[dependabot]

Bumps github.com/plexusone/systemforge from 0.11.0 to 0.20.0.

Release notes

Sourced from github.com/plexusone/systemforge's releases.

v0.20.0

Release Notes: v0.20.0

Full Changelog: plexusone/systemforge@v0.19.0...v0.20.0

v0.19.0

Release Notes: v0.19.0

Full Changelog: plexusone/systemforge@v0.18.0...v0.19.0

v0.18.0

Release Notes: v0.18.0

Full Changelog: plexusone/systemforge@v0.17.0...v0.18.0

v0.17.0

Release Notes: v0.17.0

Full Changelog: plexusone/systemforge@v0.16.0...v0.17.0

v0.16.0

Release Notes: v0.16.0

Full Changelog: plexusone/systemforge@v0.15.0...v0.16.0

v0.15.0

Release Notes: v0.15.0

Full Changelog: plexusone/systemforge@v0.14.0...v0.15.0

v0.14.0

Release Notes: v0.14.0

Full Changelog: plexusone/systemforge@v0.13.0...v0.14.0

v0.13.0

Release Notes: v0.13.0

Full Changelog: plexusone/systemforge@v0.12.0...v0.13.0

v0.12.0

Release Notes: v0.12.0

Full Changelog: plexusone/systemforge@v0.11.0...v0.12.0

Changelog

Sourced from github.com/plexusone/systemforge's changelog.

[v0.20.0] - 2026-10-23

Highlights

• Access tokens are bound to the application they were issued for: relying parties, the session JWT service, and multi-app routing each refuse tokens minted for another application that shares the signing key
• SCIM credentials are bound to one organization: a customer's identity provider provisions only its own members and cannot change the identity of users who also belong elsewhere

Breaking

• session/jwt: Config.Audience is required; NewService returns ErrMissingAudience without it. Client-kind audiences (bff, api, custom) are added in front of the application audience instead of replacing it, and ValidateAccessTokenWithAudience with an empty audience checks Config.Audience instead of skipping the check
• relyingparty: VerifyAccessToken accepts only tokens issued to Config.ClientID unless AcceptedClientIDs or AccessTokenAudience is set; client-credentials tokens from other clients must be listed
• multiapp: without AppAudiences, tokens on app routes must carry the app's AppID as an audience
• authz: RequireResourceAction no longer sets a resource's organization from the caller's token; extractor errors answer 400 for a missing or malformed ID, 403 for ErrResourceNotFound, and 500 otherwise
• scim/store: the Ent store refuses requests without a provisioning scope. For a tenant, active is the membership's state, creating a user who exists elsewhere links them as a member, deleting a shared user removes only the membership, and groups cannot be created, renamed or deleted
• connections: creator rights need an Options.Authorizer that implements authz.OrgAuthorizer (the rbac and SpiceDB providers do); with another authorizer, creators are decided by role and grants alone
• bff: a custom HandlerConfig.SessionIDGenerator must produce IDs that ValidSessionID accepts (URL-safe characters, at most 256)
• scim/store: SCIM refuses to deprovision an organization owner, restores memberships with the default role, and for a platform credential active deactivates the account through the principal service

Upgrade Guide

• session/jwt: set Config.Audience to a value naming the application. Access tokens issued before the upgrade are refused and clients refresh; refresh tokens issued without the audience require signing in again
• relyingparty: list in AcceptedClientIDs every client, including the application's own ClientID, whose tokens the API must accept, such as service clients using client credentials; or set AccessTokenAudience for an API that many clients call with an audience
• multiapp: mint tokens with jwt.TokenOptions{Audience: []string{appID}}, or set AppAudiences to the audiences your tokens already carry
• authzguardsql: handle ErrNoAuthorizedEntities from PolicyBuilder.Build by refusing the query (for example with 403)
• authz: replace WithResourceID with WithResourceLookup on routes whose access depends on the organization role, passing a lookup that returns the resource's owning organization
• scim: authenticate with CredentialMiddleware and bind each SCIM credential to its organization (Scope{OrganizationID: ...}); give Scope{Platform: true} only to platform operator credentials
• scim/store: pass the application's organization service (with its authz syncer) as Config.Memberships and its principal service as Config.Principals, so SCIM changes sync the authorization graph

Security

• Relying-party bearer authentication accepted a SystemAuth access token issued to any other OAuth client, and an ID token, as an access token for the application, taking the organization memberships in its claims; VerifyAccessToken now requires a client_id claim from an accepted client and refuses typed non-access JWTs
• The session JWT service's default validation (ValidateAccessToken, HTTPAuth, HTTPAuthOptional) accepted tokens for any audience, so applications sharing a signing key accepted each other's access and refresh tokens; tokens must now carry the service's Config.Audience
• multiapp AuthMiddleware accepted a token minted for one app on every other app unless AppAudiences was set; a token on an app route must now be addressed to that app's ID by default
• authzguardsql PolicyBuilder.Build turned a principal authorized for no entity into a GuardSQL policy with empty allowlists, which GuardSQL reads as unrestricted, so the least-privileged principals could query every entity and field; it now returns ErrNoAuthorizedEntities
• authz RequireResourceAction checked a resource named in the request against the caller's role in the organization from their token, so a member of one organization passed resource checks for another organization's resources; the resource's organization now comes only from the extractor
• The SCIM store had no tenant scoping, so any SCIM credential could read, change, delete and regroup every user and organization on the platform; each request is now bound to the credential's organization, and requests without a scope are refused
• SCIM could rewrite the login email of a user who also belonged to other organizations, enabling account takeover; a tenant now changes email, name and photo only for users it provisioned that belong to no other organization, and manages only the membership of others
• Deactivating an organization membership left the member's organization role, application roles and resource grants in the SpiceDB graph, so under the ReBAC authorizer a deactivated admin kept every permission; deactivation now removes them from the graph and reactivation writes them back
• bff RegisterHumaRoutes registered stub handlers for logout, session and refresh; on a router shared with Huma, as documented, they took precedence over the mounted BFF handler, so logout answered success without ending the session and the stubs skipped the Origin check and rate limiter. It now only documents the routes
• A connection's creator kept view, use, manage and share rights on it after leaving or being removed from the organization, and could grant themselves back in; creator rights now require current membership of the owning organization
• BFF logout passed the client's cookie value to the session store's Delete even when no session matched; with the omnistorage kvs store, the value user:<id> deleted a user's session index, so "log out everywhere" and revoke-on-password-change missed that user's sessions. Logout now deletes only a session the store returns, and malformed cookie values are treated as no session
• aauthrs accepted an agent token from any agent provider for any agent identifier, so a provider controlled by anyone could claim another domain's agents (for example aauth:billing-bot@victim.example); an agent token is now accepted only when the agent's domain is its issuer's host
• SCIM wrote memberships directly, so suspending, removing or deleting a user skipped the authorization-graph sync, the access-change record that revokes existing tokens, and cleanup of application roles and resource grants; SCIM now changes memberships through the organization service and deactivates accounts through the principal service
• SCIM could suspend, remove or delete an organization's owner, letting an identity provider lock a customer out of its own organization; it now refuses with 403
• Re-adding a suspended member through SCIM restored their previous role, possibly owner or admin; a restored membership now gets the default role

Added

• relyingparty: Config.AcceptedClientIDs lists the OAuth clients whose access tokens an application accepts
• systemauth: JWT access tokens carry the JOSE typ header at+jwt (RFC 9068)

... (truncated)

Commits

• fb2efac docs(release): add v0.20.0 release notes and changelog
• 54a8185 docs(scim): describe membership side effects and deprovisioning rules
• 339d256 fix(scim/store): change memberships through the organization service
• 81a4f89 docs(aauth): document TrustedAgentIssuers and the agent domain check
• e2d1c55 docs(changelog): record the AAuth agent issuer fix as unreleased
• af39acb fix(aauthrs): accept agent tokens only for the issuer's own agents
• 6a21ae8 docs(changelog): record the BFF logout fix as unreleased
• 6da422a fix(bff): delete only a found session at logout
• c916913 docs(changelog): record the connection creator fix as unreleased
• 8946751 fix(connections): end a creator's rights when they leave the organization
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: de00ae46-5e7d-43ac-b882-791fc9f9d907

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Superseded by #27.