Skip to content

Releases: losol/fides-auth

Release list

@eventuras/fides-auth@0.11.0

@eventuras/fides-auth@0.11.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Aug 20:47
Immutable release. Only release title and notes can be modified.
@eventuras/fides-auth@0.11.0
0c02b8d

Minor Changes

  • 82ec137: Route clientCredentialsGrant through openid-client instead of a raw fetch.

    It was the one place the server module talked to a token endpoint directly, so it
    missed the transport guards the rest of the package gets for free — while being the
    request that carries the client secret. Three behaviour changes, all breaking:

    • The token endpoint must now be https. A plain-http endpoint rejects with
      OAUTH_HTTP_REQUEST_FORBIDDEN instead of posting the secret in the clear.
    • Failures throw openid-client's typed errors rather than a generic
      Error("Client credentials grant failed: <status> - <body>"). Code matching on
      that message needs updating.
    • Requests time out, 30 seconds by default, where previously they never did.
      Configurable via the new timeout option (seconds).

    Also adds an optional issuer to ClientCredentialsConfig, defaulting to the token
    endpoint's origin.

  • fa9de74: RP-initiated logout: send id_token_hint.

    Tokens.idToken now holds the raw ID token — populated by buildSessionFromTokens,
    kept fresh by refreshSession, and stored in its own session_it cookie so no cookie
    has to carry two large JWTs. readIdToken reads it independently of session validity,
    since logout needs the hint after the access token has expired.

    buildOidcLogoutUrl(oauthConfig, options) accepts idTokenHint, state,
    logoutHint and includeClientId alongside postLogoutRedirectUri. A string second
    argument still means postLogoutRedirectUri, and it still returns null when the
    provider advertises no end_session_endpoint.

    New handleOidcLogout handler in @eventuras/fides-auth/server — POST-only by
    default and same-origin checked via Sec-Fetch-Site/Origin — wrapped for Next.js at
    @eventuras/fides-auth-next/oidc-logout. See
    packages/fides-auth/docs/rp-initiated-logout.md for the full parameter set, where
    the ID token is stored, and why client_id is still sent.

    Also fixes the ./oidc-callback and ./oidc-login subpath exports in
    @eventuras/fides-auth-next, which pointed at files the build never emitted.

    persistSession now size-checks every cookie value before writing any of them.
    Previously a value that exceeded the browser limit threw part-way through, leaving the
    new session cookie next to the previous user's tokens.

  • 2468ac6: Set secure on the default cookie options unconditionally.

    Breaking for anyone serving over plain http on a non-localhost host. Minor rather
    than major because this package is pre-1.0, where minor is the breaking channel — a
    major would cut 1.0.0.

    defaultSessionCookieOptions and defaultOAuthCookieOptions derived the flag from
    process.env.NODE_ENV === 'production', so any deployment that did not set
    NODE_ENV — staging, a container, any server that isn't following the Next
    convention — served the session cookie without Secure, over plain HTTP, silently.

    The cookie spec exempts localhost from the https requirement, so Secure cookies are
    still set and sent over http://localhost and local development is unaffected. Plain
    http on a LAN address or a custom dev hostname now needs an explicit secure: false,
    which is a deliberate choice rather than a silent default.

Patch Changes

  • db99ad0: Widen the jose dependency from an exact pin to ^6.2.8.

    An exact pin in a library forces a second copy of jose into any consumer tree that
    already resolves it through a range — openid-client depends on jose: ^6.2.2, so
    this repo was carrying two copies itself — and it withholds patch releases from
    consumers until we cut a release of our own. Reproducibility is the lockfile's job,
    not a library's dependency range.

Loading

@eventuras/fides-auth-store@0.1.2

@eventuras/fides-auth-store@0.1.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Aug 20:46
Immutable release. Only release title and notes can be modified.
@eventuras/fides-auth-store@0.1.2
0c02b8d

Patch Changes

  • Updated dependencies [82ec137]
  • Updated dependencies [db99ad0]
  • Updated dependencies [fa9de74]
  • Updated dependencies [2468ac6]
    • @eventuras/fides-auth@0.11.0
Loading

@eventuras/fides-auth-react@0.1.2

@eventuras/fides-auth-react@0.1.2 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Aug 20:47
Immutable release. Only release title and notes can be modified.
@eventuras/fides-auth-react@0.1.2
0c02b8d

Patch Changes

  • Updated dependencies [82ec137]
  • Updated dependencies [db99ad0]
  • Updated dependencies [fa9de74]
  • Updated dependencies [2468ac6]
    • @eventuras/fides-auth@0.11.0
    • @eventuras/fides-auth-store@0.1.2
Assets 3
Loading

@eventuras/fides-auth-next@0.5.0

@eventuras/fides-auth-next@0.5.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Aug 20:47
Immutable release. Only release title and notes can be modified.
@eventuras/fides-auth-next@0.5.0
0c02b8d

Minor Changes

  • fa9de74: RP-initiated logout: send id_token_hint.

    Tokens.idToken now holds the raw ID token — populated by buildSessionFromTokens,
    kept fresh by refreshSession, and stored in its own session_it cookie so no cookie
    has to carry two large JWTs. readIdToken reads it independently of session validity,
    since logout needs the hint after the access token has expired.

    buildOidcLogoutUrl(oauthConfig, options) accepts idTokenHint, state,
    logoutHint and includeClientId alongside postLogoutRedirectUri. A string second
    argument still means postLogoutRedirectUri, and it still returns null when the
    provider advertises no end_session_endpoint.

    New handleOidcLogout handler in @eventuras/fides-auth/server — POST-only by
    default and same-origin checked via Sec-Fetch-Site/Origin — wrapped for Next.js at
    @eventuras/fides-auth-next/oidc-logout. See
    packages/fides-auth/docs/rp-initiated-logout.md for the full parameter set, where
    the ID token is stored, and why client_id is still sent.

    Also fixes the ./oidc-callback and ./oidc-login subpath exports in
    @eventuras/fides-auth-next, which pointed at files the build never emitted.

    persistSession now size-checks every cookie value before writing any of them.
    Previously a value that exceeded the browser limit threw part-way through, leaving the
    new session cookie next to the previous user's tokens.

Patch Changes

  • Updated dependencies [82ec137]
  • Updated dependencies [db99ad0]
  • Updated dependencies [fa9de74]
  • Updated dependencies [2468ac6]
    • @eventuras/fides-auth@0.11.0
    • @eventuras/fides-auth-react@0.1.2
    • @eventuras/fides-auth-store@0.1.2
Loading

@eventuras/fides-auth@0.10.0

@eventuras/fides-auth@0.10.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Jun 22:36
Immutable release. Only release title and notes can be modified.
@eventuras/fides-auth@0.10.0
968b59b

Minor Changes

  • f8c2ee3: Move the framework-agnostic cookie attributes, size limits, and size guard into
    the core package.

    The new @eventuras/fides-auth/cookies export holds CookieOptions,
    defaultSessionCookieOptions, defaultOAuthCookieOptions,
    ACCESS_TOKEN_COOKIE_NAME, the COOKIE_MAX_BYTES/COOKIE_INFO_BYTES limits,
    the CookieTooLargeError class, and pure cookieByteSize /
    assertCookieWithinLimit helpers — none of which need a framework. This makes
    them reusable by future adapters (e.g. React Router) instead of living only in
    the Next.js binding.

    @eventuras/fides-auth-next now re-exports these from the core package and keeps
    only the actual cookie I/O (via next/headers). Its public API is unchanged.

  • 019f8a0: Add a framework-agnostic createHeartbeat() engine at @eventuras/fides-auth/heartbeat. fides-auth-next's useHeartbeat is now a thin wrapper over it; behaviour and API unchanged.

  • dcf1b7d: Add a framework-agnostic CookieStore interface and session persistence helpers (persistSession, readSession, refreshSessionInStore, clearSession) at @eventuras/fides-auth/server. fides-auth-next's session functions now delegate to them through a Next cookie-store adapter; public API unchanged.

  • 50f6882: Move the OIDC request handlers — handleOidcLogin, handleOidcCallback, handleHeartbeat — into @eventuras/fides-auth/server, taking a CookieStore and an optional rate-limit callback over the standard Request/Response. fides-auth-next now wraps them with its Next cookie store and rate limiters; public API unchanged.

  • 3c72759: Split the session across two cookies to make room for large access tokens.

    The access token — typically the largest part of a session — now lives in its
    own session_at cookie, while the rest stays in session, so each gets a full
    per-cookie byte budget instead of competing for one ~4KB limit.

    The framework-agnostic encode/decode logic lives in the core package as a new
    @eventuras/fides-auth/session-cookies export (encodeSessionCookies /
    decodeSessionCookies), plus a decryptJWT helper in @eventuras/fides-auth/utils.
    @eventuras/fides-auth-next is a thin adapter that wires these to the Next.js
    cookie store. Legacy single-cookie sessions are still read transparently, and the
    "expired access token means no session" contract is preserved.

Patch Changes

  • 39f2cbd: Standardize MIT licensing across the workspace.

    Every package now carries a LICENSE file with a consistent
    Copyright (c) 2024 Losol AS notice, and @eventuras/fides-auth-next gains the
    license / author metadata it was missing and ships its LICENSE in the
    published tarball. @eventuras/fides-auth's existing license notice is updated
    to the same copyright holder.

Loading

@eventuras/fides-auth-store@0.1.1

@eventuras/fides-auth-store@0.1.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Jun 22:36
Immutable release. Only release title and notes can be modified.
@eventuras/fides-auth-store@0.1.1
968b59b

Patch Changes

  • Updated dependencies [f8c2ee3]
  • Updated dependencies [019f8a0]
  • Updated dependencies [dcf1b7d]
  • Updated dependencies [50f6882]
  • Updated dependencies [3c72759]
  • Updated dependencies [39f2cbd]
    • @eventuras/fides-auth@0.10.0
Loading

@eventuras/fides-auth-react@0.1.1

@eventuras/fides-auth-react@0.1.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Jun 22:36
Immutable release. Only release title and notes can be modified.
@eventuras/fides-auth-react@0.1.1
968b59b

Patch Changes

  • Updated dependencies [f8c2ee3]
  • Updated dependencies [019f8a0]
  • Updated dependencies [dcf1b7d]
  • Updated dependencies [50f6882]
  • Updated dependencies [3c72759]
  • Updated dependencies [39f2cbd]
    • @eventuras/fides-auth@0.10.0
    • @eventuras/fides-auth-store@0.1.1
Loading

@eventuras/fides-auth-next@0.4.0

@eventuras/fides-auth-next@0.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Jun 22:36
Immutable release. Only release title and notes can be modified.
@eventuras/fides-auth-next@0.4.0
968b59b

Minor Changes

  • 2468c15: Add a size guard for auth cookies. setAuthCookie now measures the cookie's
    name + value and throws a new exported CookieTooLargeError at or above the
    browser's 4096-byte per-cookie limit, instead of letting the browser silently
    drop the cookie (which manifested as a broken login). An informational log is
    emitted at 3500 bytes for visibility before the hard limit.

  • 3c72759: Split the session across two cookies to make room for large access tokens.

    The access token — typically the largest part of a session — now lives in its
    own session_at cookie, while the rest stays in session, so each gets a full
    per-cookie byte budget instead of competing for one ~4KB limit.

    The framework-agnostic encode/decode logic lives in the core package as a new
    @eventuras/fides-auth/session-cookies export (encodeSessionCookies /
    decodeSessionCookies), plus a decryptJWT helper in @eventuras/fides-auth/utils.
    @eventuras/fides-auth-next is a thin adapter that wires these to the Next.js
    cookie store. Legacy single-cookie sessions are still read transparently, and the
    "expired access token means no session" contract is preserved.

Patch Changes

  • f8c2ee3: Move the framework-agnostic cookie attributes, size limits, and size guard into
    the core package.

    The new @eventuras/fides-auth/cookies export holds CookieOptions,
    defaultSessionCookieOptions, defaultOAuthCookieOptions,
    ACCESS_TOKEN_COOKIE_NAME, the COOKIE_MAX_BYTES/COOKIE_INFO_BYTES limits,
    the CookieTooLargeError class, and pure cookieByteSize /
    assertCookieWithinLimit helpers — none of which need a framework. This makes
    them reusable by future adapters (e.g. React Router) instead of living only in
    the Next.js binding.

    @eventuras/fides-auth-next now re-exports these from the core package and keeps
    only the actual cookie I/O (via next/headers). Its public API is unchanged.

  • 01a31d1: Move the React hooks (createAuthStoreHooks, useSessionMonitor, useHeartbeat) into a new @eventuras/fides-auth-react package. fides-auth-next re-exports them, so its public API is unchanged.

  • 7453d3f: Move the framework-agnostic authentication store into a new
    @eventuras/fides-auth-store package.

    The XState-Store-based auth state (createAuthStore, initializeAuth,
    checkAuth, startSessionMonitor, configureAuthLogger, and the SessionUser
    / AuthStatus / AuthStoreContext / AuthStoreConfig / SessionMonitorConfig
    types) has no dependency on Next.js or React — the application supplies a
    checkAuthStatus callback and the store never touches cookies or a server. It
    now lives in its own package so other adapters (e.g. React Router) and plain
    JavaScript can use it directly.

    @eventuras/fides-auth-next re-exports the store from the new package, so
    @eventuras/fides-auth-next/store imports keep working unchanged. The React
    hooks (createAuthStoreHooks, useSessionMonitor, useHeartbeat) stay in this
    package for now.

  • 019f8a0: Add a framework-agnostic createHeartbeat() engine at @eventuras/fides-auth/heartbeat. fides-auth-next's useHeartbeat is now a thin wrapper over it; behaviour and API unchanged.

  • dcf1b7d: Add a framework-agnostic CookieStore interface and session persistence helpers (persistSession, readSession, refreshSessionInStore, clearSession) at @eventuras/fides-auth/server. fides-auth-next's session functions now delegate to them through a Next cookie-store adapter; public API unchanged.

  • 50f6882: Move the OIDC request handlers — handleOidcLogin, handleOidcCallback, handleHeartbeat — into @eventuras/fides-auth/server, taking a CookieStore and an optional rate-limit callback over the standard Request/Response. fides-auth-next now wraps them with its Next cookie store and rate limiters; public API unchanged.

  • 39f2cbd: Standardize MIT licensing across the workspace.

    Every package now carries a LICENSE file with a consistent
    Copyright (c) 2024 Losol AS notice, and @eventuras/fides-auth-next gains the
    license / author metadata it was missing and ships its LICENSE in the
    published tarball. @eventuras/fides-auth's existing license notice is updated
    to the same copyright holder.

  • Updated dependencies [f8c2ee3]

  • Updated dependencies [019f8a0]

  • Updated dependencies [dcf1b7d]

  • Updated dependencies [50f6882]

  • Updated dependencies [3c72759]

  • Updated dependencies [39f2cbd]

    • @eventuras/fides-auth@0.10.0
    • @eventuras/fides-auth-react@0.1.1
    • @eventuras/fides-auth-store@0.1.1
Loading

@eventuras/fides-auth@0.9.0

@eventuras/fides-auth@0.9.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Jun 22:09
Immutable release. Only release title and notes can be modified.
@eventuras/fides-auth@0.9.0
4481a24

Minor Changes

  • 7bcf252: Type tokens.accessTokenExpiresAt / tokens.refreshTokenExpiresAt as ISO 8601 string instead of Date. The session is a JSON/JWT envelope, so these values are always strings on the wire — the Date type was a lie after a validateSessionJwt round-trip. Consumers doing date math should wrap in new Date(value).
Loading

@eventuras/fides-auth-next@0.3.0

@eventuras/fides-auth-next@0.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Jun 22:09
Immutable release. Only release title and notes can be modified.
@eventuras/fides-auth-next@0.3.0
4481a24

Minor Changes

  • d2b4f73: useHeartbeat now schedules session refreshes from the access-token expiry
    instead of a fixed interval, so the cadence self-adjusts to any token TTL.
    Adds fraction, minSkewMs, minRefreshIntervalMs and initialExpiresAt
    config and decouples idleThresholdMs from the token TTL; removes intervalMs.

Patch Changes

  • 7e4039e: Preserve the request path when reconstructing the OIDC callback URL. Behind a TLS-terminating proxy the token-exchange redirect_uri collapsed to /, causing Keycloak to reject login with invalid_redirect_uri.
  • 7250e63: Upgrade @xstate/store to v4. React hooks moved to the dedicated @xstate/store-react package; the store API itself is unchanged.
  • Updated dependencies [7bcf252]
    • @eventuras/fides-auth@0.9.0
Loading