v0.2.2-beta

What's new

OIDC public client (PKCE SPA) support

• clientSecret is now optional when creating OIDC apps — enables SPA and native app testing with PKCE-only auth
• Public/Confidential client type shown in creation review step
• Contextual info banner when PKCE secures a public client
• Insecure-config warning when no secret and no PKCE
• Client credentials flow disabled for public clients

Windows test compatibility

• Replaced /usr/bin/sqlite3 with better-sqlite3 in test DB setup — integration and security tests now initialize on any platform
• Added probeModule() skip guards to unit tests with native dependencies (argon2, sharp, otplib, etc.) so they skip cleanly instead of crashing

Also included since v0.2.1-beta

• App grouping by IdP, tagging, and SSO detection (#60)
• Claims Diff tab fix and default team preference (#58)
• Badge label overflow fix (#56)
• Functional guides and screenshots (#54)

AuthLab 0.2.1 Beta

Highlights

• Adds the post-Phase-4 logout and trust-diagnostics follow-up on top of the existing beta line.
• This is an incremental beta cut from v0.2.0-beta, focused on front-channel logout visibility and deeper SAML trust analysis.

Included in 0.2.1 Beta

• OIDC front-channel logout callback support
  • app-specific front-channel logout URI
  • matching-run invalidation when the provider triggers logout
  • logout event capture in the auth run history
• Inspector and diagnostics improvements
  • protocol compliance report tab
  • stronger logout posture visibility in the OIDC workbench
• SAML trust diagnostics
  • signature verification detail panel
  • response-vs-assertion signature coverage breakdown
  • captured digest/signature/reference metadata
  • embedded-certificate fingerprint comparison against configured IdP trust
• Certificate health tooling
  • IdP certificate subject, issuer, fingerprint, and validity window display
  • expiry / expiring-soon posture reporting
• Documentation and CI updates
  • README, roadmap, AGENTS, CLAUDE, CI strategy, and E2E docs refreshed
  • CI-facing test coverage added for front-channel logout, certificate diagnostics, signature diagnostics, and compliance reporting

Verification

• npm run test:ci

Notes

• This remains a GitHub prerelease.
• v0.2.0-beta stays available as the earlier broad Phase 1 through Phase 4 beta milestone.

AuthLab 0.2.0 Beta

Highlights

• Delivers the enterprise IdP workbench through Phase 4 across OIDC, SAML, inspector tooling, and SCIM provisioning.
• Advances the product from the original Phase 1/2 beta cut to the current beta line now merged on the beta branch.

Included in 0.2.0 Beta

• Phase 1 enterprise essentials:
  • custom OIDC authorization parameters
  • nonce generation and validation
  • RP-initiated logout
  • UserInfo retrieval
  • discovery metadata viewer
  • per-app SAML signing keys
  • SAML NameID, ForceAuthn, and IsPassive controls
  • DB-backed AuthRun session/result model
• Phase 2 token lifecycle:
  • refresh token support
  • introspection and revocation
  • client credentials grant
  • PKCE S256, PLAIN, and NONE
  • token lifecycle timeline
  • JWT signature, at_hash, and c_hash validation views
• Phase 3 enterprise SAML:
  • structured SAML assertion viewer
  • requested AuthnContextClassRef
  • signature algorithm selection
  • clock skew tolerance
  • SAML single logout
  • protocol-specific SAML inspector experience
• Phase 4 advanced flows:
  • OIDC back-channel logout
  • Device Authorization grant
  • full auth trace logging
  • Token Exchange (RFC 8693)
  • PAR (Pushed Authorization Requests)
  • claims diff
  • SCIM mock endpoints with provisioning UI
• UI and usability updates:
  • denser enterprise SaaS refresh
  • responsive table layouts for mobile
  • clearer team join-request/access UX
  • fixed team slug auto-generation
  • compact search/input control alignment

Notable Fixes

• Fixed the SAML inspector rendering the OIDC lifecycle view.
• Fixed idle session timeout redirect-loop behavior on Vercel.
• Stabilized Playwright by switching E2E to a built-server harness.

Verification

• npm run typecheck
• npm run lint
• npm run test:unit
• npm run test:integration
• npm run test:e2e
• npm run test:security
• npm run build:ci

Notes

• This release remains a GitHub prerelease.
• Remaining roadmap work is post-Phase-4 follow-up, including front-channel logout, session-management iframe support, richer SAML signature diagnostics, certificate expiry diagnostics, and protocol compliance reporting.

AuthLab 0.1.0 Alpha

Highlights

• First alpha release of AuthLab.
• Establishes the secure multi-tenant foundation, account security flows, and baseline OIDC/SAML testing experience that the later beta work builds on.

Included in 0.1.0 Alpha

• Core account and workspace platform:
  • team-based multi-tenant app management
  • role-based access controls
  • admin settings and email-provider configuration
  • user profile and account settings flows
• Account security features:
  • email verification
  • password reset
  • TOTP MFA setup and verification
  • passkey registration and login
  • idle-session handling and secure session storage
• Baseline protocol testing:
  • OIDC Authorization Code + PKCE
  • SAML SP-initiated and IdP-initiated sign-in
  • metadata import and parsing
  • inspector baseline for claims, decoded JWTs, and raw payload views
• Security and platform hardening:
  • encrypted secret storage
  • token hashing and TTL enforcement
  • CSP/CSRF protections
  • hardened profile image handling
  • Prisma/Turso production-readiness work

Notes

• This alpha release predates the later Phase 1 through Phase 4 enterprise workbench expansion.
• Advanced token lifecycle tooling, enterprise SAML controls, trace logging, device flow, PAR, token exchange, claims diff, and SCIM mock provisioning are not part of this release line.

Verification

• Alpha branch validation at the time of release included the project quality gates used for the release branch process.

Release Position

• GitHub prerelease only.
• Superseded functionally by v0.2.0-beta, but retained as the original alpha milestone.