attesto_phoenix 3.3.1

Changes

• Advertise revocation_endpoint in shared RFC 8414 authorization-server metadata.
• Warn when both bundled OIDC routes are disabled while openid_provider remains implicit.
• Clarify that protected_resource_scopes_supported describes the bundled resource surface; path-specific resources retain their own metadata catalogs.

Verification

• 2,019 tests passed with Ecto enabled; 4 skipped.
• Documentation build, strict Credo, warnings-as-errors, and Hex audit passed.

AttestoPhoenix 3.3.0

What's Changed

• Unify OIDC scope handling and prepare 3.3.0 by @neilberkman in #34

Full Changelog: v3.2.1...v3.3.0

AttestoPhoenix 3.1.0

What's Changed

• Key attesto_authorization_codes on code_hash as its primary key by @jtippett in #26
• Make device-code test identifiers collision-free by @neilberkman in #27
• Make CIBA notification test synchronization deterministic by @neilberkman in #28
• Stabilize ETS owner lifecycle monitor tests by @neilberkman in #29
• Add transactional authorization code completion by @oliver-kriska in #25
• Harden authorization-code primary-key preflight by @neilberkman in #30
• Release attesto_phoenix 3.1.0 by @neilberkman in #31

Full Changelog: v3.0.0...v3.1.0

AttestoPhoenix 3.0.0

Full Changelog: v2.14.2...v3.0.0

attesto_phoenix 2.14.2

Adds optional :authorization_grant_id_claim support for a stable, library-owned authorization-code family identifier across initial and refreshed access tokens. The feature is disabled by default and requires no migration.

New authorization-code family identifiers are 128-bit values encoded as 22-character unpadded Base64URL, matching refresh-family identifiers. Existing stored values are unaffected.

Thanks to @oliver-kriska for the contribution.

attesto_phoenix 2.14.1

Security patch for signed CIBA authentication requests. Requires an explicit atomic replay-check callback when signed requests are enabled, scopes fixed-length replay identities to the authenticated client, validates callback contracts at configuration time, and rejects non-boolean require_signed_request values.

Upgrade note: do not overlap 2.14.0 and 2.14.1 nodes while accepting signed CIBA requests. Drain 2.14.0 nodes and conservatively wait 61 minutes before starting 2.14.1.

attesto_phoenix 2.0.2

RFC 8707 resource-audience support for introspection and token exchange, consistent credential-carried client identity across token grants, stricter resource-policy validation, and the Plug 1.19.5 security floor.

attesto_phoenix 2.0.1

Security patch release requiring Req 0.6.1 or newer, replacing the Bypass/Cowboy test origin with Bandit, refreshing advisory-affected development dependencies, and clarifying HTTPS configuration semantics.

attesto_phoenix 2.0.0

Why this is a major release. The released 1.4 public contract accepted
absolute non-HTTPS endpoint overrides, and UserInfo did not apply the existing
:require_https policy. The security and conformance corrections below can
therefore fail a previously accepted configuration at startup or change an
HTTP UserInfo response from success to rejection. They are incompatible
behavior changes under this project's declared Semantic Versioning policy,
even though the old behavior was not standards-conformant.

Added

• attesto_routes/1 accepts userinfo: false and
  openid_configuration: false as independent, compile-time route-mount
  controls. Both default to true, so existing calls retain the
  exact route table and pipeline data; OAuth-only hosts can omit the OIDC-only
  surfaces without restating the authorization-server routes. Disabling OpenID
  configuration does not remove or alter RFC 8414 authorization-server
  metadata.
• :userinfo_endpoint accepts :derived as an explicit derivation marker for
  the issuer/path-derived bundled UserInfo URL. With userinfo: false, only
  this derived value can be suppressed when it is route-equivalent to the
  removed local endpoint. An explicit HTTPS URL is always authoritative,
  including at the same path, so a host can replace the bundled controller
  without losing Provider Metadata; nil retains its released omission
  behavior. Suppression follows Phoenix/Plug dispatch semantics for prefixes,
  static and dynamic scopes, empty path segments, trailing/repeated slashes,
  percent-decoded request segments, dot segments, non-default ports, and
  forwarded router mounts. A dynamic macro :prefix is rejected when
  userinfo: false is combined with openid_configuration: true, because the
  retained Provider Metadata route cannot resolve that prefix; a surrounding
  dynamic Phoenix scope remains supported.
• AttestoPhoenix.Config accepts a :resource_metadata_resolver callback that
  selects an RFC 9728 protected-resource metadata URI for each request or
  returns nil to omit it. AttestoPhoenix.Plug.Authenticate and UserInfo use
  the selected URI consistently across core verification, revoked-token,
  insufficient-scope, and transport failures. The existing static
  :resource_metadata URL remains the backward-compatible fallback when no
  resolver is configured. Function, {module, function}, and
  {module, function, extra_args} forms are supported; extra arguments follow
  the request argument. Configuration validates MFA callbacks and their
  effective arity. Invalid runtime resolver values are safely omitted; an
  explicit per-Plug override, including nil, skips the resolver; and a
  resolver exception deliberately propagates and fails the request.

Changed

• Breaking — advertised URL validation. AttestoPhoenix.Config.new/1 now
  requires an HTTPS issuer with a host and no query or fragment, and requires
  explicit :authorization_endpoint and :userinfo_endpoint URLs to use HTTPS
  with a host and no fragment. Previously accepted insecure or malformed values
  now raise ArgumentError during configuration. Migrate production and local
  issuers/endpoints to HTTPS, remove query/fragment components from the issuer,
  and use the locally trusted certificate workflow in guides/local_https.md
  for development. Endpoint query components remain supported.
• Breaking — UserInfo transport enforcement. UserInfo now applies
  :require_https before token verification or claim release. A deployment that
  terminates TLS at a proxy must configure the immediate proxy in
  :trusted_proxies so its forwarded HTTPS scheme is trusted; do not disable
  HTTPS in production.
• Potentially breaking — static Plug option validation. A non-nil
resource_metadata: option passed directly to
  AttestoPhoenix.Plug.Authenticate is now validated by init/1 and raises for
  an invalid URL. Phoenix runs Plug initialization at compile time by default;
  hosts using runtime Plug initialization see the same error when the Plug is
  initialized. Fix the URL or use explicit nil. Invalid runtime resolver
  returns are still safely omitted, while a resolver exception deliberately
  propagates and fails the request.

Fixed

• UserInfo now honors the configured error transport hooks on verification,
  TLS, revoked-token, and insufficient-scope failures. UserInfo also now honors
  bearer_methods_supported (previously it accepted header credentials only,
  regardless of configuration): a host advertising "body" will see UserInfo
  begin accepting RFC 6750 §2.2 form-body tokens as advertised.
• An explicit per-plug :resource_metadata value (including nil) and error
  transport hooks now take precedence consistently across core verification,
  TLS, revocation, and principal-resolution failures.
• OpenID Provider Metadata now derives the required authorization_endpoint
  when no override is configured, and both OAuth and OpenID metadata honor the
  same validated external override.

Security

• Issuer and advertised endpoint validation now enforces the HTTPS requirements
  of RFC 8414 and OpenID Provider Metadata, and UserInfo no longer accepts or
  releases Bearer-token claims over an insecure transport when HTTPS is
  required. These security fixes are also the breaking changes called out
  above.

attesto_phoenix 1.4.0

Added

• attesto_routes/1 now accepts route_pipelines: overrides for the documented
  :metadata, :interactive, and :protocol route classes. Each class can use
  its own pipeline or ordered pipeline list while calls without the option retain
  the existing route table and pipeline data.

Fixed

• route_pipelines: rejects nil values and module-attribute pipeline
  expressions with actionable compile-time errors.