Skip to content

Release 0.5.5

Choose a tag to compare

View all tags
@oranheim oranheim released this 06 Aug 12:28
· 65 commits to master since this release
v0.5.5
da81805

Authly v0.5.5 - Complete OAuth 2.1/OIDC Authorization Server

This major release completes the OAuth 2.1 and OpenID Connect implementation, delivering a production-ready authorization server with comprehensive administrative capabilities.

🚀 Major Features

OAuth 2.1 Compliance & OIDC Implementation

  • Complete OAuth 2.1 authorization server with PKCE support and security best practices
  • Full OpenID Connect provider with UserInfo endpoint and profile management
  • OIDC-compliant user profile updates with scope-based validation
  • Enhanced security model with proper token handling and session management

Comprehensive Admin Portal

  • Complete user management system with CRUD operations, advanced filtering, and pagination
  • Session management capabilities including user session monitoring and revocation
  • Password reset functionality with secure temporary password generation
  • Performance-optimized queries with caching layer for dashboard statistics
  • Advanced filtering system with text search, date ranges, and status filtering

Infrastructure & Performance

  • Query optimization with CTE-based operations and performance indexes
  • Caching layer with configurable TTL for admin operations (30-60s)
  • Connection pooling with enhanced database performance
  • Parallel testing support with restructured test suite (680+ tests)

🔄 Breaking Changes

API Endpoint Changes

OAuth endpoints have been moved for better organization:

  • GET/POST /api/v1/auth/token → GET/POST /api/v1/oauth/token
  • POST /api/v1/auth/refresh → POST /api/v1/oauth/refresh
  • POST /api/v1/auth/revoke → POST /api/v1/oauth/revoke

User Management Security

Enhanced security for user operations:

  • /api/v1/users/{id} endpoints now require admin privileges
  • /api/v1/users/me deprecated in favor of /oidc/userinfo
  • User listing and management operations restricted to admins only

Migration Required

  • Update client applications to use new OAuth endpoints
  • Update OAuth discovery configurations to reflect endpoint changes
  • Verify endpoint references in external integrations

✨ New Endpoints

Admin User Management

  • GET /admin/users - List users with advanced filtering and pagination
  • GET /admin/users/{user_id} - Get detailed user information
  • POST /admin/users - Create new users with temporary passwords
  • PUT /admin/users/{user_id} - Update user profiles and settings
  • DELETE /admin/users/{user_id} - Delete users with cascade cleanup
  • POST /admin/users/{user_id}/reset-password - Reset user passwords securely

Session Management

  • GET /admin/users/{user_id}/sessions - List user sessions with filtering
  • DELETE /admin/users/{user_id}/sessions - Revoke all user sessions
  • DELETE /admin/users/{user_id}/sessions/{session_id} - Revoke specific session

OIDC Compliance

  • PUT /oidc/userinfo - OIDC-compliant profile updates with scope validation
  • Enhanced /oidc/userinfo endpoint with full OIDC claims support

🔧 Technical Improvements

Database & Performance

  • Optimized queries with Common Table Expressions (CTEs)
  • Performance indexes for admin operations and session management
  • Connection pooling with 10 min / 50 max connections for tests
  • Query result caching with configurable TTL settings

Error Handling & Validation

  • Comprehensive error handling with 20+ standardized admin error codes
  • Request tracing middleware with processing time metrics
  • Business rule validation for users, clients, and scopes
  • Field-level validation with detailed error responses

Code Quality & Testing

  • Complete linting compliance with modern ruff configuration
  • Restructured test suite into 7 feature domains for better organization
  • 680+ comprehensive tests covering all functionality
  • Parallel testing support with pytest-xdist integration

📦 Dependencies

Updated

  • psycopg-toolkit → v0.2.2 (enhanced field handling)
  • anyio → v4.10.0
  • certifi → v2025.8.3
  • coverage → v7.10.2
  • redis → v6.3.0

Added

  • pytest-xdist for parallel test execution

🏗️ Infrastructure

Configuration Enhancements

  • Configurable cache TTL for different admin operations
  • Server configuration with environment variable support
  • Security settings for lockout duration and login attempts
  • Improved dependency injection throughout the application

Test Infrastructure

  • Feature-based test organization (auth, oauth, oidc, admin, infrastructure)
  • Comprehensive test documentation with clear domain separation
  • Performance testing scripts for validation and optimization
  • Enhanced test fixtures with proper resource cleanup

📚 Documentation

  • Complete implementation roadmaps for OAuth 2.1 and OIDC features
  • Comprehensive API documentation for all admin endpoints
  • Migration guides for breaking changes
  • Parallel testing guide for development workflow
  • External libraries documentation with usage guidelines

🔒 Security Enhancements

  • Admin-only field restrictions for sensitive user data
  • Session invalidation on password resets
  • Cascade cleanup on user deletion
  • Scope-based OIDC claim filtering
  • Business rule validation preventing system integrity issues
  • Audit logging for administrative operations

🎯 What's Next

This release completes Phase 2 of the OAuth 2.1/OIDC implementation. Future releases will focus on:

  • Redis backend integration for production caching
  • Advanced OIDC features and compliance enhancements
  • API rate limiting and advanced security features
  • Multi-tenant support and organization management

Full Changelog: [View on GitHub](https://github.com/your-org/authly/compare/v0.5.4...v0.5.5)

Migration Guide

1. Update OAuth Endpoints

- POST /api/v1/auth/token
+ POST /api/v1/oauth/token

- POST /api/v1/auth/refresh  
+ POST /api/v1/oauth/refresh

- POST /api/v1/auth/revoke
+ POST /api/v1/oauth/revoke

2. Update User Profile Access

- GET /api/v1/users/me
+ GET /oidc/userinfo

- PUT /api/v1/users/{id} 
+ PUT /oidc/userinfo  # For user's own profile
+ PUT /admin/users/{id}  # For admin operations

3. Update Discovery Metadata

Ensure your OAuth discovery configurations point to the new /oauth/* endpoints instead of /auth/*.

Assets 2
Loading