Release v1.10.8

Changelog

• release: 1.10.8 (#35) (7e640b4)
• test: bind supertest servers to 127.0.0.1 (fixes intermittent 401 / Parse Error) (#34) (c04e61b)
• fix: decode route params once (follow-up to #29) (#32) (77cf58f)
• fix: issue #29 residuals (admin :id decode, 501 unsupported store, link prefix, hook error status, docs) (#30) (2ac6e72)

Release v1.10.7

Changelog

• fix: address issue #26 admin delete error propagation, 404 on unknown id, verification link prefix, reason codes, docs (#28) (d2fd655)

v1.10.6

Release 1.10.6

Security

• Strictly require valid expiry (exp) and signature (s) on OAuth callback structured state; reject stripped {n, o} and bare nonces.
• Remove duplicate nonce cookie set on Path=/ in OAuth start routes.

Fixed

• Reset lastIndex = 0 before and after evaluating RegExp in allowedReturnPaths.
• Treat empty allowedReturnPaths: [] as unset and fall through precedence.

Documentation

• Documented all 4 configuration locations for allowedReturnPaths, their exact precedence, and query parameters matching behavior for string entries.

Release v1.10.5

Release v1.10.5

• fix: resolve issues #20, #21, #24 and update docs for #10 (#25)
• feat: added onBeforeDeleteUser hook (DELETE /account and DELETE /admin/api/users/:id)
• fix: avoid 500 error on body-less POST/PATCH requests across auth, admin, and tools routes
• feat: server-side sendVerificationEmail and POST /admin/api/users/:id/send-verification-email
• docs: explicit security notice on node:vm boundary for inbound webhooks

Release v1.10.4

Release v1.10.4

Security & Enhancements (closes #22)

• OAuth start return_path validation and restriction:
  • Strictly validates req.query.return_path on start endpoints (/oauth/google, /oauth/github, /oauth/:name):
    • Must start with a single / (rejects protocol-relative // and absolute URLs).
    • Rejects backslashes (\) and control characters ([\x00-\x1f\x7f]).
    • Enforces maximum length of 512 characters.
    • Invalid syntax returns HTTP 400 (OAUTH_RETURN_PATH_INVALID) immediately with no cookie set.
  • Added allowedReturnPaths?: (string | RegExp)[] option in AuthConfig['oauth'] and RouterOptions to restrict permitted redirect targets (e.g. ['/oauth/done']).
• Cryptographic state binding and expiry:
  • Structured OAuth state parameter now embeds { n, o, p, exp, s } where exp is a 10-minute expiry timestamp and s is an HMAC-SHA256 signature binding the nonce, origin, return path, and expiry via config.accessTokenSecret.
  • Callback endpoints verify state freshness (Date.now() <= exp) and cryptographically verify the signature before token exchange. Tampered p or expired state returns HTTP 400 (INVALID_OAUTH_STATE) without calling provider strategy callback.
  • Re-validate return_path against syntax and allowedReturnPaths on callback.
• Production origin allowlist enforcement:
  • When origin allowlist (allowedOrigins) is empty in production mode (NODE_ENV === 'production'), OAuth start endpoints refuse initiation with HTTP 500 (OAUTH_ORIGIN_ALLOWLIST_EMPTY) and no cookie is set.
  • Callbacks refuse to trust arbitrary origins from state when allowlist is empty in production.

Release v1.10.3

Changelog

• release: 1.10.3 (#19) (089119a)
• fix: address verification feedback for issues #13, #14, #15, and #16 (#18) (c02866b)

Release v1.10.2

Changelog

• feat: resolve issues #13, #14, #15, and #16 (v1.10.2) (#17) (0b0510b)
• chore: add the awesome-node-auth 1.10.1 bridge package (#12) (6a84328)

Release v1.10.1

Changelog

• feat!: publish as @awesome-lang-auth/node 1.10.1 (#11) (517e4ed)

Release v1.10.0

Changelog

• release: 1.10.0 (#9) (92637be)
• fix: security and parity fixes for 1.10.0 (#8) (8949e01)
• docs: cleanup after the consolidation (MCP, sync script, ecosystem, snippets) (#7) (319aa32)
• feat: consolidate the development line (buildAllRouters, admin promote/revoke, event publication) (#6) (9391415)

Release v1.9.0

Changelog

• 1.9.0 - added Identiy provider mode (cc01e99)
• fixing github publish flow (f119864)
• fixing github publish flow - updated to node 24 (33db22f)