auth-jwt/CHANGELOG.md

Changelog

[1.7.0] — 2026-08-14

Minor — coordinated framework release (lockstep versioning). No changes to this module's own API.

Changed

• Bumped einherjar dependencies to v1.7.0. The behavioural changes in this release are in spa-server (per-file Cache-Control, a navigation-scoped SPA fallback, nosniff, and a non-root image).

[1.6.0] — 2026-08-13

Minor — coordinated framework release (lockstep versioning). No changes to this module's own API.

Changed

• Bumped einherjar dependencies to v1.6.0. The framework-wide change in this release is web's new httputil.Bind / httputil.BindEmpty request-binding adapters.

[1.5.0] — 2026-08-09

Minor — coordinated framework version alignment. No code or API changes in this module.

Changed

• Bumped contracts, core, web, auth to v1.5.0.

v1.1.3 — 2026-08-08

Patch — coordinated framework version alignment. Bumped einherjar dependencies (`auth`, `contracts`, `core`, `web`) to v1.1.3. No code or API changes.## v1.1.2 — 2026-08-08

Patch — coordinated framework version alignment. Bumped auth, contracts, core, web to v1.1.2; README install line updated to v1.1.2.

v1.1.1 — 2026-08-07

Patch — coordinated framework version alignment. Bumped auth, contracts, core, web to v1.1.1. No code or API changes.

v1.1.0 — 2026-08-07

Coordinated framework version alignment — released in lockstep at v1.1.0.

Changed

• Bumped einherjar dependencies (auth, contracts, core, web) to v1.1.0 via go get + go mod tidy. No code or API changes.

v1.0.0

Initial release.

Signers and Verifiers

• Verifier interface — Verify(tokenString string) (*jwt.Token, error)
• Signer interface — extends Verifier; adds Sign(claims jwt.Claims) (string, error)
• NewHMACSigner(secret []byte) Signer — HMAC-SHA256 (HS256)
• NewRSASigner(privateKey *rsa.PrivateKey) Signer — RSA-SHA256 (RS256); public key derived from private
• NewRSASignerFromPEM(pemKey []byte) (Signer, error) — parses PKCS#8 or PKCS#1 PEM
• NewRSAPublicKeyVerifier(publicKey *rsa.PublicKey) Verifier — verify-only; use when the service never issues tokens
• NewRSAPublicKeyVerifierFromPEM(pemKey []byte) (Verifier, error) — parses PKIX or PKCS#1 PEM
• NewECSigner(privateKey *ecdsa.PrivateKey) Signer — ECDSA; algorithm auto-detected from curve (P-256→ES256, P-384→ES384, P-521→ES512)
• NewECSignerFromPEM(pemKey []byte) (Signer, error) — parses PKCS#8 PEM
• NewECPublicKeyVerifier(publicKey *ecdsa.PublicKey) Verifier — EC verify-only
• NewECPublicKeyVerifierFromPEM(pemKey []byte) (Verifier, error) — parses PKIX PEM
• All Verify implementations use jwt.WithJSONNumber() — preserves large int64 bitmasks through JSON round-trip

Token issuance

• TokenConfig struct — AccessTTL time.Duration, RefreshTTL time.Duration, Issuer string
• TokenPair struct — AccessToken string, RefreshToken string, ExpiresIn int64
• IssueTokenPair(signer, uid, customClaims, cfg) (TokenPair, error) — signs access + refresh pair; customClaims merged at top level of access token; refresh token carries only sub/iss/iat/exp/jti/fam

Token refresh

• Blacklist interface — IsRevoked(ctx, jti) (bool, error) + Revoke(ctx, jti, ttl) error; satisfied by cache-valkey via duck typing
• ErrTokenRevoked — sentinel error; use errors.Is(err, authjwt.ErrTokenRevoked) to detect replay attacks
• RefreshTokenPair(ctx, signer, refreshToken, bl, cfg, customClaims) (TokenPair, error) — validates token, checks blacklist, revokes old JTI, issues new pair; customClaims re-embedded in new access token

HTTP middleware

• AuthMiddleware(logger, verifier, publicPaths) func(http.Handler) http.Handler — verifies Bearer tokens; calls authmw.SetTokenData on success; routes 401 through httputil.Error; publicPaths support path.Match wildcards