Skip to content

v0.2.0

Choose a tag to compare

View all tags
@bambamboole bambamboole released this 15 Jul 15:50
v0.2.0
0a8b461
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.2.0 (2026-07-15)

⚠ BREAKING CHANGES

  • oidc:rotate-keys writes OIDC_* variables instead of PASSPORT_*, and the PassportKeys/PassportScopeRepository classes were renamed to SigningKeys/DefaultScopeRepository.

Features

  • access-token to context link side table (d0d5e36)
  • add AuthenticationContext amr accumulator + acr derivation (8ce779a)
  • add credential-aware client reconciliation (221bc45)
  • add DeviceRecognizer contract and LoginEvent (05a6ffe)
  • add first-party client provisioning identity (4b177da)
  • add first-party oidc client command (cd37935)
  • add LoginApi decision and claim buffer (2cc6a63)
  • add persisted authentication-context store (57fbce4)
  • add PostLoginPipeline with fail-closed error handling (d3862a8)
  • append verified factor amr after two-factor challenge (950675e)
  • auth: add extensible multi-factor authentication (d62d229)
  • auth: add extensible multi-factor authentication (be4d3e9)
  • auth: add package account view seams (a51965a)
  • auth: add server self-SSO enablers (ad27928)
  • auth: add server self-SSO enablers (b9a8eff)
  • auth: emit acr/amr authentication-context claims in the id_token (d0d039e)
  • auth: Oidc::postLogin decision trigger + authentication-context store (Phase 2a-1) (72ac879)
  • auth: own email verification flow (2bc0411)
  • auth: own login, logout, and password confirmation (f67da35)
  • auth: own password reset flow (5bfcf21)
  • auth: own registration through package action seam (ebe5f69)
  • auth: package login, logout, and password confirmation (f6e78eb)
  • auth: package-owned email verification flow (ced7901)
  • back-channel logout client registration and discovery (0b23f2d)
  • back-channel logout fan-out job and notifier (9bebc6d)
  • bake amr into the authorization code and thread it to the id_token (cfd14ef)
  • buffer access-token claims through the login ceremony (be917ac)
  • carry amr through IdTokenResponse with reset-after-read (880a19b)
  • emit amr and derived acr claims in IdTokenBuilder (8ea4ade)
  • emit and link access-token claims on fresh issuance (cc209f6)
  • emit the sid claim in id_tokens (47e6ae5)
  • expiry sweep and session pruning (4ee49aa)
  • expose credential-aware reconciliation (6e5211f)
  • expose first-party client provisioning (1ca7e30)
  • expose Oidc::postLogin and bind the pipeline (65ed07f)
  • fan out back-channel logout on logout and end-session (7ca9f5d)
  • first-class oidc_sessions with SessionRegistry (77ed711)
  • LoginApi::setAccessTokenClaim with shared protocol guard (59ad46b)
  • LogoutTokenBuilder (af42a9c)
  • make OIDC_PRIVATE_KEY/OIDC_PUBLIC_KEY the canonical signing key env vars (beab4fc)
  • OIDC conformance pass + env-based key rotation (9dc4ea5)
  • oidc:prune-authentication-contexts command (5d42d86)
  • oidc: add CheckAudience resource-server middleware (134e964)
  • oidc: add claims bag with per-artifact protected-claim filtering (a0846e3)
  • oidc: add claims resolver contract with attribute-based default (59c6c1a)
  • oidc: add Oidc::issueScopedToken facade method (47c3fa7)
  • oidc: add openid-configuration discovery document (6a70905)
  • oidc: add per-trigger claim hook registry, contexts, and facade (5acb597)
  • oidc: add programmatic access-token minter (7cb3cdd)
  • oidc: add rfc 7662 introspection and rfc 7009 revocation (021f2d7)
  • oidc: add rfc 8693 token-exchange grant with policy gating (21162cf)
  • oidc: add rp-initiated logout with registered redirect uris (da34bfb)
  • oidc: add scope contract with passport-backed default repository (455f9dc)
  • oidc: add scope-filtered userinfo endpoint (14592dd)
  • oidc: add session token provider seam with minting default (f715621)
  • oidc: add token exchanger service and issued-token value object (a98a70d)
  • oidc: add token-exchange policy contract and default with audience allowlist (466cf81)
  • oidc: bridge the scope contract into league's authorization server (181fd3e)
  • oidc: build rs256 id_tokens with full claim set (08b8acc)
  • oidc: complete discovery metadata and derive endpoints from the issuer (b1e15bb)
  • oidc: emit rfc 9068 at+jwt access tokens (5b6f777)
  • oidc: enforce max_age and record auth_time on login (5a01605)
  • oidc: env-based signing key rotation via oidc:rotate-keys (450a7b4)
  • oidc: fire access-token claim hook by grant type (e4a2c24)
  • oidc: fire id_token and userinfo claim hooks (440a736)
  • oidc: issue id_tokens via oidc auth-code grant with owned oauth routes (2771724)
  • oidc: make oauth route prefix and resource guard configurable (c57333a)
  • oidc: scaffold laravel-oidc package with testbench harness (c7e7caf)
  • oidc: serve passport public keys as jwks with rfc 7638 kids (a19de5a)
  • per-flow access-token TTLs and shortened interactive default (8b1bf10)
  • per-flow token lifetime config (d64eef7)
  • persist auth context and emit id_token claims through it (3625e92)
  • Phase 2a-2 — refresh reissue + access-token claims + session lifetime (2283c31)
  • Phase 3a — back-channel logout (provider) + first-class sessions (560f5e5)
  • pin auth context to its login session (6824ee9)
  • provision first-party oidc clients (7dd3b3d)
  • record pwd authentication method on password login (b30ecfc)
  • record session participants on authorization (659430d)
  • refresh reissue with deny-on-expiry via OidcRefreshTokenGrant (6673eac)
  • routing: unified config-driven route handlers (150dff9)
  • routing: unified config-driven route handlers (5464606)
  • run the postLogin pipeline in the login ceremony (e26ceba)
  • stamp expires_at and always persist the auth context (c8205c2)
  • start an oidc session on login (57a734f)
  • tie refresh deny-on-expiry to the login session (00a198e)
  • verify first-party client credentials (8f5493d)

Bug Fixes

  • allow valid urn optional components (b5ff9eb)
  • auth: satisfy password reset static analysis (c71b280)
  • clear pendingContext at entry to stop cross-request leaks under Octane (a8424f0)
  • docs: prepend base to the Get started hero link so it doesn't 404 (19132ac)
  • fully validate audience URIs (85cf516)
  • harden first-party provider configuration (71a63d4)
  • harden OIDC token-exchange and resource-server security (ffaa09b)
  • make BackChannelLogoutNotifier::notify idempotent (9c12e77)
  • oidc: correct namespace typo in claims resolver test (6054d2d)
  • oidc: harden logout, max_age, wildcard scope, and id_token state (6f5bcec)
  • oidc: harden session-token listener and bind root token to user (a5be8bc)
  • oidc: nest prior act claim on chained token exchange per RFC 8693 (f6200fb)
  • oidc: preserve existing query strings in post-logout redirects (147eaa8)
  • oidc: preserve subject scopes when exchange omits the scope param (27b313a)
  • oidc: reject expired subject tokens in token exchange (c6703b0)
  • oidc: require PKCE for all clients per OAuth 2.1 (3cb5189)
  • oidc: return RFC 6750 bearer + RFC 6749 client-auth error responses (d9acf91)
  • oidc: support both passport session-request storage formats; raise dep floors (00ae69e)
  • preserve adoption target during recovery (55d71fb)
  • prevent extra access-token claims from overriding structural claims (572c3f1)
  • redact client secrets from traces (483e635)
  • reset buffered id_token claims per login and cover postLogin claims e2e (2f24ded)
  • restore session isStarted guard, safe-chunk expiry sweep, cover job delivery (a2d18dd)
  • test: use array sessions in package harness (ec6d403)
  • validate urn audiences compatibly (0a7e78f)

Performance

  • slim oidc_access_token_contexts for scale (f8cc97d)

Refactoring

  • auth: use invokable authentication actions (c7c3edd)
  • drop hook paths superseded by the context store (58f565d)
  • oidc: delegate token-exchange grant to the exchanger service (94511e7)
  • oidc: derive jwks via phpseclib for multi-format key parsing (d99c9e4)
  • oidc: make CheckAudience a self-contained resource-server validator (4dbf1ec)
  • oidc: share request-grant-type resolver and verify tokens once in CheckAudience (a55bf93)
  • rename AuthenticationContext accumulator to AuthenticationMethods (b3aa03c)
  • routing: strip prefixes and unify handler names under oidc (169bc65)
  • unify first-party client configuration (44aee67)

Documentation

  • add self-SSO + auth-engine design and handoff notes (314aa6e)
  • auth: plan package account flows (97e0d30)
  • clarify Reconciled outcome when a client secret is supplied (8f7d0d3)
  • document Oidc::postLogin (eeaad0b)
  • document scheduled pruning of token-path tables (6ba8b39)
  • explain credential-aware reconciliation (12f1e1a)
  • oidc: add package readme (09bc566)
  • oidc: annotate integration tests with governing RFC/spec references (1052d4a)
  • oidc: document conformance batch (pkce, error responses, discovery, config) (90306ef)
  • oidc: document env-based key rotation (6491a1d)
  • oidc: document session token provider and scoped-token issuance (58c1467)
  • oidc: document token exchange; test: starter-kit exchange integration (a83ef13)
  • oidc: note max_age forced-relogin residual in threat model (5e7614a)
  • oidc: note RefreshContext access-token writer (10f9b3a)
  • reframe as an OIDC auth server, widen tables, and add mermaid flow diagrams (64eace8)
  • schedule the back-channel logout sweep (bea7ed4)
Assets 2
Loading