@o3co/create-auth-provider 0.5.3 → 0.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o3co/create-auth-provider",
-  "version": "0.5.3",
+  "version": "0.6.0",
   "description": "Scaffold a new o3co/auth.provider project from the standalone template",
   "license": "Apache-2.0",
   "type": "module",
@@ -29,7 +29,7 @@
   },
   "devDependencies": {
     "@types/node": "^25.1.0",
-    "vitest": "^4.1.2"
+    "vitest": "^4.1.4"
   },
   "scripts": {
     "build": "tsc",

package/templates/standalone/config/application.conf

@@ -8,15 +8,17 @@ http {
 oauth {
   jwt {
     issuer = ${?OAUTH_JWT_ISSUER}
-    # SF-1 (v0.5.1): legacy typ acceptance for the central JWT verifier.
-    # When true (default), tokens whose `typ` header is absent are
-    # accepted with a `jwt_verify_legacy_typ` warning so v0.4.x tokens
-    # keep verifying through the v0.5.x transition window. Flip to false
-    # in v0.6+ to reject typ-less tokens. Active default per the v0.5.1
-    # ADR: literal default lives in HOCON (zod has no `.default()`).
-    # Operators set OAUTH_JWT_LEGACY_TYP_ACCEPT to override (set "false"
-    # to enforce strict mode early).
-    legacyTypAccept = true
+    # SF-1 / Phase G / S2: legacy typ acceptance for the
+    # central JWT verifier. The the default is `false`: tokens whose
+    # `typ` header is absent are rejected. Operators with v0.4.x tokens
+    # still in circulation can opt back to legacy acceptance with
+    # `OAUTH_JWT_LEGACY_TYP_ACCEPT=true` for their own bounded migration
+    # window — when set, typ-less tokens verify with a
+    # `jwt_verify_legacy_typ` warning. Per the v0.5.1 ADR the literal
+    # default lives in HOCON, not the Zod schema — this keeps a single
+    # source of truth so the env-var override path and the file default
+    # don't drift.
+    legacyTypAccept = false
     legacyTypAccept = ${?OAUTH_JWT_LEGACY_TYP_ACCEPT}
     signingKey {
       provider = "local"
@@ -60,24 +62,11 @@ oauth {
     # store to Redis with old tokens still in circulation. Operators set
     # OAUTH_REFRESH_TOKEN_UNKNOWN_FAMILY_POLICY for env-var override.
     # unknownFamilyPolicy = "reject"
-    # SF-6 (v0.5.1): handling for refresh tokens lacking jti or family_id
-    # claims when rotation is wired. "reject" (default) is safe. Use
-    # "accept-with-warning" only during a migration window where v0.4.x
-    # tokens (issued before claim standardization) are still in circulation;
-    # that mode skips replay detection for the request and emits an audit
-    # log. Pair with `unknownFamilyPolicy = "accept"` to avoid immediate
-    # rejection on the next refresh — see Phase F migration guide.
+    # SF-6 / Phase G / M6: refresh tokens lacking jti or
+    # family_id claims when rotation is wired are always rejected.
+    # The only valid value is "reject"; the `accept-with-warning`
+    # migration-window opt-in was removed.
     # legacyRtPolicy = "reject"
-    # AS-12 (v0.5.1): v0.5.x default accepts v0.4.x refresh tokens that use
-    # payload.type = "refresh" or claims.user.id as the subject. Set false
-    # only after all pre-v0.5 refresh tokens have expired; remaining legacy
-    # tokens will be rejected with invalid_grant. The strict marker-required
-    # gate is preserved across both flag values: a typ-less JWT with no
-    # payload.type is rejected at the refresh-grant gate even when
-    # oauth.jwt.legacyTypAccept = true (AT-as-RT confusion stays defended).
-    # Operators set OAUTH_REFRESH_TOKEN_LEGACY_TOKEN_COMPAT for env-var
-    # override.
-    # legacyTokenCompat = true
   }
   grants {
     session { enabled = true, enabled = ${?OAUTH_GRANTS_SESSION_ENABLED} }

package/templates/standalone/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@o3co/auth-provider-standalone",
-	"version": "0.5.3",
+	"version": "0.6.0",
 	"private": true,
 	"license": "Apache-2.0",
 	"engines": {
@@ -45,7 +45,7 @@
 		"supertest": "^7.1.0",
 		"tsx": "^4.21.0",
 		"typescript": "^5.9.3",
-		"vitest": "^4.1.2"
+		"vitest": "^4.1.4"
 	},
 	"pnpm": {
 		"onlyBuiltDependencies": [

package/templates/versions.json

@@ -1,10 +1,10 @@
 {
-	"@o3co/auth-provider-core": "0.5.3",
-	"@o3co/auth-provider-federation-google": "0.5.3",
-	"@o3co/auth-provider-federation-github": "0.5.3",
-	"@o3co/auth-provider-oauth": "0.5.3",
-	"@o3co/auth-provider-oauth-token-exchange": "0.5.3",
-	"@o3co/auth-provider-session": "0.5.3",
-	"@o3co/auth-provider-foundation": "0.5.3",
-	"@o3co/auth-provider-redis": "0.5.3"
+	"@o3co/auth-provider-core": "0.6.0",
+	"@o3co/auth-provider-federation-google": "0.6.0",
+	"@o3co/auth-provider-federation-github": "0.6.0",
+	"@o3co/auth-provider-oauth": "0.6.0",
+	"@o3co/auth-provider-oauth-token-exchange": "0.6.0",
+	"@o3co/auth-provider-session": "0.6.0",
+	"@o3co/auth-provider-foundation": "0.6.0",
+	"@o3co/auth-provider-redis": "0.6.0"
 }