RESTHeart 9.6.0

RESTHeart 9.6.0 completes and hardens the restheart-accounts module introduced in 9.4.0. It delivers two large tracking epics - coherent token delivery across all auth flows, and full team/profile self-service management — plus several security fixes and a new restheart-emails module. All 18 issues in the 9.6.0 milestone are closed.

Breaking Changes

• OriginVetoer allows missing Origin header by default (#652) — new allow-missing-origin option defaults to true. If your deployment relied on requests without Origin being vetoed, set it to false explicitly.
• user.team is now a { _id, role } object (#650) — ACL team-role gating requires both the team ID and membership role. Existing documents with a plain team ID string must be migrated.
• Email config keys standardized to kebab-case — custom configurations using camelCase keys must be updated.

Highlights

Coherent cookie/bearer token delivery (#641)

All authentication flows — signup, signin, OAuth, activate, reset-password — now deliver tokens consistently via both authCookie and Authorization bearer header through a single shared helper (#640):

• Unified token delivery selector across all flows: cookie, body, fragment (#637)
• Bearer/token-in-body delivery added to /auth/activate and /auth/reset-password (#636)
• Cookie Max-Age aligned with JWT TTL; deprecated session-cookie overload dropped (#639)
• Secure flag set on all JWT cookies (#638)

Team & profile self-service management (#648)

Authenticated users can now manage their teams and profiles without admin intervention:

• List team members (#642)
• Create additional team (#643)
• Rename/edit team — name and description (#644)
• Delete team (only if no other members) (#645)
• Self-service profile update (#646)
• Change password for authenticated users (#647)

restheart-emails module

• New org.restheart.emails module with EmailSender SPI extracted to restheart-commons for external plugin reuse
• Per-request SMTP overrides (#3fe5d1f)
• Removal listener support on loading cache for ermes instance cleanup

Security Fixes

• OriginVetoer skips only genuine CORS preflights, not all OPTIONS requests (bd2ff85)
• VETOERs enforced on secure=false services (#654)
• OAuth callback respects per-team overrides; config made fully multi-tenant (#653)
• Password change blocked for OAuth accounts (eb66ceb)
• Verification gate added to account services (3b4719b)
• /users REST writes restricted to profile fields only; admin exemption preserved
• User veto now correctly checks collection and database scope
• Forgot password resends verification email for unverified accounts
• Unique JWT ID (jti) added to all tokens for revocation tracking

Bug Fixes

• team.members[] now correctly records invited members (#649)
• ListInvitationsService added with expired flag and logging
• flow=signup marker added to signup redirects

Other Improvements

• AuthCookie moved to restheart-commons for external plugin use
• Team description added to membership data
• JVM option for compact object headers (-XX:+UseCompactObjectHeaders)
• GitHub Actions job timeout increased to 10 minutes
• Test logback configuration added for emails module
• README revised for branding and feature updates

Full Changelog: [9.5.2...9.6.0