Skip to content

theAuth 0.6.0

Choose a tag to compare

View all tags
@thegdsks thegdsks released this 07 Oct 17:33
v0.6.0
e0d8bcf
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

theAuth 0.6.0

Features and changes

  • Remove the legacy KavachOS naming. The deprecated Kavach* and createKavach exports are gone: use TheAuth* and createTheAuth. Environment variables are now THEAUTH_*, webhook headers X-TheAuth-*, cookies and the default API route use theauth, and database tables are theauth_* (existing kavach_* tables are renamed in place by createTables, no data is lost). Auth* aliases remain deprecated.
  • Harden the SCIM 2.0 server. List endpoints now accept the full RFC 7644 filter grammar through a real parser, with operators eq, ne, co, sw, ew, gt, ge, lt, le and pr, the and, or and not combinators, parentheses and value path selectors, plus sortBy and sortOrder. PATCH supports path expressions with value filters such as emails[type eq "work"].value, rejects changes to immutable attributes and caps a request at 1000 operations. A new opt in Me endpoint resolves the caller through a resolveSelf callback, and the Bulk endpoint returns a spec compliant 501. Every successful provisioning write can now be recorded in the audit log by passing audit with an agent id. The Enterprise User extension is supported and advertised in the Schemas endpoint, and the repo gains an Okta example and a compatibility table.

Fixes

  • Delegation requests whose permissions are not a subset of the parent's now return HTTP 400 with error code DELEGATION_PERMISSION_SUBSET instead of a 500. Core throws a typed DelegationError (codes DELEGATION_PERMISSION_SUBSET and DELEGATION_DEPTH_EXCEEDED) and every REST adapter maps it to a 400 using that code.
  • Fix ipAllowlist denying every REST call. The permission engine now resolves the client IP from the request context first (what the framework adapters pass), then request.ip, so the allowlist and audit log agree.
  • Fix plugin endpoint rate limit windows in the anonymous, device, SIWE, and OAuth proxy plugins. They declared rateLimit.window in milliseconds while the plugin router reads it as seconds, so a 60_000 window lasted about 16 hours. The window is now in seconds, and the PluginEndpoint type documents the unit.

Upgrading

15 packages move to a new major version in this release (@glinr/theauth-astro 4.0.0, @glinr/theauth-email 4.0.0, @glinr/theauth-express 4.0.0, @glinr/theauth-fastify 4.0.0, and more). Upgrade @glinr/theauth and every adapter together. Migration guide: https://docs.theauth.dev/migrate

Packages in this release

Package Version Changelog
@glinr/theauth 0.5.0 to 0.6.0 CHANGELOG
@glinr/create-theauth-app 0.2.0 to 0.3.0 CHANGELOG
@glinr/theauth-astro 3.0.3 to 4.0.0 CHANGELOG
@glinr/theauth-cli 0.1.5 to 0.2.0 CHANGELOG
@glinr/theauth-client 0.2.0 to 0.3.0 CHANGELOG
@glinr/theauth-dashboard 0.1.3 to 0.2.0 CHANGELOG
@glinr/theauth-electron 0.2.0 to 0.3.0 CHANGELOG
@glinr/theauth-email 3.0.3 to 4.0.0 CHANGELOG
@glinr/theauth-expo 0.2.0 to 0.3.0 CHANGELOG
@glinr/theauth-express 3.1.0 to 4.0.0 CHANGELOG
@glinr/theauth-fastify 3.0.3 to 4.0.0 CHANGELOG
@glinr/theauth-gateway 3.0.3 to 4.0.0 CHANGELOG
@glinr/theauth-hono 3.1.0 to 4.0.0 CHANGELOG
@glinr/theauth-nestjs 3.0.3 to 4.0.0 CHANGELOG
@glinr/theauth-nextjs 3.0.3 to 4.0.0 CHANGELOG
@glinr/theauth-nextjs-auth 0.1.0 to 0.2.0 CHANGELOG
@glinr/theauth-nuxt 3.0.3 to 4.0.0 CHANGELOG
@glinr/theauth-plugin-discovery 3.0.3 to 4.0.0 CHANGELOG
@glinr/theauth-plugin-telemetry 3.0.3 to 4.0.0 CHANGELOG
@glinr/theauth-prisma 3.0.3 to 4.0.0 CHANGELOG
@glinr/theauth-react 0.6.0 to 0.7.0 CHANGELOG
@glinr/theauth-solidstart 3.0.3 to 4.0.0 CHANGELOG
@glinr/theauth-svelte 0.2.0 to 0.3.0 CHANGELOG
@glinr/theauth-sveltekit 3.0.3 to 4.0.0 CHANGELOG
@glinr/theauth-tanstack 3.0.3 to 4.0.0 CHANGELOG
@glinr/theauth-test-utils 0.1.0 to 0.2.0 CHANGELOG
@glinr/theauth-ui 0.1.0 to 0.2.0 CHANGELOG
@glinr/theauth-ui-headless 0.2.0 (new) CHANGELOG
@glinr/theauth-vue 0.2.0 to 0.3.0 CHANGELOG

Install

npm install @glinr/theauth@0.6.0

Go: go get github.com/glincker/theauth-go/v2 (releases: https://github.com/glincker/theauth-go/releases). Docs: https://docs.theauth.dev

Full changelog: v0.5.0...v0.6.0

What's Changed

  • chore(release): theauth canonical naming, 23 packages by @thegdsks in #104
  • chore(deps): bump the actions group with 4 updates by @dependabot[bot] in #105
  • docs: add GLINR Discord community links by @thegdsks in #110
  • feat: token self-service and agent client, hooks and UI by @thegdsks in #113
  • feat: theauth-go client, hooks and headless UI by @thegdsks in #112
  • refactor!: remove KavachOS naming across packages, docs and SDKs by @thegdsks in #115
  • docs: fix install commands and package metadata by @thegdsks in #114
  • docs: make theauth.dev the primary website URL by @thegdsks in #116
  • test(cli): spawn node directly and allow slow CI runners by @thegdsks in #117
  • docs: redesign the Mintlify docs to match theauth.dev by @thegdsks in #120
  • docs: add the Go library docs to the Mintlify site by @thegdsks in #118
  • docs: align docs with the shipped code by @thegdsks in #121
  • chore: retire the legacy MkDocs docs site by @thegdsks in #122
  • docs: write the brand as theAuth in prose by @thegdsks in #123
  • docs: drop rename notes from package READMEs by @thegdsks in #124
  • docs: isometric diagrams for agents, delegation, MCP, auth, organizations by @thegdsks in #125
  • docs: correct compliance, security, maintainer and Go security docs against code by @thegdsks in #119
  • chore(deps-dev): bump vite from 6.4.1 to 8.1.5 by @dependabot[bot] in #100
  • docs: restore the rename map and record the Kavach name removal by @thegdsks in #126
  • fix: regenerate the lockfile so frozen installs work again by @thegdsks in #133
  • fix: resolve client IP from request context for ipAllowlist by @thegdsks in #127
  • fix: use seconds for rateLimit.window in plugin endpoints by @thegdsks in #128
  • fix: return 400 with typed error for delegation subset violations by @thegdsks in #130
  • fix: create agent tables when the gateway CLI initialises its database by @thegdsks in #132
  • docs: fix stale svelte and compliance claims by @thegdsks in #135
  • feat: add theauth codemod rename for Kavach to TheAuth migration by @thegdsks in #131
  • docs: record the JWKS SSRF fix in the Go threat model (T-24, v2.7.1) by @thegdsks in #136
  • docs: add package tables and normalize package links by @thegdsks in #137
  • docs: credit the studio and list partner open-source projects by @thegdsks in #139
  • chore: automate version PRs, tagging, changeset check, and monthly release discussion by @thegdsks in #140
  • docs: brand as GLINR Studios (glinr.com) by @thegdsks in #138
  • chore: use support@glinr.com as the contact email by @thegdsks in #142
  • chore: add CODEOWNERS routing reviews to glinr-owners by @thegdsks in #141
  • chore: use shared GLINR_BOT_TOKEN and parameterize release discussion sync by @thegdsks in #144
  • feat: harden SCIM with filter grammar, bulk, me endpoint and audit by @thegdsks in #143
  • fix: use changesets action v1 which supports changesets cli v2 by @thegdsks in #145
  • chore: version packages by @thegdsks in #146

Full Changelog: v0.5.0...v0.6.0

Contributors

dependabot and thegdsks
Assets 2
Loading