- Introduce a refresh gate mechanism to prevent duplicate refresh attempts for the same token, allowing concurrent requests to safely handle expired tokens.
- Update the guard and refresh token logic to utilize the new error handling for in-progress refresh operations, enhancing the reliability of the authentication flow.
- Remove the previous caching mechanism for refresh status, streamlining the code and improving clarity in the refresh process.
- Enhance the OAuth authentication flow to allow concurrent requests to safely handle expired tokens without triggering multiple refresh attempts.
- Introduce a mechanism to mark refresh tokens as being rotated, ensuring that only one request processes the refresh while others can proceed with valid claims.
- Update the guard logic to reflect these changes, improving the overall efficiency and reliability of token management.
- Update the `Authenticate` method in the OAuth guard to allow for token refresh when an access token is expired but still valid.
- Introduce `TryRefreshToken` method to handle the refresh token logic, including token rotation and cookie management.
- Implement `VerifyTokenAllowExpired` and `VerifyRefreshToken` methods to improve token verification processes.
- Adjust error handling to provide clearer responses for token refresh failures.
- Refactor token expiration strategies in the login process to ensure consistent handling of access and refresh tokens.
- Clean up the `guard.go` file by removing the `isAPIKey` and `getAccessTokenFromAPIKey` methods, which are no longer needed.
- Add comments to clarify the purpose of the API key authentication block, ensuring it remains intact for future implementation.
- This change streamlines the access token retrieval process and improves code clarity.
- Add SecureCookie field to EntryConfig struct for frontend access
- Add GetCookieName helper to response package for dynamic cookie names
- Update guard.go to use GetCookieName instead of hardcoded __Host- prefix
- Pass secure_cookie setting to /user/entry API response
Co-authored-by: Cursor <cursoragent@cursor.com>
- Updated the `build` and `watch` commands to accept a single argument for `<sui>` and made the `<template>` argument optional, improving usability.
- Introduced a default template assignment for the `agent` SUI, ensuring a more intuitive setup for users.
- Enhanced error messages for command usage to provide clearer guidance on expected input format.
- Added new OpenAPI file to the bindata, improving the framework's capabilities for API integration.
- Deleted obsolete agent API files (agent.go, api.go, api_test.go, types.go) to streamline the codebase.
- Refactored the agent loading logic to initialize the API instance correctly, ensuring proper integration with the new structure.
- Updated context handling to improve clarity and maintainability across the agent's functionality.
- Enhanced error handling and cache management in the agent's initialization process.
- Updated context creation in handleChat, handleGenerateTitle, and handleGeneratePrompts to use the request context, improving context management.
- Commented out unused context settings for assistant ID, silent mode, history visibility, and client type to streamline the code.
- Refactored context handling in assistant methods to enhance clarity and maintainability.
- Removed deprecated functions and cleaned up the context structure for better performance and readability.
- Added detailed logging for ACL enforcement failures in the OAuth guard, providing clearer insights into permission issues.
- Updated error messages in the ACL enforcement logic to include contextual information such as client and user IDs, enhancing debugging capabilities.
- Introduced new constraints (CreatorOnly, EditorOnly) in the data access model, allowing for more granular control over data visibility based on user roles.
- Enhanced scope definitions to support additional constraints, improving flexibility in access control configurations.
- Updated documentation to reflect changes in data constraints and their usage in API handlers.
- Updated the OAuth guard to utilize a standardized response format for error handling, enhancing consistency across error responses.
- Integrated detailed error information for insufficient scope and permission denied scenarios, providing clearer insights into access issues.
- Modified the ACL enforcement logic to return structured error details, allowing for better handling of permission-related errors.
- Enhanced the ErrorResponse struct to include optional fields for reason, required scopes, and missing scopes, following OAuth 2.0 extensibility guidelines.
- Updated the OAuth guard to set authorized information in the context using the new authorized package.
- Refactored the GetAuthorizedInfo function to utilize the authorized.GetInfo method, improving clarity and maintainability.
- Enhanced the ACL implementation by adding scope resolution logic in the Enforce method, ensuring proper access control based on user roles and scopes.
- Improved error handling and logging during ACL operations, providing better insights into access decisions.
- Integrated ACL (Access Control List) functionality into the OAuth guard, enabling permission checks and rate limiting based on ACL configurations.
- Updated error responses for token validation and refresh token handling to use standardized error types.
- Enhanced error handling for ACL-related issues, providing detailed HTTP responses based on specific ACL error types.
- Improved overall security and user experience by ensuring proper authorization checks are enforced during API requests.
- Added Remember Me flag to LoginContext and AuthorizedInfo structures to support extended session management.
- Updated GetAuthorizedInfo function to retrieve Remember Me state from the context.
- Modified token issuance logic to accommodate Remember Me settings, adjusting token expiration durations accordingly.
- Preserved Remember Me state during login and team selection processes, improving user experience and session persistence.
- Implemented GinLogout function to handle user logout, including revoking access and refresh tokens, clearing authentication cookies, and returning a success response.
- Added public method GetRefreshToken to retrieve the refresh token from the request, enhancing token management.
- Updated user routing to link the logout endpoint to the new GinLogout function, improving the user authentication flow.
- Updated modification times for various asset files in bindata.go to reflect recent changes.
- Enhanced user authentication by adding support for custom claims in the context during authorization, improving flexibility in handling user data.
- Refactored entry verification logic to generate and send OTPs for user registration, streamlining the registration process and improving user experience.
- Introduced new status handling for user accounts, ensuring proper feedback for pending, unverified, and disabled accounts during login attempts.
- Updated methods related to refresh token generation and storage to accept optional extra claims, allowing for additional metadata such as team_id and tenant_id.
- Refactored tests to utilize the new method signatures, ensuring comprehensive coverage of the updated functionality.
- Introduced a new endpoint for team selection that issues tokens with team-specific claims, improving user experience in multi-team scenarios.
- Introduced methods to set and retrieve authorized information from the context, enhancing the OAuth guard functionality.
- Added a new `AuthorizedInfo` type to encapsulate user-related data such as subject, client ID, user ID, and scope.
- Implemented session ID retrieval from various sources (cookies, headers, query strings) to improve session management.
- Updated test utilities to support the creation of test users and access tokens, ensuring comprehensive testing of OAuth functionalities.
- Added functionality to capture and return the raw query string and post payload in the JSON response for both public and protected hello world endpoints.
- Improved response structure to include additional context for debugging and client-side processing.
- Updated response methods to standardize Content-Type header to "application/json" across OAuth endpoints, enhancing compliance with JSON standards.
- Refactored error and success response methods to streamline response generation without unnecessary wrappers, improving clarity and maintainability.
- Enhanced security by ensuring all responses include appropriate OAuth security headers, aligning with best practices for sensitive endpoints.
- Simplified test assertions for Content-Type in OAuth tests, ensuring consistency in response validation.
- Renamed existing hello world endpoints to public and added a new protected endpoint with OAuth guard.
- Updated test cases to reflect the new endpoint structure and added tests for protected endpoint access with and without valid tokens.
- Enhanced response handling for public and protected endpoints to ensure consistent output and proper status codes.
- Introduced a new system store management feature, allowing for the loading of predefined system stores such as cache and OAuth client stores.
- Added a `loadSystemStores` function to handle the loading of system stores with variable replacement for configuration paths.
- Enhanced the `Load` function to include the loading of system stores, improving the overall store management process.
- Updated test utilities to support loading system stores for testing, ensuring comprehensive coverage and functionality.
- Refactored the `replaceVars` function to facilitate variable replacement in JSON strings, enhancing flexibility in store configurations.
