diff --git a/.changeset/ecosystem-bump-september.md b/.changeset/ecosystem-bump-september.md new file mode 100644 index 0000000..e209775 --- /dev/null +++ b/.changeset/ecosystem-bump-september.md @@ -0,0 +1,36 @@ +--- +'seamless-cli': minor +--- + +Move the scaffold onto the current Seamless ecosystem: auth API `v0.10.0`, admin dashboard `v0.5.0`, +and seamless-templates `v0.12.0`. + +Three releases of auth API work land together. `v0.8.0` gives WebAuthn challenges their own store +with a five-minute expiry and one-time use, so a registration and a login can be outstanding at once +instead of clobbering each other, and it adds `AUTHENTICATOR_POLICY`, which decides attachment, user +verification, attestation, and whether a synced passkey may enrol. `v0.9.0` puts the lockout policy +and the per-IP and per-identity limiters on TOTP step-up, which had none of the three, and stops +running refresh tokens through bcrypt. `v0.10.0` drops the `sessions.refreshTokenHash` column the +previous release stopped writing. + +A scaffold's compose file is built from the pinned release's `.env.example`, so a new project picks up +`AUTHENTICATOR_POLICY` along with `SESSION_IDLE_TTL`, `MAX_CONCURRENT_SESSIONS` and a commented +`TRUST_PROXY`, and `REFRESH_TOKEN_TTL` moves from `1h` to `1d`. + +The admin dashboard bump keeps the standalone console (`--admin=image` and `--admin=source`) in step +with the one the API image now serves at `/console`, since `v0.10.0` embeds dashboard `v0.5.0` itself. +That release names the acting administrator separately from the subject in the events table, and +collects identity proofing before preparing a device replacement, which is what the API already +records and requires. + +Templates `v0.12.0` moves the starters onto `@seamless-auth/react` `0.11.0`, `@seamless-auth/express` +`0.13.0` and `@seamless-auth/fastify` `0.4.0`. All three are 0.x minors, so the caret ranges the +starters carried could never have resolved to them and a scaffolded project stayed on the older +versions however long ago they were pinned. It also carries per-application auth cookie names read +from `AUTH_COOKIE_PREFIX`, so two Seamless apps on one host stop overwriting each other's session. The +manifest contract is unchanged, so nothing in `init` moves with it. + +The conformance harness's adapters follow the same SDKs the starters now install: +`@seamless-auth/express` `^0.13.0` and `@seamless-auth/fastify` `^0.4.0`. Both stop repeating the +access and refresh tokens in the body of the response that sets them as `httpOnly` cookies, and both +forward a magic link's `redirectUri` to the API. diff --git a/resources/coverage-badge.svg b/resources/coverage-badge.svg index fdefd25..270ff0d 100644 --- a/resources/coverage-badge.svg +++ b/resources/coverage-badge.svg @@ -1,5 +1,5 @@ - - coverage: 99.3% + + coverage: 99.4% @@ -17,7 +17,7 @@ coverage coverage - 99.3% - 99.3% + 99.4% + 99.4% diff --git a/src/core/images.ts b/src/core/images.ts index c489542..c163572 100644 --- a/src/core/images.ts +++ b/src/core/images.ts @@ -3,11 +3,11 @@ // scaffolded with, and never has its data directory pulled out from under it. export const POSTGRES_IMAGE = "postgres:18"; -export const SEAMLESS_AUTH_API_VERSION = "v0.7.1"; +export const SEAMLESS_AUTH_API_VERSION = "v0.10.0"; export const SEAMLESS_AUTH_API_IMAGE = `ghcr.io/fells-code/seamless-auth-api:${SEAMLESS_AUTH_API_VERSION}`; -export const SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION = "v0.4.0"; +export const SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION = "v0.5.0"; export const SEAMLESS_AUTH_ADMIN_DASHBOARD_IMAGE = `ghcr.io/fells-code/seamless-auth-admin-dashboard:${SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION}`; @@ -25,4 +25,4 @@ export const SEAMLESS_AUTH_ADMIN_DASHBOARD_REF = SEAMLESS_AUTH_ADMIN_DASHBOARD_V // SEAMLESS_TEMPLATES_REF, or point at a local checkout with SEAMLESS_TEMPLATES_DIR. export const SEAMLESS_TEMPLATES_REPO = "fells-code/seamless-templates"; -export const SEAMLESS_TEMPLATES_REF = "v0.9.0"; +export const SEAMLESS_TEMPLATES_REF = "v0.12.0"; diff --git a/verify/adapter-app/package.json b/verify/adapter-app/package.json index ca26159..735a907 100644 --- a/verify/adapter-app/package.json +++ b/verify/adapter-app/package.json @@ -5,7 +5,7 @@ "type": "module", "description": "Minimal adopter backend for the conformance harness — real @seamless-auth/express with a capture transport.", "dependencies": { - "@seamless-auth/express": "^0.12.1", + "@seamless-auth/express": "^0.13.0", "cookie-parser": "^1.4.6", "cors": "^2.8.5", "express": "^5.1.0" diff --git a/verify/adapter-fastify-app/package.json b/verify/adapter-fastify-app/package.json index af358df..2203863 100644 --- a/verify/adapter-fastify-app/package.json +++ b/verify/adapter-fastify-app/package.json @@ -6,7 +6,7 @@ "description": "Minimal adopter backend for the conformance harness — real @seamless-auth/fastify with a capture transport.", "dependencies": { "@fastify/cors": "^11.0.1", - "@seamless-auth/fastify": "^0.3.1", + "@seamless-auth/fastify": "^0.4.0", "fastify": "^5.2.0" } }