@ambushsoftworks/nestjs-auth-graphql 0.16.0-rc.3 → 0.16.0

package/CHANGELOG.md

@@ -27,6 +27,68 @@ for buried obligations. **The marker was introduced in 0.9.0 and has not been
 retro-applied**, so it is reliable from 0.9.0 onward only. Convention adopted
 from `@ambushsoftworks/nestjs-payments-graphql`.
 
+## [0.16.0] - 2026-10-01
+
+Passkeys (WebAuthn), and step-up re-authentication to protect adding one.
+Identical to `0.16.0-rc.3`, which LiftIQ piloted on a real Android Credential
+Manager and against Postgres. This entry is the summary for anyone coming from
+0.15.x; the three release-candidate entries below have the detail.
+
+**Nothing changes unless you enable passkeys**, with two exceptions noted
+under Changed.
+
+### ⚠ External configuration required
+
+Only if you enable passkeys (details: README, "Passkeys → Platform setup"):
+
+- Install the optional peer `@simplewebauthn/server@^14`; it needs Node.js 20+.
+- **Web:** the frontend on HTTPS at `passkey.rp.id` or a subdomain, its exact
+  origin listed in `passkey.rp.origins`.
+- **Android:** `https://<rp.id>/.well-known/assetlinks.json` granting
+  `delegate_permission/common.get_login_creds`, and
+  `android:apk-key-hash:<base64url SHA-256 of the signing certificate>` in
+  `passkey.rp.origins`.
+- **iOS:** `https://<rp.id>/.well-known/apple-app-site-association` with
+  `webcredentials.apps`, and `webcredentials:<rp.id>` in Associated Domains.
+- **Database:** passkey credential and challenge tables
+  (`examples/passkeys/schema.prisma`), and the value `step-up` if your
+  verification repository stores its type in a database enum.
+
+### Added
+
+- **Passkeys**: `PasskeyService`, `IPasskeyRepository`, 11 `perform*` methods
+  on `BaseAuthResolver`. Usernameless sign-in, browser autofill, user
+  verification required by default (configurable), realm-bound credentials.
+- **Step-up re-authentication** (`StepUpService`): password, passkey or email
+  code, giving a five-minute token bound to user and realm and reusable until
+  it expires. **Required to add a passkey.**
+- **Owner notification emails** when a passkey is added or removed, sent by
+  the package through optional `IEmailService` methods; turn off with
+  `passkey.emailNotifications`.
+- **`@ambushsoftworks/nestjs-auth-graphql/testing`**:
+  `assertPasskeyRepositoryContract` (with `userIds`, `realms` and `cleanup`
+  for real databases) and `SoftwareAuthenticator`.
+- **`examples/passkeys/`**: reference Prisma schema and adapter, verified with
+  the contract on PostgreSQL 16.
+- Error codes `STEP_UP_FAILED`, `STEP_UP_REQUIRED`, `STEP_UP_UNAVAILABLE`,
+  `PASSKEY_AUTHENTICATION_FAILED`, `PASSKEY_ALREADY_REGISTERED`,
+  `CANNOT_REMOVE_LAST_AUTH_METHOD`. **Do not map `STEP_UP_FAILED` to a token
+  refresh**; it is not an expired session.
+
+### Changed
+
+- `RepositoryVerificationType` includes `STEP_UP`. An adapter with an
+  exhaustive `switch` over it needs the new case.
+- `BaseAuthResolver` gains protected members `authPasskeys` and `authStepUp`
+  (its constructor is unchanged). A subclass declaring members with those
+  names must rename them.
+
+### Upgrading from an RC
+
+From rc.1, read the rc.2 entry: the error codes changed, and the package now
+sends the passkey emails, so remove any you send from the hooks. From rc.2,
+nothing breaks; the contract gained options. From rc.3, nothing changes.
+
 ## [0.16.0-rc.3] - 2026-10-01
 
 The repository contract from rc.2 could not run against a real schema,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ambushsoftworks/nestjs-auth-graphql",
-  "version": "0.16.0-rc.3",
+  "version": "0.16.0",
   "description": "Production-grade authentication package for NestJS with GraphQL, supporting JWT, OAuth, email/SMS verification, and biometric auth",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",