Skip to content

v0.19.0

Release Date: 2026-10-22

This release adds a minimum sign-up age to SystemAuth. A deployment that sets one asks a person's birth month and year before their first upstream login creates an account, and refuses anyone younger while keeping nothing about them. Nothing is breaking, and nothing changes for a deployment that does not set it.

Highlights

  • The age question before an account exists. With social_login.signup_minimum_age, a first login that would create an account is parked with only its provider and destination, and SystemAuth asks the birth month and year on /signup/age. At or over the age, the upstream login restarts and creates the account; under it, the parked login is discarded and the browser is not asked again for a day. See Minimum Sign-Up Age.
  • A neutral question. Month and year start empty, and the year list includes years too recent to pass. Without the day, the last day of the birth month counts, so nobody younger passes.
  • Nothing kept on refusal. The provider's email and profile are never stored before the answer, the answer is never stored at all, and only the refusal is logged, with the provider and nothing about the person.
  • Invites first. With invite-only sign-up, an uninvited login is refused before it is asked, and an invite is used only once the age is confirmed.
  • Wording for hosts. systemauthsvc.Options.SignupAgePage, or systemauth.WithSignupAgePage for an embedded server, sets the page's title, question and refusal.

Upgrade notes

  1. Go modules. No dependency changes. The go directive stays at 1.26.6.
  2. Turning it on. Set social_login.signup_minimum_age in the SystemAuth configuration. 0, the default, asks nothing; a value outside 0 to 120 fails at startup.
  3. Existing accounts. Accounts created before the setting are not asked, and children signing in with login tokens are never asked.
  4. No migration. The parked logins use the existing login-state store; this release adds no schema changes.

Known limits

  • The age is stated, not verified. Verifying a parent's consent for a child stays the application's responsibility.
  • A refusal is remembered in the browser, so clearing cookies allows another answer.