diff --git a/.changeset/permission-guard-conformance.md b/.changeset/permission-guard-conformance.md deleted file mode 100644 index 6dc7143..0000000 --- a/.changeset/permission-guard-conformance.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"seamless-cli": patch ---- - -The adapter conformance suite covers permission guards, under the pending contract `permission-guards`. It holds a reference app's new `/api/permissions` routes to one behavior: exact matching, any-of and all-of, organization scope bound to the route, removal from an organization reaching the guard at the next token, and the live read when a token omits its permissions. The cases are skipped unless a run opts in with `SEAMLESS_VERIFY_CONTRACTS`, because they need the auth API at v0.23. The Express and Fastify reference apps add the routes only when the installed adapter has `requirePermission`. diff --git a/.changeset/provider-sign-in.md b/.changeset/provider-sign-in.md deleted file mode 100644 index e5bd244..0000000 --- a/.changeset/provider-sign-in.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -"seamless-cli": minor ---- - -`seamless profile login` signs in through the OpenID Provider, which brings passkey sign-in to the CLI. It opens the system browser with a loopback redirect, and `--device` uses the device grant for a machine with no browser. Either way the CLI exchanges the sign-in for a first-party session of its own at `POST /sessions/exchange` and stores that in the OS keychain, keeping no token from the provider. Needs auth server v0.23 and the provider edge. - -The CLI reads the provider from `oidcProvider` on `GET /system-config/public` when the instance advertises it. On one that does not, pass `--oidc-issuer` and `--client-id` once, to `seamless profile login` or `seamless profile add`. Flags win over what the profile saved, and that wins over the advertisement, so an instance that stops advertising cannot downgrade a profile. With no provider anywhere the email code stays, and `--email-code` asks for it. - -Every provider sign-in prints the issuer it uses. The CLI asks before using an advertised issuer on another origin than the instance, and without a terminal it stops and asks for the flags. It reads the advertisement only over https or on loopback, so an instance on plain http needs the flags. - -Every sign-in now checks the OS keychain before it starts, including `seamless login` and the email code, and fails early on a machine with none, rather than after a browser approval or an emailed code. - -`seamless clients create` and `update` gain `--session-exchange` and `--no-session-exchange`, and `get` shows the setting. - -A browser session can step up with a passkey as well as the authenticator app. A device session uses the authenticator app only, and needs a step-up before admin and organization commands, reads included. diff --git a/CHANGELOG.md b/CHANGELOG.md index 49a34e7..839d796 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,25 @@ # seamless-cli +## 0.28.0 + +### Minor Changes + +- 5e62f4a: `seamless profile login` signs in through the OpenID Provider, which brings passkey sign-in to the CLI. It opens the system browser with a loopback redirect, and `--device` uses the device grant for a machine with no browser. Either way the CLI exchanges the sign-in for a first-party session of its own at `POST /sessions/exchange` and stores that in the OS keychain, keeping no token from the provider. Needs auth server v0.23 and the provider edge. + + The CLI reads the provider from `oidcProvider` on `GET /system-config/public` when the instance advertises it. On one that does not, pass `--oidc-issuer` and `--client-id` once, to `seamless profile login` or `seamless profile add`. Flags win over what the profile saved, and that wins over the advertisement, so an instance that stops advertising cannot downgrade a profile. With no provider anywhere the email code stays, and `--email-code` asks for it. + + Every provider sign-in prints the issuer it uses. The CLI asks before using an advertised issuer on another origin than the instance, and without a terminal it stops and asks for the flags. It reads the advertisement only over https or on loopback, so an instance on plain http needs the flags. + + Every sign-in now checks the OS keychain before it starts, including `seamless login` and the email code, and fails early on a machine with none, rather than after a browser approval or an emailed code. + + `seamless clients create` and `update` gain `--session-exchange` and `--no-session-exchange`, and `get` shows the setting. + + A browser session can step up with a passkey as well as the authenticator app. A device session uses the authenticator app only, and needs a step-up before admin and organization commands, reads included. + +### Patch Changes + +- 3aea9df: The adapter conformance suite covers permission guards, under the pending contract `permission-guards`. It holds a reference app's new `/api/permissions` routes to one behavior: exact matching, any-of and all-of, organization scope bound to the route, removal from an organization reaching the guard at the next token, and the live read when a token omits its permissions. The cases are skipped unless a run opts in with `SEAMLESS_VERIFY_CONTRACTS`, because they need the auth API at v0.23. The Express and Fastify reference apps add the routes only when the installed adapter has `requirePermission`. + ## 0.27.2 ### Patch Changes diff --git a/package.json b/package.json index 31e48bf..9cdc80b 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "seamless-cli", - "version": "0.27.2", + "version": "0.28.0", "description": "The CLI for Seamless Auth, open source passwordless auth", "keywords": [ "seamless-auth",