Repository navigation

v0.28.0: rate limits, security events and remaining review findings - #72

Merged

grokify merged 37 commits into

mainfrom

release/v0.28.0

Oct 29, 2026

Merged

v0.28.0: rate limits, security events and remaining review findings#72
grokify merged 37 commits into
mainfrom
release/v0.28.0

Commits on Oct 29, 2026
- docs(specs): add the remaining review findings to the hardening roadmap
  
  grokify
  and
  claude
  committed
  a6144db
- feat(relyingparty)!: remove static API key authentication
  
  grokify
  and
  claude
  committed
  bc9558e
- docs: describe the removal of static API keys from relying parties
  
  grokify
  and
  claude
  committed
  1c4e6db
- docs(security): add the threat model
  
  grokify
  and
  claude
  committed
  5cee54e
- feat(clientaddr): one client-address rule for SystemAuth, the BFF and rate limits
  
  grokify
  and
  claude
  committed
  2687031
- test(clientaddr): cover spoofed headers, proxy chains, IPv6 and ports
  
  grokify
  and
  claude
  committed
  59e4812
- feat(ratelimit): layered limits with RateLimit headers
  
  grokify
  and
  claude
  committed
  395e6ee
- feat(systemauth): apply layered rate limits on one shared storage
  
  grokify
  and
  claude
  committed
  50704e6
- test(ratelimit): cover each layer, headers, outages and exemptions
  
  grokify
  and
  claude
  committed
  33fa3c0
- docs: document client addresses and layered rate limits
  
  grokify
  and
  claude
  committed
  b202382
- fix(bff): refuse a session cookie with SameSite other than Strict or Lax
  
  grokify
  and
  claude
  committed
  107bf57
- fix(systemauth): revoke the token family in EmbeddedOAuthProvider.Revoke
  
  grokify
  and
  claude
  committed
  3c9390d
- fix(multiapp): set ReadHeaderTimeout on every HTTP server systemforge builds
  
  grokify
  and
  claude
  committed
  b390161
- feat(apierror): add helpers that log internal errors without sending their text
  
  grokify
  and
  claude
  committed
  346fe78
- fix(organization): stop sending service error text in API responses
  
  grokify
  and
  claude
  committed
  511701e
- fix(marketplace): stop sending store error text in API responses
  
  grokify
  and
  claude
  committed
  1d36333
- fix(contract): stop sending provider and token error text in responses
  
  grokify
  and
  claude
  committed
  13364ef
- fix(invite): stop sending service error text in API responses
  
  grokify
  and
  claude
  committed
  f5df37b
- fix(signupapi): keep store error text out of the waitlist invite response
  
  grokify
  and
  claude
  committed
  e11ca69
- fix(connections): send fixed messages for provider failures
  
  grokify
  and
  claude
  committed
  e3ecd1a
- fix(middleware): answer token failures with fixed messages
  
  grokify
  and
  claude
  committed
  f2ce11d
- fix(managedprincipal): send the matched sentinel's text in error responses
  
  grokify
  and
  claude
  committed
  74356a9
- fix(systemauth): keep storage error text out of identity sync responses
  
  grokify
  and
  claude
  committed
  92756f5
- test(marketplace): drop the unused option parameter from the access fixture
  
  grokify
  and
  claude
  committed
  fe08eb8
- fix(systemauth): log OAuth errors as a summary without stack traces
  
  grokify
  and
  claude
  committed
  f82ee42
- feat(audit): add request IDs, a no-op emitter and a log emitter
  
  grokify
  and
  claude
  committed
  8f4422e
- feat(systemauth): record security events through an audit emitter
  
  grokify
  and
  claude
  committed
  b764542
- feat(identity): record membership, platform admin and service account changes
  
  grokify
  and
  claude
  committed
  0c33a0b
- feat(systemauthsvc): pass the audit emitter to SystemAuth and record waivers
  
  grokify
  and
  claude
  committed
  a82d77e
- test: check that logs and security events carry no secrets
  
  grokify
  and
  claude
  committed
  72be528
- docs(security): describe the security events and their fields
  
  grokify
  and
  claude
  committed
  0af03b0
- fix(systemauth): record the visitor's address in security events behind a proxy
  
  grokify
  and
  claude
  committed
  c21a796
- docs(security): describe rate limiting as shipped in the threat model
  
  grokify
  and
  claude
  committed
  3bde6b3
- docs(security): take security events' client address from the client-address rule
  
  grokify
  and
  claude
  committed
  b03941e
- docs(release): add v0.28.0 changelog and release notes
  
  grokify
  and
  claude
  committed
  ab7fd4b
- docs(specs): mark the v0.28.0 roadmap items done
  
  grokify
  and
  claude
  committed
  0a46fb9
- fix: log the matched route instead of the request path
  
  grokify
  and
  claude
  committed
  22bf9e4

Commits

Commits on Oct 29, 2026