- This may seems silly but the functionality is shared
between oauth2 and auth with no changes so it makes it nicer
not to have an oauth2/logout route like before
- Add a ClientStateMiddleware that loads the client state into the
request context and prepares a ClientStateResponseWriter for
downstream handlers
- Clean up some of the handling around session and cookie state, for
example don't write if there are no events to be processed
- Redo the Defaultts() method for config to be useful again.
- Prefix LogoutMethod with Auth to be consistent
Discovered many problems with the abstractions along the way
and did small fixes to get to the end of the auth module.
- Use more constants for random strings
- Create forcing functions to deal with the upgrades to different
interfaces
- Change changelog format to use keepachangelog standard
- Refactor the config to be made of substructs to help organize all the
pieces
- Add the new interfaces to the configuration
- Clean up module loading (no unnecessary reflection to create new value)
- Change User interface to have a Get/SetPID not E-mail/Username, this
way we don't ever have to refer to one or the other, we just always
assume pid. In the case of Confirm/Recover we'll have to make a GetEmail
or there won't be a way for us to get the e-mail to send to.
- Delete the xsrf nonsense in the core
- Re-add the age-old "Values" from the Context. This was originally
there for exactly the documented purpose. However the Context holding
the request form values negated it's use. It's back because of this
new separation.
- Make the auth success path set the authboss.CookieRemember value in
the context before calling it's callback.
- Stop logged in users from accessing pages like auth/recover etc.
- Ensure that half-authed users are allowed access to auth-like pages.
- Make sure that if users have a remember token, it's processed before
we decide if a user is logged in or not, preventing or granting access
to these pages.
- Fix#58
- Having the default logger set to nil was troublesome because some errors
are hard to detect without a logger. This falls under "sane default"
changes and so should be made.
