Tags

Tags give the ability to mark specific points in history as being important

  • v0.6.1

    protected
    5e96d818 · release: 0.6.1 — evidence release ·
    Release: auth v0.6.1 
    othala v0.6.1

Evidence release: the login-tier logic that 0.5.0's outage slipped past is now
proven against the captured production flow on every push, passkey eviction is
corrected to the model Kratos actually allows, and e2e keeps its evidence.

- **Passkey eviction is self-service, never an admin action.** Kratos refuses
  an admin DELETE of a passkey credential (400, upstream default), so the admin
  UI no longer offers it. The documented path is contain, recover, self-remove,
  delete-identity; the e2e P-block proves the real eviction (the victim removes
  the lost passkey in settings, the other session survives).
- Login tier derivation extracted into `deriveLoginTiers`, unit-tested against
  the real captured production flow and mutation-proven red on the 0.5.0 logic.
- Auth pages share one panel style; both admin user forms share one script
  component; `isSessionFresh` drops a guard that never changed the outcome.

- e2e renders the login journey in a real browser and hard-asserts all three
  tiers; passkey login is no longer fixme'd; CDP ceremonies wait
  deterministically; the N2 scrape retries then fails instead of skipping.
- e2e runs on MR, main and tag pipelines; verify and lint ride api pipelines so
  a lever run can never read greener than the push; flaky-then-green runs keep
  their first-attempt artifacts.
- The DOS-2 flood test carries a 60s budget: 8-9s on a SaaS small runner,
  27s under contention, which reddened a green merge.

  • v0.6.0

    protected
    131dc5ad · release: 0.6.0 — the outage-ending release ·
    Release: auth v0.6.0 
    othala 0.6.0 — the outage-ending release

  • v0.5.0

    protected
    7d5f4fab · release: fold the architecture-page entry into 0.5.0 — it ships in this tag ·
    Release: auth v0.5.0 
    v0.5.0 — the open-source-ready convergence: docs truth pass, D1 invite email, purity-gate rewrite, vitest consolidation, at-a-glance architecture

  • v0.4.0

    protected
    4c65e995 · release: v0.4.0 changelog + version mirror ·
    Release: auth v0.4.0 
    v0.4.0

Admin-POST and AAL2 step-up fixes, extensible Hydra CORS for browser-SPA
clients, the othala.dunn.dev docs site, and an ADR/docs rewrite that
stands the project alone. Full notes in CHANGELOG.md.

  • v0.3.0

    protected
    44db4472 · fix(e2e): playwright base image v1.60.0 → v1.61.1 — match @playwright/test 1.61.1 ·
    Release: auth v0.3.0 
    Othala v0.3.0 — CVP hardening, access-model, OTel tracing, portal UX pass

Security hardening pass (admin authority on immutable identity id,
highest-available AAL on settings, admin-recovery refusal + wildcard blocks),
access-model refactor (central group registry + forward-auth gating), PII-safe
OpenTelemetry tracing, and the passkey-first portal UX/pristine pass.
~100 commits since v0.3.0-rc. Full substrate validated pre-tag via
BUILD_CI_IMAGE pipeline 2645135898 (smoke 32/32 + browser e2e green).

  • v0.3.0-rc

    protected
    79f2e5b2 · feat(portal): /api/forward-auth group-gate endpoint for non-OIDC apps (Caddy forward_auth) ·
    Release: auth v0.3.0-rc 
    v0.3.0-rc — RC4: /api/forward-auth group-gate endpoint

  • v0.2.0

    protected
    2bde3a1c · release(v0.2.0): land adversarial e2e specs + refresh changelog ·
    Release: auth v0.2.0 
    Othala v0.2.0 — the convergence release (PRIVATE; public flip deferred to v0.3.0)

Runtime manifest model, rename to Othala, OAuth2 challenge surface converged
(dual-listener portal, /oauth2 flow URLs, Authorization: Bearer recovery-gate),
default-group tile gating, functional contact form. Config-only deploy shape;
459 unit tests, astro check/build clean, smoke green on the carmine QEMU runner.

This tag enables the dag.dunn.dev deploy (iac pins it; CI publishes othala +
othala/ldap-bridge images). Repo stays PRIVATE — public flip is a deliberate
v0.3.0 act.

  • v0.1.3

    protected
    3486d96b · Merge branch 'chore/sbom-filename-2.3.3' into 'main' ·
    Release: auth v0.1.3 
    v0.1.3

fix: 3 SBOMs in registry per release, no overwrite.

v0.1.2 only published one SBOM because the catalog's container-sbom
template used a fixed <package_name>-container.sbom.json filename;
all three jobs wrote auth-container.sbom.json and overwrote each
other. Pipeline 2.3.3 added the sbom_filename input; this consumer
now picks per-service filenames so all three SBOMs land at
/-/packages/generic/auth/v0.1.3/{consent,ldap-bridge,portal}-container.sbom.json.

No code changes since v0.1.1; just CI packaging.

  • v0.1.2

    protected
    ddbf21cc · Merge branch 'fix/sbom-package-collocation' into 'main' ·
    Release: auth v0.1.2 
    v0.1.2

fix: collocate SBOMs under single 'auth' generic package so the
release-create linker reaches them. v0.1.1 had three SBOMs scattered
across per-service packages; the Release page's portal-container.sbom.json
link pointed at an empty path.

No code changes since v0.1.1 — just the CI packaging fix.

  • v0.1.1

    protected
    60712a59 · Merge branch 'chore/full-release-pipeline' into 'main' ·
    Release: auth v0.1.1 
    v0.1.1

Full release pipeline lights up: each tag now produces

- 3 signed UBI 9.8 container images (consent, ldap-bridge, portal)
- 3 CycloneDX SBOMs via syft (uploaded to project's generic package registry)
- GitLab Release record (portal SBOM linked from the release page)

No code changes; first time exercising the container-sbom +
release-create catalog templates against this repo. Cuts the
"shippable" question: auth substrate is image-ready, SBOM-traceable,
sig-verifiable, ready for the carmine pyinfra cutover.

  • v0.1.0

    protected
    31b49d6c · ci: retrigger after enabling container registry · 
    v0.1.0

First versioned release of the auth substrate (Kratos + Hydra +
consent + LDAP bridge + portal). Containerized via the
dunn.dev/pipeline 2.3.1 catalog onto UBI 9 bases:

- consent + ldap-bridge: ci-runtime-go (UBI 9 micro)
- portal: ci-runtime-node (UBI 9 nodejs-22-minimal)
- caddy: separate dunn.dev/caddy-estate image

Images publish at:
  registry.gitlab.com/dunn.dev/auth/{consent,ldap-bridge,portal}:v0.1.0