6.1.0

• Own the Storage run id generator: StorageApiClient\StorageClientRequestFactory now takes the run id generator as its own optional Closure(ClientOptions): string dependency instead of reading it off ClientOptions. Run id resolution is unchanged: X-KBC-RunId header → configured generator → uniqid('run-').
• New keboola_api.storage_client_options.run_id_generator config knob injects that generator (a service that resolves to a Closure, exposed via a factory). It is grouped with the other Storage client options but wired to the client factory rather than merged into ClientOptions, so it may accompany the service form. This replaces setting a runIdGenerator on a custom ClientOptions service.
• Requires keboola/storage-api-php-client-branch-wrapper ^7.0, which removed ClientOptions::runIdGenerator and its Factory\StorageClientRequestFactory.

Full Changelog: 6.0.0...6.1.0

6.0.0

• Rework of #[StorageApiTokenAuth] internals — drops the dependency on keboola/storage-api-php-client-branch-wrapper's StorageClientRequestFactory (consuming apps no longer need to register it) and simplifies the auth classes. Supported auth paths behave unchanged: legacy X-StorageApi-Token, OAuth Authorization: Bearer, and the programmatic kbc_at_*/kbc_pat_* exchange.
• [BC] Security\TokenAuthenticatorInterface is now generic over the extracted credential (@template TCredential); extractToken(): ?string becomes extractCredential(Request): ?TCredential, whose result is passed to authenticateToken(). Update any custom implementors.
• [BC] Security\StorageApiToken\ProgrammaticToken was removed — kbc_at_*/kbc_pat_* detection now lives in the request-token classification (RequestToken::tryFromRequest()).
• [BC] StorageApiClient\StorageClientApiFactory constructor signature changed and its unused public RUN_ID_HEADER const was removed; the controller-facing createClientWrapper() method is unchanged.
• Security\StorageApiToken\StorageApiTokenFactory now exposes createFromValue() (verify a Storage/OAuth token) and exchangeFromProgrammaticToken() (Manage-resolver exchange); a single @internal StorageClientRequestFactory builds every Storage ClientWrapper.

Full Changelog: 5.3.0...6.0.0

5.3.0

• Add optional keboola_api.storage_client_options config node to tune the Storage API client's base ClientOptions — either a ClientOptions service id (string) or individual options (backoff_max_tries, aws_retries, aws_debug, retry_on_maintenance, use_branch_storage, user_agent, logger). See README.md.

Full Changelog: 5.2.0...5.3.0

5.2.0

• Tag StorageApiToken with its auth type (AuthType) so the resolved Storage client authenticates correctly for OAuth (kbc_at_* / kbc_pat_*) tokens.
• Require released keboola/storage-api-php-client-branch-wrapper ^6.8.0.

Full Changelog: 5.1.0...5.2.0

5.1.0

• Add StorageClientApiFactory — a request-bound Storage API client factory injectable into controllers via an argument value resolver. Nullable arguments resolve to null when the request carries no Storage API token.

Full Changelog: 5.0.0...5.1.0

5.0.0

• Add support for kbc_at_* and kbc_pat_* tokens within StorageApiTokenAuth
• [BC] Testing traits were updated to support injecting new dependencies in authenticator. See README.md for detail on how to update.

Full Changelog: 4.0.0...5.0.0

4.0.0

• [BC] Reworked ManageApiTokenAuth to ApplicationTokenAuth with added support for ServiceAccount token

Full Changelog: 3.11.0...4.0.0

3.11.0

feat: Adds list PHPDoc type annotations to the $scopes property in ManageApiTokenAuth and $features property in StorageApiTokenAuth

3.10.0

Allow permission checker 3.0
https://github.com/keboola/permission-checker/releases/tag/3.0.0

Full Changelog: 3.9.0...3.10.0

3.9.0

Add support for authenticating Storage API requests using Authorization: Bearer header as an alternative to X-StorageApi-Token

Full Changelog: 3.8.2...3.9.0