Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Removed

• AuthClient.getSessions() and GET /api/auth/sessions — not implemented on jadu-auth server
• AuthClient.changePassword() and useJaduAuth().changePassword — POST /api/auth/change-password not implemented on jadu-auth server

Fixed

• be/src/index.ts: wait for async error logging to flush before exiting on uncaughtException.
• useJaduAuth: preserve optimistic setUser(cachedUser) for non-impersonation session restores while still keeping impersonation-safe cleanup.
• package/src/server/jaduAuth.ts: temporarily relax JWT authAppId enforcement (fall back to configured appId) to unblock production token validation.

[0.1.0] - 2025-02-09

Added

• Initial release of @scenarix/jadu-auth
• JaduAuthProvider and useJaduAuth React integration
• AuthClient for low-level auth API calls
• createAuthenticatedAxios with automatic token refresh
• JaduAuth server SDK for JWT verification
• Email verification, password reset, and forgot password flows

Fixed

• getMe response shape: Backend returns { data: { user: User } }; SDK now correctly extracts user instead of treating entire data as User
• Error mapping: When backend omits error.code, SDK now infers error type from HTTP status (400→VALIDATION_ERROR, 401→SESSION_EXPIRED, etc.)
• EMAIL_NOT_VERIFIED: Added handling for backend errorCode: 'EMAIL_NOT_VERIFIED' in error responses

Changed

• Replaced magic number 15 * 60 * 1000 with DEFAULT_ACCESS_TOKEN_TTL_MS constant
• Unified debug log prefix to [JaduAuth] across authClient and authenticatedAxios
• Made ApiErrorResponse.error optional to align with backend response shape
• Added appId to provider init effect dependencies

Added (API)

• changePassword(currentPassword, newPassword) on useJaduAuth for authenticated password changes
• VERSION and SDK_NAME exports from main package
• Security note in TokenStorage JSDoc regarding localStorage and XSS

Removed

• getAuthClient and initAuthClient (unused singletons; use new AuthClient(config) instead)