Skip to content

v0.2.0

Unreleased. The date is set when the tag is cut.

v0.2.0 tracks draft-hardt-oauth-aauth-protocol-11, draft-hardt-httpbis-signature-key-09, and draft-hardt-aauth-bootstrap-02 (previously -09, -04, and -01). Draft -11 changes the wire format, so v0.1 and v0.2 parties cannot talk to each other.

Upgrade first

  1. Upgrade every agent, resource, and server you operate together. Mixed versions do not interoperate.

  2. Change the module path. The repository was renamed from auth-go to aauth-go:

    // v0.1
import aauth "github.com/aauth-dev/auth-go"

// v0.2
import aauth "github.com/aauth-dev/aauth-go"

    go get github.com/aauth-dev/aauth-go@v0.2.0

  3. Use Go 1.26 or later (was 1.24).

  4. Work through the breaking changes in Migrating from v0.1, which has before and after code for each.

Highlights

  • Every role in one module. New packages personserver, accessserver, agentprovider, and ratelimit join the root aauth package. Each server is an http.Handler over storage and policy interfaces you implement.
  • Person tokens, missions, and permissions. PSClient can request person tokens, propose and complete missions, and ask for permission, and Transport answers person-token challenges.
  • ES256 alongside Ed25519, with keys as crypto.Signer, so platform keystores and HSMs work.
  • Federation. Four-party access through a Federator, and in-process PS-AS collapse with accessserver.Server.Local.
  • Token revocation with cascade, in every server role.
  • Rate limiting through the Limiter interface.
  • Conformance vectors under testdata/vectors for other implementations.

Security

  • Metadata issuer must match the URL it was fetched from, and issuers must be server identifiers before any discovery fetch.
  • JWKS and metadata responses are bounded in size, and the JWKS cache bounds refetch rate and entry count.
  • Discovery, revocation delivery, and federation use DiscoveryClient when no client is configured. It allows only https and public unicast destinations, including on redirects.
  • Rate limits cover interaction code attempts, polling, revocations, issuance, and new resources per agent.
  • An auth token issued while its grant was being revoked could stay usable until it expired. Recording an auth token now refuses, atomically with revocation, to proceed against a revoked presented token, root person token, or terminated mission.

Details

The changelog lists every addition, breaking change, removal, and fix.