codeigniter4/shield

What's Changed

Fixed Bugs

• fix: PwnedValidator cannot reach the HIBP API by @michalsn in #1372

Full Changelog: v1.4.0...v1.4.1

What's Changed

Fixed Bugs

• fix: require login actions for magic links by @memleakd in #1329
• fix: remember-me token refresh fails in loginView() by @tomatlscomm in #1306

New Features

• feat: add conditional auth actions by @memleakd in #1328

Enhancements

• feat: add only option for authentication routes configuration by @dimtrovich in #1323
• feat: support hierarchical permission wildcards by @memleakd in #1327

New Contributors

• @dimtrovich made their first contribution in #1323
• @memleakd made their first contribution in #1328
• @tomatlscomm made their first contribution in #1306

Full Changelog: v1.3.0...v1.4.0

⚠️ Upgrade Notes

JWT: Minimum Key Length Now Enforced

If you are using the JWT authenticator with an HMAC algorithm (HS256, HS384, HS512), note that the underlying firebase/php-jwt library was upgraded to v7, which now enforces minimum key lengths at runtime. If your secret is too short, every JWT encode and decode call will throw: LogicException: Cannot encode/decode JWT: Provided key is too short.

How to fix it? Generate a new key:

php -r 'echo base64_encode(random_bytes(32));' # HS256
php -r 'echo base64_encode(random_bytes(48));' # HS384
php -r 'echo base64_encode(random_bytes(64));' # HS512

Then update your configuration:

// app/Config/AuthJWT.php
'secret' => '<output of the command above>',

What's Changed

Fixed Bugs

• fix: withPermissions() for users without permissions by @michalsn in #1290
• fix: check for empty actionClass so that actions can be disabled via .env params by @najdanovicivan in #1286

Enhancements

• PHP 8.5 compatibility
• feat: ignore robots when accessing magic link by @michalsn in #1294
• feat: add bot detection for ActionController by @michalsn in #1295
• feat: withIdentities/withGroups/withPermissions now work with first() by @michalsn in #1315

Translations

• lang: [sk] update Slovak translations for invalid email and token by @jozefrebjak in #1279
• lang: [it] Added the remaining translations for the Italian language by @Franky5831 in #1282

New Contributors

• @Franky5831 made their first contribution in #1282
• @najdanovicivan made their first contribution in #1286

Full Changelog: v1.2.0...v1.3.0

What's Changed

Fixed Bugs

• fix: escape string to prevent XSS attack by @warcooft in #1148
• fix: add missing args to lang('Auth.invalidEmail') by @kenjis in #1159
• fix: chain filter does not update last_active by @kenjis in #1160
• fix: Shield ignores AuthToken::$authenticatorHeader config by @alxjzx100 in #1169
• fix: cannot override emailer() function by @FrancoisChaumont in #1174
• fix: shield:user create does not assign a default group by @kenjis in #1162
• fix: add missing validation for group name to shield:user addgroup/removegroup by @kenjis in #1176
• fix: confusing lang message invalidEmail by @kenjis in #1175
• fix: CSP error in debugbar by @emaceda in #1242

Enhancements

• feat: Updated email templates with user information by @pmagictech in #1125
• feat: [Magic Link Login] add placeholder to invalidEmail to return user email. by @warcooft in #1145
• feat: add -g option to shield:user create by @kenjis in #1164
• feat: add UserModel::createNewUser() and RegisterController uses it by @kenjis in #1196
• feat: Add expiration date to access token & hmac keys by @CosDiabos in #1219
• feat: Add user relations loading methods for groups and permissions by @michalsn in #1257

Translations

• lang: [de] Update Auth.php - add missing translation by @sba in #1152
• lang: [fa] update error message for email verification failure by @datamweb in #1157
• lang: [ja] translate updated invalidEmail by @kenjis in #1158
• lang: [tr] Language additions by @YusufDurmaz in #1218
• lang: [nl] fix incorrect translation by @christianberkman in #1231
• lang: [pt-BR] translation completed by @xgrind in #1265

New Contributors

• @pmagictech made their first contribution in #1125
• @obozdag made their first contribution in #1138
• @warcooft made their first contribution in #1148
• @alxjzx100 made their first contribution in #1169
• @FrancoisChaumont made their first contribution in #1174
• @christianberkman made their first contribution in #1178
• @grimpirate made their first contribution in #1185
• @YusufDurmaz made their first contribution in #1216
• @amiraiman made their first contribution in #1223
• @emaceda made their first contribution in #1242
• @CosDiabos made their first contribution in #1219
• @xgrind made their first contribution in #1265

Full Changelog: v1.1.0...v1.2.0

What's Changed

Fixed Bugs

• fix: setup command cannot update Config\Autoload::$helpers with multiple lines by @kenjis in #1110
• fix: change hardcoded user entity with declared return type by @MrFrost-Nv27 in #1105

Enhancements

• feat: Change session manipulation methods from private to protected by @michalsn in #1113

Translations

• lang: [de] Added missing translations in Auth.php by @sba in #1106
• lang: [pl] add Polish translation by @mieszkou in #1117

New Contributors

• @mieszkou made their first contribution in #1117

Full Changelog: v1.0.3...v1.1.0

What's Changed

Fixed Bugs

• fix: Can't create new users via CLI if username is disabled by @kenjis in #1078
• fix: Call to a member function getErrors() on null in CheckQueryReturnTrait by @kenjis in #1088
• fix: passing Time to Query Builder in UserModel by @kenjis in #1095

Refactoring

• refactor: replace empty() by rector by @kenjis in #1081

Full Changelog: v1.0.2...v1.0.3

What's Changed

Fixed Bugs

• fix: JWT::loggedIn() does not remove Bearer prefix by @kenjis in #1040
• fix: LoginModel cannot use uuid for id column by @MrFrost-Nv27 in #1046

Translations

• lang: [nl] add Dutch translation by @NotCoffee418 in #1067

Refactoring

• test: improve tests execution time by @datamweb in #1041
• refactor: remove hard coded 'Y-m-d H:i:s' by @kenjis in #1027

New Contributors

• @MrFrost-Nv27 made their first contribution in #1046
• @NotCoffee418 made their first contribution in #1067

Full Changelog: v1.0.1...v1.0.2

What's Changed

Fixed Bugs

• fix: Shield may not send correct HTML mail by @kenjis in #1020

Translations

• lang: [cs] Add Czech Translation by @MichalSkoula in #1015

New Contributors

• @MichalSkoula made their first contribution in #1015

Full Changelog: v1.0.0...v1.0.1

Important!

• This has breaking changes. See Upgrade Guide.

What's Changed

Breaking Changes

• refactor: remove supportOldDangerousPassword by @kenjis in #976

Enhancements

• Allow specifying namespace when generating routes. by @lonnieezell in #985

Translations

• lang: [bg] Adjust translations for bg/Auth.php by @kpeu3u in #973

Refactoring

• refactor: remove unneeded deleted_at in $allowedFields by @kenjis in #963

Full Changelog: v1.0.0-beta.8...v1.0.0

Important!

• This has breaking changes. See Upgrade Guide.

What's Changed

SECURITY

• Insertion of Sensitive Information into Log
• Cleartext Storage of Sensitive Information in HMAC SHA256 Authentication

Breaking Changes

• refactor: remove Composer autoloading of auth helper by @kenjis in #893
• feat: add redirect denied for filter by @datamweb in #790
• perf: refactor Auth by @kenjis in #908

Fixed Bugs

• fix: replace url_is() by @kenjis in #915

Translations

• lang: [id] add translation by @kikuKeii in #913
• lang: [uk] Adjust translations for uk/Auth.php by @ivanBell199 in #935
• lang: [ru] add Russian language by @ivanBell199 in #936
• lang: [uk] Update Auth.php by @vasylzavalko in #953
• lang: [tr]&[uk] fix Invalid param in errorPasswordPwned by @datamweb in #954

Refactoring

• [Rector] Apply StringifyStrNeedlesRector by @samsonasik in #891
• refactor: replace /> with > for input tags by @kenjis in #894
• test: update Config\Registrar by @kenjis in #901
• refactor: update default value $hashCost to 12 by @datamweb in #916
• test: refactor SessionFilterTest by rector 0.18.6 by @datamweb in #927

New Contributors

• @samsonasik made their first contribution in #891
• @kikuKeii made their first contribution in #913
• @ivanBell199 made their first contribution in #935
• @vasylzavalko made their first contribution in #953

Full Changelog: v1.0.0-beta.7...v1.0.0-beta.8