[Bccorb]

The v0.20 adapter work for Go: parity with the Python and Rust adapters, the console framing headers, placeholder secrets, recovery sessions and account recovery notice delivery.

#11 Parity with Python and Rust

• Redirects: the upstream client never follows a redirect (CheckRedirect returns http.ErrUseLastResponse). A caller-supplied HTTPClient is copied with that CheckRedirect, so the caller's own client is not changed. It also gets the 15 second timeout if it has none, as in Python.
• Logs: upstream transport errors are logged without the *url.Error URL, so no path tokens or query strings end up in logs. This covers manifest routes, logout, the manifest fetch and JWKS.
• JWKS: the key set goes stale after 10 minutes. A failed fetch with no key set backs off 5 seconds, and an unknown kid refetches at most every 30 seconds. While the API is unreachable a stale set keeps verifying, as in Python. The response is capped at 256 KiB.
• exp: checkTimes now requires exp, for both HS256 cookies and RS256 API tokens.
• Logout: a rejected credential still clears every held cookie.
• Cookie transport body: a pick no longer lets token or refreshToken through.
• Cookie TTL: capped at 400 days.
• AuthServerURL: must be an http or https URL with a host.

#10 Console headers

ConsoleHandler now also forwards X-Frame-Options, Content-Security-Policy and X-Content-Type-Options.

Placeholder secrets (fells-code/seamless-auth-server#231)

New refuses dev-only-cookie-signing-key-replace-me, GRAB_FROM_SEAMLESS_AUTH_PORTAL_DEV and any value containing replace-me (case-insensitive) for CookieSecret and ServiceSecret. With InsecureCookies (the adapter's local development mode, as in Python and Rust) they are allowed, with a warning.

Recovery sessions (fells-code/seamless-auth-server#232)

• RequireAuth answers 403 { "error": "enrollment_required" } for an access token with recovery: true, by cookie or bearer, and Authenticate returns the new ErrEnrollmentRequired. Options.AllowRecoverySessions admits such a token, and User.Recovery marks it.
• In cookie transport, a successful POST /webauthn/register/finish or POST /totp/enroll/verify from a recovery session refreshes the session, so the new access cookie drops the claim. This also works when a silent refresh happened earlier in the same request: the refresh uses the token that refresh just issued. It goes through the shared refresher, so parallel tabs do not trip reuse detection. If the refresh fails, the enrollment response is still returned. Bearer clients hold their own refresh token, so the README tells them to call POST /auth/refresh after enrolling.

Account recovery delivery (fells-code/seamless-auth-api#500)

• ManifestRoute.Notices reads the manifest's new optional notices field. The bundled manifest is synced from the API's committed adapter-manifest.json (0.19.4), which adds the recovery, recovery code and policy routes.
• New opt-in Options.DeliverAccountNotices, false by default. A single Deliver callback cannot show whether it handles the new kinds. Only with this option (and Deliver) does a notices: true route send x-seamless-auth-delivery-mode: external, the delivery service token and x-seamless-auth-delivery-kinds: account_notice_email,account_notice_sms. Without it, external mode is not sent on that route, and the API sends the notices itself.
• Every item in deliveries goes to Deliver. deliveries (and delivery) are stripped from the response in both transports. If at least one notice is delivered, the response is the API's. If none is, the adapter cancels the request: it sends POST /recovery/cancel with {"cancelToken": <fragment of cancelUrl>} and the proxy service token, then answers 503 recovery_notice_failed. The cancel URL and token are never logged.
• Delivery gains Purpose, Notice, Subject, Text and CancelURL, plus Delivery* kind constants and PurposeAccountRecovery. Its String/GoString methods leave out the code and links. An unknown kind, or a notice kind without the opt-in, is logged and skipped, not passed to Deliver.
• Pass-through is covered by tests: /recovery/*, /recovery-codes*, GET /recovery/requests, DELETE /recovery/requests/{id}, every /system-config/policy* route, 503 recovery_notice_failed and a 403 step_up_required body on an admin write.

Checks

$ gofmt -l .
(no output)
$ go vet ./...
(no output)
$ go test -race -count=1 ./...
ok  	github.com/fells-code/seamless-auth-go	1.455s
?   	github.com/fells-code/seamless-auth-go/conformance/refapp	[no test files]
$ GOTOOLCHAIN=go1.22.12 go vet ./...
(no output)
$ GOOS=linux GOTOOLCHAIN=go1.22.12 go test -c .
(compiles)
$ scripts/api-check.sh
## compatible changes
(19 additions, no incompatible changes)
Suggested version: v0.3.0

Go 1.22 test binaries cannot run on the local macOS (a dyld LC_UUID loader error), so the 1.22 test run is left to CI. The conformance suite was not run locally.

Closes #10
Closes #11