Skip to content

v0.9.0

Release Date: 2026-08-23

Highlights

  • DPoP extracted to goauth - The RFC 9449 DPoP implementation moved to the standalone github.com/grokify/goauth/dpop package
  • GuardSQL authz adapter - authzguardsql consolidated into SystemForge, mapping GuardSQL schemas/policies to SystemForge authorization
  • Interactive API docs - OpenAPI 3.1 spec with a Scalar interactive reference in the docs site

Breaking Changes

DPoP moved to goauth/dpop

The session/dpop package has been removed. DPoP now lives in the standalone github.com/grokify/goauth/dpop package (released as goauth v0.24.0), so it can be consumed independently of the SystemForge session layer.

Update your imports:

// Old
import "github.com/grokify/systemforge/session/dpop"

// New
import "github.com/grokify/goauth/dpop"

The package API is unchanged — only the import path moved. The session/bff layer that binds DPoP to sessions (proof injection on the proxy, per-session key pairs) remains in SystemForge and now depends on goauth/dpop.

Added

GuardSQL Authorization Adapter (authzguardsql)

A new adapter maps GuardSQL schemas and policies to SystemForge authorization:

import "github.com/grokify/systemforge/authzguardsql"

It builds SystemForge PolicyBuilder, ResourceBuilder, and DefaultResourceBuilder values from GuardSQL definitions. The dependency direction is systemforge → guardsql (GuardSQL stays dependency-light and never imports SystemForge). This was previously the nested guardsql/authzsystemforge module; consolidating it into SystemForge removes the fragile cross-module tagging burden.

OpenAPI 3.1 + Interactive API Reference

The docs site now includes an OpenAPI 3.1 specification and a Scalar interactive API reference, integrated into the site navigation.

Changed

  • The bff reverse proxy migrated from the deprecated httputil.ReverseProxy.Director to Rewrite (Go 1.26 SA1019); the session value propagates via the cloned outbound request's context.

Dependencies

Notable updates: authzed/spicedb 1.54.0 → 1.56.0, google.golang.org/grpc 1.81.1 → 1.83.0, redis/go-redis/v9 9.20.1 → 9.22.0, danielgtaylor/huma/v2 2.38.0 → 2.39.1, golang.org/x/crypto 0.53.0 → 0.55.0, plus routine bumps.

Upgrade Notes

  1. If you imported github.com/grokify/systemforge/session/dpop, switch to github.com/grokify/goauth/dpop (no code changes beyond the import path).
  2. go get github.com/grokify/systemforge@v0.9.0 && go mod tidy.