[dependabot]

Bumps github.com/plexusone/systemforge from 0.11.0 to 0.14.0.

Release notes

Sourced from github.com/plexusone/systemforge's releases.

v0.14.0

Release Notes: v0.14.0

Full Changelog: plexusone/systemforge@v0.13.0...v0.14.0

v0.13.0

Release Notes: v0.13.0

Full Changelog: plexusone/systemforge@v0.12.0...v0.13.0

v0.12.0

Release Notes: v0.12.0

Full Changelog: plexusone/systemforge@v0.11.0...v0.12.0

Changelog

Sourced from github.com/plexusone/systemforge's changelog.

[v0.14.0] - 2026-10-11

Highlights

• Managed principals: humans without an email, such as young learners, created and controlled by guardian and educator managers, who sign them in with QR-friendly login tokens; opt-in per deployment and per client (ADR-005)
• Principal is the sole identity root: the legacy User model and its dependent tables are removed, so password login, social login, federation sync, and SCIM all resolve a person to the same principal (ADR-004)
• Resource servers can authenticate AI agents with AAuth through a protocol-neutral request principal and authenticator chain shared with bearer, API-key, and BFF-session credentials
• Fixed a panic on every ascending SCIM list sort, including the default order
• Security: the marketplace, organization, and invite APIs act for the authenticated caller and check organization permissions, instead of trusting IDs in the request; invite tokens are stored hashed
• The simple and SpiceDB authorization providers grant the same organization and manager permissions, held to the base schema by a parity test and a shared conformance suite
• Organizations without a plan: a first social login creates the person's personal organization, slugs are reserved, renamed with a cooling-off period and aliases, a personal organization converts to a team, and what an organization may use comes from its marketplace subscriptions and licenses (ADR-006)
• Application roles per member, entitled through the marketplace, carried in the orgs claim and on invites, with relying parties reading memberships from claims by default (ADR-007)
• Real-time invalidation of access: access tokens default to 10 minutes and are capped at 15, every access-reducing change is recorded, and relying parties refuse tokens issued before it, with polling, replay and back-channel delivery (ADR-010)
• Resource-scoped collaborators: the collaborator organization role, resource grants with a standard viewer, contributor and maintainer ladder in both authorization modes, and invites that target one resource (ADR-008)
• The authorization mode is configuration: the authz key selects rbac or rebac, and authz/mode.New builds the provider, syncer and grant store (ADR-008)
• Management is derived from manager relationships; a manager can release a principal, a self-managed human can be invited to be managed or decline, and managing operations are authorized and served over HTTP (ADR-009)
• Editor and viewer are no longer organization roles, and the organization plan column is removed; run migrations 0004 to 0009 on existing PostgreSQL databases

Breaking

• Removed Ent schemas and packages user, membership, oauthaccount, refreshtoken, apikey, serviceaccount, and serviceaccountkeypair, with the Organization memberships, api_keys, and service_accounts edges and OAuthToken.service_account_id (05d78ae)
• systemauth.Storage user methods are replaced by CreateHuman, GetHuman, GetHumanByEmail, GetHumanByExternalIdentity, LinkExternalIdentity, UpdateHuman, and DeleteHuman on one HumanPrincipal type; systemauth.User, LoginPrincipal, ErrUserNotFound, and ErrUserExists are removed in favor of HumanPrincipal, ErrPrincipalNotFound, and ErrPrincipalExists (d054dc7)
• OAuthApp.owner references Principal; statically configured clients are owned by a service principal at the fixed system ID instead of a synthetic user (12f2494)
• OAuth tokens and authorization codes drop user_id and the user edge in favor of the subject column; OAuthConsent.user_id becomes principal_id (16f7f9f)
• SCIM users are human principals and group membership uses PrincipalMembership; users provisioned before this release are not visible through SCIM (6a12bae)
• An existing PostgreSQL development database must run migrations/0002_drop_legacy_user_tables.sql before starting this version; fresh databases need no migration (97282d7)
• The default BFF session cookie is sf_session instead of the Core-era cf_session; browsers holding the old cookie sign in again. Applications that set CookieConfig.Name are unaffected (94868b5)
• organization.Service ListMembers and ListMemberships exclude inactive memberships unless IncludeInactive is passed, and take variadic ListOption arguments (3f80884)
• mixin.UserBase and mixin.MembershipBase are removed (8c95e08)
• Human.email is optional: a human without one is a managed principal with the identifier human:. HumanPrincipal.Email, principal.Human.Email, and contract identity types treat it as optional; existing creation paths still require an email (e89af69)
• Marketplace checkout buys as the authenticated caller for an organization the caller may buy for, and answers 501 until marketplace.WithPurchaseAuthorizer or WithAuthorizer is configured; purchaser_id is optional, deprecated, and must equal the caller (7cf758e)
• Marketplace listing and license operations answer 501 until marketplace.WithAuthorizer is configured and require an authenticated caller; only published listings are readable anonymously; owner_id and assigned_by are optional, deprecated, and must equal the caller (bbac538)
• Organization API endpoints require an authenticated caller and, except creating an organization and checking a slug, answer 501 until APIConfig.Authorizer is set (08bd206)
• Invite API endpoints require an authenticated caller and organization endpoints answer 501 until APIConfig.Authorizer is set; accepting and declining require the invite to be addressed to the caller's email; inviter_principal_id, principal_id, and the email query are optional, deprecated, and must match the caller (236c0e9)
• Invite tokens are stored hashed and invite.Invite no longer has a Token field; the token is only in InviteResult.InviteURL. Existing PostgreSQL databases run migrations/0003_hash_invite_tokens.sql when deploying (7ccc80e)
• spicedb.BaseSchema is now authz.BaseSpiceDBSchema: members hold contribute rather than edit on an organization, and editors are recognized (8762bc6)
• authz.RelationshipSyncer gains AddPrincipalManager and RemovePrincipalManager; credential.Service gains IssueLoginToken and VerifyLoginToken; managedprincipal.Gate implementers also provide LoginTokenPolicy (8acce83)
• identity/token reports typed errors (ErrInvalidAccessToken, ErrInvalidRefreshToken, ErrRefreshTokenReused, ErrDPoPMismatch, ErrScopeNotGranted) (2a3c8cd)
• marketplace.LicenseService gains GetByStripeSubscriptionID; Stripe webhook endpoints should also subscribe to checkout.session.async_payment_succeeded (fa2a57d)
• delegation errors are typed and an agent without a delegation is denied; signup's SignupOrGetExisting requires SignupInput.EmailVerified to return an existing account, and SignupWithInvite requires the invited email (284806d)
• systemauth.WithUserIDHeader is removed; use WithTrustedUserIDHeader with a RequestGate (TrustedProxyNetworks or TrustAllRequests), social login, or your own SessionProvider. DefaultSessionProvider authenticates nobody by default (645c151)
• identity/oauth's authorization endpoint refuses requests until WithUserAuthenticator or WithTrustedUserIDHeader is set, and third-party clients are refused until WithConsent is set (ef7ea3d)
• session/ratelimit: IPKey and the Limiter default no longer read X-Forwarded-For or X-Real-IP (use ForwardedIPKey or ForwardedClientIP behind proxies), the middleware answers 503 on storage errors unless WithFailOpen is given, and MemoryStorage returns ErrTooManyKeys when full (3019061)
• session/bff: TrustProxy and TrustCloudflare do nothing without TrustedProxies or CloudflareIPRanges; session/middleware no longer reads forwarding headers for API key usage addresses unless an IPExtractor is given (a253f24)
• scim: a provider without WithAuthorizationHook answers 403 to every request; DefaultAuthorizationHook is deprecated for AllowAllAuthorizationHook (0e3dd33)
• systemauth: NewFederationEndpoints registers the sync and lookup routes only with WithFederationAuthenticator; introspection callers need a confidential client or the introspect scope (d57bf0f)
• session/jwt and contract: tokens without exp are refused, and jwt refuses another issuer when Config.Issuer is set; relyingparty.BearerMiddleware requires an allowed Origin and JSON body for cookie-authenticated POST, PUT, and DELETE (7061c67)
• credential.ValidateClientSecret returns ErrInvalidClientCredentials for every rejection; multiapp.AppAwareDB.ForSchema returns an error (30bd958)
• identity/apikey: Get, Revoke, and Delete take the owning principal and report other keys as not found; a service with no AllowedScopes grants no scopes unless AllowAnyScope is set; RevokeInOrganization added for organization administrators (0a3cf11)
• rls: Helper.SetTenant and SetUser return ErrNotInTransaction for *sql.DB and *sql.Conn; Middleware.SetRLSContext no longer touches the database and Middleware.WithTx scopes a transaction (ba68c75)

... (truncated)

Commits

• 6527c07 docs(adr): propose ADR-014 separating application roles from seat assignments
• 02741de fix(identity): order access changes deterministically on coarse clocks
• ac31951 test(systemauth): use a generic name in the managed slug fixture
• ad731a0 docs(release): ship the organization model together with v0.14.0
• dcce643 docs(release): add v0.15.0 notes and record v0.14.0 and v0.15.0 in the changelog
• 89e81b4 docs: add the guides to the nav and mark the proposed ADRs
• 86e6142 chore: normalize line endings to LF
• 30d9c8f docs(specs): move the feature specifications under docs/specs
• cbb810e fix(organization): answer 409 when no application-role seat is left
• 940fd7e docs(guides): add guides for invites, roles, collaborators, slugs, conversion...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 4c0581ab-5cda-409a-862d-2c1ac080ee5b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Superseded by #21.