v0.6.0

nself v0.6.0 - Enterprise Authentication & Security (LTS)

Release Date: January 29, 2026 Status: Long-Term Support (LTS) Phase: Phase 1 Complete (100%)

Overview

nself v0.6.0 is a major milestone release completing Phase 1: Enterprise Authentication & Security. This release delivers production-ready authentication, authorization, and security infrastructure with 294 story points across 5 sprints.

What's New

🔐 Complete Authentication System (Sprint 1 & 2)

Core Authentication:

• Password authentication with bcrypt hashing
• Email verification with secure token generation
• Password reset with time-limited tokens
• Account linking across multiple providers
• Session management with refresh token rotation
• Device management and fingerprinting

14 OAuth Providers:

• Google, GitHub, Facebook, Discord
• Microsoft, LinkedIn, Slack, Twitch
• Apple Sign In, Twitter/X
• GitLab, Bitbucket
• Custom OIDC provider support

6 MFA Methods:

• TOTP (Time-based One-Time Password)
• SMS verification
• Email codes
• Backup codes
• WebAuthn/FIDO2 (passwordless)
• MFA policies and enforcement

👥 Authorization System (Sprint 3)

Role-Based Access Control (RBAC):

• Complete role and permission management
• Resource-based permissions (resource:action format)
• User-role assignments with multiple roles
• Role hierarchy and inheritance
• Default roles for new users
• Custom JWT claims for Hasura integration

Auth Hooks:

• Pre-signup, post-signup
• Pre-login, post-login
• MFA verification hooks
• Custom JWT claims injection
• Priority-based hook execution
• Webhook integration for external validation

🔑 API Security (Sprint 4)

API Key Management:

• SHA-256 hashed storage
• Scope-based permissions
• One-time display on creation
• Expiration and revocation
• Usage tracking and audit logs

Encrypted Secrets Vault:

• AES-256-CBC encryption at rest
• Automatic key rotation (90-day default)
• Secret versioning and rollback
• Environment separation (dev/staging/prod)
• Secret sync and promotion workflows
• Access auditing for compliance

🚦 Rate Limiting (Sprint 5)

7 Rate Limiting Strategies:

• Token Bucket (smooth rate limiting)
• Leaky Bucket (consistent throughput)
• Fixed Window (simple time-based)
• Sliding Window (accurate time-based)
• Sliding Log (precise tracking)
• Adaptive (dynamic based on load)
• Burst Protection (traffic spike handling)

Enforcement Levels:

• IP-based rate limiting
• User-based quotas (free/basic/pro/enterprise tiers)
• Endpoint-based rules with regex patterns
• Whitelist/blocklist management
• Automatic cleanup of expired entries

🔧 Additional Features

Webhook System:

• HMAC signature verification (SHA-256)
• Async delivery with retries
• Event types: user.created, auth.login, mfa.enabled, etc.
• Custom endpoint management

Device Management:

• Device fingerprinting
• Trusted device feature
• OS and browser detection
• Last seen tracking

Audit Logging:

• Comprehensive event tracking
• Actor, resource, action logging
• Compliance-ready audit trail
• Security event monitoring

Email Templates:

• Welcome emails
• Password reset
• Email verification
• MFA codes

Statistics

• 5 Sprints: All 100% complete
• 294 Story Points: 100% delivered
• 60+ Files Created: ~14,000 lines of code
• 10 CLI Commands: Complete management interface
• 14 OAuth Providers: Enterprise-ready SSO
• 6 MFA Methods: Multi-layered security
• 7 Rate Limiting Strategies: Production-scale protection
• Integration Tests: Full test coverage

CLI Commands

New commands in v0.6.0:

nself auth        # Authentication management
nself oauth       # OAuth provider configuration
nself mfa         # MFA method management
nself roles       # Role and permission management
nself vault       # Encrypted secrets management
nself rate-limit  # Rate limiting configuration
nself webhooks    # Webhook management
nself admin       # Admin dashboard API
nself hooks       # Auth hooks management
nself apikeys     # API key management

Migration Guide

Upgrading from v0.5.0

1. Update nself:

   brew upgrade nself  # macOS
   # or
   curl -sSL https://install.nself.org | bash

2. Initialize new authentication:

   nself auth init
   nself roles init

3. Configure OAuth providers (optional):

   nself oauth add google
   nself oauth add github

4. Set up MFA (optional):

   nself mfa init
   nself mfa enable totp

5. Initialize secrets vault (optional):

   nself vault init
   nself vault set DATABASE_URL "postgresql://..."

6. Configure rate limiting (optional):

   nself rate-limit init
   nself rate-limit rules add "api.*" 100 60  # 100 req/min

Breaking Changes

None. This is a feature addition release with no breaking changes to existing functionality.

Architecture

Database Schema

New tables in v0.6.0:

• auth.users - User accounts
• auth.sessions - Session management
• auth.oauth_providers - OAuth configuration
• auth.mfa_methods - MFA settings
• auth.roles - Role definitions
• auth.permissions - Permission definitions
• auth.user_roles - User-role assignments
• auth.api_keys - API key management
• secrets.vault - Encrypted secrets
• secrets.encryption_keys - Key rotation
• rate_limit.rules - Rate limit rules
• rate_limit.log - Rate limit tracking
• webhooks.endpoints - Webhook subscriptions
• audit.events - Audit logging

Security

Encryption:

• Passwords: bcrypt with 10 rounds
• Secrets: AES-256-CBC with HMAC-SHA256
• API Keys: SHA-256 hashing
• JWT: RS256 with 4096-bit keys

Token Security:

• Short-lived access tokens (15 minutes)
• Long-lived refresh tokens (30 days)
• Automatic token rotation
• Secure token storage

Performance

• PostgreSQL-backed: Scalable to millions of users
• Single-instance ready: Production-ready without Redis
• Efficient rate limiting: O(1) token bucket algorithm
• Indexed queries: Optimized for performance

Testing

• Unit Tests: All core modules tested
• Integration Tests: End-to-end workflows validated
• Security Tests: Encryption, hashing, signature verification
• Rate Limit Tests: All 7 strategies validated

What's Not Included (Phase 2)

The following features are planned for Phase 2:

• Distributed rate limiting (requires Redis cluster)
• Multi-region session replication
• Advanced audit analytics
• Compliance reporting dashboards

Installation

macOS (Homebrew)

brew tap nself-org/nself
brew install nself

Linux (curl)

curl -sSL https://install.nself.org | bash

npm

npm install -g nself-cli

Docker

docker pull nself-org/cli:0.6.0

Links

• Documentation: https://github.com/nself-org/cli/wiki
• GitHub: https://github.com/nself-org/cli
• Issues: https://github.com/nself-org/cli/issues
• Discussions: https://github.com/nself-org/cli/discussions

Contributors

Special thanks to all contributors who made v0.6.0 possible.

License

nself is source-available software. See LICENSE file for details.

---

Next Release: v0.7.0 - Phase 2: Advanced Features & Integrations Estimated: Q2 2026