xentitlement

# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [0.1.0] - 2026-08-11

### Added

- **Core validation:** `Xentitlement.validate/3` for RSA-SHA256 signature verification
- **Token extraction:** `Xentitlement.extract_from_header/2` for HTTP header parsing
- **Token creation:** `Xentitlement.sign_token/2` for signing claims with RSA private key
- **Low-level signing:** `Xentitlement.sign_canonical_json/2` for direct JSON signing
- **Public API façade:** `Xentitlement` module delegating to `Xentitlement.Entitlements`
- **Comprehensive test suite:** 52 tests covering validation, signing, and integration workflows
- **Test helpers:** `Xentitlement.Test.EntitlementHelpers` for fixture generation
- **Documentation:** README.md, CLAUDE.md, and inline @doc attributes
- **Development guide:** CLAUDE.md with conventions, testing requirements, and architecture decisions
- **BSD-3-Clause License:** Permissive open source license

### Features

- ✓ Asymmetric RSA-SHA256 signature verification
- ✓ Canonical JSON format ensures tampering detection
- ✓ Stateless validation — no state, config, or database required
- ✓ Reusable across multiple Elixir services
- ✓ Zero production dependencies (Jason for JSON only)
- ✓ ~91% code coverage (52 tests, all critical paths covered)
- ✓ Compatible with Elixir 1.14+

### Design Principles

- **Minimal scope:** One thing, done well (RSA signature validation and creation)
- **Stateless:** All parameters passed as function arguments
- **No framework coupling:** Works standalone without Phoenix, Plug, or Guardian
- **Cryptographic integrity:** Canonical JSON + RSA-SHA256 prevents all tampering
- **Full API:** Both sign (private key) and validate (public key) operations

---

## Unreleased

### Planned for Future Releases

- [ ] Support for additional signature algorithms (ES256, EdDSA)
- [ ] Token expiration enforcement
- [ ] Revocation list support
- [ ] Key rotation utilities
- [ ] Benchmarking suite