Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[0.1.0] - 2026-08-11

Added

• Core validation: Xentitlement.validate/3 for RSA-SHA256 signature verification
• Token extraction: Xentitlement.extract_from_header/2 for HTTP header parsing
• Token creation: Xentitlement.sign_token/2 for signing claims with RSA private key
• Low-level signing: Xentitlement.sign_canonical_json/2 for direct JSON signing
• Public API façade: Xentitlement module delegating to Xentitlement.Entitlements
• Comprehensive test suite: 52 tests covering validation, signing, and integration workflows
• Test helpers: Xentitlement.Test.EntitlementHelpers for fixture generation
• Documentation: README.md, CLAUDE.md, and inline @doc attributes
• Development guide: CLAUDE.md with conventions, testing requirements, and architecture decisions
• BSD-3-Clause License: Permissive open source license

Features

• ✓ Asymmetric RSA-SHA256 signature verification
• ✓ Canonical JSON format ensures tampering detection
• ✓ Stateless validation — no state, config, or database required
• ✓ Reusable across multiple Elixir services
• ✓ Zero production dependencies (Jason for JSON only)
• ✓ ~91% code coverage (52 tests, all critical paths covered)
• ✓ Compatible with Elixir 1.14+

Design Principles

• Minimal scope: One thing, done well (RSA signature validation and creation)
• Stateless: All parameters passed as function arguments
• No framework coupling: Works standalone without Phoenix, Plug, or Guardian
• Cryptographic integrity: Canonical JSON + RSA-SHA256 prevents all tampering
• Full API: Both sign (private key) and validate (public key) operations

Unreleased

Planned for Future Releases

• [ ] Support for additional signature algorithms (ES256, EdDSA)
• [ ] Token expiration enforcement
• [ ] Revocation list support
• [ ] Key rotation utilities
• [ ] Benchmarking suite