v1.8.1

Changes

• feat!: trace and measure authsome on forge v1.12.9 and grove v1.8.0 (#137) (dd8b8d5)
• docs: quote frontmatter descriptions that contain a colon (768578b)
• docs: point the UI card at the UI overview (e25e80d)
• docs: make the docs match the code (700ffaf)
• docs: rewrite the README and add a banner (4c54de4)
• fix: clear a deleted organization from its members' sessions (b3fd5f9)
• fix(ui): read the paged organization list in useOrganizations (929858b)
• fix: never return a nil auth middleware (6ca28bc)
• fix: clear the organization from a removed member's sessions (1f2c819)
• fix: only the invited account may accept an invitation (8126ef8)
• feat: expire organization invitations after a week by default (1094554)
• fix: give every hook event an audit category (a2fca32)
• fix: answer 409 when an organization slug is taken (133c883)
• fix: write each organization response once (e371f40)
• chore: bumped forge (f1acbe4)
• Merge pull request #126 from xraph/fix/setup-verification-required (c42b29b)
• fix(auth): align autoconfig form transitions across SDKs (429984f)
• fix(auth): check waitlist approval before signup details (cd8bfd5)
• fix(postgres): persist service account API key ownership (7b694db)
• fix(ui): refresh sessions with malformed expiry (b3bed15)
• fix(ui): bound refresh waits for long sessions (5626dd9)
• fix(ui): align MFA adapters with authentication contracts (383ead1)
• fix(storybook): preserve full journey card widths (e15852d)
• docs(security): record dependency and artifact qualification (403f7f3)
• fix(storybook): align fixtures and restore build compatibility (d07bb28)
• fix(sdk): build the advertised CommonJS and ES module entries (39be0ea)
• fix(docs): clear formatting and preview lint errors (5f261be)
• fix(deps): patch docs and SDK test dependencies (556a172)
• chore(deps): remove obsolete Forge auth checksums (6fd2b22)
• fix(auth): preserve explicit frame credential provenance (0e17861)
• fix(apikey): refuse unresolved service account principals (c865bd5)
• feat(setup): say when the new owner still has to verify (4f2d5ba)
• Publish verified session credential provenance (458d1ce)
• Merge pull request #120 from xraph/feat/contract-catalog-session-refresh (8b84fbc)
• Merge origin/main into feat/contract-catalog-session-refresh (ca280fd)
• Merge pull request #124 from xraph/dashboard-contract-cutover (4d0443e)
• build(deps): x/net 0.60.0 and the OpenTelemetry trace exporters at 1.45.0 (4c70373)
• chore(lint): clear the remaining golangci findings in the plugin contracts (74bbae8)
• Merge pull request #112 from xraph/fix/testcontainers-reaper (f1cf7b9)
• build(deps): Go 1.26.9 and x/net 0.60.0 (baba528)
• fix(oauth2): keep resource where the generated clients expect it (1e93e81)
• fix(ui): rebuild the post-auth redirect on the page's own origin (c16c65d)
• build(ui): patch the packages pnpm audit flags (f04d474)
• ci(security): run gitleaks as the CLI (041bc2d)
• fix: fixed sec and go work issues (743fea5)
• ci: update the go work (129e6cb)
• test(api): hash passwords at bcrypt's cheapest cost (be99e08)
• fix(security): clear the two findings the required gosec check fails on (83caaf7)
• chore(sdk): regenerate the spec and every client (4944452)
• Merge remote-tracking branch 'origin/main' into dashboard-contract-cutover (7ef4003)
• feat(flutter): the UI kit follows the client config (e2a4799)
• feat(ui): sign-in reads SSO, magic links and branding from the client config (2e5d0c2)
• fix(rbac): every role call by ID names the app that owns it (5aa2c78)
• refactor(dashboard): retire the templ dashboard (a6a9c9f)
• ci(flutter): give the example its .env before analyze (fb47c3c)
• fix(store/memory): hand webhooks back as copies (6215ab3)
• build: keep local paths out of the tracked go.work (c6199b1)
• Merge pull request #122 from xraph/fix/org-role-rank-checks (f783b5b)
• fix(api): resolve a role's parent in its own namespace (ee4ba35)
• fix(api): refuse a parent_id when creating a role (f4ef6c1)
• fix(api): make the role assignment ceiling see what a role grants (6384f3f)
• docs(sdkgen): say the role update refuses a parent_id change (b481fe4)
• fix(api): refuse a parent_id change when updating a role (25bcad9)
• fix(rbac): keep warden-only role fields when authsome updates a role (5fc60e2)
• Merge remote-tracking branch 'origin/main' into fix/org-role-rank-checks (85ae5a5)
• Merge pull request #123 from xraph/fix/otel-go-2026-6505 (b461d32)
• chore(deps): bump OpenTelemetry to v1.46.0 for GO-2026-6505 (c566c33)
• fix(organization): don't shadow err in the rank checks (59f3177)
• fix(organization): stop admins granting or removing roles above their own (9c41cad)
• Fix passkey spacing when the authenticator is unavailable (a94aa58)
• refactor(extension): register the dashboard contributor as authsome (fc3ba03)
• build: track go.work with the go1.26.6 toolchain (53eb6d0)
• docs(security): the three stale pages describe the code that exists; a test keeps them honest (635b4cb)
• chore: no environment files in git (0a8bdbe)
• ci: actions pinned to commits, least-privilege jobs, dependency review, gitleaks, pnpm audit; security policy and code owners (1c0f0bc)
• build: pinned toolchain, govulncheck in check and CI, stricter gosec, trusted-proxy warning (0d173eb)
• fix(security): sandboxed template preview; introspection gated and minimal (273fa79)
• fix(logs): emails and phones are masked (d7270a7)
• fix(api): a generic 500 with a request id, never the cause (ea2ae53)
• fix(security): cookie sessions refuse cross-site writes; cookie attributes come from the deployment (601b9bc)
• fix(engine): atomic start flag, Stop waits for background work, auto-refresh keeps the hidden refresh token (7790220)
• feat(metrics): forge adapter, route metrics, and counters at the control points (dff9570)
• perf(bridge): every outbound call has a deadline; welcome mail goes through the dispatcher (67af2da)
• perf(store,api): paged lists with limit and cursor; roles loaded in one call (4273f49)
• perf(apikey,session): touch last-use once a minute; enforce the session cap (3ab4862)
• perf(middleware): resolvers carry the request context; one user load per request (0542e03)
• perf(settings): cache resolved rows for 30 seconds, dropped on change (a88b3b6)
• docs(webhooks,retention): describe relay endpoints, once-shown secrets, erasure and retention (b9f9cc8)
• feat(api): webhook secrets shown once, rotate route, 501 without relay (a07fc3b)
• feat(webhooks): webhooks are relay endpoints with a once-shown, rotatable secret (a7290f6)
• feat(webhook): rows carry the relay endpoint id and a secret hash, never the secret (0a8f114)
• feat(bridge): endpoint management on the relay bridge (ae0e3b3)
• feat(safeurl): outbound URL validation and a pinned, redirect-free client (78c83dc)
• fix(plugins): bound the in-memory maps and event slices (faef529)
• feat(retention): a leased sweeper deletes expired rows in batches (667d736)
• feat(retention): batched expired-row deletion on every store (8d5a0e6)
• feat(erasure): every plugin forgets a deleted user; admin deletion anonymises (16ce0cb)
• feat(scim): database-backed stores and indexed token lookup (18dbbd3)
• feat(oauth2): client-bound sessions, scope gate, refresh grant (da39027)
• feat(oauth2): persisted grants and a consent page (9b7ce1f)
• fix(social): scope provider identities to the app and honour Apple email_verified (9f682dc)
• feat(social,sso): bind browser flows to a __Host- state cookie (dcd154c)
• feat(sso): nonce and PKCE on the OIDC client, discovery through the hardened fetcher (760a124)
• feat(sso): bind identities by subject and confine logins to the connection's domains (3170c9c)
• fix(password): twelve-character minimum by default (bbbe512)
• feat(crypto): count secrets read back without an envelope (ed0ce7f)
• feat(crypto): token encryption fails closed, rotates by key id, and API keys take a pepper (8fcf4b2)
• feat(oauth2,sso): hash authorization codes, hand the SSO session over by id (82aaf98)
• feat(store): convert plaintext credential rows at start (feca354)
• feat(store): store verification, reset and invitation tokens as hashes (d68468a)
• feat(store): store session and refresh tokens as hashes (4e0f7eb)
• fix(store): mongo kv validator requires the field the document stores (7b6b0ed)
• fix(auth): sign-in does not disclose which identifiers exist (eb12b70)
• fix(lockout): key by network, answer 423, add admin unlock (65758ca)
• fix(abuse): limit sign-in and code delivery per identifier (6e0e16d)
• fix(abuse): limit every credential-bearing route (91b5ca3)
• chore(recovery): restore pieces lost when the tree was rebuilt (b217e09)
• feat(abuse): shared-state wiring, limits on by default, fail closed (c936919)
• feat(abuse): rate limiter, lockout and ceremonies on shared KV (9dfb1d0)
• feat(store): shared KV contract on every backend (0e1db2c)
• fix(mfa,passkey): enrolment requires step-up (a5b4425)
• fix(session): enforce an absolute session lifetime (33d5b02)
• fix(rbac): role changes re-stamp live sessions and /v1/me reads live roles (6e1fb54)
• fix(session): JWTs are checked against the store by default (6f6ecf7)
• fix(access): bans, deactivations and credential changes revoke live sessions (1ec148f)
• fix(access): refuse banned users on every credential path (b02b5f5)
• fix(sso,scim): assert tenant scope on every loaded row (80de63b)
• fix(bootstrap): one platform owner, promoted on email verification (e0286f4)
• fix(rbac): bound grants by the caller's own permissions (b172176)
• fix(admin): scope every admin surface to the caller's tenant (910b47d)
• fix(tenancy): the credential decides the tenant, not the publishable key (e1a99c3)
• test(hook): guard action naming and drop the unused audit wrappers (b8521a0)
• refactor(audit): remove the in-memory security-event store and its API (21de7ed)
• refactor(plugins): record audit events through the hook bus (7ac9ac2)
• feat(audit): one record per action, no credentials or addresses in metadata (df483a2)
• feat(engine): require a Chronicle audit trail and drop the slog fallback (5d7b54c)
• feat(engine): record every hook event on the audit trail through one subscriber (05848c2)
• feat(middleware): attach request correlation info to every request (1709018)
• feat(bridge): carry request correlation to Chronicle and add a memory recorder (f6ebd0d)
• feat(hook): carry audit shape and request correlation on events (75d848b)
• chore(deps): require chronicle v1.7.0 for request correlation fields (bcf2678)
• chore(lint): clear the golangci findings on the contract catalog and setup handler (b797122)
• feat(contract): configure the platform during setup (ff445f0)
• feat(contract): load remote contract catalogs and harden SDK session refresh (6e1de57)
• feat(contract): return first-run setup defaults (1cc6f99)
• feat(dashboard): add Authsome contracts and upgrade Forge to v1.11.1 (af64d07)
• Merge remote-tracking branch 'origin/main' (343e454)
• fix(ui): keep the base URL's path prefix on the client-config request (a6b3778)
• ci: disable the testcontainers reaper on the conformance job (21379e3)
• Merge pull request #110 from xraph/chore/example-new-logger-api (a5f4584)
• Merge branch 'main' into chore/example-new-logger-api (853fa33)
• Merge pull request #111 from xraph/fix/client-refresh-lint (769c94b)
• chore(lint): clear the lint findings from the client refresh change (7d9798c)
• chore(example): use the current logger API in the standalone example (fa1e28a)
• Merge pull request #109 from xraph/fix/retention-lint (23a47de)
• chore: bumped forge deps (2ceff13)
• fix: fixed the client refresh (c472f0b)
• fix(retention): clear the lint findings in the retention plugin (f638995)
• Merge pull request #107 from xraph/chore/guard-private-paths (49c6026)
• chore(ci): stop private paths reaching a tagged release (cc11324)
• Merge pull request #105 from xraph/worktree-retention-crm (83ca86a)
• chore(retention): keep the spec and plan out of the branch (718ceb6)
• Merge pull request #106 from xraph/fix/store-updatedat-writeback (06221d1)
• test(store): cover Update* write-back across every fixed backend (be91142)
• fix(store): write UpdatedAt back onto the caller in Update* methods (4c2bd9d)
• fix(retention): correct the Mongo TTL index comment (27d0981)
• fix(retention): stop a late RegisterProvider from dead-lettering jobs (c45422a)
• fix(retention): index the outbox purge query (662e55d)
• fix(retention): stop a redelivered activity duplicating in the CRM (bef2388)
• feat(retention): prune the outbox, and say what pruning costs (35d33bf)
• feat(retention): raise the default retry budget to 12 attempts (8807021)
• fix(retention): stop the worker reading a map another goroutine can write (bf841b2)
• fix(store): write UpdateUser's timestamp back onto the caller (76e5e6e)
• fix(retention): stop a malformed HubSpot search response from creating a duplicate contact (b7b7b84)
• feat(retention): add the HubSpot reference provider (a02bfbd)
• feat(retention): decide and implement the generic provider's retry policy (a0aeb20)
• docs(retention): decide the retry classification policy (2a7dee4)
• test(retention): cover the env_id axis, and correct a comment that lied (55b4da1)
• fix(retention): classify delivery failures by where they came from (903046f)
• fix(retention): stop one bad outbox row from stalling its whole batch (3df5030)
• fix(retention): bind UTC on every sqlite timestamp compare and write (78e7713)
• docs(retention): bind UTC in the sqlite claim comparison (c5c8536)
• feat(retention): export CRM refs and register the plugin (5d15edf)
• feat(retention): add the config-driven generic CRM provider (47bd044)
• fix(retention): cover the consentPolicy closure with a real settings manager (3aed1dc)
• feat(retention): gate CRM delivery on consent at send time (9723176)
• fix(retention): stop hashing a clock read into the idempotency key (8c71229)
• docs(retention): stop hashing the clock into the idempotency key (4d9ca80)
• fix(retention): drop sign-out tracking per spec amendment 888b7aa (bbc1582)
• docs(retention): drop sign-out tracking, it cannot be built (888b7aa)
• feat(retention): enqueue CRM work from the auth hooks (6ed4c6e)
• docs(retention): resolve the consent gate per app, not once at startup (36fbb91)
• feat(retention): add plugin lifecycle, settings and store selection (2857261)
• fix(retention): suppress, don't dead-letter, a CapContacts gap (7a89dd6)
• docs(retention): make the two capability gates agree (0cd49b0)
• feat(retention): add the outbox delivery worker (cb89be1)
• fix(retention): correct the $gt/$ne equivalence claim in the mongo index comment (81c6bc2)
• feat(retention): add postgres and mongo outbox stores (ab8f607)
• fix(retention): make ClaimDue's per-row update atomic under concurrent claims (085ff99)
• docs(retention): fix the sqlite claim the plan specified wrong (5cc4358)
• feat(retention): add migrations and the sqlite outbox store (0d90d02)
• feat(retention): add the outbox store interface and memory backend (80c6a67)
• feat(retention): add the CRM provider contract (cdd4c8f)
• docs(retention): fix three forward references in the plan (94f1a31)
• docs(retention): implementation plan for CRM delivery (e3efe78)
• docs(retention): pick HubSpot as the reference provider (4ec9c53)
• docs(retention): design CRM delivery for auth events (2f4b77b)

---

Installation

Go:

go get github.com/xraph/authsome@v1.8.1

npm:

npm install @authsome/client@1.8.1
npm install @authsome/ui-react@1.8.1

Flutter:

dependencies:
  authsome_flutter: ^1.8.1

What's Changed

• fix(store): write UpdatedAt back onto the caller in Update* methods by @juicycleff in #106
• feat(retention): mirror signup and login activity into any CRM by @juicycleff in #105
• chore(ci): stop private paths reaching a tagged release by @juicycleff in #107
• fix(retention): clear the lint findings in the retention plugin by @juicycleff in #109
• chore(lint): clear the lint findings from the client refresh change by @juicycleff in #111
• chore(example): use the current logger API in the standalone example by @juicycleff in #110
• chore(deps): bump OpenTelemetry to v1.46.0 (GO-2026-6505) by @jaymesC in #123
• fix(organization): stop admins granting or removing roles above their own by @jaymesC in #122
• ci: disable the testcontainers reaper on the conformance job by @juicycleff in #112
• SOC 2 hardening, the React-only dashboard, and app-scoped RBAC by @juicycleff in #124
• Remote contract catalogs, first-run platform setup, and SDK session refresh hardening by @juicycleff in #120
• feat(setup): say when the new owner still has to verify by @juicycleff in #126
• feat!: trace and measure authsome on forge v1.12.9 and grove v1.8.0 by @juicycleff in #137

Full Changelog: v1.7.2...v1.8.1