Release highlights: request cancellation, interactive authWithOAuth2, fail-closed JWT checks, realtime and batch hardening, an aligned request pipeline, and documentation/CI infrastructure.
Added
- Request cancellation:
requestKey,cancelRequest(_:),cancelAllRequests(_:)and same-key auto-cancellation (SendOptions.autoCancel). - Interactive
authWithOAuth2with a pluggableurlCallback(provider discovery, one-off@oauth2realtime channel, state validation, cancellation and cleanup). - Overridable
CrudService.decodehook, applied to every CRUD and auth response. LogService.truncate,CollectionTypeaccessor and unknown collection/field key preservation throughimport.SendOptions.FormValue.arrayfor mixed value/file multipart fields.AsyncAuthStore.initialLoader, injectableLocalAuthStorestorage,JWTUtils.getExpirationTimestamp, and publicAutoRefresh.registerAutoRefresh/resetAutoRefresh.- Documentation and project infrastructure: DocC catalog with a
PublicAPIarticle,CONTRIBUTING.md,SECURITY.md,CODE_OF_CONDUCT.md, issue/PR templates, CI (macOS tests + DocC gate, Android build/tests), CodeQL and Dependabot.
Changed
- Breaking: JWT expiration checks fail closed —
JWTUtils.isTokenExpiredandBaseAuthStore.isValidrequire a well-formed three-segment JWT with a numeric (or numeric-string)expclaim in the future. - Breaking:
importCollectionswas renamed toimport, and multipart.jsonvalues are sent under@jsonPayload. - Breaking:
BaseAuthStore.clear()no longer calls the overridablesave(_:_:); subclasses should overrideclear()ortriggerChange(). - Breaking:
RecordService.updatemerges the stored auth record with the response instead of replacing it, preserving fields omitted by partial responses. - Aligned the request pipeline with the reference SDK: hook error wrapping, option precedence, query/filter escaping and number formatting, and cancellation registration before
beforeSend. - Auth stores:
triggerChange()hook, cookie trim preservingid/email, liveLocalAuthStore, FIFOAsyncAuthStorequeue,AutoRefreshlifetime and gating fixes. - Realtime: reconnect and subscription-sync hardening,
onDisconnect(activeSubscriptions)semantics, serverretry:as a backoff floor, transport lifecycle fixes and a deterministicoptions=encoding. - Batch/FormData: mixed value/file arrays,
+file keys, deterministic@jsonPayloadmerge, nested-array handling and empty-array behavior. - Services:
impersonatehonorsdecode, admin option precedence, typedappleClientSecretresponse, and saferSubBatchServicequeue lifetime. - Documentation: compiling README examples, JS parity notes, Android persistence notes, and DocC topic-heading fixes.
Removed
- Deprecated JS-compatibility aliases:
BaseAuthStore.model,isAdmin,isAuthRecord;PocketBase.admins,getFileUrl;FileService.getUrl. Userecord,isSuperuser,collection("_superusers")andfiles.getURLinstead.