nhpro/orion-auth-backend
1
0
Fork 0
Code Issues Pull requests Projects Releases 69 Packages 1 Wiki Activity Actions
69 releases 70 tags
  • v0.26.2 9ff4351ec4

    v0.26.2
    Some checks failed
    Wiki Documentation / update-wiki (push) Failing after 18s
    Details
    Tests / test (push) Failing after 18s
    Details
    Tests / tag-format (push) Successful in 3s
    Details
    / build-and-push (release) Successful in 1m11s
    Details
    Stable

    nhpro released this 2026-07-24 13:55:12 +02:00 | 0 commits to master since this release

    Security hardening from a two-pass review (vuln-class sweep + endpoint-by-endpoint audit): prompt=none takeover, request_uris SSRF, M2M privilege escalation to admin, admin read/write authz split, federation login CSRF, password-reset session revocation, client-assertion replay, per-client response_type, single-use step-up reauth, login enumeration, and user-deletion guards. See CHANGELOG.

    Downloads
  • v0.26.1 02d62a4cb1

    v0.26.1
    Some checks failed
    Wiki Documentation / update-wiki (push) Failing after 3s
    Details
    Tests / test (push) Failing after 4s
    Details
    Tests / tag-format (push) Successful in 2s
    Details
    / build-and-push (release) Successful in 48s
    Details
    Stable

    nhpro released this 2026-07-23 19:56:11 +02:00 | 9 commits to master since this release

    Fixes: single verification email on OAuth signup (was sending two, one with an invalid link that dropped audience/PKCE on click); Logto import falls back to username for empty display_name.

    Downloads
  • v0.26.0 9948f1392c

    v0.26.0
    Some checks failed
    Wiki Documentation / update-wiki (push) Failing after 18s
    Details
    Tests / test (push) Failing after 18s
    Details
    Tests / tag-format (push) Has been skipped
    Details
    / build-and-push (release) Successful in 59s
    Details
    Stable

    nhpro released this 2026-07-23 11:26:05 +02:00 | 12 commits to master since this release

    IAM migration: import users, social identities and roles from Logto (Postgres source) via new 'orion-auth import logto' CLI. Multi-scheme password verification with transparent lazy rehash to argon2id — no forced reset for verifiable hashes. See MIGRATION.md.

    Downloads
  • v0.25.2 8711beae26

    v0.25.2
    Some checks failed
    Wiki Documentation / update-wiki (push) Failing after 15s
    Details
    Tests / test (push) Failing after 16s
    Details
    Tests / tag-format (push) Successful in 4s
    Details
    / build-and-push (release) Successful in 51s
    Details
    Stable

    nhpro released this 2026-07-06 20:41:34 +02:00 | 17 commits to master since this release

    Dependency update.

    Within-major bumps: go-oidc v3.19.0, jwx v3.1.1, opa v1.18.2, goose v3.27.2, go-mail v0.8.0, x/crypto v0.53.0, gorm v1.31.2, go-webauthn v0.17.4. Build, vet and tests pass.

    See CHANGELOG.md.

    Downloads
  • v0.25.1 f477a797fe

    v0.25.1
    Some checks failed
    Tests / test (push) Failing after 16s
    Details
    Tests / tag-format (push) Has been skipped
    Details
    Wiki Documentation / update-wiki (push) Failing after 15s
    Details
    / build-and-push (release) Successful in 1m13s
    Details
    Stable

    nhpro released this 2026-07-01 11:52:59 +02:00 | 19 commits to master since this release

    Fix admin email verification.

    • fix(seed): bootstrap admin (admin@orionauth.local) is now marked email_verified so the login gate no longer locks the operator out when email verification is enabled.
    • fix(migrations): migration 054 marks every user holding the admin role as email_verified, unlocking admins provisioned before this fix. Down is a no-op.

    See CHANGELOG.md for details.

    Downloads
  • v0.25.0 9722977374

    v0.25.0
    Some checks failed
    Wiki Documentation / update-wiki (push) Failing after 2s
    Details
    / build-and-push (release) Successful in 1m16s
    Details
    Tests / tag-format (push) Successful in 1s
    Details
    Tests / test (push) Failing after 2s
    Details
    Stable

    nhpro released this 2026-06-26 12:34:28 +02:00 | 22 commits to master since this release

    [v0.25.0] — 2026-06-26

    Added

    • Silent SSO via an IdP session cookie. /authorize now issues an
      HttpOnly, SameSite=Lax orionauth_sid cookie when a session is created and
      reads it back on the next authorization request: an already-authenticated
      user is silently re-authorized across services without re-entering
      credentials. prompt=login still forces re-auth, max_age is honoured, and
      the consent rules are unchanged (first-party auto-consents; third-party still
      shows the consent screen, now without a login step). Cleared on
      /end_session.
    • sessions.cookie_token_hash / sessions.extended (migration 053). The
      cookie carries an opaque 32-byte secret; only its SHA-256 is stored, so the
      cookie stays revocable and unrecoverable. extended records the remember_me
      choice so a silent re-auth inherits the persistent-cookie behaviour.
    • session.Service.FindByCookieToken + Repository.FindActiveByCookieHash
      — resolve a raw cookie to its live (non-revoked, non-expired) session.

    Changed

    • remember_me now drives cookie persistence: a remembered session gets a
      persistent orionauth_sid cookie sized to the session lifetime; otherwise a
      browser-session cookie that dies when the browser closes. Session TTL
      resolution (SessionExtendedTTL) is unchanged.
    Downloads
  • v0.24.0 725ef4bd74

    v0.24.0
    All checks were successful
    Wiki Documentation / update-wiki (push) Successful in 17s
    Details
    / build-and-push (release) Successful in 1m29s
    Details
    Tests / test (push) Successful in 1m53s
    Details
    Tests / tag-format (push) Successful in 5s
    Details
    Stable

    nhpro released this 2026-06-06 12:29:33 +02:00 | 29 commits to master since this release

    First release under the new SemVer-by-content versioning policy. See VERSIONING.md for the rules and CHANGELOG.md for the full diff.

    Highlights since the previous tag

    • Atomicity — 9 transactional flows now run inside a single db.Transaction: user.Register, RegisterAdmin, CreateFromFederation, SendVerificationEmail, invitation.Create, account.RequestEmailChange, ConfirmEmailChange, ForgotPassword + AdminTriggerPasswordReset, RequestDeletion. Side-effect failures (role assignment, session revoke, email enqueue) roll back the whole flow instead of being swallowed with slog.Warn.
    • Clock injection — pkg/clock with Real + Fake; threaded through user, oauth, oidc, session, outbox. Lockout windows, signing-key rotation, and token TTLs are now deterministically testable.
    • Middleware decoupling — ClientAuth, BearerAuth, RequireClientScope consume narrow interfaces (ClientFinder, TokenLookup, SessionValidator) instead of *gorm.DB. Unit-testable without a database.
    • Outbox observability — orionauth_outbound_email_queue_depth (Gauge) + orionauth_outbound_email_delivered_total (CounterVec by outcome). OutboxWorker.Stop(ctx) drains the in-flight tick before exit so SIGTERM during an SMTP send no longer risks double-delivery at next boot.
    • Versioning hygiene — 63 legacy tags (-hf*, -pre*, -b*, -pr* typo) remapped to stable vX.Y.Z by scripts/remap-tags.sh. CI tag-format gate prevents the suffix soup from coming back.
    Downloads
  • v0.23.3 f92490129f

    v0.23.3
    All checks were successful
    Wiki Documentation / update-wiki (push) Successful in 20s
    Details
    Tests / test (push) Successful in 1m11s
    Details
    / build-and-push (release) Successful in 1m1s
    Details
    Stable

    nhpro released this 2026-06-05 14:43:18 +02:00 | 64 commits to master since this release

    Remap from 0.2.8-b2.

    Commit: f924901

    Downloads
  • v0.23.2 1bd722dec5

    v0.23.2
    All checks were successful
    Wiki Documentation / update-wiki (push) Successful in 20s
    Details
    Tests / test (push) Successful in 1m11s
    Details
    / build-and-push (release) Successful in 1m35s
    Details
    Stable

    nhpro released this 2026-06-05 11:51:28 +02:00 | 75 commits to master since this release

    Remap from 0.2.8-b1.

    Commit: 1bd722d

    Downloads
  • v0.23.1 08518db4a2

    v0.23.1
    All checks were successful
    Wiki Documentation / update-wiki (push) Successful in 21s
    Details
    Tests / test (push) Successful in 1m17s
    Details
    / build-and-push (release) Successful in 2m14s
    Details
    Stable

    nhpro released this 2026-06-03 16:25:33 +02:00 | 89 commits to master since this release

    Remap from 0.2.7-pre11.

    Commit: 08518db

    Downloads