v1.7.0

Changes

• Merge pull request #99 from xraph/test/plugin-postgres-conformance (00fd724)
• test(plugins): tighten the not-found assertion and correct two claims (671824a)
• test(plugins): pin three store invariants that no backend was checking (103e09e)
• Merge pull request #100 from xraph/docs/ci-lock-test-does-not-hang (27c17e7)
• Merge pull request #98 from xraph/fix/ui-components-lint-findings (da5d5ec)
• docs(ci): the migration-lock test does not hang (816ae39)
• fix(ui-components): trim the sub-path slashes without a regex (036fd7f)
• Merge pull request #96 from xraph/fix/sqlite-verification-expiry-tz (604ebc4)
• ci: run lint and tests for the ui workspace (31b41e9)
• fix(ui-components): send the social login return target as redirect_url (94a0a6b)
• fix(ui-components): adopt codes and field defaults without an effect (af52c0e)
• fix(ui-components): read the location as the external store it is (4dcb245)
• fix(ui-components): keep the spinner on a reload in the three lists (33aa4a9)
• test(ui-components): give the package a test harness (5fac498)
• test(sqlite): fail the build on an unnormalised timestamp comparison (57c68fe)
• fix(sharedsignals/sqlite): put the audit window and breaker count on UTC (0a9ec57)
• fix(sqlite): compare expiry timestamps on the same clock (9977b0b)
• Merge pull request #94 from xraph/fix/hooks-set-state-in-effect (5ee6634)
• Merge pull request #95 from xraph/fix/waitlist-mongo-unique-email (b2ed982)
• Merge pull request #93 from xraph/feat/sharedsignals-challenge-not-block (b3d6e3a)
• fix(waitlist): enforce one entry per address per app on mongo (2c2351f)
• test(sharedsignals): cover the JWKS EC point validation (90e0bf0)
• Merge pull request #91 from xraph/test/sharedsignals-hard-limit-status-mapping (e3a970e)
• test(sharedsignals): give the e2e requests a context (70a5f41)
• Merge pull request #92 from xraph/test/ui-react-harness (87dfc90)
• Merge pull request #88 from xraph/feat/plugin-store-conformance (dbb271e)
• fix(ui-react): stop setting state from effects in useUser and useOrganizations (d4204f1)
• fix(sharedsignals): challenge on a confirmed compromise, do not block (0ab620a)
• fix(oauth2provider): store the client principal link on mongo (8a64f66)
• test(plugins): add social OAuth connection stores to the conformance suite (dc385f5)
• test(plugins): add consent stores to the conformance suite (ba338e5)
• test(oauth2provider): cover the principal link on a full client replace (73fa169)
• test(oauth2provider): cover UpdateClient and the resource allow-list (071361d)
• ci: run the plugin conformance suites, serially (28f3a11)
• test(plugins): add shared signals stores to the conformance suite (ec56b82)
• test(plugins): add waitlist stores to the conformance suite (fc1c21b)
• test(plugins): add SSO connection stores to the conformance suite (7ebd1b1)
• test(plugins): add MFA stores to the conformance suite (340c9c2)
• test(plugins): add passkey stores to the conformance suite (c3b50f6)
• test(plugins): run oauth2provider stores through a shared conformance suite (3862aba)
• test(ui-react): give the package a test harness and cover AuthProvider (63706b4)
• test(sharedsignals): pin the receiver's three-way key status mapping (0b1f456)
• Merge pull request #90 from xraph/fix/react-hooks-refs-context (84c7cfa)
• Merge pull request #87 from xraph/feat/rfc8693-grant (428b34c)
• fix(ui-react): stop reading a ref during render in AuthProvider (089c9e1)
• chore(sdk): regenerate for the token exchange fields (5c8f6f8)
• Merge pull request #89 from xraph/chore/bump-ui-docs-deps (94a4d46)
• Merge pull request #84 from xraph/feat/oauth2-admin-client-update (13872a6)
• chore(deps): bring docs and ui dependencies current (5e78701)
• fix(oauth2): satisfy gosec and noctx on the token exchange grant (ac8d4a9)
• chore(sdk): regenerate the embedded ui-core and flutter-core clients (5ed80bc)
• Merge pull request #86 from xraph/feat/sharedsignals-jwks-hard-expiry (ce818b9)
• fix(oauth2provider): name the scoped errors in the admin client handlers (87e573f)
• fix(plugins): stop the memory stores aliasing their own records (3378201)
• Merge pull request #83 from xraph/chore/drop-sdk-plugins-noop (6d5b0fc)
• chore: restore forge to the versions main pins (fbd4444)
• feat(oauth2): write a security event for every token exchange (2ee434f)
• Merge pull request #82 from xraph/chore/forge-1.9.13 (b90fa84)
• feat(oauth2): let an admin edit a registered client (a43de1f)
• feat(oauth2): add the RFC 8693 token exchange grant (9c48e1d)
• ci(sdkgen): drop the SDK_PLUGINS argument, which nothing reads (a9fd1f6)
• chore(deps): move extensions/auth to v1.9.13 as well (0ebac97)
• feat(sharedsignals): give the JWKS cache a hard expiry and a refresh ticker (00fa52f)
• chore(deps): move to forge v1.9.13 (bb0be72)
• Merge pull request #79 from xraph/fix/oauth2-resource-form-binding (17c4c55)
• Merge pull request #80 from xraph/docs/middleware-withsession-gap (3403a2a)
• Merge pull request #81 from xraph/docs/rfc8707-user-guide (75109d9)
• docs(oauth2): document resource indicators (8d41f9a)
• docs(middleware): record the WithSession gap beside the fallthrough test (0287d4d)
• Merge branch 'main' into fix/oauth2-resource-form-binding (e2909ac)
• Merge branch 'main' into fix/oauth2-resource-form-binding (e91a101)
• Merge pull request #77 from xraph/fix/sdk-form-array-encoding (c4dda98)
• Merge pull request #76 from xraph/feat/oauth2-authorize-resource-param (c98d092)
• chore(deps): move to go-utils v1.1.8, unblocking this branch (7c3f53a)
• Merge branch 'main' into fix/sdk-form-array-encoding (961b927)
• Merge pull request #74 from xraph/fix/rfc8707-resource-in-sdks (f16c0b6)
• Merge pull request #75 from xraph/fix/oauth2-resource-form-binding (196c30f)
• Merge pull request #73 from xraph/test/agentauth-concurrency (fa06b01)
• Merge pull request #72 from xraph/fix/sdk-form-array-encoding (19e40a7)
• feat(oauth2provider): let clients send resource indicators to /authorize (a75af58)
• fix(oauth2provider): bind the device-authorize resource through the struct (9bd4a94)
• chore(deps): move to forge v1.9.12 (9d62c45)
• fix(sdkgen): let the RFC 8707 resource indicator reach the SDKs (d585bb1)
• test(agentauth): cover the grant cache and memory store under real concurrency (74fda3c)
• fix(sdkgen): repeat form fields instead of flattening arrays (05a7ee0)
• Consolidate the three conflicting agent branches into one (#71) (37f614a)
• chore: untrack the superpowers working documents (b02450e)
• fix(security): close the two CodeQL findings that were real (408e4ae)
• chore(sdk): regenerate for the passkey type rename (fbad0aa)
• fix(ci): give the last three test requests a context (bdf7526)
• Merge branch 'integration/agent-work' into integration/candidate (e70b754)
• Merge branch 'feat/agentauth-delegation' into integration/candidate (6ac5926)
• fix(ci): make the gosec suppressions real and clear the lint findings (9095173)
• fix(agentauth): item 3 failed open — deny middleware ran before the session existed (8da68c6)
• Merge branch 'integration/agent-work' into integration/candidate (a3d879d)
• chore: drop the constant the merge left dead (4c46a76)
• Merge branch 'chore/regenerate-sdks' into integration/candidate (17f39fa)
• fix(ci): tidy go.sum and give three test requests a context (5dd2984)
• Merge branch 'merge/rfc8707-into-integration' into integration/candidate (7b1f145)
• Merge feat/agentauth-delegation into integration/candidate (18e5f27)
• Merge branch 'integration/agent-work' into chore/regenerate-sdks (71cbc64)
• merge integration/agent-work into rfc8707 resource indicators (7cf1341)
• Merge branch 'fix/auth-method-provider-path-tag' into integration/candidate (5197e31)
• Merge branch 'fix/oauth2-admin-client-app-scope' into integration/candidate (c10d93c)
• Merge branch 'fix/dpop-autorefresh' into integration/candidate (c477e87)
• Merge branch 'integration/agent-work' into chore/regenerate-sdks (92bc335)
• fix(store): resolve migration version collision, add mongo grant_id index (37e5249)
• Merge integration/agent-work into integration/candidate (4288b09)
• fix(lint): clear the findings the token-exchange merge added (c21c3f2)
• Merge branch 'fix/dpop-lint' into integration/candidate (d6be545)
• Merge feat/rfc8693-token-exchange into integration/candidate (7a3aff8)
• fix(dpop): clear the lint findings the DPoP merge introduced (08a7463)
• ci(sdkgen): check the embedded clients for drift too (7a36597)
• fix(ui,flutter): follow the regenerated clients (879ff5a)
• chore(sdk): regenerate the spec, SDKs and embedded clients (b57a748)
• fix(passkey): describe the WebAuthn credential body in the spec (b263691)
• fix(sdkgen): give session-secured operations a token parameter (c8b8338)
• Merge branch 'integration/agent-work' into fix/dpop-issuance-coverage (c670533)
• fix(agentauth): resolve govet shadow lint on CreateGrant's idempotency check (cc0dfdf)
• fix(agentauth): stop a partial policy PUT from silently widening (c9f1f03)
• fix(dpop): refuse unbound sessions on every issuance path under required (32d2873)
• fix(jwkutil): build and read EC keys through the parsing API (2ed5682)
• chore(sdk): regenerate for the unlink provider path tag (45fdad0)
• fix(agentauth,store/postgres): two small safety fixes (683c80c)
• fix(agentauth,oauth2provider): bind the consent gate to an app (a30ece1)
• fix(oauth2provider): scope the admin client routes to the caller's app (0185a77)
• fix(api): bind the unlink provider from the path tag, not param (58ea7ae)
• fix(agentauth): make CreateGrant idempotent per (agent, user, org) (b58c3ad)
• fix(agentauth): stop a last-used stamp from silently un-revoking a grant (9e1613c)
• Merge remote-tracking branch 'origin/integration/agent-work' into integration/candidate (78c207f)
• feat(sharedsignals): let the received-event audit trail be read back (f88e8af)
• fix(middleware): give DPoP-bound sessions their auto-refresh back (29552f1)
• fix(oauth2provider): authenticate the caller on the revocation endpoint (746daf8)
• fix(agentauth): refuse agent principals on the plugin's own admin/me routes (d579ac2)
• fix(agentauth): register as oauth2provider's consent gate in OnInit (6b464b8)
• docs(agentauth): write the host integration contract (4af78bb)
• test(middleware): pin that a refused JWT never falls through to the opaque lookup (de99ee7)
• chore(sdk): regenerate for the token-exchange types (99e58a1)
• fix(scim): validate bearer tokens against the store, not an empty app filter (e878bf1)
• Merge commit 'dcdf4b8' into integration/candidate (c4ca7c0)
• fix(sharedsignals): parse JWK EC keys instead of assigning X and Y (2793573)
• fix(store): match integration's version for the session audience migration (5560740)
• Merge remote-tracking branch 'origin/chore/untrack-superpowers-docs' into integration/candidate (055da92)
• test(oauth2provider): give the client_credentials basic-auth tests their own client (8a108d2)
• fix(store): move the session audience migration off a version token exchange took (fa1f960)
• test(api): observe the duplicate-signup hash instead of timing it (3e751a8)
• fix(integration): reconcile the DPoP branch (dcdf4b8)
• fix(oauth2provider): authenticate the client on the device code grant (a24c870)
• fix(agentauth): cover Guard, log RBAC/store failures, fix scope determinism (b30adb6)
• fix(ci): clear the lint failures and stop the root package timing out (1d88559)
• chore: actually ignore docs/superpowers (93ab305)
• feat(agentauth): map authorization failures to scoped http responses (111cf1d)
• fix(middleware): route permission checks on the chain, not on the checker (e85e17d)
• fix(session): keep a refreshed chain-carrying session opaque (d3e46dc)
• fix(agentauth): zero-org policy parse, atomic bulk revoke, sqlite timestamps, client_id collisions, active-grant determinism (d068cf9)
• fix(dpop): stop nonce enforcement resolving to false in silence (84a3e64)
• fix(principals): make the actor chain reach the request path (751d56c)
• fix(dpop): enforce the binding in the two dashboard auth checkers (4f62d2e)
• fix(dpop): honour a bound session presented over cookie transport (9f32db8)
• feat(agentauth): add persistent stores and migrations (47a8b13)
• fix(dpop): stop a request from reading its own proof as a replay (9217341)
• fix(integration): reconcile the token-exchange branch (cf11e63)
• fix(integration): reconcile the two feature branches (e042528)
• fix(agentauth): gate agent status changes on org too, cover remaining response bodies (8141b6a)
• chore(sdk): regenerate after the non-human-principals merge (d4063e4)
• Merge remote-tracking branch 'origin/sdd/non-human-principals' into integration/agent-work (13b8601)
• feat(auth): record impersonation as a delegation grant (373cc07)
• fix(sdk/ts): send the DPoP proof on token-less binding calls, retry on 400 too (2efb9e4)
• fix(agentauth): make caller's org a floor on admin routes, fix double JSON writes (07b09f9)
• fix(principal): map mint-child refusals to 4xx instead of 500 (86fc8d0)
• Merge remote-tracking branch 'origin/feat/oauth2-dynamic-client-registration' into integration/agent-work (09a8b0a)
• fix(plugins): declare sqlite timestamp columns TIMESTAMP (#68) (7ffd6d3)
• feat(oauth2): bind tokens to the resource they were issued for (RFC 8707) (#67) (f9ddc33)
• Merge branch 'fix/dpop-enforcement-gaps' into worktree-dpop-rfc9449 (da72d45)
• fix(agentauth): mount routes under /v1, tenant-scope admin surfaces, sweep sessions on bulk revoke (0092150)
• feat(principal): mint ephemeral children under a registered parent (e4a44a3)
• feat(sdk/ts): generate DPoP proofs with a non-extractable WebCrypto key (a1310ca)
• fix(principal): refuse chained token exchange and close revoke auth gap (5c9386b)
• style(sharedsignals): clear the linter across the receiver (e8db59b)
• feat(oauth2): advertise dpop_signing_alg_values_supported (4f1dc45)
• feat(principal): add delegation grants and RFC 8693 token exchange (fdb4d89)
• feat(agentauth): add user grant listing and admin agent management (18eb1b2)
• fix(session): close review gaps in refresh DPoP binding (0271214)
• fix(sharedsignals): connect the inert halves of the receiver (e19e2d9)
• fix(riskengine): audit blocked machine callers with an actor (83a66d5)
• feat(session): require and inherit DPoP binding across refresh (ea4dc55)
• fix(agentauth): revoke grants on SCIM PATCH/PUT deactivation and org deletion (6be9825)
• fix(store): finish the environment migration on sqlite and mongo (c541f5c)
• feat(risk): score non-human callers across all six risk plugins (0c5279b)
• docs(plan): implementation plan for the oidcverify package (c2e44e2)
• test: run an OAuth2-issued token into the real auth middleware (f1b87b4)
• fix(settings): validate session.resource_identifier as a resource URI (955e1e0)
• test(oauth2): cover device-code narrowing and its widening rejection (618ea10)
• fix(middleware): stop a refused JWT falling through to the session store (324c2b6)
• fix(middleware): resolve the expected audience from the token's app id (c228afa)
• feat(auth): resolve the expected token audience from app settings (a5b8917)
• feat(oauth2): advertise resource indicators and expose aud on introspection (498e67b)
• Revert "fix(plugins): declare sqlite timestamp columns TIMESTAMP" (e95f735)
• fix(middleware): enforce audience check in bare AuthMiddleware too (c3593bc)
• feat(middleware): refuse a token audienced at another resource (3c922a1)
• fix(oauth2): remove em dashes from token_resource_test.go comments (5c0990e)
• feat(oauth2): stamp granted audience on issued tokens and narrow it per request (a154c2f)
• feat(oauth2): accept resource indicators at the authorization endpoint (3dca498)
• feat(oauth2): add a resources field to the client dashboard form (65ab4ca)
• feat(oauth2): register a resource allowlist on a client (2186772)
• test(oauth2): pin rejection descriptions in resolveResources tests (6993a32)
• feat(oauth2): validate requested resources against the client allowlist (1dcdd26)
• feat(oauth2): read the repeatable resource parameter off the raw request (d66ee4f)
• style(oauth2): remove em dash from resources test comment (917eec8)
• test(oauth2): add converter round-trip coverage for resources (8fc024a)
• feat(oauth2): persist requested resources on clients, codes and device codes (9b4c947)
• test(oauth2): make the tenancy tests prove precedence, not just presence (c71dcb9)
• fix(session): keep the audience across a refresh (cc79f32)
• feat(tokenformat): emit a per-token aud claim (f62fe84)
• feat(session): carry the granted audience on a session (0d8d1a6)
• docs(plan): fix three defects the pre-flight scan found (261e13e)
• docs(plan): move the session migration off a version DPoP claimed (a22cb2b)
• fix(oauth2): resolve DPoP binding before burning single-use grant artifacts (f148948)
• test(sharedsignals): end-to-end revocation and forged-token coverage (cfb6be4)
• fix(apikey): close three fail-open gaps in principal auth scoring (589fe7b)
• ci(sdkgen): fail when the committed SDKs are stale (#62) (db5ce6b)
• fix(plugins): declare sqlite timestamp columns TIMESTAMP (4a83e86)
• fix(agentauth): actually wire ban revocation, RemoveMember idempotency and hook regression tests (12d4a59)
• Merge branch 'worktree-dpop-rfc9449' into fix/dpop-enforcement-gaps (8d21b19)
• feat(auth): stamp session roles, and keep the SDK generator working across forge v1.9.10 (#59) (3bde2b9)
• fix(sharedsignals): require an authorised session for the stream admin API (ad77a7d)
• feat(apikey): score machine callers through the principal auth hooks (897dd26)
• feat(agentauth): revoke grants on ban, delete and org departure (e574c70)
• feat(oauth2): bind issued tokens to the presenting client key (9c931dc)
• fix(dpop): enforce the binding on the two paths outside the middleware (fbe99cb)
• fix(middleware): wire the principal resolver into the live engine (976a4db)
• fix(agentauth): deep-copy cached grant scopes, close revoke/cache-write race, add bulk-clear hook (2a80991)
• feat(sharedsignals): stream registration and admin CRUD (0f6c305)
• feat(middleware): resolve the caller as a principal on both auth paths (38d694b)
• feat(sharedsignals): replay stored CAEP signals into the risk engine (6e32793)
• fix(riskengine): carry the sign-in identifier into RiskRequest (05c157d)
• fix(user/store): scope email and username lookups by environment (e63cbd2)
• test(middleware): cover DPoP enforcement on the production middleware variants (1d4c40f)
• test(plugin): assert EmitAfterPrincipalAuth survives a failing hook (5ea2320)
• feat(agentauth): cache grants with explicit invalidation on revoke (22ecf3a)
• fix(lint): clear the twelve golangci-lint failures on the branch (e8a357c)
• feat(plugin): add BeforePrincipalAuth and AfterPrincipalAuth hooks (febb983)
• fix(sharedsignals): dedupe per event so bundled SETs are not dropped (e8447e8)
• fix(agentauth): fix round 3 on agent session issuance (0815b1b)
• build(deps): bump the minor-and-patch group across 1 directory with 8 updates (#57) (d8bf8de)
• feat(plugin): expose principal resolution and chain-aware authz on Engine (b309988)
• Revert "chore: stop tracking the superpowers working documents" (92a33b3)
• fix(user/store): scope phone lookups by environment (f9b5185)
• fix(authz): address review round 1 for chain-aware Can (090d35e)
• feat(middleware): enforce DPoP proof of possession on bound tokens (f200c9e)
• Merge remote-tracking branch 'origin/main' into HEAD (9ed22d8)
• chore: stop tracking the superpowers working documents (#61) (546ac5f)
• fix(agentauth): fix round 2 on agent session issuance (c12322e)
• refactor(sdkgen): format in Generate, the way main does it (8000148)
• chore: stop tracking the superpowers working documents (61786cd)
• feat(authz): add chain-aware Can, intersecting subject with actors (c245af9)
• chore(sdk): regenerate on top of main (ca0d0c6)
• fix(oauth2,plugin): repair two tests that could not fail, correct stale comments (86b0ae0)
• fix(oauth2): enforce the client_credentials grant clamp and close gaps around it (e29356a)
• chore(sdk): regenerate for the registration endpoint in discovery (c1fc049)
• chore(sdk): regenerate for the dynamic client registration routes (bbd8720)
• fix(sharedsignals): tell gosec these event URIs are not credentials (07246ee)
• fix(sdkgen): stop the format step shadowing the parse error (78ec5ad)
• doc(oauth2): name all three uncovered 401s and record SessionGuard limit (ca4a106)
• fix(oauth2): give userinfo its own resource metadata hint on 401 (a0f28c1)
• feat(middleware): advertise protected resource metadata on 401 (ee3d78f)
• feat(oauth2): add RFC 8414 and RFC 9728 metadata documents (708f956)
• fix(sharedsignals): prove alg-gate ordering and fix malformed-claim error code in setjwt (7cc7750)
• refactor(session): derive ImpersonatedBy from an actor chain (a6973da)
• docs(token-exchange): rebase onto the non-human principals design (ce6aecc)
• feat(sharedsignals): RFC 8417 security event token validation (8a83aa2)
• fix(sdkgen): generate Dart request classes for inline bodies (b7b6e8e)
• feat(principal): add delegation grants, auth attempts and context carriers (19189f8)
• feat(principal): add principal ref, chain and kind value types (a5336d5)
• docs(specs): design for federated workload identity (c233927)
• feat(sharedsignals): CAEP event payload parsing (854155e)
• feat(sharedsignals): RFC 9493 subject identifier parsing (df81826)
• chore: gitignore the subagent-driven-development workspace (81569cd)
• fix(sdkgen): read form-encoded request bodies, and say urlencoded in the spec (c3799b6)
• docs(plan): note why sharedsignals keeps its migration version numbers (c580f5b)
• docs(sharedsignals): implementation plan for the M1 receiver (f0f8acc)
• docs(plan): claim distinct migration versions and flag the overlap (4333ac0)
• docs(plan): implementation plan for non-human principals (d6fd1a9)
• docs: implementation plan for RFC 8707 resource indicators (a37f03a)
• docs(dpop): claim distinct migration versions and note the shared tables (d795a1e)
• docs(plans): implementation plan for RFC 8693 token exchange (af8d798)
• docs(plan): implementation plan for RFC 9449 DPoP support (adbdc1b)
• docs(agentauth): implementation plan for delegated agent identity (d07fda2)
• fix(oauth2): correct an overclaiming comment on the client_id smuggling fix (642d072)
• fix(oauth2): repair two tests that could not fail (b1ba6be)
• fix(oauth2): close registration management review gaps (00a7570)
• feat(oauth2): add RFC 7592 registration management (0f7bb09)
• fix(oauth2): give dynamic client registration a rate limit by default (2c66397)
• feat(oauth2): add RFC 7591 dynamic client registration (d045a3e)
• feat(oauth2): add the dynamic registration policy pipeline (a5fd6b9)
• feat(oauth2): add UpdateClient to the store interface (6c7f848)
• docs: carry the pointer ruling into the plan's later task (ad250d2)
• fix(oauth2): make client secret expiry a pointer, close a second creation path (1a4b263)
• fix(oauth2): rename unused migration Down params to blank identifiers (e9875f0)
• feat(oauth2): add dynamic registration columns to the client model (c2c41c2)
• fix(extension): drop dead guard around root route registration (a76bf0c)
• feat(plugin): add RootRouteProvider for origin-root routes (3b22700)
• docs: settle four pre-flight questions in the plan (4fcc6e5)
• docs: correct the coordination note now the sibling designs exist (b62c941)
• docs: avoid a migration version clash with the 8707 design (06f1d94)
• fix(sdkgen): format the generated Go before writing it (9a9bf88)
• chore: stop tracking the superpowers working documents (8f3b347)
• docs(spec): design for first-class non-human principals (bcc9d4c)
• docs: implementation plan for OAuth 2.0 dynamic client registration (6f9d111)
• docs(specs): design for RFC 8693 token exchange (3250a40)
• docs(spec): design for RFC 9449 DPoP support (284c767)
• docs(agentauth): design for delegated agent identity (e46ba7e)
• docs(sharedsignals): design for SSF and CAEP support (28dbb0d)
• docs: resolve four issues in the dynamic registration spec (536d78c)
• docs: design for OAuth 2.0 dynamic client registration (896a4b8)
• feat(sharedsignals): SSF push endpoint with ordered validation gates (4263eff)
• fix(agentauth): fix round 1 on agent session issuance (d3699cf)
• fix(sharedsignals): scope targeted revokes by app and survive partial revocation failure (6774302)
• test(oauth2): cover DPoPMode through a real SQLite round trip (1539020)
• feat(sharedsignals): action matrix, signal recording and the blast-radius breaker (de01d68)
• fix(store/mongo): use grove NewInsert for CreateDelegation (2655d17)
• feat(agentauth): issue agent sessions through the hook path (38cb932)
• fix(sharedsignals): scope subject resolution by environment and verify session ownership (6400b91)
• feat(oauth2): per-client DPoP mode (d095443)
• test(dpop): strengthen NilReceiverFailsClosed to actually exercise the guards (d7d5053)
• fix(agentauth): verify grant belongs to session principal, fail closed on inconsistent session (ee0ef65)
• feat(store/mongo): add delegation grants and principal fields (dce0c80)
• feat(sharedsignals): record IdP subject links on SSO sign-in (11ef02c)
• feat(sharedsignals): subject identifier resolution with domain and verification gating (39bbec9)
• fix(dpop): make NonceSigner fail closed on a nil receiver (9b4ff21)
• feat(sharedsignals): plugin lifecycle, config and settings (b3a12b8)
• feat(agentauth): enforce intersection of granted scope and owner permission (7a80030)
• feat(engine): construct the DPoP validator, nonce signer and mode resolution (031dadb)
• fix(store): align delegation and principal expiry boundary with domain IsActive (da9ec30)
• fix(sharedsignals): make subject-link upsert concurrency-safe and normalise empty lists (c585702)
• fix(agentauth): floor clampTTL's base before folding, and stamp grants with a real org (b88141f)
• feat(tokenformat): carry the cnf confirmation claim on JWT tokens (dc0bb56)
• feat(store/sqlite): implement principal and delegation persistence (71461a0)
• fix(agentauth): consult both governing orgs, deny unrecognized policy modes, and re-check invariants in CreateGrant (73d4b3f)
• feat(session): persist the DPoP confirmation thumbprint (423c26c)
• feat(sharedsignals): mongo store and collection migrations (0b87403)
• fix(store/postgres): reviewer round 1 fixes for principal/delegation store (bbaa196)
• feat(sharedsignals): postgres and sqlite stores with a conformance suite (9eb9213)
• test(middleware): prove a machine credential reaches a guarded route (7ca474f)
• test(dpop): pin the full 3x3 MaxMode combination table (0ca5cad)
• fix(sharedsignals): fail loudly on corrupt required IDs and round-trip every field (e2cf459)
• feat(dpop): modes with monotonic resolution and dynamic settings (728a7e4)
• fix(middleware): refuse malformed JWT claim ids instead of panicking (6d1d3cf)
• feat(store/mongo): persist the session actor chain (53573f9)
• feat(agentauth): add consent evaluation, ttl clamp and grant creation (467a8dd)
• fix(auth): make the session-roles branch build and ship its SDKs (#58) (9bd1cfd)
• test(dpop): pin NeedsRefresh half-TTL boundary with a real clock (2eeaafa)
• feat(store/postgres): implement principal and delegation persistence (e7dbe95)
• fix(middleware): gate RequireAuth on the principal and not the user (27804f7)
• feat(sharedsignals): grove models and migrations for pg, sqlite and mongo (ea8f6b0)
• fix(store): bound the mongo migration lock wait, correct two stale postgres tests (1fda980)
• feat(dpop): stateless reusable server nonces (6d92c5e)
• fix(oauth2provider): gate the device-authorization consent moment too (d916546)
• fix(sdkgen): fail on a $ref that resolves to nothing (d15186b)
• test(sharedsignals): make the clone-isolation test fail without the deep copy (66474ad)
• test(dpop): pin nonce fail-closed path, ath RFC vector, and positive jkt match (24f578b)
• docs(agentauth): govern consent by the agent's own org, not just the session's (1fa9877)
• build(deps): bump forge to v1.9.11 (2ebc60c)
• fix(authprovider): authenticate sessions whose principal is not a person (9555b43)
• fix(store): scope the sqlite conformance gate to only the new cases (54852d5)
• fix(sharedsignals): deep-copy stream timestamps and scope signals by environment (e55b250)
• feat(oauth2provider): add optional consent gate hook (f0f9340)
• feat(dpop): validate proofs against method, uri, freshness and binding (9b41b52)
• fix(sdkgen): post the OAuth2 bodies as form in the TypeScript and Dart SDKs (58e0e69)
• feat(sharedsignals): store domain types and in-memory backend (6be393f)
• feat(tokenformat): carry the principal kind in access token claims (1592e04)
• docs(dpop): state the ceremony replay cache's atomicity limits plainly (ec94aa7)
• feat(plugin): shared signals ID prefixes and engine capability interfaces (381ec65)
• feat(store): add principal and delegation persistence to the memory backend (3ccc3c2)
• feat(dpop): bounded replay cache with optional ceremony backing (13d4586)
• fix(session): tighten agent principal CHECK and guard sqlite Down migration (1f208c9)
• fix(sdkgen): post the OAuth2 bodies as form, not JSON (734076a)
• fix(sharedsignals): guard JWKS dialing against internal addresses (b316288)
• docs(agentauth): match the consent gate to oauth2provider's real config idiom (40bced8)
• fix(oauth2provider): accept form-encoded token requests (e137510)
• feat(dpop): parse and verify RFC 9449 proof JWTs (b87b4ae)
• feat(plugin): expose the security event store to plugins (4f65f8d)
• test(api): pin jwtToJWK KID derivation and verify determinism and uniqueness (09326b5)
• feat(session): add agent principal kind with delegating user retained (d0b0bdd)
• fix(sharedsignals): validate the JWKS URI at fetch time, injectably (e6d8bd3)
• chore: bumped forge versions (#53) (ff88a10)
• feat(tokenformat): add the RFC 8693 act claim (1081982)
• feat(config): add per-app TokenExchangeTTL (47e8b42)
• docs(plan): implementation plan for non-human principal enforcement (dfe0f7b)
• refactor(api): build JWKS entries through jwkutil (6c35d2f)
• fix(session): keep impersonated_by always-present on the wire (9e01e08)
• feat(session): record the OAuth scopes a session was issued with (099aaaf)
• feat(agentauth): add plugin skeleton with scope and store options (2d865c2)
• fix(sharedsignals): prove alg-gate ordering and fix malformed-claim error code in setjwt (957816e)
• refactor(session): derive ImpersonatedBy from an actor chain (4cca34e)
• feat(agentauth): add delegation scope registry and warden mapping (c6f5ba1)
• test(jwkutil): add deterministic coordinate-padding regression test (95d473f)
• fix(agentauth): deep-copy slices to prevent mutation of stored state (7de30f8)
• docs(token-exchange): rebase onto the non-human principals design (6de0203)
• feat(jwkutil): JWK parsing, encoding and RFC 7638 thumbprints (e9be8f7)
• feat(sharedsignals): RFC 8417 security event token validation (f467a01)
• feat(agentauth): add agent and grant domain types with memory store (2acdefb)
• fix(sdkgen): generate Dart request classes for inline bodies (bb98fbc)
• feat(principal): add delegation grants, auth attempts and context carriers (b2390be)
• feat(principal): add principal ref, chain and kind value types (a58fd3a)
• feat(id): add agent and agent grant identity types (1b0d777)
• docs(specs): design for federated workload identity (5cb2fdf)
• feat(sharedsignals): CAEP event payload parsing (1e86087)
• feat(sharedsignals): RFC 9493 subject identifier parsing (5bfab8b)
• docs(agentauth): pin migration versions clear of the sibling branches (80b3c1f)
• docs(dpop): claim distinct migration versions and note the shared tables (a2b67fd)
• chore: gitignore the subagent-driven-development workspace (a0d382a)
• fix(sdkgen): read form-encoded request bodies, and say urlencoded in the spec (8dc488a)
• docs(plan): note why sharedsignals keeps its migration version numbers (be68d9c)
• docs(sharedsignals): implementation plan for the M1 receiver (3eeffe0)
• docs(plan): claim distinct migration versions and flag the overlap (19ba035)
• docs(plan): implementation plan for non-human principals (44fae0d)
• docs: implementation plan for RFC 8707 resource indicators (6008ea3)
• docs(dpop): claim distinct migration versions and note the shared tables (68dae5a)
• docs(plans): implementation plan for RFC 8693 token exchange (55216e4)
• docs(plan): implementation plan for RFC 9449 DPoP support (ebbd36a)
• docs(agentauth): implementation plan for delegated agent identity (db9cc8c)
• docs: correct the coordination note now the sibling designs exist (04ccef5)
• docs: avoid a migration version clash with the 8707 design (a8489d8)
• fix(sdkgen): format the generated Go before writing it (0da4ecc)
• docs(spec): design for first-class non-human principals (95ef106)
• docs: implementation plan for OAuth 2.0 dynamic client registration (725cb7a)
• docs(specs): design for RFC 8693 token exchange (8b2461f)
• docs(spec): design for RFC 9449 DPoP support (461b616)
• docs(agentauth): design for delegated agent identity (c640d29)
• fix(sdkgen): read request-body fields through the $ref, and refresh the SDKs (0278951)
• fix(sdkgen): generate the publishable-key option instead of hand-adding it (f20f61a)
• docs(sharedsignals): design for SSF and CAEP support (0c3957e)
• docs: resolve four issues in the dynamic registration spec (0d31f5b)
• docs: design for OAuth 2.0 dynamic client registration (864231a)
• fix(sdkgen): keep SDK type names stable across the forge upgrade (52009a0)
• fix(api): give every route a named request and response type (a05126e)
• fix(test): unwrap the store before asserting on the backend (c606336)
• build(deps): move to forge v1.9.10 and require extensions/auth (5acdb54)
• Merge pull request #52 from xraph/multi-tenant (5ff2a4f)
• feat(sso): Implement multi-tenant SSO domain uniqueness and add connection retrieval by org (71272fa)
• fix(store/mongo): write session roles as an empty array, never null (9116564)
• feat(auth): stamp session roles and declare what routes require (ba629bd)
• fix: ran go fix (#46) (7fe532f)

---

Installation

Go:

go get github.com/xraph/authsome@v1.7.0

npm:

npm install @authsome/client@1.7.0
npm install @authsome/ui-react@1.7.0

Flutter:

dependencies:
  authsome_flutter: ^1.7.0

What's Changed

• fix: ran go fix by @juicycleff in #46
• feat(sso): Implement multi-tenant SSO domain uniqueness and add connection retrieval by org by @jaymesC in #52
• chore: bumped forge versions by @juicycleff in #53
• fix(auth): make the session-roles branch build and ship its SDKs by @juicycleff in #58
• Stop tracking the superpowers working documents by @juicycleff in #61
• build(deps): bump the minor-and-patch group across 1 directory with 8 updates by @dependabot[bot] in #57
• feat(auth): stamp session roles, and keep the SDK generator working across forge v1.9.10 by @juicycleff in #59
• ci(sdkgen): fail when the committed SDKs are stale by @juicycleff in #62
• feat(oauth2): bind tokens to the resource they were issued for (RFC 8707) by @juicycleff in #67
• Declare sqlite timestamp columns TIMESTAMP in four plugins by @juicycleff in #68
• Consolidate the three conflicting agent branches into one by @juicycleff in #71
• fix(sdkgen): repeat form fields instead of flattening arrays by @juicycleff in #72
• test(agentauth): cover the grant cache and memory store under real concurrency by @juicycleff in #73
• fix(oauth2provider): bind the device-authorize resource through the struct by @juicycleff in #75
• Let the RFC 8707 resource indicator reach the SDKs by @juicycleff in #74
• feat(oauth2provider): let clients send resource indicators to /authorize by @juicycleff in #76
• Fix/sdk form array encoding by @juicycleff in #77
• docs(oauth2): document resource indicators by @juicycleff in #81
• docs(middleware): restore the WithSession gap note lost in a branch reset by @juicycleff in #80
• Fix/oauth2 resource form binding by @juicycleff in #79
• Move to forge v1.9.13 by @juicycleff in #82
• ci(sdkgen): drop the SDK_PLUGINS argument, which nothing reads by @juicycleff in #83
• fix(plugins): stop the memory stores aliasing their records, and cover nine plugins under real concurrency by @juicycleff in #85
• feat(sharedsignals): give the JWKS cache a hard expiry and a refresh … by @juicycleff in #86
• Let an admin edit a registered OAuth2 client by @juicycleff in #84
• chore(deps): bring docs and ui dependencies current by @juicycleff in #89
• RFC 8693 token exchange grant by @juicycleff in #87
• fix(ui-react): stop reading a ref during render in AuthProvider by @juicycleff in #90
• Run plugin stores through a cross-backend conformance suite by @juicycleff in #88
• test(ui-react): give the package a test harness and cover AuthProvider by @juicycleff in #92
• test(sharedsignals): pin the receiver's three-way key status mapping by @juicycleff in #91
• fix(sharedsignals): challenge on a confirmed compromise, do not block by @juicycleff in #93
• Enforce one waitlist entry per address per app on mongo by @juicycleff in #95
• fix(ui-react): stop setting state from effects in useUser and useOrganizations by @juicycleff in #94
• Compare expiry timestamps on the same clock, and guard against the next one by @juicycleff in #96
• Clear the 13 ui-components lint findings, with tests that catch what the obvious fixes break by @juicycleff in #98
• The migration-lock test does not hang by @juicycleff in #100
• Pin three store invariants that no backend was checking by @juicycleff in #99

Full Changelog: 1.6.2...v1.7.0