@hilbras/keystone 1.1.0

package/CHANGELOG.md

@@ -0,0 +1,53 @@
+# Changelog
+
+All notable changes to Hilbras Keystone are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.1.0] - 2026-09-19
+
+Security hardening, architecture improvements, and enterprise SSO enhancements.
+
+### Added
+
+- **SCIM provisioning** — User and group provisioning endpoints (`/scim/v2/Users`, `/scim/v2/Groups`) for identity provider integration.
+- **Enterprise SSO** — SAML 2.0 and OIDC enterprise connectors with SCIM user provisioning.
+- **mTLS support** — Service account resolution via client certificate headers.
+- **Comprehensive audit logging** — All authentication events (register, login, logout, refresh) and state-changing operations now emit audit events.
+- **Rate limiting** — Added to 8 sensitive endpoints: password reset, magic links, email verification, SMS OTP send/verify, and organization creation.
+- **Owner-only access** — Configuration and permission management endpoints restricted to platform owner.
+- **Organization membership checks** — Workflow operations now verify org membership.
+- **XML injection prevention** — SAML metadata generation now escapes dynamic values.
+- **Cryptographic nonces** — Rate limiter uses `crypto.randomBytes()` instead of `Math.random()`.
+- **Shared helpers** — `sendResultError` and `escapeXml` utilities for consistent error handling and XML safety.
+
+### Changed
+
+- **Admin routes split** — Monolithic `admin.ts` (1071 lines) refactored into 7 focused modules under `src/routes/admin/` (platform, organizations, permissions, sso, billing, webhooks, helpers).
+- **Repository pattern enforced** — 9 route files updated to use DI container repositories instead of direct database access.
+- **Dynamic imports eliminated** — 15+ `await import()` workarounds converted to static imports across 10 files.
+- **Permission endpoints** — Now require owner-only access (was any authenticated user).
+- **Workflow endpoints** — Now require organization membership (was any authenticated user).
+- **Config endpoints** — Now require owner-only access (was any authenticated user).
+
+### Fixed
+
+- **Critical runtime crash** — Missing `cache` import in `src/index.ts` causing shutdown failures.
+- **Import ordering bug** — `sessions.ts` using `config` and `hashToken` before import declaration.
+- **Missing dependency** — Added `fastify-plugin` as explicit dependency.
+- **Redundant dynamic imports** — Removed 2 unnecessary `await import("jose")` calls in `tokens.ts`.
+- **Duplicate code** — Consolidated 3 duplicate `sendResultError` functions to shared helper.
+- **Unused imports** — Cleaned up across 8+ files.
+
+### Security
+
+- **Rate limiting** — 8 endpoints protected against abuse (password reset, magic links, email verification, SMS OTP, org creation).
+- **Authorization hardening** — 16 endpoints updated with proper owner/role/org membership checks.
+- **XML injection prevention** — SAML metadata generation escaped in 2 files.
+- **Cryptographic security** — Rate limiter nonce generation uses secure random bytes.
+- **Information leak removal** — Queue class name no longer exposed in API response.
+- **Input validation** — All route inputs validated with Zod schemas.
+
+[1.1.0]: https://github.com/Hilbras/Keystone/releases/tag/v1.1.0
+[1.0.0]: https://github.com/Hilbras/Keystone/releases/tag/v1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hilbras
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.