Release v1.20.1

Release v1.20.1

Changelog

Fixed

• When nowo-tech/slide-to-confirm-bundle is not installed, register no-op Twig stubs for nowo_slide_to_confirm_asset_path and nowo_slide_to_confirm_asset_package so AuthKit templates that reference those helpers still compile.

Notes

• No configuration changes. Optional SlideToConfirm integration behaviour is unchanged when the package is installed.

What's Changed

• fix(demo): Git safe.directory for demo-smoke CI by @HecFranco in #14

Full Changelog: v1.20.0...v1.20.1

Release v1.20.0

Release v1.20.0

Changelog

Added

• Optional OTP input integration with nowo-tech/otp-input-bundle (suggest + require-dev only — no hard Composer dependency):
  • Profile keys otp_input.enabled (default false) and otp_input.password_reset_code (default true).
  • Password-reset code field uses OtpType (length/charset from password_reset) when enabled and the package is installed; otherwise the existing TextType remains.
  • Layout partial _otp_input_assets.html.twig loads otp-input.js (nowo_otp_input asset package) only when enabled and the package is present.
  • Global/function nowo_auth_kit_otp_input_assets. The widget is UX only; server OTP checks (hash_equals, max_code_attempts) stay mandatory.

Changed

• Spec Kit baseline inventory 151/151 (123 PHP + 28 Resources), including OTP-input units.

Security

• REQ-SEC-004 re-audit of the 1.20.0 OTP-input delta: overall Pass (conditional) / Medium; this delta Low (no new Critical/High/Medium). The widget is UX only. hash_equals and max_code_attempts are unchanged. Login forms are unchanged.

Notes

• No application change unless you install the optional package and set otp_input.enabled: true. Login forms are unchanged.

Full Changelog: v1.19.0...v1.20.0

Release v1.19.0

Release v1.19.0

Changelog

Added

• Optional device intelligence integration with nowo-tech/device-intelligence-bundle (suggest only — not require / require-dev; that package needs PHP 8.3+ while AuthKit CI stays on 8.2):
  • Profile keys device_intelligence.enabled (default false), collect_on_auth_pages (default true), collect_endpoint (default /_device/collect), new_device_notify (default false), device_rate_limit (default false), qr_login.approve_require_trusted (default false).
  • Layout partial _device_intelligence_assets.html.twig calls collect() when enabled and Device Intelligence is installed.
  • After LoginSuccess, optional session flag nowo_auth_kit.new_device + NewDeviceLoginNotifierInterface (default no-op) when the observed cluster is new. Does not auto-trust().
  • Extra AuthKitAttemptLimiter consume keyed by device ULID on register / password-reset request / magic-login request when device_rate_limit is true. Missing observation is a no-op.
  • QR approve: DeviceIntelligenceQrLoginStepUp decorates QrLoginStepUpInterface; when approve_require_trusted is true and the bundle is present, requires _device + isTrusted(). Default NullQrLoginStepUp is skipped so it does not throw; a custom inner still runs. Device ID is not a credential.

Changed

• Spec Kit baseline inventory 149/149 (122 PHP + 27 Resources), including device-intelligence units.

Security

• REQ-SEC-004 re-audit of the 1.19.0 HTTP surface: overall Pass (conditional) / Medium; this delta Low (no new Critical/High). Device ID is not a credential. Login forms, CSRF, LoginThrottle, and remember-me are unchanged. AuthKit never auto-trust()s after login.

Notes

• No application change unless you install the optional package (PHP 8.3+) and set device_intelligence.enabled: true. Login forms and remember-me are unchanged.

Full Changelog: v1.18.0...v1.19.0

Release v1.18.0

Release v1.18.0

Changelog

Added

• Optional slide-to-confirm integration with nowo-tech/slide-to-confirm-bundle (suggest + require-dev only — no hard Composer dependency):
  • Profile keys slide_to_confirm.enabled (default false), registration_consent (default gate), qr_login_approve (default false).
  • Registration fields: slide_to_confirm (true or a profile name) and mapped (defaults to false when a slide is requested). UserRegistrar does not persist unmapped fields.
  • QR approve: QrLoginApproveType with Form CSRF + SwipeToSubmitType when enabled and the package is installed.
  • Twig partials _slide_to_confirm_assets.html.twig and _registration_submit.html.twig; global/function nowo_auth_kit_slide_to_confirm_assets.
  • Translations: register.field.terms, register.slide.*, qr_login.approve.slide / confirmed / slide_hint.

Changed

• Spec Kit baseline inventory 142/142 (116 PHP + 26 Resources), including LoginThrottleRequiredPass (shipped in 1.17.4) and slide-to-confirm units.

Security

• REQ-SEC-004 re-audit of the 1.18.0 HTTP surface: overall Pass (conditional) / Medium; this delta Low (no new Critical/High). QR approve with slide uses Form CSRF. The swipe is confirmation UX, not authorization. Login forms are unchanged.

Notes

• No application change unless you install the optional package and set slide_to_confirm.enabled: true.

Full Changelog: v1.17.5...v1.18.0

Release v1.17.5

Release 1.17.5

See docs/CHANGELOG.md for details.

Changelog

Changed

• Demos: MySQL env policy in FrankenPHP stack (REQ-DEMO-011).
• Docs: PHP-FIG PSR evaluation (REQ-CS-007).

Notes

• No API or configuration changes for integrators unless noted above.

Full Changelog: v1.17.4...v1.17.5

Release v1.17.4

Release v1.17.4

Changelog

Security

• login_throttle_required: when true, container compilation fails if nowo-tech/login-throttle-bundle is not registered. Flex recipe when@prod enables the flag. Default remains false so existing apps that skip the recipe do not break.

Full Changelog: v1.17.3...v1.17.4

Release v1.17.3

Release v1.17.3: require Login Throttle in Flex recipe for production.

• Flex recipe requires nowo-tech/login-throttle-bundle ^3.1
• Post-install configures login throttling for production login forms

Release v1.17.2

Release v1.17.2: spec inventory catch-up for shipped 1.17.x features.

Changelog

Documentation

• Specs: baseline inventory 137/137 (src/ PHP + Resources) and user stories for magic login, QR login, social/enterprise SSO, and the outbound-mail gate (product already shipped in 1.17.x).

Full Changelog: v1.17.1...v1.17.2

Release v1.17.1

Release v1.17.1: Symfony 8 demos and Hot Reload 1.4.

Changelog

Changed

• Demos: pin nowo-tech/hot-reload-bundle to ^1.4 with FrankenPHP Mercure/hot_reload (dev/test only).

What's Changed

• test(magic-login): restore 100% coverage for confirm interstitial by @HecFranco in #11
• docs: mark QR phone login as shipped by @HecFranco in #12

Full Changelog: v1.17.0...v1.17.1

Release v1.17.0

Release v1.17.0

Changelog

Changed

• Magic login confirm interstitial (closes #9): MagicLoginConfirmType with Form CSRF; GET magic_login_check only; POST magic_login_confirm validates CSRF, consumes the login link, then Security::login(..., 'login_link'). Stock confirm Twig uses form_start / form_end (REQ-TWIG-005; no plain <form).
• nowo:auth-kit:configure-security adds public access_control for magic_login_confirm when confirm_interstitial is enabled.

Documentation

• MAGIC-LOGIN / CONFIGURATION / UPGRADING: confirm Form CSRF flow.

What's Changed

• Magic login confirm: FormType + real CSRF before login by @HecFranco in #10

New Contributors

• @HecFranco made their first contribution in #10

Full Changelog: v1.16.0...v1.17.0