v0.4.1

Make the TypeScript client usable for an application that holds session state,
and let an application generate the client of its own contract. The Go API of
the library does not change.

• createSessionStore holds the session of the current person, and it reads it
  again after every call that can change it
• the entry point @alternayte/auth-all-client/react holds the hook useSession.
  React is an optional peer dependency
• the client reads a header and a bearer token before each request, so a server
  that serves many people and a mobile application both use one client
• the hooks onRequest, onResponse, and onError reach every call
• auth-all client --openapi generates the client of a host contract, so
  the types name the host columns of WithUserFields and WithOrganizationFields

apidiff reports no incompatible change against v0.3.0.

Changelog

Other

• d461735: Give the TypeScript client a session store and per-request options (@alternayte)
• ba419fb: Give the race detector the time that the suite needs (@alternayte)

Install

Go library:

go get github.com/alternayte/auth-all@v0.4.1

TypeScript client:

npm install @alternayte/auth-all-client@0.4.1

v0.4.0

Add organizations, fine-grained permissions, and the external policy boundary.
Every new capability is off until the application enables it, so a v0.3.0
application compiles and runs with no code change.

• plugins/organizations: organizations, memberships, and the active organization
• plugins/organizations/permission: the statement resource:action and the wildcard
• custom roles that an organization declares at run time, with an escalation guard
• invitations with a hashed single-use token and an atomic acceptance
• teams inside an organization, and the union of the organization role and every team role
• organization-scoped API keys that never exceed the live permissions of the owner
• administrative routes for the organizations of the whole application
• ObjectChecker, the optional seam for a per-object question
• the Go methods SignIn, SignOut, SignOutToken, and ChangePassword
• WithStrictOriginCheck, which refuses a cookie request that names no origin

The credential read loads the session, the user, the organization, the
membership, and the resolved statements in one round trip, so a permission
check costs no store access. One check of a set of 100 statements costs 44
nanoseconds and allocates nothing.

Apply the migration units 20261101000001 to 20261101000006 for the
organizations plugin, and 20261101000007 for the API key column. The two new
columns are nullable, so the units apply to a database that holds rows.

apidiff reports no incompatible change against v0.3.0.

Changelog

Other

• b1fee4b: Add the Go methods for the sign-in, the sign-out, and the password change (@alternayte)
• 8558646: Add the compatibility routes and the external policy boundary (@alternayte)
• 59d2df0: Add the custom roles and their escalation guard (@alternayte)
• 8fa530a: Add the invitations and the member limit (@alternayte)
• 804d5bd: Add the membership operations and the owner guard (@alternayte)
• d0b3c4e: Add the organization routes and the lifecycle hooks (@alternayte)
• 86979c8: Add the organization tables and the organization store (@alternayte)
• bb4c10f: Add the organization-scoped API keys (@alternayte)
• f0a1ecc: Add the permission model and the role declaration (@alternayte)
• dc546c2: Add the personal organizations (@alternayte)
• e1e9f93: Add the strict origin check (@alternayte)
• 96b228a: Add the teams and the union of the roles (@alternayte)
• 73773c1: Complete the organizations release (@alternayte)
• 4d25d88: Describe the organizations in the README (@alternayte)
• f74e95d: Describe the v0.3.0 capabilities in the README (@alternayte)
• de7ee21: Keep the principal comparable and record the decisions (@alternayte)
• 1b415fb: Load the active organization with the credential (@alternayte)
• 783429a: Merge the organizations release (@alternayte)
• 6df67a4: Prove the route checks and the default deny (@alternayte)
• 5da821c: Record the organization scenarios in the verification evidence (@alternayte)

Install

Go library:

go get github.com/alternayte/auth-all@v0.4.0

TypeScript client:

npm install @alternayte/auth-all-client@0.4.0

v0.3.0

Changelog

Other

• eae003f: Add the host columns to the users table (@alternayte)
• ae3a4e9: Administer the users (@alternayte)
• 2d3d6f0: Apply the exported migrations with goose (@alternayte)
• 9d2cad6: Authenticate a machine with an API key (@alternayte)
• bad15bd: Bound the memory of the authorization state (@alternayte)
• bedad67: Check the origin of a host route (@alternayte)
• 4d945ab: Check the release before it publishes anything (@alternayte)
• 48b2c61: Check the role of a request (@alternayte)
• 98057fd: Count the sensitive attempts in the store (@alternayte)
• 34388b0: Document the new capabilities (@alternayte)
• dc0683f: Export the schema as versioned migration units (@alternayte)
• 539a7a0: Give the apidiff step the history it reads (@alternayte)
• c71f3c1: Keep the design documents and the evidence local (@alternayte)
• 318f33b: Merge the Auth-All API into a huma document (@alternayte)
• 3beffd8: Name the actor of every event (@alternayte)
• 8b0dc61: Prove the non-functional requirements (@alternayte)
• cf54fb9: Publish the TypeScript client through trusted publishing (@alternayte)
• d0bbaef: Record the v1.1 scenarios in the verification evidence (@alternayte)
• 78ff0ad: Resolve one principal for every request (@alternayte)
• 457042b: Serve the store from a pgx pool (@alternayte)
• 4dbb4fd: Start the first administrator from the operator API (@alternayte)

Install

Go library:

go get github.com/alternayte/auth-all@v0.3.0

TypeScript client:

npm install @alternayte/auth-all-client@0.3.0

v0.2.0

Changelog

Other

• d075eed: Add the RequireAuth and LoadSession middleware (@alternayte)
• cebf7c8: Add the TOTP algorithm package (@alternayte)
• 36e7029: Add the TOTP enrolment endpoints (@alternayte)
• 666bb32: Add the TOTP storage (@alternayte)
• 1c94fc7: Add the generic OpenID Connect provider (@alternayte)
• 86452ff: Add the recovery code generator (@alternayte)
• e4518b9: Add the recovery code storage (@alternayte)
• baef50d: Add the recovery codes to the second factor (@alternayte)
• cb5e0d0: Build the TypeScript client before the typecheck (@alternayte)
• 7080b2c: Cover the duplicate provider identifier guard (@alternayte)
• 09e8146: Cover the magic-link redirect with the second factor (@alternayte)
• b7a8586: Document the generic OpenID Connect provider (@alternayte)
• 4b15df7: Document the second factor across the guides (@alternayte)
• e14a58a: Gate the sign-in behind the second factor (@alternayte)
• 795c0fb: Keep the development tools out of the published module graph (@alternayte)
• 3754a7b: Record the verification evidence for commit b7a8586 (@alternayte)
• a7decab: Record the verification evidence for commit baef50d (@alternayte)
• ee823ce: Record the verification evidence for commit cb5e0d0 (@alternayte)
• 7b8f8f3: Reduce the Google provider to a preset (@alternayte)
• 119c191: Skip the PostgreSQL tests outside of verification (@alternayte)

Install

Go library:

go get github.com/alternayte/auth-all@v0.2.0

TypeScript client:

npm install @alternayte/auth-all-client@0.2.0

v0.1.0

Changelog

Other

• bfbd146: Add a confirmation step to the magic-link verify (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• 53a8ba1: Add the Auth-All core, storage adapters, OAuth providers, and the Magic Link plugin (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• 0b2a6c3: Add the account delete endpoints (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• 3023b3f: Add the command line tool, the generated contract artifacts, and the verification gate (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• 290d853: Add the deployment guide and guard the cookie attributes (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• 96810b8: Add the email change endpoints (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• 34642c5: Add the generated v1 verification evidence (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• 240d08d: Add the password change endpoint (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• c530c1e: Add the release tooling for the binary and the client (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• f74e4bd: Add the session list and the session revocation endpoints (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• 8f06f0f: Add the v1 documentation set, the CI gate, and the decision record (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• 2f90394: Bind the sign-in timing equalizer to the instance parameters (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• cf54006: End a session at an absolute lifetime and at an idle timeout (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• eabf670: Extend the secret leak test and complete the security model (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• 37f2be3: Fix the review round A findings (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• c673102: Fix the review round B findings (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• c1896d2: Fix the review round C finding (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• 879a8d1: Forbid a body-supplied subject with a contract test (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• 5e4c3a9: Keep the example build out of the working tree (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• d40771c: Keep the local working documents out of the repository (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• 7d86602: Keep the specification and the decision log local (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• d83518a: Make a missing rate limiter loud (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• b58d072: Record the v1 verification evidence for commit c1896d2 (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• 969019e: Record the v1 verification evidence for commit c673102 (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• 4e020cc: Record the v1 verification evidence for commit eabf670 (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• 25d8183: Reject a redirect candidate that hides another origin (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• e46392f: Remove a planted password on a proof of address ownership (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• 7c40c2e: Rename the TypeScript client package to the personal scope (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• 6ceae42: Share one test database project between checkouts (AlterNayte 47716887+AlterNayte@users.noreply.github.com)
• 2b29d48: Trust a forwarded client address only behind a declared proxy (AlterNayte 47716887+AlterNayte@users.noreply.github.com)

Install

Go library:

go get github.com/alternayte/auth-all@v0.1.0

TypeScript client:

npm install @alternayte/auth-all-client@0.1.0