Skip to main content

AuthProxy Backend Changelog

Текущая версия

1.4.5 (Май 2026) — соответствует VersionPrefix модуля (версия, которую отдаёт GET /auth/v1/get_info).

[1.4.5] - 2026-05-26​

  • Файлы без диалога (app logo, аватары) загружаются в персональное хранилище пользователя: AuthProxy сам резолвит chat для ChatId <= 0 вместо ошибки ChatNotFound.
  • Привязка социальных аккаунтов делегирована CRM и сделана идемпотентной.

[1.4.4] - 2026-05-22​

  • Push-уведомления по платёжным ордерам приведены к актуальному контракту состояния (PaymentOrderEventOut.state).

[1.4.3] - 2026-05-18​

  • Динамические рантайм-настройки файлового сервиса: лимиты размера, запрещённые расширения, скорость upload/download.
  • Логотип OAuth-приложения хранится как файл AuthProxy (по timetick).
  • Маршрутизация входящей почты по никнейму без коллизий кодов.

[1.4.2] - 2026-05-13​

  • Внутренний AES-128-GCM отправитель web push вместо внешнего пакета.
  • Ужесточение CardDAV well-known маршрутизации; ключи CardDAV больше не утекают в логи DAV-аутентификации.

[1.4.1] - 2026-05-13​

  • Консистентный отказ для заблокированных сессий пользователя.
  • Приватная конфигурация приложения отдаётся из рантайм-кэша приложений.

[1.4.0] - 2026-05-07​

  • Основа маршрутов CardDAV/WebDAV (DAV-ветка прокси, проброс заголовков, флаг CardDav-ключа).
  • SMTP-мост входящей почты для reply-back сценариев.
  • OAuth-провайдеры Discord и GitHub.

[1.3.1] - 2026-03-15​

Migration Level: 🟢 PATCH​

Pre-Release Audit (Safe Fix Batches 1-6)​

  • Null semantics enforcement: 21 non-nullable value type properties made nullable across 6 entity classes (user_app, user_key, login_log, app_access, chat_members, user_exid) to prevent silent data corruption via UpdateNotNullAndGet COALESCE
  • Session security: exact ApgSession limit boundaries + expired-session cleanup on access
  • Runtime cache: immediate user_app runtime cache refresh after create/update/delete
  • AuthOptions stats: real AuthOptions.Active count instead of stale cached value
  • File access model: raw fileId now requires authenticated owner/member access; code-based download remains anonymous bearer
  • MCP security: built-in /mcp route enforced in pipeline

Observability​

  • UptraceDsn injected into deploy configs for all modules and scanners
  • Uptrace v2 deployment with Docker Compose

[1.3.0] - 2026-02-21​

Migration Level: 🟢 PATCH​

Performance (P1-P6 from load testing)​

  • Lock-free session lookup: ConcurrentDictionary replaces Dictionary + lock for session storage. Read path (FindSessionById, FindSessionCookie, TouchSession) is now completely lock-free. Write operations (Add/Remove/Cleanup) use a separate _writeLock. Reduces auth latency tail at high concurrency (max latency -20% at 500 VU).
  • Per-IP rate limiting: New IpRPSLimit setting (SettingType=23, default: disabled). Limits aggregate RPS from a single IP across all TCP connections. Closes security gap where multi-connection abuse bypassed per-connection limits.
  • Connection pool increase: MaxConnectionsPerServer raised from 100 to 256 (configurable). Prevents request queuing when backend modules have >10ms latency under load.
  • CORS O(1) origin lookup: Pre-built HashSet<string> of normalized origins at settings reload. Replaces O(N) Any(StartsWith) scan.
  • Zero-alloc cookie lookup: FindSessionCookie iterates IRequestCookieCollection directly instead of .Where().ToArray().
  • Rate limiter GC optimization: Interlocked.Exchange swap instead of ConcurrentDictionary.Clear() every second.

Load Test Results (k6, Docker local environment)​

MetricValue
Peak throughput (500 VU)14,000+ RPS
Proxy overhead vs nginx (p95)+1.8ms
Mixed workload (100 VU, 5 min)1,935 RPS, 0% errors
Auth overhead at 200 VU (p95)8.5ms
Max latency at 500 VU111ms (was 140ms before P1)

Added​

  • SettingType.IpRPSLimit (23) — per-IP rate limiting
  • UrlsOrigins pre-computed HashSet for CORS validation
  • BandwidthLimitService.CanIpCall() method

Changed​

  • ApgSession._sessions: Dictionary → ConcurrentDictionary
  • ApgSession._writeLock: renamed from lock_obj, used only for write operations
  • HttpClientExt.CreateClient: maxConnectionsPerServer parameter (default 256)
  • TouchSession: Interlocked.Add for _accessRateLimit instead of lock

[1.2.0] - 2026-02-14​

Migration Level: 🟡 MINOR​

Added​

  • Admin Pages: 4 new pages
    • Sessions — real-time session monitoring, revoke actions
    • AppAccess — application management, webhook health, approve/reject
    • EventMonitor — SSE event stream, BroadcastEvent live view
    • McpMonitor — AI agent sessions, tool usage stats
  • Admin Improvements (36 unit tests added):
    • LoginLog: login_type and IP location filters, export
    • UserApps: flag badges, approve/reject flow, webhook health indicator
    • UserKeys: type filter, revoke/restore actions, flag badges
    • SignLog: JOIN user_key — shows key owner and type
    • RouteMap: flag checkboxes (NoAuth, GeoEnrich, etc.), flag badges
    • Settings: grouping by category, human-readable names, color-coded type badges
    • Dashboard: EventHub connection stats, login type breakdown, system metrics
    • Users: scope search, flag/scope badges, Keys quick link
  • License Domain Protection: runtime enforcement
    • Startup validation (ServerOrigin/FIDO2 from License.Domain)
    • Runtime Host header check in ApiPathMiddleware
    • CORS validation in CorsMiddleware
    • Feature gating (MCP/OAuth) via License.HasFeature()

Changed​

  • SSE events: NotifyMess deprecated → BroadcastEvent is now primary format
  • Menu updated with new admin page entries

[1.1.0] - 2026-02-04​

Migration Level: 🟡 MINOR​

  • Database: No schema changes required
  • API: Backward compatible (new fields added)
  • Webhooks: New format available via opt-in (default for new apps)

Added​

  • MCP (Machine-Callable Protocol) authentication:
    • McpBasic - public key only (read-only access)
    • McpVerified - public key + timestamp + signature (full access)
    • McpApp - delegated app access
    • MCP rate limiting via McpApiRPSLimit setting
  • SSE endpoint /auth/v1/subscribe for real-time events
  • BroadcastEvent format for webhooks (opt-in via UseBroadcastFormat flag)
  • Multi-database support:
    • SQLite standalone mode for lightweight deployments
    • PostgreSQL support as alternative database
    • DbProviderFactory for automatic database selection
  • Comprehensive unit tests for controllers (xUnit)

Changed​

  • New apps use BroadcastEvent webhook format by default
  • upsert_usr_app resets Approved flag when URL changes (security)
  • upsert_usr_app resets CallbackConfirmed flag when webhook_url changes
  • WebhookSrv uses unified events() API instead of cross-module DB queries
  • Upgraded to .NET 10
  • SQL queries migrated to ANSI compatibility

Deprecated​

  • NotifyMess webhook format - deprecated; BroadcastEvent is the replacement

[1.0.2] - 2026-01-26​

Migration Level: 🟢 PATCH​

Added​

  • LoginType enum for API responses
  • IP blacklist setting for blocking malicious IPs
  • Chart.js library for admin analytics
  • form-action CSP directive support

Changed​

  • CSP settings moved to database (Settings page)
  • Settings page UI improvements with validation rules

Fixed​

  • get_app_info endpoint response format
  • LoginMethod handling as flags
  • Webhook delivery reliability

[1.0.1] - 2026-01-15​

Migration Level: 🟢 PATCH​

Added​

  • User apps tariff group management
  • RPS limit settings per category
  • MarketMakingDirections setting integration
  • User app tag field

Fixed​

  • User apps edit modal styling
  • Various admin panel fixes

[1.0.0] - 2024-12-01​

Migration Level: 🔴 MAJOR (Initial Stable Release)​

Added​

  • Authentication: PassKey, FIDO2, UserKey, Telegram, OAuth (Google, Discord, Github, VK), Phone/Email OTP
  • Reverse Proxy: Route mapping, load balancing, rate limiting, CSP headers
  • File Service: chunked upload with external storage backend
  • Webhooks: Delivery, validation, public key header
  • Admin Panel: User management, application management, route configuration

[0.9.0] - 2024-11-01​

Migration Level: BETA​

Added​

  • File upload/download functionality
  • SPA routing support
  • Swagger documentation UI

[0.8.0] - 2024-10-15​

Migration Level: ALPHA​

Added​

  • Telegram authentication support
  • Login route /login/
  • Frame sources CSP directive

[0.1.0] - 2024-10-01​

Migration Level: ALPHA​

Added​

  • Basic project structure
  • Database schema (AuthProxyDB)
  • Docker containerization