theauth-go v2.6.0 released: first resolvable v2, SQLite, API tokens, agent identity and more

[thegdsks]

theauth-go v2.6.0 is out. This is the first release that go get can actually resolve as v2, plus a large batch of auth features that make it a good fit for a single-binary app backed by SQLite.

Install

go get github.com/glincker/theauth-go/v2
go get github.com/glincker/theauth-go/storage/sqlite   # optional, embedded SQLite

Read this if you are upgrading

• The module path is now github.com/glincker/theauth-go/v2. The v2.0 to v2.5 tags were never resolvable by the Go toolchain (the path lacked the /v2 suffix), so go get github.com/glincker/theauth-go returned v1.0.0. Update your imports; the API itself is unchanged. Migration guide.
• Login throttle is on by default, errors are JSON {"code","message"}, TOTP verify rotates the session cookie, and an https BaseURL now sets Secure cookies.
• Redirects and fetches are stricter: authorization errors only redirect to a registered redirect_uri, SAML RelayState is restricted, and CIMD client-metadata fetches refuse private and metadata addresses.
• The repository layout changed (the module root went from 80 Go files to 15) with no exported name removed.

The full list is in the release notes and the CHANGELOG.

What is new

• Storage: capability interfaces and Config.CoreStorage, a pure-Go SQLite adapter (storage/sqlite, with one-transaction import helpers), and capability parity for Postgres and MySQL.
• Tokens and CLIs: scoped API tokens, the RFC 8628 device grant, bearer-only /auth/tokens/current, and a clientauth package for CLI login.
• Agents: agent identity tokens and a revocation watcher.
• Authorization: a JSON policy engine and RequirePolicy middleware.
• Operations: a security doctor (Doctor, GET /auth/admin/doctor, cmd/theauth-doctor), session management with step-up re-auth, Config.PathPrefix, Handler(), and a dynamic OAuth ProviderResolver.
• Security fixes: login lockout, TOTP replay protection, OAuth login CSRF binding, and an SSRF guard plus redirect validation.

Stability. Only the storage capability split, Handler() and Config.PathPrefix are Stable. Everything else new in this release is Experimental for one release cycle, so it can still change in a minor release. See STABILITY.

Docs: https://docs.theauth.dev/go/ (start with "Auth for a Single-Binary Go App").

Known gaps: Postgres and MySQL support for the newer capabilities is new, and the older shared contract suite for those two adapters is still off in CI. The sub-modules are versioned separately and are published as storage/sqlite v0.1.0, mcpresource v0.1.0 and audit/sinks/otlp v0.1.0.

Questions, bugs and feedback welcome here or in issues.