v4.1.0

4.1.0 (2026-09-15)

Features

• middleware: add the human and application principal guards (378b039)
• middleware: add the Principal type and its context accessor (479664d)
• middleware: demand a principal bearer when auth is disabled (81cacd5)
• middleware: export Check for authorization outside the chain (657c843)
• middleware: publish the derived principal on authorized requests (0386fcb)
• middleware: send declared scope attributes on authorize (9a67890)

Bug Fixes

• middleware: answer 503 when the authorization service cannot decide (a5e3226)
• apply the repair the steward validated on this head (547c195)
• apply the repair the steward validated on this head (be647b8)
• apply the repair the steward validated on this head (56da6ce)
• apply the repair the steward validated on this head (bed729a)
• apply the repair the steward validated on this head (331d0a2)
• apply the repair the steward validated on this head (864c685)
• apply the repair the steward validated on this head (d477176)
• apply the repair the steward validated on this head (a8738be)
• apply the repair the steward validated on this head (2f66ee8)
• apply the repair the steward validated on this head (e7a78f6)
• middleware: decide authorization on the http status (23273f9)
• middleware: fail a login that did not return a token (61d88e5)
• middleware: keep principal identifiers out of span attributes (2fc5672)
• middleware: log missing trusted proxies at error only when required (041a6c3)
• middleware: make the attributes cache key injective by construction (004955d)
• middleware: never follow a redirect from the authorization service (823d0af)
• middleware: redact the subject from the authorization span payload (b275244)
• declaration: refuse a deny effect instead of accepting one nobody applies (8bf314a)
• middleware: refuse a misdeclared route while auth is disabled (c09b370), closes #184
• middleware: refuse a scope declaration that repeats a dimension name (5a638d2)
• middleware: refuse the principal path when enabled without an address (c025847)
• middleware: reject whitespace-only identity claims (7531d37)
• middleware: report a 4xx that is not about the caller as 503 (e5bbcc2)
• middleware: report authorization outages from check as 503 (32895b0)
• declaration: require the auth host and auth-enabled when declaring (0e605f7)
• middleware: return fiber errors from Authorize refusals (63067c0)
• middleware: return fiber errors from the principal guards (7d694c1)
• middleware: treat a timeout and a missing decision as no answer (c86128b)