v2.0.0

What's Changed

• Prep CharonOauth2 integration by @juulSme in #14
  • session stores take a type argument to separate sessions into full (legacy name meaning first-party) and oauth2 sessions, so that a delete_all call will not log out oauth2 sessions, for example
  • sessions now contain their full expiration info to simplify implementing session stores
  • TokenFactory.SymmetricJwt is renamed to simply TokenFactory.Jwt, because...
  • JWT factory now supports asymmetric Ed25519/Ed448 signatures
  • JWT factory supports key rotation using keysets and kid claims
  • JWT factory relies on kid claim in Jwt header to determine signing key, instead of "guessing" it using the alg claim
  • JWT factory config has been simplified
  • Config now has :get_base_secret which is used to derive keys for other purposes using PBKDF2 (which can also be used by child packages)
  • Config now has :json_module (which can also be used by child packages)
  • Utils.Keygenerator can be used to derive keys using PBKDF2, and caches the keys using FastGlobal. It assumes that the number of derived keys is limited, because FastGlobal is very fast for reads but increasingly slow for writes.
  • TokenPlug.PutAssigns supports assigning any token claim to the conn
  • SessionPlugs support :session_type option, the value of which is added as token claim styp
  • SessionPlugs makes sure that a session's :refresh_expires_at never outlives :expires_at, meaning that session stores can rely on this value for garbage collection
  • TokenPlugs adds verify_token_payload/2, verify_session_payload/2
  • TokenPlugs.verify_refresh_token_fresh now determines freshness based on "refresh generations" (read the docstring for full explanation)
  • Utils has additional setters

Full Changelog: v1.3.4...v2.0.0