From 5ae22b90218bec9b12fbe88ae2f89345fef8f319 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 21 Jul 2026 18:37:33 +0000 Subject: [PATCH] chore: update version and changelog --- .changeset/defineroute-response-passthrough.md | 5 ----- .changeset/oauth-provider-admin-routes.md | 5 ----- .../require-service-token-for-external-delivery.md | 5 ----- .changeset/serve-admin-dashboard.md | 5 ----- .changeset/set-token-audience.md | 5 ----- CHANGELOG.md | 13 +++++++++++++ package.json | 2 +- 7 files changed, 14 insertions(+), 26 deletions(-) delete mode 100644 .changeset/defineroute-response-passthrough.md delete mode 100644 .changeset/oauth-provider-admin-routes.md delete mode 100644 .changeset/require-service-token-for-external-delivery.md delete mode 100644 .changeset/serve-admin-dashboard.md delete mode 100644 .changeset/set-token-audience.md diff --git a/.changeset/defineroute-response-passthrough.md b/.changeset/defineroute-response-passthrough.md deleted file mode 100644 index 47c6a12..0000000 --- a/.changeset/defineroute-response-passthrough.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'seamless-auth-api': patch ---- - -Fix response schema handling so a controller response that fails its declared schema is no longer overwritten. Previously the API replaced the real body with a generic `Response validation failed` object and leaked internal Zod issues to clients. It now logs the drift server-side and returns the controller's intended response unchanged. diff --git a/.changeset/oauth-provider-admin-routes.md b/.changeset/oauth-provider-admin-routes.md deleted file mode 100644 index 536d43b..0000000 --- a/.changeset/oauth-provider-admin-routes.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'seamless-auth-api': minor ---- - -Add admin routes to manage OAuth providers at runtime without hand-editing `system_config` or replacing the whole config array. New endpoints under the existing SystemConfig admin surface: `GET /system-config/oauth-providers` (list), `POST /system-config/oauth-providers` (add, 409 on duplicate id), `PATCH /system-config/oauth-providers/:id` (update, 404 on unknown id), and `DELETE /system-config/oauth-providers/:id` (remove, 404 on unknown id). Each route requires an admin access token (`requireAdmin('read')` for the list, `requireAdmin('write')` for mutations), validates against `OAuthProviderConfigSchema`, invalidates the system-config cache after writes, and records a `system_config_updated` audit event. Client secrets stay out of the API surface: providers continue to reference `clientSecretEnv` and the routes never accept or return a raw secret. Providers remain editable through the existing `PATCH /system-config/admin` whole-array patch, so this is additive. diff --git a/.changeset/require-service-token-for-external-delivery.md b/.changeset/require-service-token-for-external-delivery.md deleted file mode 100644 index d308473..0000000 --- a/.changeset/require-service-token-for-external-delivery.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'seamless-auth-api': minor ---- - -Require a validated internal service token for external delivery in all environments. `canReturnExternalDelivery` no longer treats a non-production `NODE_ENV` as sufficient, so the `x-seamless-auth-delivery-mode: external` header must now be accompanied by an `x-seamless-service-token` that passes issuer, audience, and subject validation. `canReturnSensitiveDevelopmentDetails` is gated the same way. Local development that cannot present a service token can set `ALLOW_UNCREDENTIALED_DELIVERY_SECRETS=true`, an explicit opt-in that is ignored when `NODE_ENV=production`. diff --git a/.changeset/serve-admin-dashboard.md b/.changeset/serve-admin-dashboard.md deleted file mode 100644 index cd6f5cf..0000000 --- a/.changeset/serve-admin-dashboard.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'seamless-auth-api': minor ---- - -Serve the admin dashboard SPA at the `/console` subpath on the API's own origin. Static serving is additive and gated behind `SERVE_ADMIN_DASHBOARD` (enabled by default): the admin API routes are registered first and keep priority, and an SPA history fallback returns the dashboard `index.html` for unmatched `/console` and `/console/*` navigations, with correct MIME types, long-lived immutable caching for hashed assets, and `no-store` on the shell. `/console` is used instead of `/admin` so the SPA namespace never overlaps the admin API under `/admin/*`. The Docker image builds the dashboard from a pinned git ref (the `SEAMLESS_ADMIN_DASHBOARD_REF` build ARG) with base path `/console` and copies it into the runtime image. No CORS changes are needed because the dashboard is same-origin. diff --git a/.changeset/set-token-audience.md b/.changeset/set-token-audience.md deleted file mode 100644 index 389de2e..0000000 --- a/.changeset/set-token-audience.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'seamless-auth-api': patch ---- - -Bind the `aud` claim on signed user tokens. `signAccessToken`, `signRefreshToken`, and `signEphemeralToken` now call `.setAudience(ISSUER)` in addition to `.setIssuer(ISSUER)`. The Seamless adapter verifies signed auth responses with `aud === audience`, and the deployment contract requires the adopter's `audience` to equal its `authServerUrl`, which is byte-identical to this server's `ISSUER`. Without the claim, jose rejects every token the adapter checks, so login, registration, OAuth, OTP, magic-link, and organization-switch all fail once the adapter's audience binding ships. The claim is additive and ignored by verifiers that do not check it. diff --git a/CHANGELOG.md b/CHANGELOG.md index 33b52cd..84ccf4e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,18 @@ # seamless-auth-api +## 0.3.0 + +### Minor Changes + +- fe78de9: Add admin routes to manage OAuth providers at runtime without hand-editing `system_config` or replacing the whole config array. New endpoints under the existing SystemConfig admin surface: `GET /system-config/oauth-providers` (list), `POST /system-config/oauth-providers` (add, 409 on duplicate id), `PATCH /system-config/oauth-providers/:id` (update, 404 on unknown id), and `DELETE /system-config/oauth-providers/:id` (remove, 404 on unknown id). Each route requires an admin access token (`requireAdmin('read')` for the list, `requireAdmin('write')` for mutations), validates against `OAuthProviderConfigSchema`, invalidates the system-config cache after writes, and records a `system_config_updated` audit event. Client secrets stay out of the API surface: providers continue to reference `clientSecretEnv` and the routes never accept or return a raw secret. Providers remain editable through the existing `PATCH /system-config/admin` whole-array patch, so this is additive. +- 916a3b7: Require a validated internal service token for external delivery in all environments. `canReturnExternalDelivery` no longer treats a non-production `NODE_ENV` as sufficient, so the `x-seamless-auth-delivery-mode: external` header must now be accompanied by an `x-seamless-service-token` that passes issuer, audience, and subject validation. `canReturnSensitiveDevelopmentDetails` is gated the same way. Local development that cannot present a service token can set `ALLOW_UNCREDENTIALED_DELIVERY_SECRETS=true`, an explicit opt-in that is ignored when `NODE_ENV=production`. +- 0005244: Serve the admin dashboard SPA at the `/console` subpath on the API's own origin. Static serving is additive and gated behind `SERVE_ADMIN_DASHBOARD` (enabled by default): the admin API routes are registered first and keep priority, and an SPA history fallback returns the dashboard `index.html` for unmatched `/console` and `/console/*` navigations, with correct MIME types, long-lived immutable caching for hashed assets, and `no-store` on the shell. `/console` is used instead of `/admin` so the SPA namespace never overlaps the admin API under `/admin/*`. The Docker image builds the dashboard from a pinned git ref (the `SEAMLESS_ADMIN_DASHBOARD_REF` build ARG) with base path `/console` and copies it into the runtime image. No CORS changes are needed because the dashboard is same-origin. + +### Patch Changes + +- 594df9b: Fix response schema handling so a controller response that fails its declared schema is no longer overwritten. Previously the API replaced the real body with a generic `Response validation failed` object and leaked internal Zod issues to clients. It now logs the drift server-side and returns the controller's intended response unchanged. +- ff8067d: Bind the `aud` claim on signed user tokens. `signAccessToken`, `signRefreshToken`, and `signEphemeralToken` now call `.setAudience(ISSUER)` in addition to `.setIssuer(ISSUER)`. The Seamless adapter verifies signed auth responses with `aud === audience`, and the deployment contract requires the adopter's `audience` to equal its `authServerUrl`, which is byte-identical to this server's `ISSUER`. Without the claim, jose rejects every token the adapter checks, so login, registration, OAuth, OTP, magic-link, and organization-switch all fail once the adapter's audience binding ships. The claim is additive and ignored by verifiers that do not check it. + ## 0.2.7 ### Patch Changes diff --git a/package.json b/package.json index 75dd6f0..9d9621e 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "seamless-auth-api", - "version": "0.2.7", + "version": "0.3.0", "description": "Seamless Auth API - A web application server for supporting a Seamless Auth server instance.", "main": "index.js", "type": "module",