[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@seamless-auth/core@0.24.0

Minor Changes

• bdf2160: Passthrough routes come from the auth API's adapter manifest, and guard and not-found responses match the Go, Python and Rust adapters.

  Breaking response changes:

  • requireAuth answers 401 {"error":"unauthenticated"} for a missing, invalid or expired session and for an ephemeral token. It used to answer "Failed to find authentication token required" or "Invalid or expired session".
  • requireRole answers 403 {"error":"insufficient_role"} when no listed role is granted, including for a user with no roles. The body no longer carries required and actual, so a client never sees the user's roles. A request no guard authenticated gets 401 {"error":"unauthenticated"}.
  • In Express, a path under the auth router that no route and no manifest entry matches answers 404 {"error":"not_found"} instead of calling next(). Fastify and Next.js already did.
  • POST /users/update is no longer served. The auth API has no such route, so it only ever answered the API's 404.

  The static passthrough tables are gone. Organizations, step-up, TOTP, credentials, OAuth provider configuration, admin organizations, enrollment, review accounts, the auth event export and integrity check, and the coverage report are served from the manifest, like any other route the adapter has no handler for. In cookie transport their bodies no longer carry token or refreshToken. A dot segment in one of their path parameters answers 404 not_found rather than 400 bad_request, and no upstream call is made either way. A recovery session that enrolls an authenticator app is still rotated right away.

  OTP verification, magic link polling and verification, and organization switching also drop tokens from a cookie-transport body when the auth API's answer is not a complete session.

  setSeamlessLogger and the SeamlessLogger type are exported from @seamless-auth/express, @seamless-auth/fastify and @seamless-auth/nextjs, and every warning and error those packages log goes through it.

• 82687e6: Next.js: add requireAuth(handler, options) and requireRole(roles, handler, options) to guard App Router route handlers. They accept the access cookie or the auth API's access token in Authorization: Bearer, verify the token against the auth API's key set (so roles come from a token the API signed), refuse recovery sessions unless allowRecoverySession is set, apply the origin check to cookie requests, and never refresh. Refusals answer 401 {"error":"unauthenticated"}, 403 {"error":"enrollment_required"}, 403 {"error":"cross_site_request_blocked"} or 403 {"error":"insufficient_role"}, without naming any roles. The user handed to the route carries organizationId from the token's org_id. A role guard with no roles throws at setup.

  Next.js: add a trustedProxies option (addresses or CIDR ranges) that reads the client IP from X-Forwarded-For, walking from the right past your proxies, when resolveClientIp is not given. Nothing is forwarded when neither is set, as before, but the handler now logs one warning at startup saying so. getSeamlessSession takes the request headers with trustedProxies or resolveClientIp and forwards the client IP, and reads the user agent from them when userAgent is not given.

  Core: authenticateBearer and authenticateRequest (with bearer verification on) set organizationId on the user from the verified access token's org_id. The new GuardUser type describes it.

• 3096144: Calls to the auth API now behave the same as in the Go, Python and Rust adapters.

  • OTP generation and magic link requests use POST. The GET routes they called are deprecated in the auth API and missing from its adapter manifest.
  • Every call times out after 15 seconds (timeoutMs on authFetch). An auth API that cannot be reached or does not answer in time gets 502 {"error":"upstream_unavailable"} instead of a hung request or 500 internal_error.
  • The key set is fetched from authServerUrl with its path kept, so an auth API mounted under a prefix such as https://example.com/auth-api is verified against its own keys.
  • /registration/register verifies the registration token (issuer, audience, typ ephemeral, and a sub matching the body) before it sets the registration cookie or returns the token to a bearer client, and answers 502 {"error":"invalid_upstream_session"} when it fails.

  Breaking for code that calls registerHandler from @seamless-auth/core directly: RegisterOptions now requires audience and accepts authServerIssuer, like LoginOptions. The express, fastify and nextjs adapters pass both already.

Patch Changes

• 241a207: verifyRefreshCookie accepts only a refresh cookie: a signed payload with a non-empty sub and refreshToken and no upstream token. Every adapter cookie is signed with the same secret, so before this a pre-auth, registration or access cookie placed in the refresh cookie slot verified too, and hasSeamlessSession in @seamless-auth/nextjs reported a session for it. Refresh cookies issued by earlier versions already have this shape and keep working.

@seamless-auth/express@0.24.0

Minor Changes

• bdf2160: Passthrough routes come from the auth API's adapter manifest, and guard and not-found responses match the Go, Python and Rust adapters.

  Breaking response changes:

  • requireAuth answers 401 {"error":"unauthenticated"} for a missing, invalid or expired session and for an ephemeral token. It used to answer "Failed to find authentication token required" or "Invalid or expired session".
  • requireRole answers 403 {"error":"insufficient_role"} when no listed role is granted, including for a user with no roles. The body no longer carries required and actual, so a client never sees the user's roles. A request no guard authenticated gets 401 {"error":"unauthenticated"}.
  • In Express, a path under the auth router that no route and no manifest entry matches answers 404 {"error":"not_found"} instead of calling next(). Fastify and Next.js already did.
  • POST /users/update is no longer served. The auth API has no such route, so it only ever answered the API's 404.

  The static passthrough tables are gone. Organizations, step-up, TOTP, credentials, OAuth provider configuration, admin organizations, enrollment, review accounts, the auth event export and integrity check, and the coverage report are served from the manifest, like any other route the adapter has no handler for. In cookie transport their bodies no longer carry token or refreshToken. A dot segment in one of their path parameters answers 404 not_found rather than 400 bad_request, and no upstream call is made either way. A recovery session that enrolls an authenticator app is still rotated right away.

  OTP verification, magic link polling and verification, and organization switching also drop tokens from a cookie-transport body when the auth API's answer is not a complete session.

  setSeamlessLogger and the SeamlessLogger type are exported from @seamless-auth/express, @seamless-auth/fastify and @seamless-auth/nextjs, and every warning and error those packages log goes through it.

Patch Changes

• 3096144: Calls to the auth API now behave the same as in the Go, Python and Rust adapters.

  • OTP generation and magic link requests use POST. The GET routes they called are deprecated in the auth API and missing from its adapter manifest.
  • Every call times out after 15 seconds (timeoutMs on authFetch). An auth API that cannot be reached or does not answer in time gets 502 {"error":"upstream_unavailable"} instead of a hung request or 500 internal_error.
  • The key set is fetched from authServerUrl with its path kept, so an auth API mounted under a prefix such as https://example.com/auth-api is verified against its own keys.
  • /registration/register verifies the registration token (issuer, audience, typ ephemeral, and a sub matching the body) before it sets the registration cookie or returns the token to a bearer client, and answers 502 {"error":"invalid_upstream_session"} when it fails.

  Breaking for code that calls registerHandler from @seamless-auth/core directly: RegisterOptions now requires audience and accepts authServerIssuer, like LoginOptions. The express, fastify and nextjs adapters pass both already.

• Updated dependencies [bdf2160]

• Updated dependencies [82687e6]

• Updated dependencies [241a207]

• Updated dependencies [3096144]

  • @seamless-auth/core@0.24.0

@seamless-auth/fastify@0.15.0

Minor Changes

• bdf2160: Passthrough routes come from the auth API's adapter manifest, and guard and not-found responses match the Go, Python and Rust adapters.

  Breaking response changes:

  • requireAuth answers 401 {"error":"unauthenticated"} for a missing, invalid or expired session and for an ephemeral token. It used to answer "Failed to find authentication token required" or "Invalid or expired session".
  • requireRole answers 403 {"error":"insufficient_role"} when no listed role is granted, including for a user with no roles. The body no longer carries required and actual, so a client never sees the user's roles. A request no guard authenticated gets 401 {"error":"unauthenticated"}.
  • In Express, a path under the auth router that no route and no manifest entry matches answers 404 {"error":"not_found"} instead of calling next(). Fastify and Next.js already did.
  • POST /users/update is no longer served. The auth API has no such route, so it only ever answered the API's 404.

  The static passthrough tables are gone. Organizations, step-up, TOTP, credentials, OAuth provider configuration, admin organizations, enrollment, review accounts, the auth event export and integrity check, and the coverage report are served from the manifest, like any other route the adapter has no handler for. In cookie transport their bodies no longer carry token or refreshToken. A dot segment in one of their path parameters answers 404 not_found rather than 400 bad_request, and no upstream call is made either way. A recovery session that enrolls an authenticator app is still rotated right away.

  OTP verification, magic link polling and verification, and organization switching also drop tokens from a cookie-transport body when the auth API's answer is not a complete session.

  setSeamlessLogger and the SeamlessLogger type are exported from @seamless-auth/express, @seamless-auth/fastify and @seamless-auth/nextjs, and every warning and error those packages log goes through it.

Patch Changes

• 3096144: Calls to the auth API now behave the same as in the Go, Python and Rust adapters.

  • OTP generation and magic link requests use POST. The GET routes they called are deprecated in the auth API and missing from its adapter manifest.
  • Every call times out after 15 seconds (timeoutMs on authFetch). An auth API that cannot be reached or does not answer in time gets 502 {"error":"upstream_unavailable"} instead of a hung request or 500 internal_error.
  • The key set is fetched from authServerUrl with its path kept, so an auth API mounted under a prefix such as https://example.com/auth-api is verified against its own keys.
  • /registration/register verifies the registration token (issuer, audience, typ ephemeral, and a sub matching the body) before it sets the registration cookie or returns the token to a bearer client, and answers 502 {"error":"invalid_upstream_session"} when it fails.

  Breaking for code that calls registerHandler from @seamless-auth/core directly: RegisterOptions now requires audience and accepts authServerIssuer, like LoginOptions. The express, fastify and nextjs adapters pass both already.

• Updated dependencies [bdf2160]

• Updated dependencies [82687e6]

• Updated dependencies [241a207]

• Updated dependencies [3096144]

  • @seamless-auth/core@0.24.0

@seamless-auth/nextjs@0.8.0

Minor Changes

• bdf2160: Passthrough routes come from the auth API's adapter manifest, and guard and not-found responses match the Go, Python and Rust adapters.

  Breaking response changes:

  • requireAuth answers 401 {"error":"unauthenticated"} for a missing, invalid or expired session and for an ephemeral token. It used to answer "Failed to find authentication token required" or "Invalid or expired session".
  • requireRole answers 403 {"error":"insufficient_role"} when no listed role is granted, including for a user with no roles. The body no longer carries required and actual, so a client never sees the user's roles. A request no guard authenticated gets 401 {"error":"unauthenticated"}.
  • In Express, a path under the auth router that no route and no manifest entry matches answers 404 {"error":"not_found"} instead of calling next(). Fastify and Next.js already did.
  • POST /users/update is no longer served. The auth API has no such route, so it only ever answered the API's 404.

  The static passthrough tables are gone. Organizations, step-up, TOTP, credentials, OAuth provider configuration, admin organizations, enrollment, review accounts, the auth event export and integrity check, and the coverage report are served from the manifest, like any other route the adapter has no handler for. In cookie transport their bodies no longer carry token or refreshToken. A dot segment in one of their path parameters answers 404 not_found rather than 400 bad_request, and no upstream call is made either way. A recovery session that enrolls an authenticator app is still rotated right away.

  OTP verification, magic link polling and verification, and organization switching also drop tokens from a cookie-transport body when the auth API's answer is not a complete session.

  setSeamlessLogger and the SeamlessLogger type are exported from @seamless-auth/express, @seamless-auth/fastify and @seamless-auth/nextjs, and every warning and error those packages log goes through it.

• 82687e6: Next.js: add requireAuth(handler, options) and requireRole(roles, handler, options) to guard App Router route handlers. They accept the access cookie or the auth API's access token in Authorization: Bearer, verify the token against the auth API's key set (so roles come from a token the API signed), refuse recovery sessions unless allowRecoverySession is set, apply the origin check to cookie requests, and never refresh. Refusals answer 401 {"error":"unauthenticated"}, 403 {"error":"enrollment_required"}, 403 {"error":"cross_site_request_blocked"} or 403 {"error":"insufficient_role"}, without naming any roles. The user handed to the route carries organizationId from the token's org_id. A role guard with no roles throws at setup.

  Next.js: add a trustedProxies option (addresses or CIDR ranges) that reads the client IP from X-Forwarded-For, walking from the right past your proxies, when resolveClientIp is not given. Nothing is forwarded when neither is set, as before, but the handler now logs one warning at startup saying so. getSeamlessSession takes the request headers with trustedProxies or resolveClientIp and forwards the client IP, and reads the user agent from them when userAgent is not given.

  Core: authenticateBearer and authenticateRequest (with bearer verification on) set organizationId on the user from the verified access token's org_id. The new GuardUser type describes it.

Patch Changes

• 241a207: verifyRefreshCookie accepts only a refresh cookie: a signed payload with a non-empty sub and refreshToken and no upstream token. Every adapter cookie is signed with the same secret, so before this a pre-auth, registration or access cookie placed in the refresh cookie slot verified too, and hasSeamlessSession in @seamless-auth/nextjs reported a session for it. Refresh cookies issued by earlier versions already have this shape and keep working.

• 3096144: Calls to the auth API now behave the same as in the Go, Python and Rust adapters.

  • OTP generation and magic link requests use POST. The GET routes they called are deprecated in the auth API and missing from its adapter manifest.
  • Every call times out after 15 seconds (timeoutMs on authFetch). An auth API that cannot be reached or does not answer in time gets 502 {"error":"upstream_unavailable"} instead of a hung request or 500 internal_error.
  • The key set is fetched from authServerUrl with its path kept, so an auth API mounted under a prefix such as https://example.com/auth-api is verified against its own keys.
  • /registration/register verifies the registration token (issuer, audience, typ ephemeral, and a sub matching the body) before it sets the registration cookie or returns the token to a bearer client, and answers 502 {"error":"invalid_upstream_session"} when it fails.

  Breaking for code that calls registerHandler from @seamless-auth/core directly: RegisterOptions now requires audience and accepts authServerIssuer, like LoginOptions. The express, fastify and nextjs adapters pass both already.

• Updated dependencies [bdf2160]

• Updated dependencies [82687e6]

• Updated dependencies [241a207]

• Updated dependencies [3096144]

  • @seamless-auth/core@0.24.0