v0.28.2

• Add a new privilege for managing user identities. Before this change it was required to have the 'admin' privilege to do this.
• Verify response endpoint is now exposed as a form on the identity resource.
• It's now possible to mark an identity as an MFA identity when verifying using the 'enableMfa' property.

v0.28.1

• Fix a timing bug when using Redis as the kv store.

v0.28.0

• #563: Users can now enter a code sent to them by email as a one-time-password. This feature has been added to the authorizion_challege / first party auth API but is not yet exposed to the admin interface.
• Refactored and centralized abstract cache system, supporting redis/valkey and memory stores.
• Email identities can now be verified in the admin UI and via the API.
• Allow authorization_challenge to be preselected in 'new client'
• Add button in admin UI to enable/disable MFA for a specific email identity.
• Dropped support for Node 16, which is EOL.

v0.27.6

• Update @curveball/browser, which fixes an issue with submitting HTML forms that don't use GET or POST.

v0.27.5

• #555: Another fix for launching the a12nserver npx script. (@Zen-cronic)

v0.27.4

• Schemas misspelled as 'schema'. Sorry for all the releases, I dont know to do a clean test of npx without doing a release first, so the feedback loop is change->release->test.

v0.27.3

• Copy simplewebauthn browser bundle into assets directory for easier distribution.

v0.27.2

• Fix missing entries in files section in package.json, preventing the npx @curveball/a12n-server tool from working.

v0.27.1

• Fix HTTP/500 error when requesting a developer access token.

v0.27.0

• authorization_challenge now supports a TOTP challenge step!
• Refactored logging system. Less ugly now with fewer enums!
• authorization_challenge clients can now specify remote_addr and user_agent, so the server can keep accurate logs of the users' browser that's trying to authenticate.
• Return the correct 'ttl' value for a verification-token.
• Instead of 1 generic error with a few parameters, the server now emits invididual error codes for each kind of error that may be emitted from the authorization_challenge endpoint. This is change is based on examples in more recent drafts and should simplify the process for clients a bit. This is a BC break for authorization_challenge.
• Renamed login_failed event to password-check-failed.
• Added events: password-check-succes, totp-success, login-challenge-started, login-challenge-success