gamertan/web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Releases 3 Activity
Files
v0.1.0-preview.3
web/CHANGELOG.md
T
gamertan 5905fe6fb2
verify / verify (push) Successful in 3m14s
Details
auth: publish one-time bootstrap rotation 
Publish the reviewed Web Foundations v0.1.0-preview.3 snapshot with cryptographic temporary credentials, explicit forced-rotation state, atomic password replacement and session revocation, additive SQLite migration, tests, and application-boundary documentation.

Exported from reviewed private source b8fb4ff3cd012859f2d307dfb2a1cc783a38f6db after trusted CI run 257 and exact Go 1.26.6 verification.

Material implementation assistance provided by OpenAI Codex; reviewed and verified through the maintainer workflow.

Signed-off-by: Cole Speelman <crspeelman@gmail.com>
2026-08-18 00:08:01 -04:00

1.7 KiB
Raw Permalink Blame History

Changelog

v0.1.0-preview.3 — 2026-08-18

  • Add cryptographically generated temporary credentials and an explicit password-change-required account state.
  • Replace credentials, clear the requirement, and revoke all existing sessions in one repository transaction after verifying the current password.
  • Migrate existing SQLite users with the new requirement disabled; applications continue to own first-login routing, private credential delivery, and audit policy.
  • Keep Preview 1 and Preview 2 immutable; applications select Preview 3 explicitly when adopting forced bootstrap rotation.

v0.1.0-preview.2 — 2026-08-17

  • Add storage-neutral organizations, teams, projects, environments, services, single-use invitations, and independently scoped access roles.
  • Separate platform-level authentication roles from organization data access.
  • Add expiring break-glass grants with transactional organization-visible audit events and a no-CGO SQLite implementation.
  • Keep v0.1.0-preview.1 immutable; applications adopt these additive packages by explicitly selecting Preview 2.

v0.1.0-preview.1 — 2026-08-16

  • Establish independent request metadata, logging, browser security, abuse, authentication, SQLite, and analytics package boundaries.
  • Add a minimal 0BSD net/http starter.
  • Fail closed when unsafe requests lack same-origin evidence or authentication middleware is constructed with invalid cookie/service configuration.
  • Bound untrusted request-record byte and duration fields before aggregation.
  • Support Linux as the maintained release platform; native Windows is not a release gate or compatibility promise.

No compatibility promise is made before a stable release.

Reference in New Issue View Git Blame Copy Permalink