chore(release): v1.32.5 — OIDC sign-in survives a duplicated service-worker callback

CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## [Unreleased]
 
+## [1.32.5] — 2026-07-23
+
+- **Browser SSO sign-in no longer fails on a duplicated callback.** With the
+  service worker's navigation preload enabled, a single-use OIDC callback could
+  be requested twice — the first redeemed the authorization code and set the
+  session, the second hit the identity provider with the now-consumed code and
+  failed, landing every successful sign-in on an error page. The service worker
+  now settles one-shot auth navigations itself so the callback reaches the
+  server exactly once, and the callback is idempotent: a duplicate that already
+  holds a database-valid session is sent into the app instead of erroring,
+  while a forged or session-less state still fails closed and never redeems a
+  code.
+
+No migrations. No breaking changes.
+
 ## [1.32.4] — 2026-07-23
 
 - **The Coach's numeric verifier stops flagging figures it was actually given.**

docs/api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.32.4
+  version: 1.32.5
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.32.4",
+  "version": "1.32.5",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",

public/sw.js

@@ -36,7 +36,7 @@ try {
 // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild.
 const CACHE_VERSION =
   (typeof self !== "undefined" && self.__APP_VERSION__) ||
-  /* @sw-version-fallback */ "v1.32.4";
+  /* @sw-version-fallback */ "v1.32.5";
 const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`;
 const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`;
 // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`