@eminuckan/spine 0.2.4 → 0.3.1

package/CHANGELOG.md

@@ -4,18 +4,37 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+No unreleased changes.
+
+## [0.3.1] - 2026-06-01
+
+### Changed
+
+- Clarified README positioning, backend contract guidance, and quick-start snippets for the open source package.
+
+## [0.3.0] - 2026-06-01
+
 ### Added
 
+- Added a public-surface check that blocks private project names and app-specific authorization hints from the public package.
+- Added per-login allowlists for app-specific OIDC authorization parameters and public state UI context.
 - Added Keycloak-compatible back-channel and front-channel logout handlers.
 - Added Redis session indexes by user, OIDC `sid`, and legacy `session_state`.
 - Added session listing and destroy primitives for current-user, all-user, `sid`, and `session_state` cleanup.
 - Added OIDC client authentication method configuration for public and confidential clients.
+- Added generic tenant, identity, permission, access, and API configuration surfaces for custom SaaS backend contracts.
+- Added Vitest coverage for authorization parameters, access evaluation, permissions, tenant state, identity state, and API header configuration.
+- Added React Router SaaS example app, installation docs, adapter docs, roadmap, maintainer notes, and Codex maintenance plan.
+- Added an adapter request issue template for framework and provider integrations.
 
 ### Changed
 
 - Switched server-side auth from direct `oauth4webapi` calls to `openid-client`.
+- Removed built-in product-flow redirects from route protection; consuming apps now own all setup, billing, and tenant workflow routing through `configureRouteProtection`.
+- Changed built-in package defaults from legacy project branding to Spine-oriented defaults.
 - Made default logout RP-Initiated Logout and kept app-local cleanup explicit with `logout=local`.
 - Removed `offline_access` from the default scope; apps can opt in explicitly if they need long-lived refresh tokens.
+- Updated CI and release validation to run the full `pnpm check` gate.
 
 ## [0.2.4] - 2026-04-25
 

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,39 @@
+# Code of Conduct
+
+## Our Pledge
+
+We want Spine to be a welcoming project for contributors of all experience levels. We commit to making participation respectful, constructive, and harassment-free.
+
+## Our Standards
+
+Examples of behavior that help create a positive environment:
+
+- Being respectful in language and tone
+- Giving actionable, kind feedback
+- Accepting good-faith disagreement
+- Prioritizing shared understanding over ego
+- Helping newer contributors learn the codebase
+
+Examples of unacceptable behavior:
+
+- Harassment or discrimination
+- Personal attacks
+- Trolling or deliberately hostile behavior
+- Publishing private information without permission
+- Repeatedly derailing technical discussions
+
+## Enforcement
+
+Project maintainers are responsible for clarifying and enforcing this code of conduct. They may remove, edit, or reject comments, commits, issues, pull requests, and other contributions that violate these standards.
+
+## Reporting
+
+If you experience or witness unacceptable behavior, open a private report to the maintainer at `eminuckan@gmail.com`.
+
+## Scope
+
+This code of conduct applies within project spaces and in public spaces when someone is representing the project.
+
+## Attribution
+
+This document is inspired by the Contributor Covenant and adapted for this project.

package/CONTRIBUTING.md

@@ -0,0 +1,78 @@
+# Contributing to Spine
+
+Thanks for contributing.
+
+Spine is intended to be a reusable foundation for SaaS infrastructure, so changes should optimize for clarity, composability, and portability across products.
+
+## Before You Start
+
+- Read [README.md](README.md)
+- Read [docs/architecture.md](docs/architecture.md)
+- Read [docs/backend-adaptation.md](docs/backend-adaptation.md)
+- Check existing issues and pull requests first
+
+## Local Setup
+
+```bash
+pnpm install
+pnpm check
+```
+
+## Project Structure
+
+| Path | Purpose |
+| --- | --- |
+| `src/auth` | OAuth, sessions, token refresh, route protection |
+| `src/tenant` | Tenant store, provider, cookie, and server helpers |
+| `src/identity` | Identity cache, client store, and provider |
+| `src/permissions` | Permission store, hooks, components, and server protection |
+| `src/api-client` | API config factory, fetch middleware, and retry/error helpers |
+| `src/query-client` | TanStack Query defaults and utilities |
+| `src/signalr` | Realtime client primitives |
+| `src/logging` | Logging utilities |
+| `src/react-router` | React Router adapter entry points |
+| `docs` | Project documentation |
+
+## Contribution Rules
+
+- Keep core modules framework-agnostic unless the file is inside an adapter namespace
+- Prefer configuration hooks over hardcoded product behavior
+- Avoid shipping product-specific routes, claim names, endpoint paths, or UI assumptions into core
+- Keep public APIs small and explicit
+- Update documentation when behavior or public APIs change
+- Add or update changelog entries for user-visible changes
+
+## Adapter Philosophy
+
+When deciding where code should live:
+
+- Put it in core if it can work across multiple apps with configuration
+- Put it in an adapter if it depends on framework primitives
+- Keep it in the consuming app if it expresses product policy
+
+Examples:
+
+- Good for core: token refresh, tenant cookie utilities, permission checks, identity caching
+- Good for adapters: framework-specific redirects, loader wrappers, request helpers
+- Good for apps: setup redirects, entitlement gating, domain permission constants
+
+## Pull Request Checklist
+
+- `pnpm check` passes
+- Public API changes are documented
+- Changelog is updated when needed
+- No product-specific behavior leaked into core without a configuration escape hatch
+
+## Commit Messages
+
+Use concise, English commit messages.
+
+Examples:
+
+- `docs: rewrite README for open source release`
+- `feat: add configurable permission route protection`
+- `refactor: move tenant cookie policy into core config`
+
+## Release Notes
+
+Maintainers should also read [docs/releasing.md](docs/releasing.md).

package/MAINTAINERS.md

@@ -0,0 +1,43 @@
+# Maintainers
+
+## Current Maintainer
+
+- Muhammet Emin Uckan, primary maintainer
+
+## Maintainer Responsibilities
+
+The maintainer owns:
+
+- reviewing issues and pull requests
+- keeping the package installable and documented
+- preserving the boundary between Spine core, framework adapters, and consuming apps
+- coordinating security reports
+- preparing releases and changelog entries
+- validating changes with `pnpm check` and package dry runs
+
+## Review Policy
+
+Changes should be reviewed against these questions:
+
+- Does this solve a repeated SaaS infrastructure problem?
+- Can it work across multiple apps without product-specific naming?
+- Is the core still framework-agnostic?
+- Does this belong in core, a framework adapter, provider guidance, or the app?
+- Are public API changes documented and covered by tests?
+
+## Release Policy
+
+Spine follows semver. While the package is on a `0.x` line, breaking changes may still happen, but they must be documented and kept migration-friendly where practical.
+
+Before publishing:
+
+```bash
+pnpm check
+npm pack --dry-run
+```
+
+## Codex-Assisted Maintenance
+
+Codex may be used to help with issue triage, pull request review, release checks, documentation updates, and security hardening. The maintainer remains responsible for all final decisions, shipped code, and release artifacts.
+
+See [docs/codex-maintenance.md](docs/codex-maintenance.md) for the operating plan.