Skip to content

v1.4.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 May 20:00
· 594 commits to main since this release
v1.4.2
92203db

Changes

  • fix(script): update version stamping method in prepare-npm-publish.sh to avoid npm workspace issues (92203db)
  • feat(dependencies): update package.json to use workspace:* for internal dependencies fix(auth): simplify session refresh logic and improve type handling for passkeys refactor(scripts): streamline npm publish preparation by removing redundant workspace resolution (d6ccfe9)
  • fix(extension): wire remote contract contributor in client mode + expose contract server in server mode (e9ed971)
  • feat(extension/contract): auth.config query + login-04 form + role gate wiring (5c8b526)
  • feat(extension/contract): contribute auth.login + /login route to dashboard contract (2e08361)
  • feat(passkey): enhance dashboard settings panel with dynamic settings (855daf2)
  • feat(admin): copy user across apps and list roles per-app (b892de4)
  • fix(ui-core): fetchClientConfig uses generated client's actual fields (c3e26f4)
  • fix(api,sdk): route public-auth by publishable key, never to platform (636c706)
  • feat: WithInitialOwnerCount — configurable auto-promotion threshold (default 3) (39c933b)
  • fix(service-account): address critical and important code review issues (66d0bcd)
  • feat: add first-class ServiceAccount entity with API keys and admin API (6716455)
  • fix(admin): enforce platform-owner auth gate and harden last-owner guard (3ad5520)
  • feat: platform owner configurability — WithInitialOwners, YAML config, admin API (cf02517)
  • fix: remove SuperAdminSlug from IsPlatformRole to prevent auth gate leakage (f96121f)
  • fix(rbac): add SuperAdminSlug constant, update IsPlatformRole, and purge duplicate platform-admin roles (4ca9177)
  • feat: Enhance admin API for social and SSO management (5443cce)
  • fix(mongo): create_authsome_users tolerates pre-existing OLD-shape index (2fa89f8)
  • fix(mongo): self-heal grove_migrations decode-corruption on boot (efbb0c6)
  • fix(mongo): run migration orchestrator + tolerate index-shape conflicts on boot (900061a)
  • fix(store): empty-username unique-index collision + clean error mapping (9fad32f)
  • test(engine): pin MFA gate contract for every plugin's AuthMethod (677fac5)
  • feat(ui): MFA round-trip via ticket — challenge form completes the sign-in (c4a13f5)
  • refactor(engine): SignIn delegates session minting to IssueSession; remove inline gate (277118b)
  • feat(mfa): /v1/mfa/challenge accepts ticket and issues session (9ac33dd)
  • feat(phone): route verify endpoint through Engine.IssueSession (da8d687)
  • feat(sso): route SAML/OIDC callback through Engine.IssueSession (ec0c2c2)
  • feat(magiclink): route verify endpoint through Engine.IssueSession (564c7e6)
  • feat(social): route OAuth callback through Engine.IssueSession (22bcebc)
  • feat(api): map ErrMFARequired to 403 with mfa_ticket + available_methods (5030a7f)
  • feat(engine): IssueSession centralized chokepoint with MFA ticket gate (9d8e891)
  • docs(superpowers): track auth-security-hardening design spec (3defea3)
  • test(dashboard): coverage for PageBase plumbing (a37434e)
  • fix(sdkgen): persist Go-SDK lazy app-id discovery in template (42181ed)
  • feat(dashboard,extension): plumb PageBase + POST contributor protocol (9085bb2)
  • feat(engine): surface mfa_required on client-config (0920995)
  • feat(appclientconfig,api): mfa_required override per-app (586f8ad)
  • fix(middleware,apikey): clearer ops signals for auth failures (1610be9)
  • chore: ignore /specgen + /standalone binaries; track refresh-replay tests (e9b54c9)
  • fix(extension): replace removed dashboard.WatchRemoteContributor API (1015375)
  • feat(store/mongo): native refresh-token replay detection (e52ee46)
  • feat(store/sqlite): native refresh-token replay detection (2ad797c)
  • feat(store/postgres): native refresh-token replay detection (a954ac0)
  • feat(store): add family_id + revoked_refresh_tokens schema for SQL/Mongo (5ed8f43)
  • feat(engine): detect refresh-token replay and revoke session family (cecdfd3)
  • feat(store): add refresh-token revocation set + family cascade (8ca131c)
  • feat(id,session): add SessionFamilyID for refresh-token replay detection (7ded3e0)
  • feat(ui-nextjs): inherit verification + captcha UX from ui-components (95694da)
  • feat(ui-vue): wire verification panels and captcha into sign-in/sign-up (c6a6908)
  • feat(api,engine): POST /v1/verify-email/resend (enumeration-safe) (73e857c)
  • fix(sdkgen): persist 'type' field on TS AuthClientError template (cf24a73)
  • feat(ui-components): wire verification panels and captcha into sign-in/sign-up (a431739)
  • feat(ui-components): add Cloudflare Turnstile widget (52fd4cf)
  • feat(ui-core,ui-react): add email_not_verified and verification_pending auth states (5b7ebb0)
  • feat(ui-core): surface backend error type field on AuthClientError (94f6804)
  • feat(engine,api,sdk): expose Captcha section on /v1/client-config (38718d2)
  • feat(api,sdk): regenerate SDKs with captcha_token field + Phase 2A behavior (6f5193e)
  • feat(webhook): canonical signature helpers (X-Authsome-Signature) (05b6690)
  • feat(account): NeedsRehash also fires on weakened Argon2/bcrypt parameters (c259899)
  • feat(scim): RotateToken with grace window for zero-downtime rotation (269dc27)
  • feat(bridge,social): encrypt OAuth provider tokens at rest (AES-256-GCM) (613d5aa)
  • feat(api): apply SecurityHeadersForAPI to every JSON route (7f3df66)
  • feat(middleware): SecurityHeaders middleware (CSP/HSTS/Frame/Referrer/Permissions) (5cfc458)
  • fix(middleware): gate 401 debug_reason on AUTHSOME_DEBUG_AUTH=1 (89573bd)
  • feat(organization): atomic cascade delete via per-backend native tx (7d1b2ec)
  • feat(social): rate-limit /v1/social/:provider endpoints (753ddc7)
  • feat(social): PKCE (S256) + OIDC nonce + per-app state namespacing (d072f98)
  • fix(plugins): migrate dashboard form nonces to scoped HMAC variant (b7a638a)
  • test(secutil): centralize RelaxAuthDefaults bootstrap helper (c6e2d6e)
  • fix(organization): migrate org-create form to scoped nonce (5e88da7)
  • fix(social): use template.JSEscapeString for redirect in callback HTML (ed72fc2)
  • feat(authsome): __Host- session cookie prefix opt-in + unify cookie config (6dc4182)
  • feat(api,extension): apply captcha middleware to auth endpoints (a1069a4)
  • feat(middleware): captcha middleware + per-app settings (6ee726a)
  • fix(captcha): correct Turnstile action handling, return Result, drop unreachable sentinel (0410781)
  • feat(captcha): Verifier interface + Cloudflare Turnstile implementation (5659b66)
  • fix(api): map ErrEmailNotVerified to 403 with stable error code (590e273)
  • fix(authsome): default SettingRequireEmailVerification to true (cd554e6)
  • fix(api): close /v1/signup timing and shape oracles (eb5db00)
  • fix(api): /v1/signup no longer leaks email existence (3acf2f4)
  • feat(dashboard): require CSRF token on register/login/forgot/setup (461e3f0)
  • feat(dashboard): pre-session CSRF token for unauthenticated forms (cb3679d)
  • fix(dashboard): Auditor sets Outcome and handles empty actor (9457561)
  • feat(dashboard): audit helper + coverage gate (874320a)
  • docs(memory store): clarify WithTx snapshot semantics (458351c)
  • feat(organization): WithTx-wrapped DeleteOrganization cascade (12a2365)
  • fix(organization): canDeleteOrg passes resource TYPE, not instance ID (5235b01)
  • feat(organization): authz + audit log for dashboard org delete (aeb3a9f)
  • fix(dashboard): length-prefix HMAC inputs in nonceSigner (d40947b)
  • feat(dashboard): add HMAC-bound CSRF nonce (session+scope) (072ef0f)
  • feat(social): per-app frontend-URL allowlist for OAuth state (f51b640)
  • fix(api): /v1/introspect must validate API keys (86000b2)
  • fix(social): close backslash and relative-path open-redirect vectors (adaf8fc)
  • fix(social): reject absolute redirect URLs without trusted origin (f018a05)
  • test: add secutil shared test helpers for security work (d28b9ab)
  • Refactor imports and add App ID handling (c62517b)
  • feat: implement client mode for dashboard contributor and expose contributor protocol over HTTP (844afa6)
  • feat(testutil): add SwitchOrg, SetMemberRole, SessionByToken helpers (b4d1c08)
  • test(engine): coverage for SwitchActiveOrg (17221e0)
  • feat(api): add POST /v1/me/switch-org for active-org session updates (56e5322)
  • feat: implement dynamic email verification setting and update related logic (87bf427)
  • feat: add signup_enabled feature to app client configurations (6fb937b)

Installation

Go:

go get github.com/xraph/authsome@v1.4.2

npm:

npm install @authsome/client@1.4.2
npm install @authsome/ui-react@1.4.2

Flutter:

dependencies:
  authsome_flutter: ^1.4.2

Full Changelog: v1.4.1...v1.4.2

Assets 2
Loading