Version Packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@seamless-auth/core@0.19.0

Minor Changes

• a004f89: Pass the auth API's audit and reporting routes through with the caller's access identity: GET /admin/auth-events/integrity (Audit records are updatable and have no integrity protection seamless-auth-api#174), GET /admin/auth-events/export (Audit events have no retention policy and no bulk export seamless-auth-api#173) and GET /admin/reports/authentication-coverage (No authentication coverage report for assessment and insurance responses seamless-auth-api#178), each with its query.

  The export and the coverage report answer with a file (NDJSON, or CSV when format=csv), so proxied routes can now forward an upstream response unparsed. proxyRequest takes raw: true and returns raw: { headers, body }, holding the body stream and its content-type, content-disposition and cache-control. Each adapter streams it through as is, so the download keeps its type and filename rather than arriving wrapped in { message }.

  ResponseAdapter gains a required sendRaw(status, raw). A custom adapter that implements ResponseAdapter itself has to add it. The adapters in this repository already do.

  @seamless-auth/types is now ^0.27.0.

• 79aad32: Add authServerIssuer, the expected iss of the tokens and signed responses the auth server returns. It defaults to authServerUrl, so nothing changes unless you set it. Set it when the auth server is reached at a different URL from the issuer it advertises: on the local Docker stack the auth server signs as http://auth:5312, while an app run on the host calls http://localhost:5312, and every sign-in failed with Invalid signed response from Auth Server (Sign-in fails when the app runs on the host against the Docker auth server (issuer mismatch) seamless-cli#224). Requests and key set fetches still go to authServerUrl; only the iss check reads the new option.

  The auth API sets aud to its ISSUER as well, and audience stays required with no default, so with authServerIssuer set, set audience to the same value. For the Docker stack from the host that is authServerUrl: "http://localhost:5312", authServerIssuer: "http://auth:5312", audience: "http://auth:5312". The option docs and READMEs now say this.

  It is accepted by createSeamlessAuthServer, requireAuth and getSeamlessUser in Express, the seamlessAuth plugin, requireAuth and getSeamlessUser in Fastify, and createSeamlessAuthHandler and getSeamlessSession in Next.js. In core, verifySignedAuthResponse, verifyAccessToken and verifyUpstreamSession take it as an optional last argument, and getSeamlessUser, authenticateBearer, authenticateRequest (under bearer), issueSessionCookies, sessionResult and the session-issuing handlers' options take it as a field (AuthServerIssuerOption).

  The startup warning for an unset or dev-main jwksKid now says what the value is: the kid header on the HS256 service tokens the adapter signs with serviceSecret, not the auth server's signing key. The READMEs describe jwksKid the same way.

• 629c428: - GET /internal/metrics/dashboard and GET /internal/security/anomalies now forward their query string, so the time range and paging the auth API accepts on them reach it ([Feature]: Dashboard metrics and security anomalies accept no time range seamless-auth-api#132). Before, both handlers were built without a query, and a range from the dashboard was silently dropped. getDashboardMetricsHandler and getSecurityAnomaliesHandler accept query.

  • Pass GET /admin/review-accounts (with its days query) through to the auth API with the caller's access identity (feat(otp): record review account sign-ins and surface enabled review accounts seamless-auth-api#331).

Patch Changes

• 9dbd345: Recover when the auth server starts signing with a new key under the same kid. The cached key set was only refetched for an unknown kid, so after such a change (a recreated local auth container regenerates its dev key this way) every signed auth response and Bearer token failed verification for up to 10 minutes, and sign-in answered 500 until the application restarted. A signature that does not match a cached key now refetches the key set once and verifies again, at most once per 30 second cooldown so a stream of bad signatures cannot hammer the JWKS endpoint. The verification failure log now includes the jose error code. Fixes fix(core): signed auth responses fail for up to 10 minutes after keys change under the same kid #184.
• da7f33f: Support Node 22 and newer. The engines field now requires >=22 instead of >=24 <25, and CI runs on Node 22, 24, and the latest release (chore: support Node versions beyond 24 across the ecosystem seamless-auth-api#339).
• 4006a5b: Depend on @seamless-auth/types ^0.28.0, which adds the ranged dashboard metrics and security anomalies schemas ([Feature]: Dashboard metrics and security anomalies accept no time range seamless-auth-api#132).

@seamless-auth/express@0.19.0

Minor Changes

• a004f89: Pass the auth API's audit and reporting routes through with the caller's access identity: GET /admin/auth-events/integrity (Audit records are updatable and have no integrity protection seamless-auth-api#174), GET /admin/auth-events/export (Audit events have no retention policy and no bulk export seamless-auth-api#173) and GET /admin/reports/authentication-coverage (No authentication coverage report for assessment and insurance responses seamless-auth-api#178), each with its query.

  The export and the coverage report answer with a file (NDJSON, or CSV when format=csv), so proxied routes can now forward an upstream response unparsed. proxyRequest takes raw: true and returns raw: { headers, body }, holding the body stream and its content-type, content-disposition and cache-control. Each adapter streams it through as is, so the download keeps its type and filename rather than arriving wrapped in { message }.

  ResponseAdapter gains a required sendRaw(status, raw). A custom adapter that implements ResponseAdapter itself has to add it. The adapters in this repository already do.

  @seamless-auth/types is now ^0.27.0.

• 79aad32: Add authServerIssuer, the expected iss of the tokens and signed responses the auth server returns. It defaults to authServerUrl, so nothing changes unless you set it. Set it when the auth server is reached at a different URL from the issuer it advertises: on the local Docker stack the auth server signs as http://auth:5312, while an app run on the host calls http://localhost:5312, and every sign-in failed with Invalid signed response from Auth Server (Sign-in fails when the app runs on the host against the Docker auth server (issuer mismatch) seamless-cli#224). Requests and key set fetches still go to authServerUrl; only the iss check reads the new option.

  The auth API sets aud to its ISSUER as well, and audience stays required with no default, so with authServerIssuer set, set audience to the same value. For the Docker stack from the host that is authServerUrl: "http://localhost:5312", authServerIssuer: "http://auth:5312", audience: "http://auth:5312". The option docs and READMEs now say this.

  It is accepted by createSeamlessAuthServer, requireAuth and getSeamlessUser in Express, the seamlessAuth plugin, requireAuth and getSeamlessUser in Fastify, and createSeamlessAuthHandler and getSeamlessSession in Next.js. In core, verifySignedAuthResponse, verifyAccessToken and verifyUpstreamSession take it as an optional last argument, and getSeamlessUser, authenticateBearer, authenticateRequest (under bearer), issueSessionCookies, sessionResult and the session-issuing handlers' options take it as a field (AuthServerIssuerOption).

  The startup warning for an unset or dev-main jwksKid now says what the value is: the kid header on the HS256 service tokens the adapter signs with serviceSecret, not the auth server's signing key. The READMEs describe jwksKid the same way.

• 629c428: - GET /internal/metrics/dashboard and GET /internal/security/anomalies now forward their query string, so the time range and paging the auth API accepts on them reach it ([Feature]: Dashboard metrics and security anomalies accept no time range seamless-auth-api#132). Before, both handlers were built without a query, and a range from the dashboard was silently dropped. getDashboardMetricsHandler and getSecurityAnomaliesHandler accept query.

  • Pass GET /admin/review-accounts (with its days query) through to the auth API with the caller's access identity (feat(otp): record review account sign-ins and surface enabled review accounts seamless-auth-api#331).

Patch Changes

• 9dbd345: Recover when the auth server starts signing with a new key under the same kid. The cached key set was only refetched for an unknown kid, so after such a change (a recreated local auth container regenerates its dev key this way) every signed auth response and Bearer token failed verification for up to 10 minutes, and sign-in answered 500 until the application restarted. A signature that does not match a cached key now refetches the key set once and verifies again, at most once per 30 second cooldown so a stream of bad signatures cannot hammer the JWKS endpoint. The verification failure log now includes the jose error code. Fixes fix(core): signed auth responses fail for up to 10 minutes after keys change under the same kid #184.
• da7f33f: Support Node 22 and newer. The engines field now requires >=22 instead of >=24 <25, and CI runs on Node 22, 24, and the latest release (chore: support Node versions beyond 24 across the ecosystem seamless-auth-api#339).
• Updated dependencies [a004f89]
• Updated dependencies [79aad32]
• Updated dependencies [9dbd345]
• Updated dependencies [da7f33f]
• Updated dependencies [629c428]
• Updated dependencies [4006a5b]
  • @seamless-auth/core@0.19.0

@seamless-auth/fastify@0.10.0

Minor Changes

• a004f89: Pass the auth API's audit and reporting routes through with the caller's access identity: GET /admin/auth-events/integrity (Audit records are updatable and have no integrity protection seamless-auth-api#174), GET /admin/auth-events/export (Audit events have no retention policy and no bulk export seamless-auth-api#173) and GET /admin/reports/authentication-coverage (No authentication coverage report for assessment and insurance responses seamless-auth-api#178), each with its query.

  The export and the coverage report answer with a file (NDJSON, or CSV when format=csv), so proxied routes can now forward an upstream response unparsed. proxyRequest takes raw: true and returns raw: { headers, body }, holding the body stream and its content-type, content-disposition and cache-control. Each adapter streams it through as is, so the download keeps its type and filename rather than arriving wrapped in { message }.

  ResponseAdapter gains a required sendRaw(status, raw). A custom adapter that implements ResponseAdapter itself has to add it. The adapters in this repository already do.

  @seamless-auth/types is now ^0.27.0.

• 79aad32: Add authServerIssuer, the expected iss of the tokens and signed responses the auth server returns. It defaults to authServerUrl, so nothing changes unless you set it. Set it when the auth server is reached at a different URL from the issuer it advertises: on the local Docker stack the auth server signs as http://auth:5312, while an app run on the host calls http://localhost:5312, and every sign-in failed with Invalid signed response from Auth Server (Sign-in fails when the app runs on the host against the Docker auth server (issuer mismatch) seamless-cli#224). Requests and key set fetches still go to authServerUrl; only the iss check reads the new option.

  The auth API sets aud to its ISSUER as well, and audience stays required with no default, so with authServerIssuer set, set audience to the same value. For the Docker stack from the host that is authServerUrl: "http://localhost:5312", authServerIssuer: "http://auth:5312", audience: "http://auth:5312". The option docs and READMEs now say this.

  It is accepted by createSeamlessAuthServer, requireAuth and getSeamlessUser in Express, the seamlessAuth plugin, requireAuth and getSeamlessUser in Fastify, and createSeamlessAuthHandler and getSeamlessSession in Next.js. In core, verifySignedAuthResponse, verifyAccessToken and verifyUpstreamSession take it as an optional last argument, and getSeamlessUser, authenticateBearer, authenticateRequest (under bearer), issueSessionCookies, sessionResult and the session-issuing handlers' options take it as a field (AuthServerIssuerOption).

  The startup warning for an unset or dev-main jwksKid now says what the value is: the kid header on the HS256 service tokens the adapter signs with serviceSecret, not the auth server's signing key. The READMEs describe jwksKid the same way.

• 629c428: - GET /internal/metrics/dashboard and GET /internal/security/anomalies now forward their query string, so the time range and paging the auth API accepts on them reach it ([Feature]: Dashboard metrics and security anomalies accept no time range seamless-auth-api#132). Before, both handlers were built without a query, and a range from the dashboard was silently dropped. getDashboardMetricsHandler and getSecurityAnomaliesHandler accept query.

  • Pass GET /admin/review-accounts (with its days query) through to the auth API with the caller's access identity (feat(otp): record review account sign-ins and surface enabled review accounts seamless-auth-api#331).

Patch Changes

• 9dbd345: Recover when the auth server starts signing with a new key under the same kid. The cached key set was only refetched for an unknown kid, so after such a change (a recreated local auth container regenerates its dev key this way) every signed auth response and Bearer token failed verification for up to 10 minutes, and sign-in answered 500 until the application restarted. A signature that does not match a cached key now refetches the key set once and verifies again, at most once per 30 second cooldown so a stream of bad signatures cannot hammer the JWKS endpoint. The verification failure log now includes the jose error code. Fixes fix(core): signed auth responses fail for up to 10 minutes after keys change under the same kid #184.
• da7f33f: Support Node 22 and newer. The engines field now requires >=22 instead of >=24 <25, and CI runs on Node 22, 24, and the latest release (chore: support Node versions beyond 24 across the ecosystem seamless-auth-api#339).
• Updated dependencies [a004f89]
• Updated dependencies [79aad32]
• Updated dependencies [9dbd345]
• Updated dependencies [da7f33f]
• Updated dependencies [629c428]
• Updated dependencies [4006a5b]
  • @seamless-auth/core@0.19.0

@seamless-auth/nextjs@0.3.0

Minor Changes

• a004f89: Pass the auth API's audit and reporting routes through with the caller's access identity: GET /admin/auth-events/integrity (Audit records are updatable and have no integrity protection seamless-auth-api#174), GET /admin/auth-events/export (Audit events have no retention policy and no bulk export seamless-auth-api#173) and GET /admin/reports/authentication-coverage (No authentication coverage report for assessment and insurance responses seamless-auth-api#178), each with its query.

  The export and the coverage report answer with a file (NDJSON, or CSV when format=csv), so proxied routes can now forward an upstream response unparsed. proxyRequest takes raw: true and returns raw: { headers, body }, holding the body stream and its content-type, content-disposition and cache-control. Each adapter streams it through as is, so the download keeps its type and filename rather than arriving wrapped in { message }.

  ResponseAdapter gains a required sendRaw(status, raw). A custom adapter that implements ResponseAdapter itself has to add it. The adapters in this repository already do.

  @seamless-auth/types is now ^0.27.0.

• 79aad32: Add authServerIssuer, the expected iss of the tokens and signed responses the auth server returns. It defaults to authServerUrl, so nothing changes unless you set it. Set it when the auth server is reached at a different URL from the issuer it advertises: on the local Docker stack the auth server signs as http://auth:5312, while an app run on the host calls http://localhost:5312, and every sign-in failed with Invalid signed response from Auth Server (Sign-in fails when the app runs on the host against the Docker auth server (issuer mismatch) seamless-cli#224). Requests and key set fetches still go to authServerUrl; only the iss check reads the new option.

  The auth API sets aud to its ISSUER as well, and audience stays required with no default, so with authServerIssuer set, set audience to the same value. For the Docker stack from the host that is authServerUrl: "http://localhost:5312", authServerIssuer: "http://auth:5312", audience: "http://auth:5312". The option docs and READMEs now say this.

  It is accepted by createSeamlessAuthServer, requireAuth and getSeamlessUser in Express, the seamlessAuth plugin, requireAuth and getSeamlessUser in Fastify, and createSeamlessAuthHandler and getSeamlessSession in Next.js. In core, verifySignedAuthResponse, verifyAccessToken and verifyUpstreamSession take it as an optional last argument, and getSeamlessUser, authenticateBearer, authenticateRequest (under bearer), issueSessionCookies, sessionResult and the session-issuing handlers' options take it as a field (AuthServerIssuerOption).

  The startup warning for an unset or dev-main jwksKid now says what the value is: the kid header on the HS256 service tokens the adapter signs with serviceSecret, not the auth server's signing key. The READMEs describe jwksKid the same way.

• 6538393: Add createSeamlessConsoleProxy, which serves the Seamless admin console from a Next.js application. Mount it at app/console/[[...path]]/route.ts and export its GET and HEAD, and the dashboard loads from the same origin as /auth, as it does with the Express and Fastify console proxies. It forwards only the method and the path upstream, copies the caching headers back, and refuses any path that leaves the console subtree. A mountPath option covers a route mounted elsewhere or under a Next.js basePath. Closes feat(nextjs): serve the admin console from a Next.js application #185.

• 629c428: - GET /internal/metrics/dashboard and GET /internal/security/anomalies now forward their query string, so the time range and paging the auth API accepts on them reach it ([Feature]: Dashboard metrics and security anomalies accept no time range seamless-auth-api#132). Before, both handlers were built without a query, and a range from the dashboard was silently dropped. getDashboardMetricsHandler and getSecurityAnomaliesHandler accept query.

  • Pass GET /admin/review-accounts (with its days query) through to the auth API with the caller's access identity (feat(otp): record review account sign-ins and surface enabled review accounts seamless-auth-api#331).

Patch Changes

• 9dbd345: Recover when the auth server starts signing with a new key under the same kid. The cached key set was only refetched for an unknown kid, so after such a change (a recreated local auth container regenerates its dev key this way) every signed auth response and Bearer token failed verification for up to 10 minutes, and sign-in answered 500 until the application restarted. A signature that does not match a cached key now refetches the key set once and verifies again, at most once per 30 second cooldown so a stream of bad signatures cannot hammer the JWKS endpoint. The verification failure log now includes the jose error code. Fixes fix(core): signed auth responses fail for up to 10 minutes after keys change under the same kid #184.
• da7f33f: Support Node 22 and newer. The engines field now requires >=22 instead of >=24 <25, and CI runs on Node 22, 24, and the latest release (chore: support Node versions beyond 24 across the ecosystem seamless-auth-api#339).
• 4006a5b: Depend on @seamless-auth/types ^0.28.0, which adds the ranged dashboard metrics and security anomalies schemas ([Feature]: Dashboard metrics and security anomalies accept no time range seamless-auth-api#132).
• Updated dependencies [a004f89]
• Updated dependencies [79aad32]
• Updated dependencies [9dbd345]
• Updated dependencies [da7f33f]
• Updated dependencies [629c428]
• Updated dependencies [4006a5b]
  • @seamless-auth/core@0.19.0