Skip to content

v2.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Oct 16:12
· 139 commits to main since this release
v2.6.0
This tag was signed with the committer’s verified signature.
thegdsks GDS K S
SSH Key Fingerprint: mFk1QTYiZEMrZckCdNTjaUb4FxQvlAmE/+K/u3YJawo
Verified
Learn about vigilant mode.
3d6992d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Docs: https://go.theauth.dev/ . Full list: CHANGELOG.md. Questions and feedback: Discussion #192.

Upgrade notes

  • Module path is now github.com/glincker/theauth-go/v2. Update imports; the old path stays at v1.0.0. This is the first resolvable v2 tag. See the migration guide: https://go.theauth.dev/migrations/to-v2-module-path/
  • Login throttle is on by default. 429 with Retry-After, codes rate_limited or account_locked. Tune with Config.LoginThrottle.
  • Errors are JSON {"code","message"} instead of plain text. Status codes are unchanged.
  • TOTP verify and recovery routes rotate the session cookie.
  • The theauth_oauth_state cookie value no longer equals the state parameter.
  • OAuth callback refuses an email that matches an existing account unless the provider marks it verified.
  • An https BaseURL now yields Secure cookies.
  • EncryptionKey is required when ProviderResolver is set.
  • Device-request routes need the root ability by default (DeviceRequestsAbility, or DeviceRequestsAnySignedInUser).
  • Closed signup and Config.Bootstrap need UserCountStorage.
  • PasswordPolicy.AllowLegacyBcrypt is now honored.
  • The repository layout changed; no exported name was removed. The module root holds 15 Go files (it held 80), feature code is in internal/ packages and black-box tests are in integration/. Imports and calls are unaffected; %T and reflect print the aliased type, and go test on the root package no longer runs the integration suite (use ./...).
  • CIMD fetches refuse non-public addresses (a localhost CIMD setup needs CIMDConfig.AllowPrivateNetworks).
  • Authorization errors redirect only to a registered redirect_uri, and SAML RelayState is restricted (SAMLConfig.AllowedRelayStates).
  • Also: CSRF/Origin checks on cookie-authenticated writes (TrustedOrigins), 72 byte password cap, new migrations (Postgres and MySQL 0017 and 0018, SQLite 0006 to 0008).

Highlights

  • Storage capability interfaces and Config.CoreStorage; SQLite, Postgres and MySQL capability parity.
  • storage/sqlite adapter (experimental).
  • Scoped API tokens, RFC 8628 device grant, token self-service routes, device pending list.
  • clientauth for CLI login, agent identity tokens (MintAgentToken, RegisterAgent), revocation watcher.
  • policy JSON policy engine and RequirePolicy middleware.
  • Security doctor: Doctor, GET /auth/admin/doctor, cmd/theauth-doctor.
  • Config.PathPrefix, (*TheAuth).Handler(), Config.ProviderResolver, provider/oidc, Config.OAuth.
  • Session management, step-up re-auth, session links, passkey policy, AuthEventSink.

Security

  • Login throttle and per-user lockout, TOTP replay protection, per-user MFA guess caps.
  • First-run bootstrap with a one-time setup token, email canonicalization, password policy and optional HIBP check.
  • OAuth login CSRF binding and verified-email account linking.
  • SSRF guard on the CIMD client-metadata fetch (dial-time address check, no redirects); authorization error and SAML RelayState redirects validated.
  • Fix: synced passkeys (backup-eligible flag) can sign in again.

Stability

New and Experimental in this release: storage/sqlite, clientauth, policy, the agent identity and revocation APIs, Doctor, Config.ProviderResolver, and the new optional storage capabilities (sessions, API tokens, device codes). Only the storage capability split, Handler() and Config.PathPrefix are Stable. See STABILITY.md.

Full commit list

Changelog

New features

  • : feat(sqlite): implement API token, device code, session, MFA and throttle capabilities (@thegdsks)
  • : feat(storage): add pure Go SQLite adapter for core, WebAuthn, TOTP, OAuth and audit (@thegdsks)
  • : feat: Postgres and MySQL storage capabilities for tokens, devices, sessions (@thegdsks)
  • : feat: add bearer-only GET and DELETE /auth/tokens/current (@thegdsks)
  • : feat: add clientauth package for CLI device login (@thegdsks)
  • : feat: add stdlib Handler, CSRF origin check, auto Secure cookies (@thegdsks)
  • : feat: agent identity tokens and revocation watcher (@thegdsks)
  • : feat: bind sqlite Store to a caller transaction and add import helpers (@thegdsks)
  • : feat: configurable PathPrefix and dynamic OAuth ProviderResolver (@thegdsks)
  • : feat: end-user session management, step-up re-auth and session links (@thegdsks)
  • : feat: harden OAuth login, passkey policy and add auth event stream (@thegdsks)
  • : feat: honor AllowLegacyBcrypt and accept legacy API tokens (@thegdsks)
  • : feat: list and decide pending device requests by id (@thegdsks)
  • : feat: login throttle, MFA replay and per-user caps, bootstrap, email canonicalization, JSON errors (@thegdsks)
  • : feat: policy engine with RequirePolicy and token permission boundaries (@thegdsks)
  • : feat: scoped API tokens and RFC 8628 device grant (@thegdsks)
  • : feat: security doctor with admin route and CLI (@thegdsks)
  • : feat: split Storage into capability interfaces, add Config.CoreStorage (@thegdsks)

Bug fixes

  • : fix(cimd): also block 0.0.0.0/8 and IPv4-compatible IPv6 (@thegdsks)
  • : fix(postgres): clamp offset and limit before int32 conversion (@thegdsks)
  • : fix(security): add explicit slash-backslash guards to redirect validators (@thegdsks)
  • : fix(security): reject control characters in redirect validation (@thegdsks)
  • : fix(sqlite): persist agent token kind, name and delegator (@thegdsks)
  • : fix(storage/postgres): testPool applies all embedded migrations, not a stale 0001-0008 list (@thegdsks)
  • : fix(webauthn): persist and restore credential backup-eligible flag (@thegdsks)
  • : fix: apply TOTP replay and per-user lockout to step-up (@thegdsks)
  • : fix: close CodeQL SSRF and open-redirect alerts (@thegdsks)
  • : fix: resolve lint findings in doctor CLI and policy tests (@thegdsks)
  • : fix: restrict device pending list and by-id decide to root or a configured ability (@thegdsks)

Other changes

  • : Merge remote-tracking branch 'origin/feat/auth-platform-wave4' into integ/land (@thegdsks)
  • : Merge remote-tracking branch 'origin/feat/device-pending-list' into integ/auth-wave5 (@thegdsks)
  • : Merge remote-tracking branch 'origin/feat/pathprefix-provider-resolver' into integ/auth-wave5 (@thegdsks)
  • : Merge remote-tracking branch 'origin/feat/pg-mysql-capabilities' into integ/auth-wave4 (@thegdsks)
  • : Merge remote-tracking branch 'origin/feat/policy-engine' into integ/auth-wave4 (@thegdsks)
  • : Merge remote-tracking branch 'origin/feat/single-binary-example-docs' into integ/auth-wave4 (@thegdsks)
  • : Merge remote-tracking branch 'origin/main' into chore/release-2.6.0 (@thegdsks)
  • : chore(release): prepare v2.6.0 (@thegdsks)
  • : ci(docs): serialize gh-pages deploys (@thegdsks)
  • : ci: bump actions/setup-python from 6 to 7 (#135) (@dependabot[bot])
  • : ci: bump github/codeql-action from 4 to 4.37.3 (#141) (@dependabot[bot])
  • : ci: bump github/codeql-action from 4.37.3 to 4.37.6 (#145) (@dependabot[bot])
  • : ci: bump github/codeql-action from 4.37.6 to 4.37.7 (#151) (@dependabot[bot])
  • : ci: bump github/codeql-action from 4.37.7 to 4.38.0 (#163) (@dependabot[bot])
  • : ci: bump github/codeql-action from 4.38.0 to 4.38.1 (#169) (@dependabot[bot])
  • : ci: bump github/codeql-action from 4.38.1 to 4.38.2 (#174) (@dependabot[bot])
  • : ci: raise per-package test timeout to 300s (@thegdsks)
  • : ci: run root jobs without go.work and test storage/sqlite on Go 1.26 (@thegdsks)
  • : merge: sync with origin/main (@thegdsks)
  • : refactor: consolidate config, storage capability and testhooks root files (@thegdsks)
  • : refactor: extract token, device, agent and revocation code into internal packages (@thegdsks)
  • : refactor: group root facades and move storage stubs to internal (@thegdsks)
  • : refactor: move RBAC catalog into internal/rbac and merge root files by feature (@thegdsks)
  • : refactor: move black-box root tests to integration/ (@thegdsks)
  • : refactor: move doctor, import, bootstrap, ratelimit, httpsec, authevents and redaction out of root (@thegdsks)
  • : test(webauthn): regression + conformance for backup-flag fix (@thegdsks)

Verify this release

# Download the SBOM and its Sigstore signature from the release assets, then:
cosign verify-blob \
  --certificate-identity "https://github.com/glincker/theauth-go/.github/workflows/release.yml@refs/tags/v2.6.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --signature theauth-go-v2.6.0.tar.gz.sbom.json.sig \
  --certificate theauth-go-v2.6.0.tar.gz.sbom.json.cert \
  theauth-go-v2.6.0.tar.gz.sbom.json

Use this library: go get github.com/glincker/theauth-go/v2@v2.6.0

Contributors

dependabot and thegdsks
Assets 8
Loading