v0.2.0

Released commit: 8bb3826c6adce78490f125676fe61fb3f84eb84c

Added

• AccessDeniedException (access_denied, 403) and InvalidTargetException (invalid_target, 400) typed by MapOAuthError; neither counts toward the circuit breaker.
• AuthplaneMcpAuth.Options.ResourceMetadataUrl points the resource_metadata challenge at an AS-hosted PRM document; validated at construction with the resource identifier's rules, and http://authserver:8080/... is accepted.
• README Compatibility section: tested against authserver 0.2.0; introspection-based revocation requires authserver 0.1.2 or later.
• Resource-server DPoP nonce enforcement (RFC 9449 §9), opt-in via InboundDPoPOptions.nonceIssuer; null, the default, leaves existing deployments unchanged. When enabled, every client's first DPoP request takes a 401 use_dpop_nonce round trip.
• Inbound DPoP nonce API: IDPoPNonceIssuer, HmacDPoPNonceIssuer (key required; CreateEphemeral() for single-process), DPoPNonceRequiredException, AuthplaneErrors.ResponseHeaders and VerifiedClaims.NextDPoPNonce. Custom adapters must copy both onto the response.
• AuthplaneErrors.ErrorResponseBody(...), ErrorDescriptionFor(code) and ErrorCodeFor(error) build the RFC 6750 §3 JSON error body and fixed description from the challenge's error code.
• Authplane.Mcp — the middleware logs the exception behind every failure: Error for a 5xx, Debug for a rejection. Hosts without an ILoggerFactory get no output.

Changed

• TokenRevokedException from an active=false introspection now names the other cause: the AS not recognising this resource server as the token's owner (authserver ≥ 0.1.2 runtime-client rule).
• User guides document access_denied vs consent_required on token exchange, the allowed_client_ids operator step, and the confidential + runtime-client requirement for introspection.
• manual-e2e-setup.sh no longer sets AUTHPLANE_CLIENT_CREDENTIALS_ENABLED (on by default since authserver 0.2.0) and accepts AUTHSERVER_REF to check out an authserver ref before building.
• manual-e2e-smoke.sh no longer calls POST /admin/scopes (the route does not exist in authserver 0.2.0; the demo provisioner creates the scopes).
• OAuthProtectedResourceMetadata.GetDocumentUrl derives the document URL from the configured identifier string verbatim, query included. Migration: an identifier with an uppercase scheme or host, a default port or dot-segments now advertises a different URL; update hard-coded expectations.
• Breaking A resource identifier must be an absolute URL with a scheme and host, with no fragment, userinfo, whitespace, backslash, C0 control or DEL, a port of in-range digits with no leading zero, and an RFC 3986 path and query; anything else throws ArgumentException at construction. Migration: configure the full URL and percent-encode offending octets.
• The same identifier gates run in ProtectedResourceMetadata's constructor and Build.
• BREAKING AuthplaneErrors.WwwAuthenticate(...) now emits a fixed error_description chosen by the error= code instead of the exception message. Migration: log error.Message server-side, or pass verboseDescription: true.
• BREAKING Authplane.Mcp — every failure answers with an RFC 6750 §3 JSON body and a fixed description per error code, instead of prose and the exception message. Migration: parse error and error_description from the body.
• BREAKING Authplane.Mcp — a 503 (JWKS or metadata unreachable) answers temporarily_unavailable instead of server_error. Migration: match temporarily_unavailable to detect a transient outage.

Deprecated

• VerifiedClaims.MayAct marked [Obsolete]: authserver 0.2.0 no longer issues may_act; removed in the next minor.

Fixed

• The MCP middleware's decoded-path fallback held %5C back from decoding while Kestrel decodes it, so a %5C-bearing resource identifier answered 401 at its own advertised metadata URL on hosts without a raw request target.
• AuthplaneResource.CreateAsync no longer abandons the AuthplaneClient it builds when the resource constructor rejects its arguments; DisposeAsync is now idempotent.
• The authority now has an RFC 3986 §3.2.2 character-production gate, so an internationalized host is rejected at construction instead of reaching a WWW-Authenticate challenge as a non-URI.
• An authority that is only userinfo (https://user@) is reported as a missing host with ArgumentException, instead of throwing IndexOutOfRangeException.
• AuthplaneClient.CreateAsync no longer abandons the client it built when the priming metadata fetch fails or the caller's token is cancelled.
• An opaque resource identifier such as mailto:ops@example.com is no longer reported as carrying userinfo; it is still refused, now because an opaque URI has no host to derive a metadata document URL from.
• The MCP middleware answers a JWKS or metadata outage with 503 instead of 401 invalid_token, and sends WWW-Authenticate only on a 401.