Changelog
Release notes for go-auth, newest first.
Admin two-factor auth, account lockout, peer comparison, OAuth PKCE, configurable hasher, and password pepper rotation.
One identity endpoint instead of two, a session and its user resolved in a single query, correct client IPs behind a proxy, and the cookie settings a frontend on another host actually needs.
RemoteAuth — authenticate a second Go service against a go-auth server it shares no database with — plus an admin view of any user's organizations, and role filters that reject a bad value instead of silently returning everything.
Row counts split into dedicated /count endpoints, admin-console read-path indexes, trigram search for users and invites, derived invite expiry, admin-only invite service, and bulk invite actions.
Platform-admin org oversight, cross-user session admin, stats endpoints, and reworked audit-log filtering.
First tagged release — email/password and OAuth, two-token sessions, organizations, the admin API, and CI with govulncheck.