1.5.0

Enhancements

• Support public OAuth2 clients that hold no client secret (#178).
  • OAuth2ClientConfiguration gains init(publicClientIdentifier:environment:guestUsername:guestPassword:) and a read-only isPublicClient flag. A public client identifies itself with client_id in the token grant body and sends no Authorization: Basic header across every grant type. Confidential clients are unchanged.
  • Client-level authorization for a public client through OAuth2RequestPipelineMiddleware requires guest credentials. Client-level basic, and client-level bearer without guest credentials, fail with OAuth2Error.internalFailure instead of sending a request with no credential.
  • A public client using authorization_code must use PKCE and the authorization server must enforce it (RFC 8252 §6). Pass code_challenge via OAuth2AuthorizationRequest.additionalParameters and code_verifier via tokenGrantRequestAdditionalBodyParameters.

1.4.6

Bug Fixes

• Make OAuth2RequestPipelineMiddleware.refreshClaimCoordinationEnabled thread-safe for runtime toggling (#176).
  • Backs the process-wide kill switch with a shared lock while preserving its public API and default-enabled behavior.
• Normalize native URLError.timedOut errors to the blocking client's documented URLSessionClientError.requestTimeout result (#176).
  • Uses a stalled URLProtocol to keep the timeout test deterministic and independent of a live endpoint.

1.4.5

Bug Fixes

• Serialize concurrent token refreshes to prevent one-time refresh token double-spend (#174)
  • Adds an in-process atomic refresh claim (OAuth2RefreshClaimRegistry) so only one refresh grant is issued per client at a time; concurrent callers wait and reuse the winner's persisted token.
  • The winner re-reads the stored token after claiming and skips the grant if it was already refreshed; new tokens are persisted before waiters are woken.
  • Kill switch: OAuth2RequestPipelineMiddleware.refreshClaimCoordinationEnabled (defaults to true); setting it to false restores the previous refresh behavior.

Other

• Replace httpbin with httpbingo in tests (#175)

1.4.4

What's Changed

• T 1404619: Update new network error condition in OAuth2Error by @amrutakamat-mindbody in #171

Full Changelog: 1.4.3...1.4.4

1.4.3

What's Changed

• T 1377658: Updated Refresh Token API minimumExpirationTime to 6 minutes by @AnshulMindbody in #170

Full Changelog: 1.4.2...1.4.3

1.4.2

What's Changed

• T 1331575: Updated Refresh Token API minimumExpirationTime to 5 minutes by @amrutakamat-mindbody in #169

New Contributors

• @amrutakamat-mindbody made their first contribution in #169

Full Changelog: 1.4.1...1.4.2

Release 1.4.1

Breaking

• None

Enhancements

• #168 (Task AB#1268089) | Defer token store unlock until token refresh response action occurs

Bug Fixes

• None

Other

• None

Release 1.4.0

Breaking

• None

Enhancements

• None

Bug Fixes

• Add check for nil request URL #166

Other

• None

Release 1.3.0

Breaking

• None

Enhancements

• None

Bug Fixes

• Update multipart form request serializer #165

Other

• None

Release 1.2.0

Breaking

• None

Enhancements

• Create URLDataCache and DataDownloader #164

Bug Fixes

• None

Other

• None