v4.0.0-alpha.1

Full Changelog: v3.6.0...v4.0.0-alpha.1

v3.6.0

• feat: support token introspection by @jasonraimondi in #148
• feat: token introspection add client credentials auth by @jasonraimondi in #150
• tests: improve adapter test suite and improve responseFromVanilla by @jasonraimondi in #153
• fix: revocation inconsistencies and match oauth spec rfc7009 by @jasonraimondi in #152
• fix: introspect and revoke to spec and return falsey instead of throwing by @jasonraimondi in #154

Whats New

• RFC7662 "OAuth 2.0 Token Introspection" - https://tsoauth2server.com/docs/endpoints/introspect
• RFC7009 "OAuth 2.0 Token Revocation" - https://tsoauth2server.com/docs/endpoints/revoke

new AuthorizationServer(..., {
  authenticateIntrospect: false, // Default: false (v3.x), true (v4.x)
  authenticateRevoke: false,     // Default: false (v3.x), true (v4.x)
})

• Default false values maintain v3.x compatibility, and you must implement your own authentication.
• Setting to true enables client credentials authentication (v4.x behavior).

Full Changelog: v3.4.1...v3.6.0

v3.6.0-alpha.5

What's Changed

• feat: add support for RFC7662 "OAuth 2.0 Token Introspection"
• add configuration options to control client credentials authentication for /introspect and /revoke endpoints.

new AuthorizationServer({
  authenticateIntrospect: false, // Default: false (v3.x), true (v4.x)
  authenticateRevoke: false,     // Default: false (v3.x), true (v4.x)
})

• Default false values maintain v3.x compatibility, and you must implement your own authentication.
• Setting to true enables client credentials authentication (v4.x behavior).

Important Notes

• If set to false, you must implement your own authentication:
  • Use middleware or similar to authenticate requests before they reach these endpoints.
  • Implement according to specifications:
    • Introspection: RFC 7662 Section 2.1
    • Revocation: RFC 7009 Section 2.1

Full Changelog: v3.6.0-alpha.1...v3.6.0-alpha.5

v3.6.0-alpha.1

What's Changed

• fix: introspect and revoke to spec and return falsey instead of throwing by @jasonraimondi in #154

Full Changelog: v3.6.0-alpha.0...v3.6.0-alpha.1

v3.6.0-alpha.0

What's Changed

• fix(break): support readable streams in response to vanilla by @jasonraimondi in #149
• feat: support token introspection by @jasonraimondi in #148 #150
• tests: improve adapter test suite by @jasonraimondi in #153
• fix: revocation inconsistencies and match oauth spec rfc7009 by @jasonraimondi in #152
• docs: improve documentation

Full Changelog: v3.4.1...v3.6.0-alpha.0

v3.4.1 - patch express/fastify adapters handle errors

What's Changed

• fix: swallowed exceptions from improper exports by @jasonraimondi in #146
• docs: fix adapter error signature to match implementation by @jasonraimondi in #147

Thanks

• @noru - finding and reporting in detail the exact problem

Full Changelog: v3.4.0...v3.4.1

v3.4.0 - Vanilla Request/Response Adapter, new documentation site

Description

New Docs site - https://tsoauth2server.com

New VanillaJS Adapter - https://tsoauth2server.com/docs/adapters/vanilla/

What's Changed

• docs: improve documentation site by @jasonraimondi in #143
• feat: vanilla adapter (prerelease v3.4.0) by @jasonraimondi in #144

Full Changelog: v3.3.1...v3.4.0

v3.3.0 - Custom Grants, JWT iss & aud

What's Changed

• feat: support custom grants by @jasonraimondi in #129
• feat: support aud and iss on access tokens by @jasonraimondi in #131

Full Changelog: v3.2.0...v3.3.0

v3.3.0-alpha.1

Full Changelog: v3.3.0-alpha.0...v3.3.0-alpha.1

v3.3.0-alpha.0

What's Changed

• feat: support custom grants by @jasonraimondi in #129
• feat: support aud and iss by @jasonraimondi in #131

Full Changelog: v3.2.0...v3.3.0-alpha.0