[dependabot]

Bumps github.com/plexusone/systemforge from 0.11.0 to 0.22.0.

Release notes

Sourced from github.com/plexusone/systemforge's releases.

v0.22.0

Release Notes: v0.22.0

Full Changelog: plexusone/systemforge@v0.21.0...v0.22.0

v0.21.0

Release Notes: v0.21.0

Full Changelog: plexusone/systemforge@v0.20.0...v0.21.0

v0.20.0

Release Notes: v0.20.0

Full Changelog: plexusone/systemforge@v0.19.0...v0.20.0

v0.19.0

Release Notes: v0.19.0

Full Changelog: plexusone/systemforge@v0.18.0...v0.19.0

v0.18.0

Release Notes: v0.18.0

Full Changelog: plexusone/systemforge@v0.17.0...v0.18.0

v0.17.0

Release Notes: v0.17.0

Full Changelog: plexusone/systemforge@v0.16.0...v0.17.0

v0.16.0

Release Notes: v0.16.0

Full Changelog: plexusone/systemforge@v0.15.0...v0.16.0

v0.15.0

Release Notes: v0.15.0

Full Changelog: plexusone/systemforge@v0.14.0...v0.15.0

v0.14.0

Release Notes: v0.14.0

Full Changelog: plexusone/systemforge@v0.13.0...v0.14.0

v0.13.0

Release Notes: v0.13.0

Full Changelog: plexusone/systemforge@v0.12.0...v0.13.0

... (truncated)

Changelog

Sourced from github.com/plexusone/systemforge's changelog.

[v0.22.0] - 2026-10-25

Highlights

• Invite-gated sign-up grows a deployment on purpose: operators create invite codes with use limits, expiry and cohort labels, members invite people from an allowance, every account records which invite admitted it, and an HTTP API serves admin and member pages

Added

• signupgate.CodeStore: invite codes stored as hashes and shown once, reserved with one conditional update so a code admits at most its use limit, redemptions for attribution, and member allowances with single-use member codes (8ffe82f)
• systemauth.WithSignupCodes: the /signup?code= page and invite_code on provider sign-in carry a code to the sign-up gate; SignupGateAborter lets a gate give back a reservation when account creation fails (89d2b55)
• signupgate/signupapi: operator routes for email invites, codes, the waitlist, allowances and joined accounts, and member routes for a person's own codes, with audit events (1551e8a)
• systemauthsvc options SignupCodes, SignupPage, MemberInvites and SignupAPI, and Service.SignupCodes and Service.SignupAPI (93915ad)
• Commands code, allowance, waitlist invite and admin (principal/admincmd) for operators, including granting the first platform administrator (e75977e)
• Migration 0011 records who created a sign-up invite and when a waitlist entry was invited (f7ee741)

Documentation

• Invite-Gated Sign-Up guide (bb60e66)

[v0.21.0] - 2026-10-25

Highlights

• Tokens are DPoP-bound by default: SystemAuth and the identity/oauth provider verify DPoP proofs (RFC 9449) at the token endpoint and bind access and refresh tokens to the proof's key, the relying-party, session and multi-app middleware accept a bound token only with a proof by its key, and the BFF presents tokens with proofs by the session's key; unbound bearer tokens remain only as an explicit per-client opt-out (allow_bearer_tokens)
• Keys and secrets rotate N / N-1: JWT signing keys carry key IDs and pre-staged verification keys, and client secrets, BFF session sealing keys and SCIM tokens keep the current and previous value valid, so a rotation can be rolled back without signing anyone out
• Built-in per-tenant SCIM tokens: the scimtoken store issues, rotates and revokes hashed tokens bound to one organization, and the packaged SystemAuth service serves SCIM 2.0 and token management with them
• Revocations reach the ReBAC graph first: removing access deletes the relationships under advisory graph locks before the database change commits and fails when the graph refuses, a reconciler repairs the graph from the identity tables, and the packaged service runs in mode rebac
• Each multi-app application connects with its own database login, verified at startup to be confined to its schema, reads the shared identity tables read-only, and is migrated by a separate step that keeps the owner login out of app servers

Breaking

• systemauth: token requests without a DPoP proof are refused unless the client sets allow_bearer_tokens; tokens are DPoP-bound and must be presented with the DPoP scheme and a proof. Existing databases need migrations/0010_oauth_app_allow_bearer_tokens.sql. EmbeddedOAuthProvider.UserInfo refuses DPoP-bound tokens, and AuthorizeIntrospectionCaller also accepts the DPoP scheme
• systemauth: a token subject must be a principal ID; tokens for other subjects are refused, and custom Storage implementations must implement PrincipalActive
• systemauth: a client secret older than the two newest active secrets no longer authenticates
• systemauth: WithAccessChanges takes an AccessChangeScope; without one /access-changes answers 501
• systemauth: EntStorage.UpdateHuman with Active false fails, and the principal stays active, when the graph refuses to remove its relationships, and it records a deactivation access change
• oauth: clients without allow_bearer_tokens must send DPoP proofs and present tokens with the DPoP scheme; NewProvider requires Config.PrivateKey or AllowEphemeralKey; API.Middleware panics without WithAcceptedClientIDs or WithAnyClient; Provider.Session returns *systemauth.Session
• token: IssueInput.DPoPJKT and RefreshInput.DPoPJKT are replaced by DPoP *dpopproof.Proof, and bound tokens have TokenType DPoP
• relyingparty: BearerMiddleware and RequestAuthenticator panic when Tokens is set without BearerConfig.DPoP or AllowBearerTokens, and always refuse a DPoP-bound token sent as Bearer; relying-party instances sharing sessions must share Config.DPoPKey
• session/middleware: HTTPAuth, HTTPAuthForAudience, HTTPAuthOptional, ChiAuth and ChiAuthOptional take a DPoPConfig, return an error and refuse unbound tokens unless DPoPConfig.AllowBearer is set; the bearer-only middleware is renamed HTTPAuthBearer and its variants
• session/middleware: APIKeyMiddleware panics without OwnerCheck, and RequireAPIKey, RequireAPIKeyWithScopes and OptionalAPIKey take an APIKeyOwnerCheck
• session/jwt: NewService fails with ErrMissingIssuer without Config.Issuer and with ErrWeakSecret for an HMAC secret shorter than the hash output
• multiapp: AuthMiddleware returns (middleware, error), needs MiddlewareConfig.JWTService and DPoP.ReplayCache, and refuses unbound tokens unless DPoP.AllowBearer is set
• multiapp: every app needs its own database login in Config.AppDatabases; Config.DatabaseURL is removed, MigrationDatabaseURL is refused without AllowInProcessMigrations or AllowSharedDatabaseLogin, RegisterApp fails when the app schema is missing, and an AppAwareDB serves one schema unless opened with AllowSharedLogin or AsMigrationLogin
• multiapp: RoleProvisioning with nil SharedReadTables, and multiappdb without --shared-table, grant SELECT on the default shared identity tables; restricted tables are refused
• bff: the default session cookie is __Host-sf_session (sf_session when insecure), NewHandler refuses invalid __Host- and __Secure- cookie configs, and CookieConfig.Domain is removed
• bff: NewOmniStorageStore with the redis backend requires SiteID and a Sealer (or InsecurePlaintext), NewOmniStorageStoreWithKVS returns an error and requires both, and the default key prefix is session:<SiteID>:
• bff: NewEntStore requires a Sealer or EncryptionKey (ErrSealerRequired) and writes sealed fields in a format earlier versions cannot open
• oauthclient: the state cookie is __Host-sf_oauth_client_state; SetStateCookie returns an error, NewStateManagerInsecure takes a *slog.Logger, a StateManager is Secure unless AllowInsecure is set, and SameSite Strict or None is refused
• organization, approle, resourcegrant, managedprincipal, principal: a revocation whose graph removal fails returns the error and leaves the database unchanged, also in SyncModeEventual; approle.RemoveForMember removes nothing on a graph error, and resourcegrant.GrantInTx may write to the graph before commit when lowering a grant

... (truncated)

Commits

• 6a10804 Merge pull request #63 from plexusone/fix/signup-code-order
• ab008c9 test(signupgate): cover code ordering when creation times tie
• cedb659 fix(signupgate): list invite codes in creation order when times tie
• 091dddb Merge pull request #62 from plexusone/feat/signup-invites
• bbf82e2 docs(release): add v0.22.0 changelog and release notes
• bb60e66 docs: add the invite-gated sign-up guide
• 93915ad feat(systemauthsvc): admit invite codes and serve the invite API
• 2daabb4 feat(signupgate): check codes for the sign-up page
• 89d2b55 feat(systemauth): carry invite codes through sign-in
• 1551e8a feat(signupapi): serve the invite-gated sign-up API
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: f04900fa-5ec1-4b9c-8999-86a693eecf5f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Superseded by #29.