auth-jwt/CHANGELOG.md

# Changelog

## [1.7.0] — 2026-08-14

Minor — coordinated framework release (lockstep versioning). No changes to this module's own API.

### Changed

- Bumped einherjar dependencies to v1.7.0. The behavioural changes in this release are in `spa-server`
  (per-file Cache-Control, a navigation-scoped SPA fallback, nosniff, and a non-root image).

## [1.6.0] — 2026-08-13

Minor — coordinated framework release (lockstep versioning). No changes to this module's own API.

### Changed

- Bumped einherjar dependencies to v1.6.0. The framework-wide change in this release is
  `web`'s new `httputil.Bind` / `httputil.BindEmpty` request-binding adapters.

## [1.5.0] — 2026-08-09

Minor — coordinated framework version alignment. No code or API changes in this module.

### Changed

- Bumped `contracts`, `core`, `web`, `auth` to v1.5.0.

## v1.1.3 — 2026-08-08

Patch — coordinated framework version alignment. Bumped einherjar dependencies (\`auth\`, \`contracts\`, \`core\`, \`web\`) to v1.1.3.
No code or API changes.## v1.1.2 — 2026-08-08

Patch — coordinated framework version alignment. Bumped `auth`, `contracts`, `core`, `web` to
v1.1.2; README install line updated to v1.1.2.

## v1.1.1 — 2026-08-07

Patch — coordinated framework version alignment. Bumped `auth`, `contracts`, `core`, `web` to v1.1.1.
No code or API changes.

## v1.1.0 — 2026-08-07

Coordinated framework version alignment — released in lockstep at v1.1.0.

### Changed

- Bumped einherjar dependencies (`auth`, `contracts`, `core`, `web`) to v1.1.0 via `go get` + `go mod tidy`.
  No code or API changes.

## v1.0.0

Initial release.

### Signers and Verifiers

- `Verifier` interface — `Verify(tokenString string) (*jwt.Token, error)`
- `Signer` interface — extends `Verifier`; adds `Sign(claims jwt.Claims) (string, error)`
- `NewHMACSigner(secret []byte) Signer` — HMAC-SHA256 (HS256)
- `NewRSASigner(privateKey *rsa.PrivateKey) Signer` — RSA-SHA256 (RS256); public key derived from private
- `NewRSASignerFromPEM(pemKey []byte) (Signer, error)` — parses PKCS#8 or PKCS#1 PEM
- `NewRSAPublicKeyVerifier(publicKey *rsa.PublicKey) Verifier` — verify-only; use when the service never issues tokens
- `NewRSAPublicKeyVerifierFromPEM(pemKey []byte) (Verifier, error)` — parses PKIX or PKCS#1 PEM
- `NewECSigner(privateKey *ecdsa.PrivateKey) Signer` — ECDSA; algorithm auto-detected from curve (P-256→ES256, P-384→ES384, P-521→ES512)
- `NewECSignerFromPEM(pemKey []byte) (Signer, error)` — parses PKCS#8 PEM
- `NewECPublicKeyVerifier(publicKey *ecdsa.PublicKey) Verifier` — EC verify-only
- `NewECPublicKeyVerifierFromPEM(pemKey []byte) (Verifier, error)` — parses PKIX PEM
- All `Verify` implementations use `jwt.WithJSONNumber()` — preserves large int64 bitmasks through JSON round-trip

### Token issuance

- `TokenConfig` struct — `AccessTTL time.Duration`, `RefreshTTL time.Duration`, `Issuer string`
- `TokenPair` struct — `AccessToken string`, `RefreshToken string`, `ExpiresIn int64`
- `IssueTokenPair(signer, uid, customClaims, cfg) (TokenPair, error)` — signs access + refresh pair; `customClaims` merged at top level of access token; refresh token carries only `sub/iss/iat/exp/jti/fam`

### Token refresh

- `Blacklist` interface — `IsRevoked(ctx, jti) (bool, error)` + `Revoke(ctx, jti, ttl) error`; satisfied by `cache-valkey` via duck typing
- `ErrTokenRevoked` — sentinel error; use `errors.Is(err, authjwt.ErrTokenRevoked)` to detect replay attacks
- `RefreshTokenPair(ctx, signer, refreshToken, bl, cfg, customClaims) (TokenPair, error)` — validates token, checks blacklist, revokes old JTI, issues new pair; `customClaims` re-embedded in new access token

### HTTP middleware

- `AuthMiddleware(logger, verifier, publicPaths) func(http.Handler) http.Handler` — verifies Bearer tokens; calls `authmw.SetTokenData` on success; routes 401 through `httputil.Error`; `publicPaths` support `path.Match` wildcards