Skip to content

Release Notes - v0.2.0

Release Date: 2026-10-26

v0.2.0 turns the Petstore from a table definition into a running API. petstore-server serves every operation of the Swagger Petstore from memory, and it can act as an AAuth resource, so an AI agent has a realistic API that asks for different levels of trust. The release also adds a container image, a documentation site, and makes the MySQL tools build from a clean clone.

Highlights

  • Petstore Server - petstore-server serves the 20 operations of the Petstore OpenAPI 3.1 definition from memory, seeded with six pets, and serves the spec at /openapi.yaml and /openapi.json.
  • AAuth Resource Mode - With --auth aauth, each operation requires the access its x-aauth annotation names: the agent's identity, the person, or an auth token for write:orders or write:pets. Orders belong to the person who placed them.
  • Spec as a Go Package - The OpenAPI definition is embedded in package petstore, with an x-aauth annotation on every operation.
  • Container Image - A static, non-root image runs the server, with a health subcommand for health checks in a shell-less image.
  • Clean-Clone MySQL Tools - create_tables, create_pets and the benchmark read their databases from a private JSON file, so the repository builds without any file that was left out of it.

What's New

The Server

go run ./cmd/petstore-server --listen 127.0.0.1:8080
curl 'http://127.0.0.1:8080/v2/pet/findByStatus?status=available'
Flag Meaning
--listen the address to listen on, plain HTTP (default :8080)
--auth none (default) or aauth
--url the resource's public URL and AAuth identifier
--trust a person server whose tokens to accept (repeatable)
--ca-file an extra root CA for fetching issuers' keys, such as the sandbox CA

The store lives in memory, so a restart brings back the six seeded pets. See the Run the Server guide.

AAuth

In AAuth mode the server accepts person and auth tokens only from the person servers you give with --trust, and publishes its resource metadata and scope descriptions at /.well-known/aauth-resource.json. Run it behind the aauth-go sandbox and check an agent against it with the interop guide. The tests cover every operation and run the server behind the aauth-go sandbox as an enrolled agent.

Container

docker build -t petstore-server .
docker run --rm -p 127.0.0.1:8080:8080 petstore-server

Publish the port on 127.0.0.1 unless you mean to expose a server that, without --auth aauth, lets anyone change its pets.

Upgrading

MySQL tools

The tools no longer carry database hostnames or credentials in source. They read them from the JSON file that PETSTORE_DATASOURCES names:

  • Create the file from models/cmd/datasources.example.json, keep it outside the repository, and run chmod 600 on it. The tools refuse a file that other users can read.
  • cmd.GetDataSourceSet() is replaced by cmd.LoadDataSourceSet(), which returns an error. Go code that called the old function must handle it.
  • create_tables prints the database and host, no longer the whole data source with its password.
  • BenchmarkPet is skipped unless PETSTORE_BENCH_DATASOURCE names an entry of that file.

See the MySQL Tools guide.

Dependencies

The module requires aauth-go v0.3.0 and mogo v0.75.0, and its go directive is now 1.27.0, where v0.1.0 needed Go 1.20. Update your toolchain before building from source.

Documentation

  • Run the Server: flags, endpoints, the store and the container.
  • Test AAuth Interop: the access level of each operation, and checking an agent or a person server against the Petstore.
  • MySQL Tools: the data sources file, the commands, the benchmark and the Java example.
  • Postman AI Readiness: how usable the API is by an AI agent, scored with the Postman CLI.
  • Release notes for v0.1.0, the first release.

Full Changelog

See CHANGELOG.md for the complete list of changes.