- Added ExecuteWithAuthorized method to the Script struct, allowing scripts to be executed with user authorization information.
- Updated existing Execute method to utilize ExecuteWithAuthorized for improved authorization handling.
- Enhanced script execution tests to verify behavior with and without authorized information, ensuring accurate context management.
- Implemented authorized information conversion to a map for easier integration with runtime environments.
- Refactored context handling in script execution to ensure authorized data is correctly passed and utilized.
- Enhanced the OIDC user info structure to include Yao member profile information, such as member ID, display name, bio, avatar, and email.
- Updated the SignIDToken and MakeOIDCUserInfo functions to incorporate member details if available, improving team context handling.
- Refactored the issueTokens function to accept a new IssueTokensParams structure, streamlining token issuance with team and member context.
- Adjusted login functions to retrieve and pass member profile data during token issuance, ensuring comprehensive user context in authentication flows.
- Added a new endpoint `PUT /teams/:team_id/members/:member_id/profile` to allow members to update their profile information, including display name, bio, avatar, and email.
- Introduced `UpdateMemberProfileRequest` structure to handle profile update requests.
- Enhanced the `GinMemberUpdateProfile` handler to process profile updates with appropriate validation and error handling.
- Implemented business logic in `memberUpdateProfile` to ensure only the member can update their own profile.
- Expanded test cases to validate the new profile update functionality, ensuring comprehensive coverage for various update scenarios.
- Added the `UpdateRobotMember` method to handle updates for robot members, including validation for member existence, type checks, and email uniqueness.
- Introduced a new `UpdateRobotMemberRequest` structure to facilitate updates via the API, allowing for modifications to various fields such as `robot_email`, `status`, and `autonomous_mode`.
- Enhanced the `GinMemberUpdateRobot` handler to process update requests, ensuring proper authentication and error handling for various scenarios.
- Expanded test coverage with new test cases for the robot member update functionality, validating successful updates, error conditions, and edge cases.
- Refactored existing member management logic to integrate the new update capabilities, improving overall system robustness and user experience.
- Introduced the `robot_email`, `authorized_senders`, and `email_filter_rules` fields to the robot member model, enhancing the configuration options for robot members.
- Updated the member creation and existence check logic to ensure the uniqueness of `robot_email` globally, improving data integrity.
- Refactored API endpoints and request/response structures to accommodate the new fields, ensuring consistency across the member management system.
- Enhanced test cases to validate the new robot member features, including scenarios for email uniqueness and configuration updates, improving overall test coverage and reliability.
- Introduced member_id as a unique identifier for members, improving data integrity and consistency across member operations.
- Updated member-related functions to utilize member_id instead of internal IDs, enhancing API usability and clarity.
- Implemented email existence checks for team members, allowing for better validation during member creation and updates.
- Refactored existing tests to accommodate changes in member identification and email validation, ensuring comprehensive coverage and reliability.
- Added new API endpoint for checking if an email exists within a team, improving user experience during member management.
- Implemented path normalization in the ACL enforcement logic to ensure consistent matching by removing trailing slashes from request paths.
- Introduced a new utility function, normalizePath, to handle path normalization across various components.
- Updated endpoint matching and public endpoint checks to utilize the normalized paths, improving access decision accuracy.
- Enhanced team and member creation logic to include a new field, __yao_team_id, for better data management.
- Added detailed logging for ACL enforcement failures in the OAuth guard, providing clearer insights into permission issues.
- Updated error messages in the ACL enforcement logic to include contextual information such as client and user IDs, enhancing debugging capabilities.
- Introduced new constraints (CreatorOnly, EditorOnly) in the data access model, allowing for more granular control over data visibility based on user roles.
- Enhanced scope definitions to support additional constraints, improving flexibility in access control configurations.
- Updated documentation to reflect changes in data constraints and their usage in API handlers.
- Refactored the ACL enforcement process to include a comprehensive chain of permission checks for clients, users, teams, and members.
- Introduced data access constraints (OwnerOnly, TeamOnly) to enhance access control based on endpoint requirements.
- Updated the Error struct to include the stage of permission checks where failures occur, improving error reporting.
- Enhanced scope management with wildcard matching capabilities and added checks for restricted scopes.
- Implemented tests to validate the enforcement logic and ensure correct handling of data access constraints.
- Updated the OAuth guard to utilize a standardized response format for error handling, enhancing consistency across error responses.
- Integrated detailed error information for insufficient scope and permission denied scenarios, providing clearer insights into access issues.
- Modified the ACL enforcement logic to return structured error details, allowing for better handling of permission-related errors.
- Enhanced the ErrorResponse struct to include optional fields for reason, required scopes, and missing scopes, following OAuth 2.0 extensibility guidelines.
- Integrated ACL (Access Control List) functionality into the OAuth guard, enabling permission checks and rate limiting based on ACL configurations.
- Updated error responses for token validation and refresh token handling to use standardized error types.
- Enhanced error handling for ACL-related issues, providing detailed HTTP responses based on specific ACL error types.
- Improved overall security and user experience by ensuring proper authorization checks are enforced during API requests.
- Added Remember Me flag to LoginContext and AuthorizedInfo structures to support extended session management.
- Updated GetAuthorizedInfo function to retrieve Remember Me state from the context.
- Modified token issuance logic to accommodate Remember Me settings, adjusting token expiration durations accordingly.
- Preserved Remember Me state during login and team selection processes, improving user experience and session persistence.
- Introduced the invitation model in bindata.go, including the new invitation.mod.yao file.
- Updated system models to include the invitation model for better integration.
- Added invitation code related error handling in default.go, enhancing user experience during invitation processes.
- Implemented invitation code management methods in the user provider interface, allowing for creation, usage, and deletion of invitation codes.
- Enhanced entry configuration to support invitation code verification, improving the user registration flow.
- Added a new endpoint for verifying invitation codes in user routing, streamlining the invitation redemption process.
- Modified the AcceptInvitation method to accept an optional user ID parameter, allowing for updates to the user ID when accepting invitations without an existing user ID.
- Adjusted related tests to include the new user ID parameter, ensuring comprehensive coverage of invitation acceptance scenarios.
- Updated the team invitation acceptance logic to utilize the new parameter, enhancing the invitation flow and user management capabilities.
- Updated the AcceptInvitation method to require both invitation ID and token, improving the invitation acceptance process.
- Modified related tests to accommodate the new invitation ID parameter, ensuring comprehensive coverage of acceptance scenarios.
- Enhanced the invitation acceptance endpoint to validate invitation ID, providing clearer error handling for invalid or expired invitations.
- Refactored tests to include detailed scenarios for accepting invitations, including success and failure cases, ensuring robust testing of the invitation flow.
- Enhanced the SignIDToken method to include the original Yao user ID in the token claims, improving user identification.
- Updated the MakeOIDCUserInfo function to extract and set the Yao user ID from the user map, ensuring consistency in user information.
- Modified the OIDCUserInfo structure to include a field for Yao user ID, facilitating better integration with Yao-specific features.
- Adjusted the team invitation response to include the inviter's user ID, enhancing the invitation context.
- Enhanced the OIDCUserInfo structure to include YaoTypeID and YaoType fields for better user type management.
- Updated SignIDToken method to incorporate YaoTypeID and YaoType claims, ensuring comprehensive user type information in ID tokens.
- Modified team creation logic to set default type_id based on team configuration, improving team management capabilities.
- Refactored token generation methods to support additional type information in access and refresh tokens, enhancing overall token customization.
- Added 'locale' field to user type structure for language localization.
- Updated API methods to include locale in pricing and published types retrieval.
- Enhanced tests to validate locale handling in user type operations, ensuring robust support for multiple languages.
- Updated the UpdateUserLastLogin method to accept a LoginContext, allowing for tracking of last login IP, user agent, device, and platform.
- Modified the LoginThirdParty and LoginByUserID functions to utilize the new LoginContext, improving the accuracy of login tracking.
- Enhanced the user model to include fields for last login details, ensuring comprehensive user activity logging.
- Refactored tests to validate the new login context handling, ensuring robust coverage of the updated functionality.
- Updated methods related to refresh token generation and storage to accept optional extra claims, allowing for additional metadata such as team_id and tenant_id.
- Refactored tests to utilize the new method signatures, ensuring comprehensive coverage of the updated functionality.
- Introduced a new endpoint for team selection that issues tokens with team-specific claims, improving user experience in multi-team scenarios.
- Removed unnecessary blank lines in the TokenClaims, AuthorizedInfo, and JWTClaims structs to enhance code clarity and maintainability.
- Ensured consistent formatting across the claims structures for better organization.
- Updated storeAccessToken and related methods to accept an optional extraClaims parameter for additional flexibility.
- Modified MakeAccessToken and generateAccessTokenWithScope functions to incorporate extra claims, enhancing token customization.
- Adjusted tests to utilize the new extraClaims parameter, ensuring comprehensive coverage of the updated functionality.
- Introduced GetTeamsByMember and CountTeamsByMember methods in the DefaultUser struct to retrieve teams associated with a specific member and count the total number of teams, respectively.
- Updated the UserProvider interface to include these new methods.
- Enhanced the login response structure to include a status indicating whether team selection is required based on the user's team membership.
- Added error handling for team retrieval in the authentication process.
- Introduced invitation_id handling for member management, allowing for unique identification of pending invitations.
- Added methods to create, update, and remove members by invitation_id, improving the invitation workflow.
- Updated member data structures and API responses to include invitation-related fields, enhancing clarity and usability.
- Implemented tests for invitation ID operations, ensuring robust validation and error handling.
- Refactored team access checks to streamline member management processes.
- Introduced methods to set and retrieve authorized information from the context, enhancing the OAuth guard functionality.
- Added a new `AuthorizedInfo` type to encapsulate user-related data such as subject, client ID, user ID, and scope.
- Implemented session ID retrieval from various sources (cookies, headers, query strings) to improve session management.
- Updated test utilities to support the creation of test users and access tokens, ensuring comprehensive testing of OAuth functionalities.
- Introduced new constants for team and member error handling, enhancing error reporting.
- Added default field lists for teams and members, improving data structure organization.
- Expanded the UserProvider interface with methods for team and member management, including creation, updates, and retrieval.
- Enhanced the NewDefaultUser function to support team and member configurations, ensuring flexibility in user management.
- Added support for numeric ID generation in the OAuth service, replacing the previous NanoID approach for better compatibility.
- Refactored client ID and secret generation methods to be public and renamed them for consistency.
- Enhanced dynamic client registration to allow optional client ID usage.
- Updated client configuration loading to include validation and registration of clients if not found.
- Improved error handling and logging for client configuration processes.
- Adjusted tests to reflect changes in ID generation and client configuration handling.
- Added `SignIDToken` method to the OAuth service for signing ID tokens with user data and claims.
- Introduced `MakeAccessToken` and `MakeRefreshToken` methods for generating access and refresh tokens.
- Implemented user fingerprint management with `Subject` and `UserID` methods for mapping user IDs to unique NanoIDs.
- Enhanced `LoginByUserID` to generate and return OIDC tokens and access tokens during user login.
- Updated `OIDCUserInfo` mapping to include additional user attributes and improved handling of optional fields.
- Added `last_login_ip` field to the user model to track the IP address of the last login.
- Updated `UpdateUserLastLogin` method to accept an IP address parameter for logging.
- Introduced `GetUserWithScopes` method to retrieve user information along with associated scopes and permissions.
- Modified `LoginThirdParty` and `LoginByUserID` functions to include IP address handling during login processes.
- Improved user provider interface to reflect the new methods and parameters, enhancing overall user management capabilities.
- Updated GetUserProvider to return an error alongside the user provider for better error handling.
- Modified CreateUser, CreateRole, and CreateType methods to return user and role IDs as strings instead of interfaces, enhancing type safety.
- Adjusted test data setup in oauth_test.go to reflect changes in user ID handling and ensure compatibility with the updated user provider interface.
- Removed unnecessary nil checks and improved assertions in tests for clarity and reliability.
- Implemented methods to check the existence of OAuth accounts, roles, types, and users by their respective identifiers, enhancing the user provider's functionality.
- Added error handling for these methods to ensure robust feedback in case of failures.
- Updated the user provider interface to include the new existence check methods, improving overall usability and maintainability.
- Added Multi-Factor Authentication (MFA) capabilities to the user provider, including methods for generating MFA secrets, enabling/disabling MFA, and verifying MFA codes.
- Introduced MFA configuration options, allowing customization of issuer, algorithm, digits, and recovery codes.
- Enhanced error handling for MFA operations, providing clear feedback for failures.
- Updated user model to include MFA-related fields and improved database interactions for MFA management.
- Refactored existing user provider methods to integrate MFA functionality seamlessly.
- Added methods for creating, retrieving, updating, and deleting user types, improving user type management capabilities.
- Introduced type field lists in DefaultUser and DefaultUserOptions for better type configuration.
- Implemented error handling for user type operations, ensuring robust feedback for failures.
- Enhanced user deletion process to clean up associated data before removing user accounts.
- Updated tests to cover new user type functionalities and ensure proper cleanup of test data.
- Added role field lists to DefaultUser and DefaultUserOptions for better role configuration.
- Implemented methods for creating, retrieving, updating, and deleting user roles, improving role management capabilities.
- Enhanced error handling for role operations, ensuring robust feedback for failures.
- Introduced ClearUserRole method to remove role assignments from users, streamlining user-role management.
- Updated tests to ensure proper cleanup of role data and maintain a clean testing environment.
- Added methods for creating, retrieving, updating, and deleting OAuth accounts, improving user authentication capabilities.
- Introduced default OAuth account fields and options for better configuration management.
- Enhanced error handling for OAuth account operations, ensuring robust feedback for failures.
- Updated tests to ensure unique identifiers and improved cleanup processes for test data, maintaining a clean testing environment.
- Added the go-nanoid library for generating unique IDs, enhancing user ID management.
- Refactored user provider methods to improve clarity and consistency, including updates to user retrieval and authentication processes.
- Adjusted user model fields to align with new ID generation strategy, ensuring compliance with best practices.
- Cleaned up code by removing obsolete test files and improving overall structure for better maintainability.
- Added OIDC standard types for ID Token and User Info, improving compliance with OpenID Connect specifications.
- Updated the Provider struct to support user info source types, allowing retrieval from endpoints, ID tokens, or access tokens.
- Enhanced the authback and user info retrieval functions to handle cached user data and improve error management.
- Introduced new utility functions for managing user info mapping and merging cached data, streamlining the user information processing flow.
- Updated OAuth token handling to include PKCE (Proof Key for Code Exchange) parameters, improving security for authorization code grants.
- Refactored token management tests to incorporate PKCE code verifier and challenge, ensuring compliance with OAuth 2.1 standards.
- Enhanced refresh token handling to validate requested scopes against originally granted scopes, improving security and compliance.
- Updated various methods to support optional scope parameters, streamlining token management and validation processes.
- Improved test coverage for token introspection and exchange scenarios, ensuring robust validation of token handling logic.
- Introduced global test certificate paths to avoid redundant certificate generation across tests, improving efficiency.
- Implemented a function to create temporary certificates once for all tests, ensuring consistent usage of signing certificates.
- Updated test configurations to utilize the new certificate management, enhancing clarity and maintainability.
- Added cleanup functionality for global test certificates to ensure proper resource management after tests.
- Removed outdated token management tests from the user provider, including tests for storing, revoking, and retrieving tokens.
- Updated the user provider interface to reflect the removal of token management methods, ensuring cleaner code and improved maintainability.
- Streamlined the test suite by focusing on relevant user management functionalities, enhancing overall test clarity and effectiveness.
- Renamed existing hello world endpoints to public and added a new protected endpoint with OAuth guard.
- Updated test cases to reflect the new endpoint structure and added tests for protected endpoint access with and without valid tokens.
- Enhanced response handling for public and protected endpoints to ensure consistent output and proper status codes.
- Updated the SigningConfig, TokenConfig, SecurityConfig, and ClientConfig structures to include optional default values for various fields, improving clarity and usability.
- Added comments to specify default values and optionality for each configuration parameter, enhancing documentation within the code.
- This change aims to streamline the configuration process for OAuth service implementations.
- Added dynamic client registration support in the OAuth service, implementing RFC 7591 for automatic client registration.
- Introduced methods for generating client IDs and secrets, validating registration requests, and creating client information.
- Enhanced authorization flow by validating client requests, redirect URIs, and response types.
- Implemented token management features, including token introspection, token exchange, and refresh token handling.
- Improved security with state parameter generation and validation, as well as code challenge methods for PKCE.
- Updated endpoint discovery and server metadata retrieval to include new features and capabilities.
- Introduced a new user model `yao/models/user.mod.yao` to support user management functionalities.
- Updated the OAuth service to utilize the new `DefaultUser` provider, enhancing user authentication and management capabilities.
- Refactored user retrieval methods to align with the new user model structure, ensuring compatibility and improved functionality.
- Added token management methods to the user provider interface, streamlining token handling processes.
- Enhanced test utilities to include the new user model for comprehensive testing coverage.
- Deleted the OAuth interface and related types that were previously defined in the `interfaces.go` and `types.go` files, streamlining the codebase.
- Updated the `oauth.go` file to integrate user and client providers directly, enhancing the service's functionality and reducing complexity.
- Refactored the user information retrieval method to utilize the new user provider structure, ensuring compatibility with the updated architecture.
