Changelog
Release notes for go-auth, newest first.
Optional Redis integration: SQL-authoritative session and token snapshots, distributed rate limits, shared 2FA counters, and schema revision 5.
Password-work limits, email-address changes, credential and authorization fixes, dependency updates, and client-security guidance.
Startup readiness, truthful password policy, safe application routes, explicit authentication steps, and complete onboarding.
Separate authentication and signup policy, verification for existing sessions, OAuth invitations, and consistent email 2FA.
Mandatory signed double-submit CSRF, unified browser configuration, and independent app/admin sessions on one backend.
Organization-local roles and permissions, mandatory schema revision 2, and the owner-initialization rollout.
Standalone auth migrations with immutable history, verified adoption and recovery, schema exports, and maintainer authoring tools.
Opt-in app roles and permissions, explicit delegation, permission-aware clients, and consistent Go and HTTP contracts.
Password hashing hardening, transactional authentication, durable audit delivery, queued recovery, and SQLite, PostgreSQL, and MySQL parity.
Admin two-factor auth, account lockout, peer comparison, OAuth PKCE, configurable hasher, and password pepper rotation.
One identity endpoint instead of two, a session and its user resolved in a single query, correct client IPs behind a proxy, and the cookie settings a frontend on another host actually needs.
RemoteAuth — authenticate a second Go service against a go-auth server it shares no database with — plus an admin view of any user's organizations, and role filters that reject a bad value instead of silently returning everything.
Row counts split into dedicated /count endpoints, admin-console read-path indexes, trigram search for users and invites, derived invite expiry, admin-only invite service, and bulk invite actions.
Platform-admin org oversight, cross-user session admin, stats endpoints, and reworked audit-log filtering.
First tagged release — email/password and OAuth, two-token sessions, organizations, the admin API, and CI with govulncheck.