james.maesandClaude Sonnet 5.5
b87171cafc
Ordinary Sign out cleared only the QQQ session; the provider session left in the browser silently signed the same person back in (prompt=login alone was already observed reusing retained SSO on real Authentik). Sign out now runs the provider end-session flow when the server supports it, and every sign-in also sends max_age=0. Stored-session restore after sign-out was checked: not a cause. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2.5 KiB
2.5 KiB
Changelog
1.0.4 (versionCode 6)
- Loading the server's metadata no longer fails with "Error loading QInstance: timeout" on a handheld. The metadata response is about 1.7 MB and takes the server 4 to 8 seconds to build, and the default 10 second read timeout expired. That one call now allows 60 seconds; every other call keeps its short timeout. A timeout now reads "Timed out after 60.0s loading the server's metadata from /qqq/v1/metaData".
- Sign-out now also ends the identity-provider session in the browser when the server supports it (the same flow as "Sign out of company", now behind the single Sign out action), and every browser sign-in sends
max_age=0next toprompt=login. Before, ordinary Sign out cleared only the QQQ session, so the provider session left in the browser silently signed the same person straight back in on the next sign-in. Servers without provider logout still get local plus QQQ sign-out. Stored-session restore after sign-out was checked and is not a cause (test added). - Includes 1.0.3 (versionCode 5): string widget icons and summary-only help content from current QQQ core are accepted. (PR 24)
1.0.2 (versionCode 4), candidate
Not yet built, signed, tagged or published (prepared 2026-11-06). Supersedes the unpublished signed 1.0.1 (versionCode 3) candidate and updates it in place with the same permanent signer.
- Company sign-out now completes: the provider logout request runs before the scanner host ends its device session, so the browser end-session page opens. Previously the device-session end ran first, removed the QQQ session server-side, and
nativeLogoutDatawas never returned; observed on the MC9400 with the production APK against the real Authentik server. (PR 17) - The signed-in user's name is shown after browser (OAuth) sign-in instead of a blank current user. (PR 17)
- The scanner host reports the installed app and OS version on every session heartbeat, so scan receipts show the new version after an in-place update. Effective with mobile-scanners server 1.6.0; older servers ignore the keys. (PR 18)
Unreleased
- Add the QQQ Mobile scanner host for metadata-defined native apps and processes.
- Add administrator-approved device enrollment and Zebra DataWedge single-barcode capture.
- Add table-backed login, current QQQ HttpOnly session handling, and server-side logout.
- Preserve pending scan identity for explicit retry and require a matching server acknowledgment.
- Add scanner APK/test/lint CI and an optional emulator workflow alongside managed library CI.