Skip to content

v0.13.0

Release Date: 2026-10-06

SystemAuth can now be embedded in a host binary. The new identity/systemauthsvc package exposes everything the standalone systemauth command does — configuration loading, production safety checks, database setup, migrations, client bootstrap, health — so an application that composes several services in one process can mount SystemAuth next to its own handlers without copying code. Relying parties in the same process can be built from SystemAuth's provider metadata directly, without fetching discovery over the network. No breaking changes.

Highlights

  • identity/systemauthsvc — LoadConfig / LoadConfigBytes with overrides, CheckProduction, and New(ctx, cfg, Options) returning a Service with Handler(), Migrate, Ready, Close, Issuer(), and Metadata().
  • Production checks in the library — a signing key, an https issuer, a persistent database and secure cookies are enforced by New itself, not only by the command.
  • Discovery-free relying parties — Service.Metadata() feeds relyingparty.NewClientWithMetadata, so an in-process application can build its OIDC client before the listener is up.
  • Override-first configuration — overrides now apply before defaults and validation, so a host can supply values the file omits (for example the issuer), and SystemAuth configuration can be loaded from bytes embedded in a host's own config file.

New Features

  • identity/systemauthsvc:
    • LoadConfig(path, ...Override), LoadConfigBytes(data, format, ...Override) (yaml, yml, json, or auto-detect).
    • Overrides: WithIssuer, WithDefaultIssuer, WithDatabase, WithSigningKeyFile, WithDefaultSigningKeyPEM, WithKeyID.
    • CheckProduction(cfg, opts) reports every problem at once, wrapping ErrNotProductionReady.
    • Options: Dev, Logger, SigningKey, an injected DB + DBDialect or EntClient, Migrate, ServerOptions. A database or Ent client supplied by the caller is left open on Close.
    • Service: Handler(), ServeHTTP, Migrate(ctx) (idempotent), Ready(ctx), Close(), Issuer(), KeyID(), Metadata(), Discovery(), Server(), Config(), StorageName(), EntClient().
    • Helpers: OpenDatabase, Migrate(ctx, cfg), NewLogger.
  • identity/systemauth: Server.OpenIDConfiguration() and Server.Ready(ctx); DecodeConfig(data, format) and DecodeConfigFile(path) decode (with ${ENV} expansion) without applying defaults or validating.

Changes

  • cmd/systemauth is now a thin caller of systemauthsvc. Flags, environment variables and defaults are unchanged. The production-refusal message now begins systemauthsvc: refusing to start in production mode: and still lists every problem with a hint; the MySQL driver error reads "not supported".
  • ParseConfig and LoadConfig in identity/systemauth behave as before (decode, defaults, validate).

Documentation

  • New guide: Embedding SystemAuth in a host binary, including the security trade-off (the token-signing key shares the process with application code, and restarts affect sign-in for every application).
  • Design of record for the next feature set: ADR-003 and INIT-SYSTEMFORGE-006 — verified email in SystemAuth, delivered through omnimail.

Upgrade Notes

No code changes are required. Applications that embed SystemAuth should switch from copied setup code to systemauthsvc. Note that importing systemauthsvc links the SQLite driver, which needs cgo; builds with CGO_ENABLED=0 work and use PostgreSQL.

What's Next

Verified email for SystemAuth via omnimail (INIT-SYSTEMFORGE-006), and consumer convergence onto the relying-party contract (INIT-SYSTEMFORGE-005 Phase 3).