- introduced scope.sign(user, opts) to get a jwt without reference to express
- refactor how variants are stored - use the same shared dictionnary
- update nginx config to allow more memory for the shared dictionnaries
- pass HttpError from http-errors module for throwing forbidden/unauthorized errors. The corresponding scope() options are no longer in use.
- factored restrict and allowed, renamed allowed to
test - parametrized scopes now correctly return wildcard headers
- issuer is the hostname and cannot be configured
- scope.serializeBearer(req, user, opts)
make luarocksinstalls lua modules in a local tree
- nothing is cached unless tagged
- no particular peremption is set (used to be 1 day by default if nothing was set)
- major breaking changes: scopes are now locks and has been simplified a lot.
- upcache.disabled (the lua module) let lua-ngx code disable upcache
- more es6 javascript
- fix Vary handling when no response header is set
- test Vary with Map
- tag.for cannot override tag.disable
- better support for headers lists
- lock: req.user.grants is always set