Skip to content

CHANGELOG.md

Latest commit

 

History

History
86 lines (63 loc) · 3.75 KB

CHANGELOG.md

File metadata and controls

86 lines (63 loc) · 3.75 KB
Raw

Changelog

Source of truth: GitHub Releases.

Release notes for v1.1.4 and later are auto-generated by GoReleaser from commit messages on tag publish. The grouping (Features / Bug Fixes / Dependencies / DevOps / Refactoring / Other) is configured in .goreleaser.yml and keys off the same commit-prefix convention enforced by the highflame-commit-check CI job (feat: / fix: / devops: / build(deps) / [Snyk] / Bump / Merge / Revert).

The pre-v1.1.4 history below is preserved for context; it is not updated per release. To find what changed in any released version, click through to its GitHub Release.

ZeroID uses Semantic Versioning.

Pre-v1.1.4 history

1.1.3 — 2026-03-23

Changed

  • Grant type and scope labels are now generic strings rather than a fixed enum, enabling custom grant types registered via RegisterGrantHandler

1.1.2 — 2026-03-23

Fixed

  • Custom grant hooks now receive the correct request context when invoked via RegisterGrantHandler

1.1.1 — 2026-03-20

Added

  • GET /oauth2/token/verify — forward-auth endpoint; returns 200 with X-Auth-* headers on valid tokens, 401 on invalid
  • pkg/authjwt — importable Go package for JWKS-based JWT verification; verifies ES256 and RS256 tokens against the ZeroID JWKS endpoint with a 5-minute key cache

1.1.0 — 2026-03-19

Changed

  • Internal service layer refactored for cleaner separation between OAuth grant logic and identity resolution; no public API changes

1.0.1 — 2026-03-18

Fixed

  • CI pipeline: resolved Trivy security scan false positives in Docker image build

1.0.0 — 2026-03-18

Initial public release.

Added

  • Identity management — register, update, suspend, and delete NHI/agent identities with external ID, trust level, and capability metadata
  • OAuth2 grants
    • client_credentials (RFC 6749 §4.4) — M2M service-to-service tokens
    • urn:ietf:params:oauth:grant-type:jwt-bearer (RFC 7523) — keyless agent authentication via signed JWT assertions
    • urn:ietf:params:oauth:grant-type:token-exchange (RFC 8693) — delegated sub-agent tokens with act claims and depth enforcement
    • API key grant — exchange long-lived API keys for short-lived JWTs
  • Token operations — introspection (RFC 7662), revocation (RFC 7009), JWKS endpoint (RFC 7517)
  • OAuth2 client registration — POST /api/v1/oauth/clients for M2M confidential clients
  • WIMSE Proof Tokens — single-use DPoP-style proof tokens with DB-level replay prevention
  • CAE signals — POST /api/v1/signals for continuous access evaluation; credential revocation on critical and high severity signals
  • Attestation — register and retrieve identity attestation records
  • OpenTelemetry — distributed tracing via OTLP exporter
  • Embedded migrations — schema managed via golang-migrate, auto-applied on startup by default
  • Extensibility hooks — ClaimsEnricher, RegisterGrantHandler, AdminAuthMiddleware, TrustedServiceValidator
  • /.well-known/oauth-authorization-server metadata endpoint (RFC 8414)
  • Multi-stage Docker image, docker-compose.yml for local development, make setup-keys for key generation