Skip to content

theAuth 0.7.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Oct 05:37
v0.7.0
9e4d322
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

theAuth 0.7.0

Features and changes

  • Security: the framework adapters no longer serve the management routes anonymously. (details in the package changelog)
  • Add an opt-in tamper-evident audit trail. audit: { tamperEvident: true, hmacKey } links each audit row to the previous one with a SHA-256 or HMAC hash, one chain per agent. New theauth.audit.verifyAuditChain, replayAgent and exportAudit (JSONL plus a signed manifest), a verifyAuditExport helper, and theauth audit verify / theauth audit replay in the CLI. theauth_audit_logs gains nullable chain_seq, prev_hash and hash columns and a unique index on (agent_id, chain_seq); createTables adds them to existing databases and old rows are left alone. Nothing changes unless you turn it on.
  • Add opt-in DPoP (RFC 9449) and a requireMcpAuth resource wrapper for MCP. (details in the package changelog)
  • Edge case hardening and opt-in session features. (details in the package changelog)
  • Feature-gap pass, all additive. (details in the package changelog)
  • Harden the MCP authorization server and token families. (details in the package changelog)
  • Add an opt-in migration toolkit under @glinr/theauth/migrate. Importers for Auth0, Keycloak, Clerk, Better Auth, Auth.js and generic CSV or JSON feed one importUsers call with a dry run, idempotent re-runs and conflict policies. Lazy password migration verifies PBKDF2, scrypt and (with a verifier you pass) bcrypt or argon2 hashes on first login, then rehashes. externalIssuers accepts tokens from an existing OIDC provider with issuer, audience and algorithm pinning and a rotating JWKS cache, with optional just in time provisioning. A sticky percentage and cohort rollout (percent: 0 is the rollback switch), a login onboarding hook that falls back to the incumbent on any failure, a shadow mode that never enforces, and a counts-only progress report. theauth migrate plan | import | verify | status replaces the old placeholder message. Nothing changes unless you call it.
  • OTP over HTTP, all opt-in. otpRoutes plugin adds POST /auth/code/send and /auth/code/verify (rate limited, enumeration safe). twoFactor({ otp }) adds email or SMS codes as a second method, and passwordReset.otp adds requestResetOtp and resetPasswordWithOtp plus matching routes. Fix: the Facebook preset now maps the Graph API id to the profile id, so sign-in no longer fails with a missing sub error.
  • Outbound token vault. New tokenVault() plugin and createTokenVault() store third-party OAuth connections per user, encrypted with AES-256-GCM (key ids for rotation), and hand agents short-lived access tokens via vault.getAccessToken({ agentId, userId, provider, scopes }). (details in the package changelog)
  • Add a permission simulator. createSimulator() answers "what would this agent be allowed to do?" with a decision (allow, deny, needs_approval), reasons and a step by step trace, without writing audit rows or touching rate and budget state. It supports what-if overrides (extra permissions, other delegation chains, a budget cost), simulateMany for agent by action matrices, and effectivePermissions. The opt-in simulator() plugin mounts the admin-only POST /agents/:id/simulate, and the CLI gains theauth simulate and theauth permissions. Resource matching and constraint evaluation moved into shared helpers in policy/abac.ts so authorize() and the simulator run the same code; authorize() behavior is unchanged.
  • Pluggable secondary storage, hardened device auth, CLI login, agent registration tokens. (details in the package changelog)

Upgrading

10 packages move to a new major version in this release (@glinr/theauth-astro 5.0.0, @glinr/theauth-express 5.0.0, @glinr/theauth-fastify 5.0.0, @glinr/theauth-hono 5.0.0, and more). Upgrade @glinr/theauth and every adapter together. Migration guide: https://docs.theauth.dev/migrate

Packages in this release

Package Version Changelog
@glinr/theauth 0.6.0 to 0.7.0 CHANGELOG
@glinr/create-theauth-app 0.3.0 to 0.4.0 CHANGELOG
@glinr/theauth-astro 4.0.0 to 5.0.0 CHANGELOG
@glinr/theauth-cli 0.2.0 to 0.3.0 CHANGELOG
@glinr/theauth-express 4.0.0 to 5.0.0 CHANGELOG
@glinr/theauth-fastify 4.0.0 to 5.0.0 CHANGELOG
@glinr/theauth-hono 4.0.0 to 5.0.0 CHANGELOG
@glinr/theauth-nestjs 4.0.0 to 5.0.0 CHANGELOG
@glinr/theauth-nextjs 4.0.0 to 5.0.0 CHANGELOG
@glinr/theauth-nuxt 4.0.0 to 5.0.0 CHANGELOG
@glinr/theauth-solidstart 4.0.0 to 5.0.0 CHANGELOG
@glinr/theauth-sveltekit 4.0.0 to 5.0.0 CHANGELOG
@glinr/theauth-tanstack 4.0.0 to 5.0.0 CHANGELOG

Install

npm install @glinr/theauth@0.7.0

Go: go get github.com/glincker/theauth-go/v2 (releases: https://github.com/glincker/theauth-go/releases). Docs: https://docs.theauth.dev

Full changelog: v0.6.0...v0.7.0

Discussion: https://github.com/glincker/theauth/discussions/172

Assets 2
Loading