atauth
AtAuth
Star 7
Fork 0
Watch
atauth CHANGELOG.md
11 kB · 245 lines
Markdown
at commit bfa3fd58

Changelog #

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

2.3.0 - 2026-03-09 #

Added #

  • Passkey login support for forward-auth proxy flow (previously only available in OIDC flow)
  • New endpoint POST /auth/proxy/passkey for WebAuthn authentication in proxy-auth
  • Passkey button and WebAuthn JavaScript on proxy login page (feature-detected)
  • GitHub Actions CI workflow for the FOSS repository

Security #

  • MFA verify endpoints (/auth/mfa/totp/verify, /auth/mfa/backup-codes/verify) now require authentication; DID comes from session, not request body
  • Session expiry enforced at the database query level (getSession() checks expires_at)
  • OIDC logout redirect validation uses origin comparison instead of prefix matching (prevents open redirect)
  • PKCE plain method rejected; only S256 accepted with constant-time comparison
  • Empty DID guard in OIDC token endpoint prevents minting tokens for unauthenticated authorization codes
  • Handle format validation in OIDC authorize endpoint
  • trust proxy configured for correct client IP behind reverse proxies
  • user_id NaN validation in auth link endpoint

Changed #

  • Removed uuid package dependency (replaced with crypto.randomUUID())
  • Test suite expanded to 404 tests

2.2.0 - 2026-02-24 #

Added #

  • 10 new OIDC setup wizard presets: Paperless-ngx, Vaultwarden, Miniflux, Mattermost, Vikunja, Plane, GoToSocial, Stirling-PDF, Tandoor Recipes, FreshRSS
  • Development guide (CLAUDE.md) with project structure, testing patterns, and common gotchas
  • Unit tests for OIDC revocation, logout, userinfo, passkey service, session management, token verification, rate limiting, HMAC utilities, and error handling
  • Audit log for all admin operations with 90-day retention cleanup
  • GET /admin/audit-log endpoint for viewing admin activity

Changed #

  • Passkey registration now requires discoverable credentials (residentKey: 'required')
  • Rate limit increased from 10 to 30 requests per window
  • Test suite expanded to 394 tests across 22 test files (~56% statement coverage)
  • Request body size limited to 16kb (JSON and URL-encoded)

Fixed #

  • Forward-auth user profile: x-forwarded-proto header handling for correct protocol detection
  • Email removal endpoint validates email format before processing
  • Proxy auth handle validation rejects malformed handles
  • CORS startup validation rejects wildcard origin with credentials mode

2.1.0 - 2026-02-24 #

Added #

  • User profile page at /auth/profile with passkey registration, passkey management (rename/delete), and active session management (view/revoke)
  • Forward-auth session cookie authentication for passkey API routes (enables profile page WebAuthn registration)

Changed #

  • Login page theme: dark mode, no emojis, gradient accent (blue-violet), matching admin dashboard aesthetic
  • Both OIDC and forward-auth login pages share the new dark theme
  • Passkey button text simplified to "Sign in with passkey" with SVG key icon
  • Brand text "ATAuth" replaces emoji lock logo

2.0.3 - 2026-02-23 #

Added #

  • Passkey login on the OIDC authorize page: users with a registered passkey can now sign in with biometrics or a security key, skipping the Bluesky OAuth flow entirely
  • New endpoint POST /oauth/authorize/passkey completes the OIDC authorization code flow via WebAuthn
  • Login page shows "Sign in with a passkey" button when passkeys are enabled (feature-detected; hidden if browser lacks WebAuthn support)
  • Tests for passkey authorize flow (8 new tests)

2.0.2 - 2026-02-23 #

Security #

  • Removed hardcoded fallback secrets from config; OIDC_KEY_SECRET, MFA_ENCRYPTION_KEY, and FORWARD_AUTH_SESSION_SECRET are now required when their features are enabled
  • Fixed XSS in OIDC login page: all user-controlled values (clientName, state, authCode, errorMessage) are now HTML-escaped
  • Client secrets no longer appear in URL query parameters; uses one-time flash tokens instead
  • Updated nodemailer from v6 to v7 (SES transport security fix)
  • Updated docker-compose.yaml to use required variable syntax (${VAR:?msg}) for secrets
  • Updated .env.example with all current configuration options

2.0.1 - 2026-02-23 #

Fixed #

  • Setup wizard double-protocol bug: entering https://abs.example.com in domain field no longer produces https://https://abs.example.com/... in redirect URIs

Added #

  • Gitea OIDC client registration (client_id: gitea, PKCE disabled for compatibility)
  • Regression test for wizard domain protocol stripping

Removed #

  • gateway/admin-ui/ -- old React SPA (replaced by server-rendered dashboard)
  • gateway/tekton/ -- old Tekton CI for suspended k3s
  • gateway/helm/ -- unused Helm chart
  • gateway/k8s/ -- old k3s kustomize manifests
  • gateway/.gitea/workflows/build.yaml -- stale k3s deploy workflow
  • .github/ -- GitHub Actions and issue templates (repo is on Gitea)
  • Dockerfile admin-ui-builder stage (was a no-op after admin-ui removal)

Changed #

  • README.md: rewritten for OIDC provider reality (removed stale Rust/TS library references)
  • docs/HOMELAB.md: updated for OIDC setup wizard workflow

2.0.0 - 2026-02-22 #

Added #

  • OIDC Provider: Full OpenID Connect provider using AT Protocol OAuth as identity source
    • Authorization endpoint with PKCE support
    • Token endpoint (authorization_code + refresh_token grants)
    • UserInfo endpoint with DID-to-handle resolution via AT Protocol API
    • Token revocation endpoint
    • JWKS endpoint with ES256 key rotation
    • Discovery document (/.well-known/openid-configuration)
  • Forward-Auth SSO Proxy: nginx auth_request based single sign-on for arbitrary services
    • Per-user DID and handle pattern access control rules
    • Deny-overrides evaluation model
    • Per-origin and global rule scoping
    • HMAC-SHA256 signed session cookies with typ discriminator
    • Ticket-based exchange for X-Auth-DID/X-Auth-Handle headers
  • Admin Dashboard: Server-rendered HTML admin UI replacing static React SPA
    • OIDC client management (list, create, edit, delete, secret rotation)
    • Setup wizard with presets for 10 common self-hosted apps (Audiobookshelf, Jellyfin, Nextcloud, Gitea, Immich, Grafana, WikiJS, Portainer, Outline, Mealie)
    • Forward-auth proxy quick setup wizard with nginx/k8s config snippet generation
    • Proxy origin management, access rule management, session management
    • Access check dry-run tool
    • HMAC-signed CSRF tokens on all forms
    • Cookie-based auth (24h TTL) alongside Bearer token auth
  • CI/CD: GitHub Actions pipeline (test on push)

Changed #

  • Infrastructure: Docker Compose and Kubernetes deployment support
  • Test suite: Expanded from ~50 to 262 tests across 11 test files

Fixed #

  • OIDC token endpoint: hash incoming client secret before comparing against stored SHA-256 hash
  • OIDC authorize: pass explicit redirect_uri to AT Protocol OAuth callback (prevents @atproto/oauth-client fallback mismatch)
  • OIDC userinfo: resolve DID to handle via app.bsky.actor.getProfile when no cached mapping exists
  • Legacy /auth/init: separate OAuth redirect_uri from downstream app callback URL
  • Register OIDC and forward-auth callback URIs in NodeOAuthClient metadata

Security #

  • Client secrets stored as SHA-256 hashes (not plaintext)
  • Constant-time comparison for all secret verification
  • PKCE required for OIDC clients (configurable per-client)
  • Access control deny-overrides: deny rules always win regardless of order

1.3.0 - 2025-12-15 #

Changed #

  • Express 5: Migrated gateway from Express 4 to Express 5
  • ESLint 9: Migrated to ESLint 9 flat config with typescript-eslint 8
  • Async Error Handling: Route handlers now use throw pattern instead of try/catch blocks
  • Added HttpError class and httpError factory functions for cleaner error handling

Updated Dependencies #

  • express: 4.18.2 -> 5.0.0
  • helmet: 7.1.0 -> 8.0.0
  • @types/express: 4.17.21 -> 5.0.0
  • eslint: 8.56.0 -> 9.0.0
  • typescript-eslint: 7.0.0 -> 8.0.0
  • @atproto/oauth-client-node: 0.1.0 -> 0.3.0
  • better-sqlite3: 11.0.0 -> 11.6.0
  • typescript: 5.3.0 -> 5.7.0
  • vitest: 1.0.0 -> 2.0.0
  • @types/node: 20.10.0 -> 22.0.0

Improved #

  • Enabled projectService in typescript-eslint for better type-aware linting performance
  • Simplified error handling code (~150 lines of boilerplate removed)

1.2.0 - 2025-12-14 #

Added #

  • TypeScript library unit tests for token and validation modules
  • Security report issue template
  • GitHub issue labels (security, rust, typescript, gateway, breaking change, ci/cd)

Changed #

  • BREAKING: TokenVerifier::new() now returns Result<Self, AuthError> instead of Self
  • Minimum HMAC secret key length enforced at 32 bytes (256 bits)
  • TypeScript library defaults to sessionStorage instead of localStorage
  • Docker compose binds to localhost only (127.0.0.1) by default

Security #

  • Enforce minimum 32-byte secret key for HMAC-SHA256 in Rust library
  • Add HTTPS URL validation for production environments in TypeScript
  • Add redirect URI validation against registered callbacks in gateway
  • Improved token storage security with sessionStorage default

1.0.0 - 2025-12-14 #

Added #

  • Initial release
  • Rust library for HMAC-SHA256 token verification
  • TypeScript/JavaScript library for frontend integration
  • React hooks and Zustand store for state management
  • OAuth gateway server (Node.js/Express)
  • SQLite and PostgreSQL session store backends
  • Rate limiting middleware
  • DID and handle validation
  • Docker support with multi-arch images (amd64/arm64)
  • Homelab deployment documentation
  • CI/CD with GitHub Actions

Security #

  • Constant-time signature comparison
  • CSRF protection via cryptographic nonces
  • Input validation and sanitization
  • Rate limiting on all endpoints