cjw/Oxicloud
1
0
Fork 0
Code Issues Pull Requests Actions 4 Packages Projects Releases Wiki Activity

feat(passwordless): pass4: add env variable to enable mgaiclink on account with password

Browse Source 
OXICLOUD_MAGIC_LINK_OPEN_TO_PASSWORD_USERS (default false)
    For security I recommand to keep it false
    OIDC cannot be bypassed because OIDC may have MFA in place
This commit is contained in:
Edouard Vanbelle
2026-06-02 22:30:00 +02:00
parent 9a49ab44d8
commit 130ff363dc
4 changed files with 188 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/interfaces/api/handlers/app_password_handler.rs
+1 -1
View File
@@ -26,7 +26,7 @@ pub fn app_password_routes() -> Router<Arc<AppState>> {
/// Returns the plain-text password ONCE. The user must copy it immediately.
///
/// External users are rejected with 403: app passwords are persistent
/// credentials, and the magic-link-eligibility rule (`has_login_credential`)
/// credentials, and the magic-link-eligibility rule (`magic_link_eligibility`)
/// is built on the assumption that externals have NO other credential
/// configured. Letting an external mint an app password would break that
/// invariant — and the Basic-Auth surface (`/remote.php/*`, `/ocs/*`)