Changelog¶

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

v0.3.0 — Post-Quantum (ML-DSA) Support (2026-03-15)¶

Configurable JWT algorithm — auth.algorithm setting supports RS256 (default), ML-DSA-65, and ML-DSA-87
ML-DSA key generation — Auto-generates ML-DSA key pairs (pqc_secret.bin, pqc_public.bin) via liboqs-python
ML-DSA token signing — JWTProvider creates and verifies ML-DSA-signed JWTs
PQC JWKS — JWKS endpoint serves kty: "AKP" keys with pub field for ML-DSA algorithms
pqc optional extra — pip install pico-auth[pqc] installs liboqs-python
auth_client.accepted_algorithms — Accepts RS256 + ML-DSA-65 + ML-DSA-87 by default in application.yaml
PQC test suite with 18 tests using mocked oqs (no liboqs required)

Group CRUD API — 7 endpoints at /api/v1/groups for creating, listing, updating, deleting groups and managing membership
groups JWT claim — Login and refresh tokens now include group IDs for the authenticated user
Group entity — SQLAlchemy model with id, name, description, org_id, timestamps
GroupMember entity — Composite-key model linking users to groups
GroupRepository — Data access for groups and group membership
GroupService — Business logic for group CRUD and member management
GroupController — REST controller at /api/v1/groups
@requires_group forwarding — LocalAuthConfigurer forwards the decorator from pico-client-auth
Error types: GroupNotFoundError, GroupExistsError, MemberAlreadyInGroupError, MemberNotInGroupError
Docker E2E test infrastructure (Dockerfile.test, Makefile)

DatabaseConfigurer guard patch: Removed the monkeypatch in local_auth_configurer.py that guarded AuthFastapiConfigurer.configure() against non-FastAPI calls. No longer needed after the protocol method rename in pico-sqlalchemy and pico-fastapi.

Registration endpoint with email uniqueness validation.
Login endpoint returning RS256 JWT access token and opaque refresh token.
Refresh token rotation with SHA-256 hashed storage — old tokens invalidated on use.
Profile endpoint (GET /me) returning user details from JWT claims.
Change password endpoint with old-password verification and token revocation.
Admin endpoints: list users, update user roles (requires superadmin or org_admin).
RBAC with four built-in roles: superadmin, org_admin, operator, viewer.
OIDC discovery: /.well-known/openid-configuration and /api/v1/auth/jwks.
Auto-generated RSA key pair stored as PEM files in configurable data directory.
Auto-created admin user on first startup (configurable).
Bcrypt password hashing with 72-byte input limit.
Full pico-stack integration: pico-ioc, pico-boot, pico-fastapi, pico-sqlalchemy.
E2E test suite with 34 tests and >95% code coverage.