Skip to content

github.com/faustbrian/go-authorization v1.0.0

Latest
Latest

Choose a tag to compare

View all tags
@faustbrian faustbrian released this 26 Aug 06:13
· 12 commits to main since this release
v1.0.0
6c8a6a7

1.0.0 - 2026-08-25

Fixed

  • Refresh the exported API baseline with the repository's Go 1.26 toolchain so
    identical JSON types are compared by their current standard-library identity.

  • Bind the reviewed zero-mutant authhttp compatibility facade to its exact
    standalone source identity.

Changed

  • Exclude intentional nested modules from root local-proxy archives so local,
    bootstrap, CI, and public module checksums describe the same source
    boundary.

  • Track the pinned documentation-tool lockfile so clean CI checkouts install
    the exact validated cspell dependency.

  • Reconcile standalone dependency checksums against deterministic current
    module archives so CI, local verification, and release consumers resolve
    identical content.

  • Harden standalone documentation validation with deterministic spelling and
    link checks, package-specific documentation gates, and repository-local
    contributor guidance.

Documentation

  • Correct stale package, standalone, and authoritative-source links in public
    documentation.

Documentation

  • Link the package README to the repository-wide Golib documentation portal.

Changed

  • Publish the module from its standalone github.com/faustbrian/go-authorization identity while preserving its documented API and behavior.

  • Replace obsolete owned-module pseudo-version pins with the monorepo's local
    v0.0.0 source-proxy coordinates; release tooling continues to emit exact
    v1.0.0 dependency versions.

  • Delegate package mutation checks to the canonical exact-100 repository
    runner instead of permissive package-local Gremlins configuration.

  • Require owned sibling modules at local v0.0.0; clean external consumers
    pin each module to an exact main pseudo-version.

  • Align the integration-contract module's indirect system dependency with its
    resolved graph so clean consumers and CI obtain reproducible module metadata.

  • Make synchronizer cancellation coverage deterministic across scheduler timing
    differences on local and hosted runners.

  • Execute API compatibility tooling against the isolated module graph so owned
    dependency source changes cannot conflict with release checksums.

  • Refresh owned-module checksums against the final consolidated archives.

  • Normalized standalone module metadata against the canonical owned dependency
    graph, including complete checksums for clean consumer resolution.

  • Use the repository-pinned current apidiff revision for the canonical API
    compatibility gate.

Added

  • Typed authorization requests, outcomes, reasons, explanations, and limits.
  • Four explicit policy combining algorithms with exhaustive truth tables.
  • Immutable revisioned snapshots and atomic optimistic engine replacement.
  • Tenant-safe typed ACL evaluation, groups, batches, and resource-ID listing.
  • Tenant-safe RBAC, bounded inheritance, effective permission inspection, and
    revisioned in-memory assignment administration.
  • Closed typed ABAC conditions with versioned reusable conditions and bounded
    cost, depth, match, batch, and collection cardinality.
  • Snapshot diff and decision dry-run support.
  • Strict authorization.policy/v1 JSON envelope and storage-neutral repository
    contract.
  • Bounded manifest compiler with a copied, explicit model decoder registry.
  • Strict versioned ACL, RBAC, and ABAC documents and built-in compiler
    decoders.
  • PostgreSQL manifest repository with atomic optimistic updates and a reusable
    schema migration.
  • Monotonic Valkey invalidation with durable revision polling and pub/sub
    wakeups.
  • Repository synchronizer with direct source-of-truth polling and verified
    invalidation hints.
  • Configurable fail-closed repository freshness enforcement for synchronizer
    authorization, including explicit stale-policy decisions.
  • Fail-closed net/http integration with explicit request mapping and separate
    denial and internal-error handlers.
  • Canonical authhttp package, dependency-neutral authenticated-principal
    mapper, and native fail-closed jsonrpc middleware.
  • Failure-isolated decision instrumentation, bounded log audit events,
    telemetry-compatible OpenTelemetry metrics and spans, and an explicit
    advisory cache manifest adapter.
  • Deterministic authorizationtest request builders, evaluators, assertions,
    canonical decision snapshots, and authorizer conformance suites.
  • Independently bounded matched-policy diagnostics with explicit truncation
    propagated through engines, dry runs, snapshots, logs, and telemetry.
  • Fail-closed evaluator panic containment and hostile-input fuzz coverage for
    every portable policy decoder.
  • Positive snapshot revisions and pre-parse model/manifest byte limits, plus
    compiler policy-count and aggregate-document limits.
  • Iterative ABAC condition preflight that enforces configured depth before
    descending into typed or portable condition trees.
  • Pinned whole-module mutation testing with measured efficacy and mutant
    coverage gates.
  • Shared ACL, RBAC, and ABAC model conformance, rolling-revision differential
    tests, and cold, warm, batch, inheritance, predicate, reload, compiler, and
    policy-size benchmarks.
  • Complete API, model-selection, application-pattern, lifecycle, operations,
    security, troubleshooting, compatibility, and governance guides; a compiled
    multi-model example; and dedicated documentation and example automation.
  • Formal decision tables, tenant-isolation evidence, a maintained hardening
    report, explicit stale-policy guidance, and versioned compatibility corpora.
  • Executable consumer contracts for published authentication, log,
    and telemetry modules, including authentication claim collections.
  • Environment-gated PostgreSQL and Valkey integration tests, manifest fuzzing,
    a decision benchmark, exact-coverage enforcement, and CI quality gates.
  • API compatibility enforcement, reproducible release archives, release
    automation, security guidance, and an explicit threat model.

Release integrity

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS

Assets 9
Loading