v0.28.1: compose: Expose token entropy setting (#342)

Signed-off-by: nerocrux <nerocrux@gmail.com>

v0.28.0

oauth2: Add ability to specify refresh token lifespan (#337)

Set it to `-1` to disable this feature. Defaults to 30 days.

Closes #319

Signed-off-by: arekkas <aeneas@ory.am>

v0.27.4: docs: Fix quickstart (#335)

- replace NewMemoryStore with NewExampleStore
- fix length of signing key
- fix config type

Signed-off-by: Peter Schultz <peter.schultz@classmarkets.com>

v0.27.3: oauth2: Set exp for authorize code issued by hybrid flow (#333)

Signed-off-by: nerocrux <nerocrux@gmail.com>

v0.27.2: pkce: Allow hybrid flows (#328)

Signed-off-by: Adam Shannon <adamkshannon@gmail.com>
Signed-off-by: Wenhao Ni <niwenhao@gmail.com>

v0.27.1: oauth2: Improve refresh security and reliability (#332)

This patch resolves several issues regarding the refresh flow. First,
an issue has been resolved which caused the audience to not be
set in the refreshed access tokens.

Second, scope and audience are validated against the client's
whitelisted values and if the values are no longer allowed,
the grant is canceled.

Closes #331
Closes #325
Closes #324

v0.27.0: oauth2: Update jwt access token interface (#330)

The interface needed to change in order to natively handle the audience claim.

Signed-off-by: arekkas <aeneas@ory.am>

v0.26.1: hash: Raise bcrypt cost factor lower bound (#321)

Users of this library can easily create the following:

hasher := fosite.BCrypt{}
hasher.Hash(..)

This is a problem because WorkFactor will default to 0 and x/crypto/bcrypt will default that to 4 (See https://godoc.org/golang.org/x/crypto/bcrypt).

Instead this should be some higher cost factor. Callers who need a lower WorkFactor can still lower the cost, if needed.

Signed-off-by: Adam Shannon <adamkshannon@gmail.com>

v0.26.0: all: Rearrange commits with goreturns

Signed-off-by: aeneasr <aeneas@ory.sh>

v0.25.1: handler/openid: Populate at_hash in explicit/refresh flows (#315)

Signed-off-by: Wenhao Ni <niwenhao@gmail.com>