[dependabot]

Bumps github.com/plexusone/systemforge from 0.11.0 to 0.13.0.

Release notes

Sourced from github.com/plexusone/systemforge's releases.

v0.13.0

Release Notes: v0.13.0

Full Changelog: plexusone/systemforge@v0.12.0...v0.13.0

v0.12.0

Release Notes: v0.12.0

Full Changelog: plexusone/systemforge@v0.11.0...v0.12.0

Changelog

Sourced from github.com/plexusone/systemforge's changelog.

[v0.13.0] - 2026-10-06

Highlights

• identity/systemauthsvc: embed SystemAuth in a host binary with config loading, production checks, migrations, client bootstrap and health
• Production safety checks enforced by systemauthsvc.New, not only by the command
• Service.Metadata() lets in-process relying parties skip network discovery
• Configuration overrides apply before defaults and validation; SystemAuth configuration can be loaded from bytes

Added

• Server.OpenIDConfiguration() and Server.Ready(ctx) on the SystemAuth server (d4e1834)
• identity/systemauthsvc exported SystemAuth service setup for host binaries (77e642b)
• systemauth.DecodeConfig and DecodeConfigFile decode configuration without validating (af3891e)
• systemauthsvc.LoadConfigBytes; LoadConfig validates after overrides (974b8b0)

Changed

• cmd/systemauth builds the server through systemauthsvc; flags and defaults unchanged, production-refusal message reworded (adf9268)

Documentation

• Verified email design: ADR-003 and INIT-SYSTEMFORGE-006 (9786049)
• Embedding SystemAuth in a host binary (7a7e5f5)
• LoadConfigBytes and override ordering (f52d8f2)

[v0.12.0] - 2026-10-06

Highlights

• Social login on SystemAuth: GitHub/Google login routes, principal upsert keyed by provider subject with verified-email linking, hardened __Host-sf_login session, state CSRF + PKCE, allowlisted redirects
• Session and token lifecycle: refresh-token rotation with reuse detection and absolute expiry, logout with token revocation, consent page
• OpenID Connect: ID tokens, optional RS256 JWT access tokens, and the /oauth/userinfo endpoint
• identity/relyingparty: reusable OIDC relying party with sub → sf_principal_id linking, /bff/* cookie sessions, and bearer middleware for JWTs and API keys
• Durable stores: Ent-backed SystemAuth login sessions, login state and consent grants; identity/relyingparty/pgstore encrypted PostgreSQL session stores with key rotation
• Production-deployable systemauth binary: PostgreSQL via pgx, signing key from a secret, health checks, and a production mode that refuses unsafe configuration

Breaking

• Removed the unused duplicate session/oauth package; use identity/oauthclient (51f85fd)
• cmd/systemauth without --dev refuses to start without a signing key, an https issuer, and a persistent database, and rejects insecure_cookies (bd65215)
• Refresh tokens rotate on every use; presenting a rotated refresh token returns invalid_grant and revokes the token family (2c72979)
• OAuth codes and tokens record a subject; auth-code user_id becomes nullable; run systemauth migrate (6ed9b76)

Added

• identity/oauthclient: provider Connector, User.EmailVerified, and a pluggable single-use StateStore (178063d)
• ExternalIdentity entity (sf_external_identities) linking principals to upstream logins (9d2f589)
• SystemAuth principal directory and external-login account linking (verified-email linking only) (ae8a363)
• social_login configuration with redirect allowlist (9ae2eb5)

... (truncated)

Commits

• 604c553 chore(deps): go mod: update dependencies
• d94ac56 chore(release): update changelog for v0.13.0
• 6696ff3 docs: list embeddable SystemAuth in features and package layout
• fc908e4 docs(release): add v0.13.0 release notes
• f52d8f2 docs(systemauth): describe LoadConfigBytes and override ordering
• da2e2ec test(systemauthsvc): cover decode-then-override config loading
• 974b8b0 feat(systemauthsvc): validate after overrides and add LoadConfigBytes
• af3891e feat(systemauth): add DecodeConfig and DecodeConfigFile
• 7a7e5f5 docs(systemauth): document embedding SystemAuth in a host binary
• 9d2b10e test(systemauthsvc): cover production refusals, migrations and embedding
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 6dda27e1-bc93-4cfb-947d-ac5f97b87d88

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Superseded by #17.