダースコア、ハイフンのみを含めることができます",
+	"custom_client_id_description": "アプリケーションで必要とされる場合は、カスタムクライアントIDを設定してください。必要ない場合は、空白のままにするとランダムなIDが生成されます。",
 	"generated": "Generated",
-	"administration": "Administration",
-	"group_rdn_attribute_description": "The attribute used in the groups distinguished name (DN).",
-	"display_name_attribute": "Display Name Attribute",
+	"administration": "管理",
+	"group_rdn_attribute_description": "グループの識別名（DN）で使用される属性。",
+	"display_name_attribute": "表示名属性",
 	"display_name": "表示名",
 	"configure_application_images": "アプリケーションの画像を設定",
-	"ui_config_disabled_info_title": "UI Configuration Disabled",
-	"ui_config_disabled_info_description": "The UI configuration is disabled because the application configuration settings are managed through environment variables. Some settings may not be editable.",
+	"ui_config_disabled_info_title": "UI設定が無効になっています",
+	"ui_config_disabled_info_description": "アプリケーションの設定は環境変数を通じて管理されているため、UI設定は無効になっています。一部の設定は編集できない場合があります。",
 	"logo_from_url_description": "画像の直接のURL (svg, png, webp) を貼り付けます。アイコンは <link  href=\"https://selfh.st/icons\">Selfh.st Icons</link> か <link href=\"https://dashboardicons.com\">Dashboard Icons</link> で探せます。",
 	"invalid_url": "無効な URL",
-	"require_user_email": "Require Email Address",
+	"require_user_email": "メールアドレスを必須にする",
 	"require_user_email_description": "ユーザーにメールアドレスの登録を必須とします。無効にした場合、メールアドレスを持たないユーザーはメールアドレスが必要な機能を利用できなくなります。",
 	"view": "表示",
 	"toggle_columns": "列の表示/非表示を切り替える",
--- a/frontend/messages/ko.json
+++ b/frontend/messages/ko.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "이 브라우저에서는 패스키를 지원하지 않습니다. 다른 로그인 방법을 사용해 주세요.",
 	"critical_error_occurred_contact_administrator": "치명적인 오류가 발생했습니다. 관리자에게 연락해주세요.",
 	"sign_in_to": "{name}에 로그인",
+	"account_selection_signin_confirmation": "다음 계정으로 계속 진행하시겠습니까? <b>{name}</b>계속하시겠습니까?",
+	"use_a_different_account": "다른 계정을 사용하세요",
 	"client_not_found": "클라이언트를 찾을 수 없습니다",
 	"client_wants_to_access_the_following_information": "<b>{client}</b>이(가) 다음 정보에 접근하려고 합니다:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "{appName} 계정으로 <b>{client}</b>에 로그인하시겠습니까?",
--- a/frontend/messages/lv.json
+++ b/frontend/messages/lv.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "Šis pārlūks neatbalsta piekļuves atslēgas. Lūdzu, izmantojiet alternatīvu pierakstīšanās metodi.",
 	"critical_error_occurred_contact_administrator": "Radās kritiska kļūda. Lūdzu, sazinieties ar administratoru.",
 	"sign_in_to": "Pierakstīties {name}",
+	"account_selection_signin_confirmation": "Vai vēlaties izmantot šo kontu, lai turpinātu <b>{name}</b>?",
+	"use_a_different_account": "Izmanto citu kontu",
 	"client_not_found": "Klients nav atrasts",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> vēlas piekļūt šādai informācijai:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "Vai vēlaties pierakstīties <b>{client}</b> ar savu {appName} kontu?",
--- a/frontend/messages/nl.json
+++ b/frontend/messages/nl.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "Passkeys worden niet ondersteund door deze browser. Probeer een andere manier om in te loggen.",
 	"critical_error_occurred_contact_administrator": "Er is een kritieke fout opgetreden. Neem contact op met de beheerder.",
 	"sign_in_to": "Meld je aan bij {name}",
+	"account_selection_signin_confirmation": "Wil je met het volgende account verdergaan <b>{name}</b>?",
+	"use_a_different_account": "Gebruik een ander account",
 	"client_not_found": "Client niet gevonden",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> wil toegang tot de volgende informatie:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "Wil je je aanmelden bij <b>{client}</b> met je {appName} account?",
--- a/frontend/messages/no.json
+++ b/frontend/messages/no.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "Passkeys are not supported by this browser. Please use an alternative sign in method.",
 	"critical_error_occurred_contact_administrator": "A critical error occurred. Please contact your administrator.",
 	"sign_in_to": "Logg inn til {name}",
+	"account_selection_signin_confirmation": "Do you want to use the following account to continue to <b>{name}</b>?",
+	"use_a_different_account": "Use a different account",
 	"client_not_found": "Fant ikke klient",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> ønsker tilgang til følgende informasjon:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "Do you want to sign in to <b>{client}</b> with your {appName} account?",
--- a/frontend/messages/pl.json
+++ b/frontend/messages/pl.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "Ta przeglądarka nie obsługuje kluczy dostępu. Proszę skorzystać z alternatywnej metody logowania.",
 	"critical_error_occurred_contact_administrator": "Wystąpił krytyczny błąd. Skontaktuj się z administratorem.",
 	"sign_in_to": "Zaloguj się do {name}",
+	"account_selection_signin_confirmation": "Czy chcesz użyć poniższego konta, aby kontynuować <b>{name}</b>?",
+	"use_a_different_account": "Zaloguj się na inne konto",
 	"client_not_found": "Nie znaleziono klienta",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> chce uzyskać dostęp do następujących informacji:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "Czy chcesz zalogować się do <b>{client}</b> używając konta {appName}?",
--- a/frontend/messages/pt-BR.json
+++ b/frontend/messages/pt-BR.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "As chaves de acesso não são suportadas por este navegador. Por favor, use um método alternativo de login.",
 	"critical_error_occurred_contact_administrator": "Ocorreu um erro grave. Por favor, entre em contato com o administrador.",
 	"sign_in_to": "Entrar em {name}",
+	"account_selection_signin_confirmation": "Queres usar a seguinte conta para continuar <b>{name}</b>?",
+	"use_a_different_account": "Usa outra conta",
 	"client_not_found": "Cliente não encontrado",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> quer acessar as seguintes informações:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "Deseja entrar em <b>{client}</b> com a sua conta {appName}?",
--- a/frontend/messages/pt.json
+++ b/frontend/messages/pt.json
@@ -1,58 +1,60 @@
 {
 	"$schema": "https://inlang.com/schema/inlang-message-format",
-	"my_account": "My Account",
-	"logout": "Logout",
-	"confirm": "Confirm",
-	"docs": "Docs",
-	"key": "Key",
-	"value": "Value",
-	"remove_custom_claim": "Remove custom claim",
-	"add_custom_claim": "Add custom claim",
-	"add_another": "Add another",
-	"select_a_date": "Select a date",
-	"select_file": "Select File",
-	"profile_picture": "Profile Picture",
-	"profile_picture_is_managed_by_ldap_server": "The profile picture is managed by the LDAP server and cannot be changed here.",
-	"click_profile_picture_to_upload_custom": "Click on the profile picture to upload a custom one from your files.",
-	"image_should_be_in_format": "The image should be in PNG, JPEG or WEBP format.",
-	"items_per_page": "Items per page",
-	"no_items_found": "No items found",
-	"select_items": "Select items...",
-	"search": "Search...",
-	"expand_card": "Expand card",
-	"copied": "Copied",
-	"click_to_copy": "Click to copy",
-	"something_went_wrong": "Something went wrong",
-	"go_back_to_home": "Go back to home",
-	"alternative_sign_in_methods": "Alternative Sign In Methods",
-	"login_background": "Login background",
-	"logo": "Logo",
-	"login_code": "Login Code",
-	"create_a_login_code_to_sign_in_without_a_passkey_once": "Create a login code that the user can use to sign in without a passkey once.",
-	"one_hour": "1 hour",
-	"twelve_hours": "12 hours",
-	"one_day": "1 day",
-	"one_week": "1 week",
-	"one_month": "1 month",
-	"expiration": "Expiration",
-	"generate_code": "Generate Code",
-	"name": "Name",
-	"browser_unsupported": "Browser unsupported",
-	"this_browser_does_not_support_passkeys": "This browser doesn't support passkeys. Please use an alternative sign in method.",
-	"an_unknown_error_occurred": "An unknown error occurred",
-	"authentication_process_was_aborted": "The authentication process was aborted",
-	"error_occurred_with_authenticator": "An error occurred with the authenticator",
-	"authenticator_does_not_support_discoverable_credentials": "The authenticator does not support discoverable credentials",
-	"authenticator_does_not_support_resident_keys": "The authenticator does not support resident keys",
-	"passkey_was_previously_registered": "This passkey was previously registered",
-	"authenticator_does_not_support_any_of_the_requested_algorithms": "The authenticator does not support any of the requested algorithms",
-	"webauthn_error_invalid_rp_id": "The configured relying party ID is invalid.",
-	"webauthn_error_invalid_domain": "The configured domain is invalid.",
-	"contact_administrator_to_fix": "Contact your administrator to fix this issue.",
+	"my_account": "A Minha Conta",
+	"logout": "Sair",
+	"confirm": "Confirmar",
+	"docs": "Documentação",
+	"key": "Chave",
+	"value": "Valor",
+	"remove_custom_claim": "Remover reivindicação personalizada",
+	"add_custom_claim": "Adicionar reivindicação personalizada",
+	"add_another": "Adicionar outro",
+	"select_a_date": "Seleciona uma data",
+	"select_file": "Seleciona o ficheiro",
+	"profile_picture": "Imagem de perfil",
+	"profile_picture_is_managed_by_ldap_server": "A imagem de perfil é gerida pelo servidor LDAP e não pode ser alterada aqui.",
+	"click_profile_picture_to_upload_custom": "Clica na imagem do perfil para carregar uma imagem personalizada dos teus ficheiros.",
+	"image_should_be_in_format": "A imagem deve estar no formato PNG, JPEG ou WEBP.",
+	"items_per_page": "Itens por página",
+	"no_items_found": "Nenhum item encontrado",
+	"select_items": "Seleciona itens...",
+	"search": "Pesquisa...",
+	"expand_card": "Expandir cartão",
+	"copied": "Copiado",
+	"click_to_copy": "Clica para copiar",
+	"something_went_wrong": "Ocorreu um erro",
+	"go_back_to_home": "Voltar à página inicial",
+	"alternative_sign_in_methods": "Métodos alternativos de início de sessão",
+	"login_background": "Fundo da autenticação",
+	"logo": "Logótipo",
+	"login_code": "Código de acesso",
+	"create_a_login_code_to_sign_in_without_a_passkey_once": "Criar um código de acesso que o utilizador pode usar para iniciar sessão sem uma chave-passe, uma vez.",
+	"one_hour": "1 hora",
+	"twelve_hours": "12 horas",
+	"one_day": "1 dia",
+	"one_week": "1 semana",
+	"one_month": "1 mês",
+	"expiration": "Expiração",
+	"generate_code": "Gerar código",
+	"name": "Nome",
+	"browser_unsupported": "Navegador não suportado",
+	"this_browser_does_not_support_passkeys": "Este navegador não suporta chaves-passe. Por favor, usa um método de início de sessão alternativo.",
+	"an_unknown_error_occurred": "Ocorreu um erro desconhecido",
+	"authentication_process_was_aborted": "O processo de autenticação foi interrompido",
+	"error_occurred_with_authenticator": "Ocorreu um erro com o autenticador",
+	"authenticator_does_not_support_discoverable_credentials": "O autenticador não suporta credenciais detectáveis",
+	"authenticator_does_not_support_resident_keys": "O autenticador não suporta chaves residentes",
+	"passkey_was_previously_registered": "Esta chave-passe já foi registada antes",
+	"authenticator_does_not_support_any_of_the_requested_algorithms": "O autenticador não suporta nenhum dos algoritmos solicitados",
+	"webauthn_error_invalid_rp_id": "O ID da entidade de confiança configurado não é válido.",
+	"webauthn_error_invalid_domain": "O domínio configurado não é válido.",
+	"contact_administrator_to_fix": "Contacta o teu administrador para resolver este problema.",
 	"webauthn_operation_not_allowed_or_timed_out": "The operation was not allowed or timed out",
 	"webauthn_not_supported_by_browser": "Passkeys are not supported by this browser. Please use an alternative sign in method.",
 	"critical_error_occurred_contact_administrator": "A critical error occurred. Please contact your administrator.",
 	"sign_in_to": "Sign in to {name}",
+	"account_selection_signin_confirmation": "Queres usar a seguinte conta para continuar a <b>{name}</b>?",
+	"use_a_different_account": "Usa outra conta",
 	"client_not_found": "Client not found",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> wants to access the following information:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "Do you want to sign in to <b>{client}</b> with your {appName} account?",
@@ -99,76 +101,76 @@
 	"settings": "Settings",
 	"update_pocket_id": "Update Pocket ID",
 	"powered_by": "Powered by",
-	"see_your_recent_account_activities": "See your account activities within the configured retention period.",
-	"time": "Time",
-	"event": "Event",
-	"approximate_location": "Approximate Location",
-	"ip_address": "IP Address",
-	"device": "Device",
-	"client": "Client",
+	"see_your_recent_account_activities": "Vê as atividades da tua conta dentro do período de retenção configurado.",
+	"time": "Tempo",
+	"event": "Evento",
+	"approximate_location": "Localização aproximada",
+	"ip_address": "Endereço de IP",
+	"device": "Dispositivo",
+	"client": "Cliente",
 	"actor": "Ator",
-	"unknown": "Unknown",
-	"account_details_updated_successfully": "Account details updated successfully",
-	"profile_picture_updated_successfully": "Profile picture updated successfully. It may take a few minutes to update.",
-	"account_settings": "Account Settings",
-	"passkey_missing": "Passkey missing",
-	"please_provide_a_passkey_to_prevent_losing_access_to_your_account": "Please add a passkey to prevent losing access to your account.",
-	"single_passkey_configured": "Single Passkey Configured",
-	"it_is_recommended_to_add_more_than_one_passkey": "It is recommended to add more than one passkey to avoid losing access to your account.",
-	"account_details": "Account Details",
-	"passkeys": "Passkeys",
-	"manage_your_passkeys_that_you_can_use_to_authenticate_yourself": "Manage your passkeys that you can use to authenticate yourself.",
+	"unknown": "Desconhecido",
+	"account_details_updated_successfully": "Detalhes da conta atualizados com sucesso",
+	"profile_picture_updated_successfully": "Imagem de perfil atualizada com sucesso. Pode demorar alguns minutos para atualizar.",
+	"account_settings": "Definições de conta",
+	"passkey_missing": "Chave-passe em falta",
+	"please_provide_a_passkey_to_prevent_losing_access_to_your_account": "Adiciona uma chave-passe para evitar perder o acesso à tua conta.",
+	"single_passkey_configured": "Uma única chave-passe configurada",
+	"it_is_recommended_to_add_more_than_one_passkey": "É recomendado adicionar mais do que uma chave-passe para evitar perder acesso à conta.",
+	"account_details": "Detalhes da conta",
+	"passkeys": "Chaves-passe",
+	"manage_your_passkeys_that_you_can_use_to_authenticate_yourself": "Gere as tuas chaves-passe que podes usar para te autenticares.",
 	"manage_this_users_passkeys": "Gerir as chaves de acesso deste utilizador.",
-	"add_passkey": "Add Passkey",
-	"create_a_one_time_login_code_to_sign_in_from_a_different_device_without_a_passkey": "Create a one-time login code to sign in from a different device without a passkey.",
-	"create": "Create",
-	"first_name": "First name",
-	"last_name": "Last name",
-	"username": "Username",
-	"save": "Save",
-	"username_can_only_contain": "Username can only contain lowercase letters, numbers, underscores, dots, hyphens, and '@' symbols",
-	"username_must_start_with": "Username must start with an alphanumeric character",
-	"username_must_end_with": "Username must end with an alphanumeric character",
-	"sign_in_using_the_following_code_the_code_will_expire_in_minutes": "Sign in using the following code. The code will expire in 15 minutes.",
-	"or_visit": "or visit",
-	"added_on": "Added on",
-	"rename": "Rename",
-	"delete": "Delete",
-	"are_you_sure_you_want_to_delete_this_passkey": "Are you sure you want to delete this passkey?",
-	"passkey_deleted_successfully": "Passkey deleted successfully",
-	"delete_passkey_name": "Delete {passkeyName}",
-	"passkey_name_updated_successfully": "Passkey name updated successfully",
-	"name_passkey": "Name Passkey",
-	"name_your_passkey_to_easily_identify_it_later": "Name your passkey to easily identify it later.",
-	"create_api_key": "Create API Key",
-	"add_a_new_api_key_for_programmatic_access": "Add a new API key for programmatic access to the <link href='https://pocket-id.org/docs/api'>Pocket ID API</link>.",
-	"add_api_key": "Add API Key",
-	"manage_api_keys": "Manage API Keys",
-	"api_key_created": "API Key Created",
-	"for_security_reasons_this_key_will_only_be_shown_once": "For security reasons, this key will only be shown once. Please store it securely.",
-	"description": "Description",
-	"api_key": "API Key",
-	"close": "Close",
-	"name_to_identify_this_api_key": "Name to identify this API key.",
-	"expires_at": "Expires At",
-	"when_this_api_key_will_expire": "When this API key will expire.",
-	"optional_description_to_help_identify_this_keys_purpose": "Optional description to help identify this key's purpose.",
-	"expiration_date_must_be_in_the_future": "Expiration date must be in the future",
-	"revoke_api_key": "Revoke API Key",
-	"never": "Never",
-	"revoke": "Revoke",
-	"api_key_revoked_successfully": "API key revoked successfully",
-	"are_you_sure_you_want_to_revoke_the_api_key_apikeyname": "Are you sure you want to revoke the API key \"{apiKeyName}\"? This will break any integrations using this key.",
-	"last_used": "Last Used",
-	"actions": "Actions",
-	"images_updated_successfully": "Images updated successfully. It may take a few minutes to update.",
-	"general": "General",
-	"configure_smtp_to_send_emails": "Enable email notifications to alert users when a login is detected from a new device or location.",
+	"add_passkey": "Adicionar chave-passe",
+	"create_a_one_time_login_code_to_sign_in_from_a_different_device_without_a_passkey": "Criar um código de início de sessão único para iniciar sessão num dispositivo diferente sem uma chave-passe.",
+	"create": "Criar",
+	"first_name": "Nome próprio",
+	"last_name": "Apelido",
+	"username": "Nome de utilizador(a)",
+	"save": "Guardar",
+	"username_can_only_contain": "O nome de utilizador(a) só pode conter letras minúsculas, números, underscores, pontos, hífenes e '@'",
+	"username_must_start_with": "O nome de utilizador(a) deve começar com um carater alfanumérico",
+	"username_must_end_with": "O nome de utilizador(a) deve acabar com um carater alfanumérico",
+	"sign_in_using_the_following_code_the_code_will_expire_in_minutes": "Inicia sessão usando o código abaixo. O código expira em 15 minutos.",
+	"or_visit": "ou visita",
+	"added_on": "Adicionado em",
+	"rename": "Alterar nome",
+	"delete": "Eliminar",
+	"are_you_sure_you_want_to_delete_this_passkey": "Tens a certeza de que queres eliminar esta chave-passe?",
+	"passkey_deleted_successfully": "Chave-passe eliminada com sucesso",
+	"delete_passkey_name": "Eliminar {passkeyName}",
+	"passkey_name_updated_successfully": "Nome da chave-passe atualizado com sucesso",
+	"name_passkey": "Nome da chave-passe",
+	"name_your_passkey_to_easily_identify_it_later": "Nome da chave-passe, para a identificares facilmente mais tarde.",
+	"create_api_key": "Criar chave API",
+	"add_a_new_api_key_for_programmatic_access": "Adiciona uma nova chave API para acesso programático à <link href='https://pocket-id.org/docs/api'>API Pocket ID</link>.",
+	"add_api_key": "Adicionar chave API",
+	"manage_api_keys": "Gerir chaves API",
+	"api_key_created": "Chave API criada",
+	"for_security_reasons_this_key_will_only_be_shown_once": "Por motivos de segurança, esta chave só será mostrada uma vez. Guarda-a num local seguro.",
+	"description": "Descrição",
+	"api_key": "Chave API",
+	"close": "Fechar",
+	"name_to_identify_this_api_key": "Nome para identificar esta chave API.",
+	"expires_at": "Expira a",
+	"when_this_api_key_will_expire": "Quando esta chave API vai expirar.",
+	"optional_description_to_help_identify_this_keys_purpose": "Descrição opcional para ajudar a identificar o propósito desta chave.",
+	"expiration_date_must_be_in_the_future": "A data de expiração tem de ser no futuro",
+	"revoke_api_key": "Revogar chave API",
+	"never": "Nunca",
+	"revoke": "Revogar",
+	"api_key_revoked_successfully": "Chave API revogada com sucesso",
+	"are_you_sure_you_want_to_revoke_the_api_key_apikeyname": "Tens a certeza de que queres revogar a chave API \"{apiKeyName}\"? Isto irá partir todas as integrações que utilizam esta chave.",
+	"last_used": "Última utilização",
+	"actions": "Ações",
+	"images_updated_successfully": "Imagens atualizadas com sucesso. A atualização pode demorar alguns minutos.",
+	"general": "Geral",
+	"configure_smtp_to_send_emails": "Ativar as notificações por email para alertar os utilizadores quando for detetado um início de sessão a partir de um novo dispositivo ou local.",
 	"ldap": "LDAP",
-	"configure_ldap_settings_to_sync_users_and_groups_from_an_ldap_server": "Configure LDAP settings to sync users and groups from an LDAP server.",
-	"images": "Images",
-	"update": "Update",
-	"email_configuration_updated_successfully": "Email configuration updated successfully",
+	"configure_ldap_settings_to_sync_users_and_groups_from_an_ldap_server": "Configurar as definições LDAP para sincronizar utilizadores e grupos a partir de um servidor LDAP.",
+	"images": "Imagens",
+	"update": "Atualizar",
+	"email_configuration_updated_successfully": "Configuração de email atualizada com sucesso",
 	"save_changes_question": "Save changes?",
 	"you_have_to_save_the_changes_before_sending_a_test_email_do_you_want_to_save_now": "You have to save the changes before sending a test email. Do you want to save now?",
 	"save_and_send": "Save and send",
--- a/frontend/messages/ru.json
+++ b/frontend/messages/ru.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "Этот браузер не поддерживает ключи доступа. Попробуйте войти другим способом.",
 	"critical_error_occurred_contact_administrator": "Произошла критическая ошибка. Обратитесь к администратору.",
 	"sign_in_to": "Войти в {name}",
+	"account_selection_signin_confirmation": "Хочешь использовать следующую учетную запись, чтобы продолжить <b>{name}</b>?",
+	"use_a_different_account": "Воспользуйся другой учетной записью",
 	"client_not_found": "Клиент не найден",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> запрашивает доступ к следующей информации:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "Вы хотите войти в <b>{client}</b> с помощью вашей учетной записи {appName}?",
--- a/frontend/messages/sv.json
+++ b/frontend/messages/sv.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "Passkeys stöds inte av denna webbläsare. Använd en alternativ inloggningsmetod.",
 	"critical_error_occurred_contact_administrator": "Ett kritiskt fel har inträffat. Kontakta din administratör.",
 	"sign_in_to": "Logga in på {name}",
+	"account_selection_signin_confirmation": "Vill du använda följande konto för att fortsätta till <b>{name}</b>?",
+	"use_a_different_account": "Använd ett annat konto",
 	"client_not_found": "Klienten hittades inte",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> vill få åtkomst till följande information:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "Vill du logga in på <b>{client}</b> med ditt {appName} -konto?",
--- a/frontend/messages/tr.json
+++ b/frontend/messages/tr.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "Bu tarayıcıda geçiş anahtarları desteklenmemektedir. Lütfen alternatif bir oturum açma yöntemi kullanın.",
 	"critical_error_occurred_contact_administrator": "Kritik bir hata oluştu. Lütfen sistem yöneticinizle iletişime geçin.",
 	"sign_in_to": "{name} hesabına giriş yap",
+	"account_selection_signin_confirmation": "Devam etmek için aşağıdaki hesabı kullanmak ister misiniz <b>{name}</b>?",
+	"use_a_different_account": "Başka bir hesap kullanın",
 	"client_not_found": "İstemci bulunamadı",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> aşağıdaki bilgilere erişmek istiyor:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "{appName} hesabınla <b>{client}</b> uygulamasına giriş yapmak istiyor musun?",
@@ -247,7 +249,7 @@
 	"edit": "Düzenle",
 	"user_groups_updated_successfully": "Kullanıcı grupları başarıyla güncellendi",
 	"user_updated_successfully": "Kullanıcı başarıyla güncellendi",
-	"custom_claims_updated_successfully": "Özel alanlar başarıyla güncellendi",
+	"custom_claims_updated_successfully": "Özel yetkiler başarıyla güncellendi",
 	"back": "Geri",
 	"user_details_firstname_lastname": "Kullanıcı Detayları {firstName} {lastName}",
 	"manage_which_groups_this_user_belongs_to": "Bu kullanıcının ait olduğu grupları yönetin.",
--- a/frontend/messages/uk.json
+++ b/frontend/messages/uk.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "Цей браузер не підтримує ключі доступу. Будь ласка, скористайтеся альтернативним методом входу.",
 	"critical_error_occurred_contact_administrator": "Виникла критична помилка. Будь ласка, зверніться до адміністратора.",
 	"sign_in_to": "Увійти в {name}",
+	"account_selection_signin_confirmation": "Ви хочете продовжити, використовуючи цей обліковий запис <b>{name}</b>?",
+	"use_a_different_account": "Використовуйте інший обліковий запис",
 	"client_not_found": "Клієнт не знайдений",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> хоче отримати доступ до наступної інформації:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "Бажаєте увійти до <b>{client}</b> за допомогою облікового запису {appName}?",
--- a/frontend/messages/vi.json
+++ b/frontend/messages/vi.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "Chìa khóa truy cập không được hỗ trợ bởi trình duyệt này. Vui lòng sử dụng phương thức đăng nhập thay thế.",
 	"critical_error_occurred_contact_administrator": "Đã xảy ra lỗi nghiêm trọng. Vui lòng liên hệ với quản trị viên.",
 	"sign_in_to": "Đăng nhập {name}",
+	"account_selection_signin_confirmation": "Bạn có muốn sử dụng tài khoản sau đây để tiếp tục <b>{name}</b>?",
+	"use_a_different_account": "Sử dụng tài khoản khác",
 	"client_not_found": "Không tìm thấy client.",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> muốn truy cập các thông tin sau:",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "Bạn có muốn đăng nhập vào <b>{client}</b> với tài khoản {appName} của bạn?",
--- a/frontend/messages/zh-CN.json
+++ b/frontend/messages/zh-CN.json
@@ -53,6 +53,8 @@
 	"webauthn_not_supported_by_browser": "此浏览器不支持密钥登录。请使用其他登录方式。",
 	"critical_error_occurred_contact_administrator": "发生严重错误。请联系您的管理员。",
 	"sign_in_to": "登录到 {name}",
+	"account_selection_signin_confirmation": "您是否要使用以下账户继续 <b>{name}</b>？",
+	"use_a_different_account": "请使用另一个账户",
 	"client_not_found": "客户端未找到",
 	"client_wants_to_access_the_following_information": "<b>{client}</b> 希望访问以下信息：",
 	"do_you_want_to_sign_in_to_client_with_your_app_name_account": "您是否希望使用您的 {appName} 账户登录到 <b>{client}</b>？",
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Elias Schneider	37c568b66c	Merge remote-tracking branch 'origin/main'	2026-06-16 08:48:35 +02:00
github-actions[bot]	212c574a68	chore: update AAGUIDs (#1511 ) Co-authored-by: stonith404 <58886915+stonith404@users.noreply.github.com>	2026-06-08 09:22:50 +02:00
Elias Schneider	420fd02c8c	fix: PAR parameters not respected by authorize page	2026-06-05 11:39:14 +02:00
Elias Schneider	4f97cd4188	refactor: fix linter issues	2026-06-02 14:08:33 +02:00
Thibault NORMAND	68a5abdcca	feat(oauth): add support for Pushed Authorization Requests (RFC9126) (#1404 ) Co-authored-by: Elias Schneider <login@eliasschneider.com>	2026-06-02 14:02:12 +02:00
wollew	2eada149af	docs: fix link to watchtower repo (#1500 )	2026-06-01 11:42:00 +02:00
Elias Schneider	81e5aa2168	chore(translations): update translations via Crowdin (#1498 )	2026-06-01 11:17:12 +02:00
Melvin Snijders	e88ff03ea2	fix: issues with loading new font (#1496 )	2026-06-01 11:16:55 +02:00
Elias Schneider	fc42f6211d	docs: add "needs more upvotes" label as default	2026-05-31 21:08:08 +02:00
Elias Schneider	bf9f76bbd5	docs: add PR template	2026-05-31 21:04:33 +02:00
Elias Schneider	fea933b62d	docs: add AI Usage Policy to CONTRIBUTING.md	2026-05-31 20:55:05 +02:00
Elias Schneider	cdc77062f0	release: 2.8.0	2026-05-31 20:04:59 +02:00
Elias Schneider	7027296632	fix: restore cross-platform binary builds	2026-05-31 20:04:30 +02:00
Elias Schneider	e046a03364	chore: use fixed minor version of Go	2026-05-31 19:09:06 +02:00
Elias Schneider	0616abaf7f	refactor: run formatter	2026-05-31 16:11:21 +02:00
Elias Schneider	9ad2bfc7b3	tests(e2e): don't compare hashes of profile pictures	2026-05-29 13:43:21 +02:00
Elias Schneider	bc4f75c44f	refactor: fix linter issues	2026-05-29 12:25:06 +02:00
Elias Schneider	a71219637a	fix: add support for unix socket mode in healthcheck	2026-05-29 12:11:26 +02:00
Elias Schneider	b3d40a476b	feat: improve design trough the whole application	2026-05-29 11:37:34 +02:00
Elias Schneider	272d1479bd	fix: scope confirmation wasn't shown if account selection was prompted	2026-05-29 10:04:56 +02:00
Elias Schneider	f13424720b	tests(e2e): use custom Playwright route for callback URL checks	2026-05-29 09:44:37 +02:00
Elias Schneider	6aefe6c8e1	chore(translations): update translations via Crowdin (#1490 )	2026-05-29 09:18:59 +02:00
V	dd77bb0f32	feat: add support for systemd socket activation (#1479 )	2026-05-29 09:18:29 +02:00
Elias Schneider	0c95b7c3cc	feat: add support for `response_mode=fragment`	2026-05-29 09:14:44 +02:00
github-actions[bot]	f4a20e3ef9	chore: update AAGUIDs (#1487 ) Co-authored-by: stonith404 <58886915+stonith404@users.noreply.github.com>	2026-05-25 09:20:32 -05:00
Elias Schneider	5db570bf66	feat: remove EXIF/XMP metadata from uploaded images (#1477 )	2026-05-19 20:56:14 -07:00
Elias Schneider	e8c398ffbd	ci/cd(dependabot): fix invalid schema	2026-05-19 17:09:14 +02:00
Elias Schneider	9dd3d319cf	feat: delete OAuth refresh token on RP initiated logout (#1480 )	2026-05-19 17:05:44 +02:00
Elias Schneider	b9fdd530c0	ci/cd: use dependabot for automatic dependency upgrades	2026-05-19 17:02:05 +02:00
Elias Schneider	cc9163f577	fix: make stream of downloaded logos seekable for S3 checksum calculation	2026-05-19 16:28:30 +02:00
Elias Schneider	b27a52a591	revert: delete refresh tokens on end-session to prevent reuse after logout (#1458 ) This reverts commit `7aacbd0245`.	2026-05-18 23:36:39 +02:00
Elias Schneider	bb5a111e3d	docs: update SECURITY.md	2026-05-18 23:15:12 +02:00
Elias Schneider	8ad95b8af1	refactor: apply go 1.26.0 syntax updated	2026-05-18 23:06:54 +02:00
Elias Schneider	e56dc124ce	refactor: remove deprecated http2 package	2026-05-18 23:04:08 +02:00
Elias Schneider	91c2ea2a66	chore: upgrade dependencies	2026-05-18 22:55:00 +02:00
Elias Schneider	ce6bdb9d7e	fix: reject unknown PKCE code challenge methods	2026-05-18 22:07:20 +02:00
Elias Schneider	8b22fcaaa4	fix: add `email_verified` to reserved claims list	2026-05-18 21:08:51 +02:00
github-actions[bot]	4abd1a5124	chore: update AAGUIDs (#1476 ) Co-authored-by: stonith404 <58886915+stonith404@users.noreply.github.com>	2026-05-18 18:16:48 +02:00
Elias Schneider	714b5b3307	fix: return 404 status code for `.well-known` routes if not found	2026-05-18 18:15:54 +02:00
wucm667	7aacbd0245	fix(oidc): delete refresh tokens on end-session to prevent reuse after logout (#1458 ) Co-authored-by: Alessandro (Ale) Segala <43508+ItalyPaleAle@users.noreply.github.com> Signed-off-by: wucm667 <stevenwucongmin@gmail.com>	2026-05-15 21:25:40 +00:00
Elias Schneider	532a7a1d14	chore(translations): update translations via Crowdin (#1472 )	2026-05-15 16:19:53 -05:00
Kyle Mendell	9399cba775	release: 2.7.0	2026-05-11 11:06:09 -05:00
Kyle Mendell	5c7e5f680b	chore: fix incorrect container name variable	2026-05-11 11:04:36 -05:00
Elias Schneider	4e8995e04e	chore(translations): update translations via Crowdin (#1470 )	2026-05-10 18:16:13 -05:00
mgabor	da3489cfa5	fix(oidc): fall back to Basic auth when PKCE puts client_id in body (#1466 ) Co-authored-by: mgabor3141 <@mgabor3141> Co-authored-by: Gabor Mezo <git@mgabor.hu> Co-authored-by: Alessandro (Ale) Segala <43508+ItalyPaleAle@users.noreply.github.com>	2026-05-07 23:01:51 -05:00
Elias Schneider	12ac7973a2	chore(translations): update translations via Crowdin (#1460 )	2026-05-05 11:16:06 -05:00
GameTec-live	27945f5695	fix: invalidate cache when changing image (#1462 )	2026-05-05 11:10:38 -05:00
Kyle Mendell	2340bb0f1d	chore: fix caching of ldap-cli e2e tests docker build (#1457 )	2026-04-28 15:14:22 -05:00
Elias Schneider	d860ef43ec	chore(translations): update translations via Crowdin (#1456 ) Co-authored-by: Kyle Mendell <kmendell@ofkm.us>	2026-04-28 12:12:41 -05:00
Kyle Mendell	d5cf60689e	ci/cd: migrate github actions runners to depot runners (#1329 )	2026-04-26 19:48:19 -05:00
Alessandro (Ale) Segala	f4706cd6cc	feat: add support for "select_account" prompt (#1453 ) Co-authored-by: Elias Schneider <login@eliasschneider.com>	2026-04-26 17:26:21 +00:00
Elias Schneider	e33a9b8c88	chore: post dependency upgrade fixes	2026-04-26 15:46:35 +02:00
Elias Schneider	20df033c1f	chore: upgrade dependencies	2026-04-26 14:41:41 +02:00
Elias Schneider	f9f93f0ef1	chore: add script to update deps	2026-04-26 14:41:27 +02:00
John	64d4ac7919	feat: add support for response_mode=form_post (#1360 ) Co-authored-by: Alessandro (Ale) Segala <43508+ItalyPaleAle@users.noreply.github.com> Co-authored-by: Kyle Mendell <kmendell@ofkm.us> Co-authored-by: Elias Schneider <login@eliasschneider.com>	2026-04-26 14:11:35 +02:00
Anthony Clerici	0ed2c48591	docs: add missing /api prefix to app config swagger routes (#1454 )	2026-04-25 17:58:41 +02:00
Alessandro (Ale) Segala	5559077ab4	fix: add `_FILE` support for `S3_SECRET_ACCESS_KEY_FILE` env var (#1452 )	2026-04-22 14:22:42 -07:00
@@ -1 +1 @@
 .6.2
 .8.0