v0.3.0

SaaSKit v0.3.0

This release introduces major security and identity improvements as part of Phase 3 of the SaaSKit roadmap.

🔐 Highlights

Role-Based Access Control (RBAC)

Added a flexible permission-based authorization system:

• New permission model for granular access control
• Added Manager and Viewer tenant roles
• Introduced RequirePermission middleware
• Replaced inline authorization checks with centralized RBAC enforcement

Supported permissions include:

• tenant.read
• tenant.update
• members.invite
• members.remove

---

🔑 Multi-Factor Authentication (MFA)

Added MFA support with TOTP-based authentication.

Features:

• TOTP generation and verification
• AES-256-GCM encrypted MFA secret storage
• Recovery code generation and validation
• Extensible MFA domain supporting future methods:
  • WebAuthn
  • SMS
  • Email

---

🔄 Refresh Token Grace Window Rotation

Improved refresh token security and reliability.

New behavior:

• Added a 10-second grace period during token rotation
• Prevents authentication failures caused by concurrent refresh requests
• Stores previous token metadata securely
• Maintains strong security guarantees while improving user experience

---

🪪 Enhanced JWT Claims

Access tokens now support additional identity context:

• Tenant role
• Permissions
• MFA verification status

---

🧪 Testing

This release includes:

• New RBAC integration tests
• MFA service coverage
• Refresh token rotation tests
• Updated authentication tests

All tests are passing.

---

📦 Upgrade Notes

This release is backward compatible.

No breaking changes are introduced.

Existing deployments can upgrade normally by applying the new database migration: