From a6f202274998415b9eab03f84e68f4bc8555c04d Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 31 Aug 2026 00:17:36 +0000 Subject: [PATCH] Version Packages --- .changeset/great-otters-count.md | 20 -------------------- CHANGELOG.md | 21 +++++++++++++++++++++ package.json | 2 +- 3 files changed, 22 insertions(+), 21 deletions(-) delete mode 100644 .changeset/great-otters-count.md diff --git a/.changeset/great-otters-count.md b/.changeset/great-otters-count.md deleted file mode 100644 index 5b435df..0000000 --- a/.changeset/great-otters-count.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -'@seamless-auth/types': minor ---- - -Add `max_concurrent_sessions` to the system configuration. - -How many sessions one user may hold at once. `null` means no limit, and that is -the default, so a deployment that predates the key keeps behaving exactly as it -does today. - -`null` rather than `0` for unlimited: zero would otherwise read as "no sessions -allowed", which is a plausible way for someone to try to remove a cap and lock -every user out. The schema refuses zero and any negative or fractional value, on -both the full config and a patch. - -The server side of this is NIST 800-53 AC-10, concurrent session control. It is -also an operational concern wherever workstations are shared, since an unbounded -session count leaves sessions alive on machines a user has walked away from. - -This publishes the key. Enforcing it is the consuming server's job. diff --git a/CHANGELOG.md b/CHANGELOG.md index 894511e..8c244a1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,26 @@ # @seamless-auth/types +## 0.17.0 + +### Minor Changes + +- b5b056b: Add `max_concurrent_sessions` to the system configuration. + + How many sessions one user may hold at once. `null` means no limit, and that is + the default, so a deployment that predates the key keeps behaving exactly as it + does today. + + `null` rather than `0` for unlimited: zero would otherwise read as "no sessions + allowed", which is a plausible way for someone to try to remove a cap and lock + every user out. The schema refuses zero and any negative or fractional value, on + both the full config and a patch. + + The server side of this is NIST 800-53 AC-10, concurrent session control. It is + also an operational concern wherever workstations are shared, since an unbounded + session count leaves sessions alive on machines a user has walked away from. + + This publishes the key. Enforcing it is the consuming server's job. + ## 0.16.0 ### Minor Changes diff --git a/package.json b/package.json index a991b18..de3cec6 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@seamless-auth/types", - "version": "0.16.0", + "version": "0.17.0", "description": "Shared TypeScript types and Zod schemas for SeamlessAuth.", "author": "Fells Code, LLC", "license": "AGPL-3.0-only",