diff --git a/.changeset/secure-cookie-defaults.md b/.changeset/secure-cookie-defaults.md deleted file mode 100644 index 907e6b3..0000000 --- a/.changeset/secure-cookie-defaults.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -"@codelitdev/oauth-server-kit": minor ---- - -Add hardened Better Auth defaults. `@codelitdev/oauth-server-kit/better-auth` exports `secureCookieOptions` (`__Host-` session cookies over https, `__Secure-` with cross-subdomain cookies, plain over http, optional client-IP header), `sessionCookieName`, `secureSessionOptions` (no session cookie cache), `secureEmailAndPasswordOptions` (password sign-up off; opting in also requires a verified email before sign-in) and `isRecentlyAuthenticated`. Session identities now carry `authenticatedAt`. `@codelitdev/oauth-server-kit/express` exports `parseTrustProxy`, `DEFAULT_TRUST_PROXY` and `createClientIpMiddleware`. - -Requires Better Auth 1.7.16 or later (`better-auth` and `@better-auth/oauth-provider` peer floor `^1.7.16`; tested on 1.7.22), which carries fixes for GHSA-fvxx-76fc-893x, GHSA-2f9c-7xj7-gh55 and GHSA-9hm7-xhfp-cx58. A product's resource client must be bound to its real Better Auth instance (`options` and a `$context` resolving `baseURL`), as newer `@better-auth/oauth-provider` requires. - -**Product changes for this release** - -- Upgrade `better-auth` and every `@better-auth/*` package together (1.7.22 needs `@better-auth/utils` 0.5.1, `better-call` 1.4.5 and `@better-fetch/fetch` 1.3.3; mismatched copies break plugin types). If your database ran Better Auth 1.7.0–1.7.2, make `account.issuer` nullable and drop `account_issuer_accountId_uidx` (see Better Auth's 1.7 upgrade guide). - -- Spread `secureCookieOptions({ baseURL, cookiePrefix, clientIpHeader })` into `advanced`, `secureSessionOptions()` into `session`, and set `emailAndPassword: secureEmailAndPasswordOptions()`. Switching to `__Host-` renames the session cookie, so users sign in once more; select credentials with `sessionCookieName(advanced)`. -- Set `app.set("trust proxy", parseTrustProxy(process.env.TRUST_PROXY))` and mount `createClientIpMiddleware` before Better Auth's handler. -- Under `__Host-` the OAuth provider's RP-initiated logout confirmation cookie is rejected by browsers; use cross-subdomain mode if you need that step. diff --git a/packages/billing/CHANGELOG.md b/packages/billing/CHANGELOG.md index a4b757d..7f44fd2 100644 --- a/packages/billing/CHANGELOG.md +++ b/packages/billing/CHANGELOG.md @@ -1,5 +1,9 @@ # @codelitdev/billing +## 0.10.0 + +No changes in this release. + ## 0.9.0 No changes in this release. diff --git a/packages/billing/package.json b/packages/billing/package.json index c679a0d..8327e4e 100644 --- a/packages/billing/package.json +++ b/packages/billing/package.json @@ -1,6 +1,6 @@ { "name": "@codelitdev/billing", - "version": "0.9.0", + "version": "0.10.0", "description": "Provider-neutral billing engine for CodeLit products", "author": "CodeLit", "type": "module", diff --git a/packages/design-system/CHANGELOG.md b/packages/design-system/CHANGELOG.md index 27dcbe0..d7f5a90 100644 --- a/packages/design-system/CHANGELOG.md +++ b/packages/design-system/CHANGELOG.md @@ -1,5 +1,9 @@ # @codelitdev/design-system +## 0.10.0 + +No changes in this release. + ## 0.9.0 No changes in this release. diff --git a/packages/design-system/package.json b/packages/design-system/package.json index a1b523d..7eba9a3 100644 --- a/packages/design-system/package.json +++ b/packages/design-system/package.json @@ -1,6 +1,6 @@ { "name": "@codelitdev/design-system", - "version": "0.9.0", + "version": "0.10.0", "description": "Shared CodeLit design tokens, Tailwind preset, and React primitives for CourseLit, MediaLit, SendLit, and FrontLit.", "license": "Apache-2.0", "author": "CodeLit", diff --git a/packages/mcp-server-kit/CHANGELOG.md b/packages/mcp-server-kit/CHANGELOG.md index 482fc5c..cdcb4e2 100644 --- a/packages/mcp-server-kit/CHANGELOG.md +++ b/packages/mcp-server-kit/CHANGELOG.md @@ -1,5 +1,11 @@ # @codelitdev/mcp-server-kit +## 0.10.0 + +### Patch Changes + +- @codelitdev/platform@0.10.0 + ## 0.9.0 ### Patch Changes diff --git a/packages/mcp-server-kit/package.json b/packages/mcp-server-kit/package.json index 3eebb8e..4eb1d38 100644 --- a/packages/mcp-server-kit/package.json +++ b/packages/mcp-server-kit/package.json @@ -1,6 +1,6 @@ { "name": "@codelitdev/mcp-server-kit", - "version": "0.9.0", + "version": "0.10.0", "description": "Stateless MCP 2026-07-28 endpoint, auth hooks, and error mapping for CodeLit products", "author": "CodeLit", "type": "module", @@ -38,7 +38,7 @@ "zod-to-json-schema": "^3.25.2" }, "peerDependencies": { - "@codelitdev/platform": ">=0.9.0" + "@codelitdev/platform": ">=0.10.0" }, "devDependencies": { "@codelitdev/platform": "workspace:*", diff --git a/packages/oauth-server-kit/CHANGELOG.md b/packages/oauth-server-kit/CHANGELOG.md index d043fdd..2d2c750 100644 --- a/packages/oauth-server-kit/CHANGELOG.md +++ b/packages/oauth-server-kit/CHANGELOG.md @@ -1,5 +1,21 @@ # @codelitdev/oauth-server-kit +## 0.10.0 + +### Minor Changes + +- 15e6f2c: Add hardened Better Auth defaults. `@codelitdev/oauth-server-kit/better-auth` exports `secureCookieOptions` (`__Host-` session cookies over https, `__Secure-` with cross-subdomain cookies, plain over http, optional client-IP header), `sessionCookieName`, `secureSessionOptions` (no session cookie cache), `secureEmailAndPasswordOptions` (password sign-up off; opting in also requires a verified email before sign-in) and `isRecentlyAuthenticated`. Session identities now carry `authenticatedAt`. `@codelitdev/oauth-server-kit/express` exports `parseTrustProxy`, `DEFAULT_TRUST_PROXY` and `createClientIpMiddleware`. + + Requires Better Auth 1.7.16 or later (`better-auth` and `@better-auth/oauth-provider` peer floor `^1.7.16`; tested on 1.7.22), which carries fixes for GHSA-fvxx-76fc-893x, GHSA-2f9c-7xj7-gh55 and GHSA-9hm7-xhfp-cx58. A product's resource client must be bound to its real Better Auth instance (`options` and a `$context` resolving `baseURL`), as newer `@better-auth/oauth-provider` requires. + + **Product changes for this release** + + - Upgrade `better-auth` and every `@better-auth/*` package together (1.7.22 needs `@better-auth/utils` 0.5.1, `better-call` 1.4.5 and `@better-fetch/fetch` 1.3.3; mismatched copies break plugin types). If your database ran Better Auth 1.7.0–1.7.2, make `account.issuer` nullable and drop `account_issuer_accountId_uidx` (see Better Auth's 1.7 upgrade guide). + + - Spread `secureCookieOptions({ baseURL, cookiePrefix, clientIpHeader })` into `advanced`, `secureSessionOptions()` into `session`, and set `emailAndPassword: secureEmailAndPasswordOptions()`. Switching to `__Host-` renames the session cookie, so users sign in once more; select credentials with `sessionCookieName(advanced)`. + - Set `app.set("trust proxy", parseTrustProxy(process.env.TRUST_PROXY))` and mount `createClientIpMiddleware` before Better Auth's handler. + - Under `__Host-` the OAuth provider's RP-initiated logout confirmation cookie is rejected by browsers; use cross-subdomain mode if you need that step. + ## 0.9.0 No changes in this release. diff --git a/packages/oauth-server-kit/package.json b/packages/oauth-server-kit/package.json index 3978744..bc891b7 100644 --- a/packages/oauth-server-kit/package.json +++ b/packages/oauth-server-kit/package.json @@ -1,6 +1,6 @@ { "name": "@codelitdev/oauth-server-kit", - "version": "0.9.0", + "version": "0.10.0", "description": "Lean Better Auth OAuth authentication framework for web, mobile, REST, and MCP surfaces.", "author": "CodeLit", "license": "MIT", diff --git a/packages/observability/CHANGELOG.md b/packages/observability/CHANGELOG.md index 351d1fc..92aaf64 100644 --- a/packages/observability/CHANGELOG.md +++ b/packages/observability/CHANGELOG.md @@ -1,5 +1,9 @@ # @codelitdev/observability +## 0.10.0 + +No changes in this release. + ## 0.9.0 No changes in this release. diff --git a/packages/observability/package.json b/packages/observability/package.json index a5b6400..6e28b4b 100644 --- a/packages/observability/package.json +++ b/packages/observability/package.json @@ -1,6 +1,6 @@ { "name": "@codelitdev/observability", - "version": "0.9.0", + "version": "0.10.0", "description": "Provider-neutral logging and optional telemetry for CodeLit products", "author": "CodeLit", "type": "module", diff --git a/packages/platform-cli/CHANGELOG.md b/packages/platform-cli/CHANGELOG.md index e281c0d..9c91d54 100644 --- a/packages/platform-cli/CHANGELOG.md +++ b/packages/platform-cli/CHANGELOG.md @@ -1,5 +1,9 @@ # @codelitdev/platform-cli +## 0.10.0 + +No changes in this release. + ## 0.9.0 No changes in this release. diff --git a/packages/platform-cli/package.json b/packages/platform-cli/package.json index 174b65d..cd80827 100644 --- a/packages/platform-cli/package.json +++ b/packages/platform-cli/package.json @@ -1,6 +1,6 @@ { "name": "@codelitdev/platform-cli", - "version": "0.9.0", + "version": "0.10.0", "description": "Create, check, and sync CodeLit Platform products", "author": "CodeLit", "type": "module", diff --git a/packages/platform-cli/src/preset.json b/packages/platform-cli/src/preset.json index cbb4d96..96c956f 100644 --- a/packages/platform-cli/src/preset.json +++ b/packages/platform-cli/src/preset.json @@ -5,42 +5,42 @@ }, "packages": { "@codelitdev/platform": { - "recommended": "0.9.0", + "recommended": "0.10.0", "supported": ">=0.1.0-alpha.0 <2", "minimumSecure": "0.1.0-alpha.0" }, "@codelitdev/observability": { - "recommended": "0.9.0", + "recommended": "0.10.0", "supported": ">=0.1.0-alpha.0 <2", "minimumSecure": "0.1.0-alpha.0" }, "@codelitdev/mcp-server-kit": { - "recommended": "0.9.0", + "recommended": "0.10.0", "supported": ">=0.1.0-alpha.0 <2", "minimumSecure": "0.1.0-alpha.0" }, "@codelitdev/platform-conformance": { - "recommended": "0.9.0", + "recommended": "0.10.0", "supported": ">=0.1.0-alpha.0 <2", "minimumSecure": "0.1.0-alpha.0" }, "@codelitdev/platform-cli": { - "recommended": "0.9.0", + "recommended": "0.10.0", "supported": ">=0.1.0-alpha.0 <2", "minimumSecure": "0.1.0-alpha.0" }, "@codelitdev/billing": { - "recommended": "0.9.0", + "recommended": "0.10.0", "supported": ">=0.1.0-alpha.4 <1", "minimumSecure": "0.1.0-alpha.4" }, "@codelitdev/oauth-server-kit": { - "recommended": "0.9.0", + "recommended": "0.10.0", "supported": ">=0.1.0-alpha.2 <1", "minimumSecure": "0.1.0-alpha.2" }, "@codelitdev/design-system": { - "recommended": "0.9.0", + "recommended": "0.10.0", "supported": ">=0.1.0-alpha.7 <1", "minimumSecure": "0.1.0-alpha.7" } diff --git a/packages/platform-conformance/CHANGELOG.md b/packages/platform-conformance/CHANGELOG.md index 9b4ada4..a488bce 100644 --- a/packages/platform-conformance/CHANGELOG.md +++ b/packages/platform-conformance/CHANGELOG.md @@ -1,5 +1,11 @@ # @codelitdev/platform-conformance +## 0.10.0 + +### Patch Changes + +- @codelitdev/platform@0.10.0 + ## 0.9.0 ### Patch Changes diff --git a/packages/platform-conformance/package.json b/packages/platform-conformance/package.json index ee2e67f..7742421 100644 --- a/packages/platform-conformance/package.json +++ b/packages/platform-conformance/package.json @@ -1,6 +1,6 @@ { "name": "@codelitdev/platform-conformance", - "version": "0.9.0", + "version": "0.10.0", "description": "Shared HTTP conformance suites for CodeLit Platform products", "author": "CodeLit", "type": "module", @@ -37,7 +37,7 @@ "tag": "latest" }, "peerDependencies": { - "@codelitdev/platform": ">=0.9.0" + "@codelitdev/platform": ">=0.10.0" }, "devDependencies": { "@codelitdev/platform": "workspace:*", diff --git a/packages/platform/CHANGELOG.md b/packages/platform/CHANGELOG.md index 8dd9070..7bb70cf 100644 --- a/packages/platform/CHANGELOG.md +++ b/packages/platform/CHANGELOG.md @@ -1,5 +1,11 @@ # @codelitdev/platform +## 0.10.0 + +### Patch Changes + +- @codelitdev/billing@0.10.0 + ## 0.9.0 ### Minor Changes diff --git a/packages/platform/package.json b/packages/platform/package.json index 5cdb1d3..d4a0d6f 100644 --- a/packages/platform/package.json +++ b/packages/platform/package.json @@ -1,6 +1,6 @@ { "name": "@codelitdev/platform", - "version": "0.9.0", + "version": "0.10.0", "description": "Composition kernel for CodeLit Platform products", "author": "CodeLit", "type": "module", @@ -56,7 +56,7 @@ "typescript": "^5.9.3" }, "peerDependencies": { - "@codelitdev/billing": ">=0.9.0", + "@codelitdev/billing": ">=0.10.0", "drizzle-orm": "^0.45.2" }, "peerDependenciesMeta": {