Self-service, session management, admin verbs, and a two-pass security hardening — features that fit a same-origin embedded Go BFF.

Features

• HIBP password-breach check (pluggable BreachChecker, k-anonymity, fail-open, opt-in)
• SESSION_SECRET rotation via a PreviousSessionSecrets verify-only list
• Email OTP (numeric sign-in code) alongside the magic link
• Optional SessionStore — server-side revocation, list/revoke devices, sign-out-everywhere
• Self-service delete-account, verified change-email, OAuth unlink + last-method guard, passkey rename
• Admin verbs — create / set-password / time-boxed ban / hard-delete / impersonate + list/revoke sessions
• Quick wins — 429 + Retry-After, IPv6 /64 rate-limit keying, trusted-origins allow-list

Hardening

• Microsoft/Entra multi-tenant email no longer trusted (nOAuth) — pin MICROSOFT_TENANT
• Social-login-only deployments still gate; session verify fails closed on a weak key
• sanitizeNext rejects control bytes; SCIM CREATE/PUT returns 409 uniqueness; LDAP deprovision keys on presence
• Hard-delete tombstones sessions; unknown SID fails closed; passkey-2FA must differ from the first factor
• bcrypt-72 cap; PeekToken (validate reset before consuming); gorm/memory store parity

⚠️ Breaking

CredentialStore / DirectoryStore gain methods; new optional SessionStore; AuthUser gains ban fields. Both reference stores already implement them. See CHANGELOG for the full list.

Full details: CHANGELOG.md