1fa1966fbe
feat(upgrate): add i18n for account upgade
2026-07-14 11:40:16 +02:00
f331dbf0ee
feat(account): upgrade external to internal
2026-07-14 11:10:23 +02:00
5ae551a93d
Merge pull request #577 from EdouardVanbelle/feat/users-perfs-and-filter-dotfiles
...
feat: users prefs server side + filter dotfiles + filter shares by resource type
2026-07-14 09:07:09 +02:00
17bfb57af7
Merge pull request #578 from EdouardVanbelle/feat/user-regisration-with-allow-list
...
feat(registration): add a domain allow list
2026-07-14 09:06:34 +02:00
341e354162
test(frontend): correct test to fit sign up/in
2026-07-14 03:27:28 +02:00
691d01a458
clippy
2026-07-14 03:18:04 +02:00
3350e77080
fix(env): ensure .env is not taken when using --config
2026-07-14 03:16:27 +02:00
0ad283e590
fix(magic-link): correct url to fit sveltekit
2026-07-14 03:16:27 +02:00
e94063d96a
test(login/register): via password or magic-link
...
Password login
┌─────┬────────────────────────────────────────────────────┬────────────────────────┬─────────────────────────────────────────────────────────────────────────────────────────────┐
│ # │ Case │ Where │ Assertion │
├─────┼────────────────────────────────────────────────────┼────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤
│ L1 │ Login by username │ auth_login.hurl Case 1 │ 200 + access_token, user.email match │
├─────┼────────────────────────────────────────────────────┼────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤
│ L2 │ Login by email (dispatch on @) │ auth_login.hurl Case 2 │ 200, same session shape as L1 │
├─────┼────────────────────────────────────────────────────┼────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤
│ L3 │ Bad password on username path │ auth_login.hurl Case 3 │ 403 anti-enum │
├─────┼────────────────────────────────────────────────────┼────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤
│ L4 │ Bad password on email path │ auth_login.hurl Case 4 │ 403 anti-enum (same shape as L3) │
├─────┼────────────────────────────────────────────────────┼────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤
│ L5 │ Unknown username │ auth_login.hurl Case 5 │ 403 anti-enum (same shape as L3) │
├─────┼────────────────────────────────────────────────────┼────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤
│ L6 │ Unknown email │ auth_login.hurl Case 6 │ 403 anti-enum (same shape as L3) │
├─────┼────────────────────────────────────────────────────┼────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤
│ L7 │ /api/auth/oidc/providers reports methods correctly │ auth_login.hurl Case 7 │ password_login_enabled: true, magic_link_login_enabled: true, require_verified_email: false │
└─────┴────────────────────────────────────────────────────┴────────────────────────┴─────────────────────────────────────────────────────────────────────────────────────────────┘
Password registration
┌─────┬───────────────────────────────────────────────────┬──────────────────────────────┬─────────────────────────────────────────────────────────┐
│ # │ Case │ Where │ Assertion │
├─────┼───────────────────────────────────────────────────┼──────────────────────────────┼─────────────────────────────────────────────────────────┤
│ R1 │ Classic username + email + password → uniform 200 │ registration.hurl Step 2 │ anti-enum message contains "request received" │
├─────┼───────────────────────────────────────────────────┼──────────────────────────────┼─────────────────────────────────────────────────────────┤
│ R2 │ Login after register works │ registration.hurl Step 2b │ 200 + session for the new user │
├─────┼───────────────────────────────────────────────────┼──────────────────────────────┼─────────────────────────────────────────────────────────┤
│ R3 │ Email collision → uniform 200 (no rewrite) │ registration.hurl Steps 8-10 │ attacker password doesn't work; original account intact │
├─────┼───────────────────────────────────────────────────┼──────────────────────────────┼────────────────────────────┤
│ R4 │ Username collision → uniform 200 │ registration.hurl Step 11 │ same anti-enum shape │
├─────┼───────────────────────────────────────────────────┼──────────────────────────────┼────────────────────────────┤
│ R5 │ Off-domain rejection │ registration.hurl Step 12 │ 403 RegistrationDomainNotAllowed │
├─────┼───────────────────────────────────────────────────┼──────────────────────────────┼────────────────────────────┤
│ R6 │ Case-insensitive domain match │ registration.hurl Step 12b │ uniform 200 on charlie@EXAMPLE.COM │
└─────┴───────────────────────────────────────────────────┴──────────────────────────────┴────────────────────────────┘
Magic-link registration (email-only signup)
┌─────┬──────────────────────────────────────────────────────────────────────────────────────────────────┬───────────────────────────────────────────────────┐
│ # │ Case │ Where │ Assertion │
├─────┼──────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤
│ MR1 │ Email-only signup → welcome mail queued │ registration.hurl Step 3 │ uniform 200 + browser-binding cookie set │
├─────┼──────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤
│ MR2 │ Welcome mail contains magic-link URL │ registration.hurl Step 4 │ captured from mock SMTP │
├─────┼──────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤
│ MR3 │ PR 22 cross-browser confirmation page │ registration.hurl Step 5a │ 200 HTML "different browser" │
├─────┼──────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤
│ MR4 │ Cookie-bound redemption lands on SPA │ registration.hurl Step 5b │ 302 → /files (SvelteKit route, post-migration) │
├─────┼──────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤
│ MR5 │ email_verified_at stamped after redemption │ registration.hurl Step 6 │ field present on /api/auth/me │
├─────┼──────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤
│ MR6 │ Second magic-link post-signup │ registration.hurl Step 7 │ uniform 200 │
├─────┼──────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤
│ MR7 │ Profile PATCH — no-op, name set, empty-string rejected, username-taken 409, claim-once 409, etc. │ registration.hurl Steps 6a–6i │ full profile lifecycle │
└─────┴──────────────────────────────────────────────────────────────────────────────────────────────────┴───────────────────────────────────────────────────┘
Magic-link login (existing account)
┌─────┬──────────────────────────────────────────────────────────┬──────────────────────────────────────┬───────────────────────────────────────┐
│ # │ Case │ Where │ Assertion │
├─────┼──────────────────────────────────────────────────────────┼──────────────────────────────────────┼───────────────────────────────────────┤
│ ML1 │ Baseline password login still works │ auth_magic_link_login.hurl Steps 1-2 │ 200 │
├─────┼──────────────────────────────────────────────────────────┼──────────────────────────────────────┼───────────────────────────────────────┤
│ ML2 │ magic-link/send with email identifier │ auth_magic_link_login.hurl Step 3 │ uniform 200 + cookie │
├─────┼──────────────────────────────────────────────────────────┼──────────────────────────────────────┼───────────────────────────────────────┤
│ ML3 │ magic-link/send with username identifier (dispatch on @) │ auth_magic_link_login.hurl Step 4 │ uniform 200 │
├─────┼──────────────────────────────────────────────────────────┼──────────────────────────────────────┼───────────────────────────────────────┤
│ ML4 │ Password-user policy: mail actually sent │ auth_magic_link_login.hurl Step 5 │ SMTP capture proves permit_magic_link_for_password_users in effect │
├─────┼──────────────────────────────────────────────────────────┼──────────────────────────────────────┼───────────────────────────────────────┤
│ ML5 │ Redemption creates a session │ auth_magic_link_login.hurl Steps 6-7 │ 302 → /files, /api/auth/me returns the same user │
├─────┼──────────────────────────────────────────────────────────┼──────────────────────────────────────┼───────────────────────────────────────┤
│ ML6 │ Anti-enum on unknown identifier │ auth_magic_link_login.hurl Step 8 │ same uniform 200 shape as ML3 │
└─────┴──────────────────────────────────────────────────────────┴──────────────────────────────────────┴───────────────────────────────────────┘
OIDC
┌─────┬────────────────────────────────────────────────────────────────────────┬───────────────────┬────────────────────────────────────────────────────────────────────────────────────────────┐
│ # │ Case │ Where │ Assertion │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O1 │ Setup local admin (bootstrap) │ oidc.hurl Step 1 │ 201 │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O2 │ Providers endpoint — OIDC visible │ oidc.hurl Step 2 │ enabled: true, provider_name: MockSSO, password_login_enabled: true, magic_link_login_enabled: false (OIDC-master rule) │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O2b │ Magic-link/send refused (endpoint layer) │ oidc.hurl Step 2b │ 403 MagicLinkLoginDisabled — proves the policy gate fires, not a 503 SMTP-unwired │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O3 │ Authorize redirect includes PKCE + state │ oidc.hurl Step 3 │ 307 to fake IdP │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O4 │ IdP round-trip + JIT provisioning │ oidc.hurl Step 4 │ Callback lands on /login?oidc_code=… │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O5 │ Code exchange → session cookies │ oidc.hurl Step 5 │ 200 + all three cookies │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O6 │ JIT profile mapping (name, given/family, picture, groups → admin role) │ oidc.hurl Step 6 │ every claim reflected on /api/auth/me │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O7 │ Refresh rotation on OIDC session │ oidc.hurl Step 7 │ new access/refresh/CSRF cookies │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O8 │ Refreshed cookies authenticate │ oidc.hurl Step 8 │ 200 on /api/auth/me │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O9 │ Repeat login = same local user (no dup) │ oidc.hurl Step 9 │ user_id stable │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O10 │ Anti-takeover: unverified email → refused │ oidc.hurl Step 10 │ 401/403 │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O11 │ One-time code replay refused │ oidc.hurl Step 11 │ second /exchange → 401 │
└─────┴────────────────────────────────────────────────────────────────────────┴───────────────────┴────────────────────────────────────────────────────────────────────────────────────────────┘
test
2026-07-14 03:16:25 +02:00
01da450cf6
feat(registration): add a domain allow list
...
add:
- OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS to specify list of domains allowing a self registration
- OXICLOUD_REQUIRE_VERIFIED_EMAIL=true|false
- OXICLOUD_AUTH_METHODS=password,magic_link (login methods, OIDC is on top of this)
- OXICLOUD_AUTH_POLICIES=permit_magic_link_for_password_users (OIDC is on top)
2026-07-14 02:43:39 +02:00
3fe6af25f1
fix(loading): fix issue with sveltekit and scripts
...
fix issues like:
```
Executing inline script violates the following Content Security Policy directive 'script-src 'self''.
Either the 'unsafe-inline' keyword, a hash ('sha256-Vv9My0PApDW3C+xGLu9cH98KLrOg/Qhc7hlT1lK5tyM='),
or a nonce ('nonce-...') is required to enable inline execution. The action has been blocked.
```
2026-07-14 02:26:36 +02:00
b9d6fa39c0
feat(user-pref): revert view mode as user-prefs serverside
...
previous change is breaking playwright tests, need to check later changes
2026-07-13 23:16:09 +02:00
b18f0dc74a
test(front): isolate dotfile e2e fixtures under scratch parents
2026-07-13 22:00:53 +02:00
899a08bebe
Merge pull request #575 from EdouardVanbelle/doc/drive
...
docs(drive): add drive doc
2026-07-13 21:36:22 +02:00
2d49c3c8de
Merge pull request #574 from EdouardVanbelle/fix/nextcloud-with-oidc-and-drive-picker
...
fix(nc): login OIDC + drive picker
2026-07-13 21:36:08 +02:00
063382ad60
test(front): test dotfile view/hidden
2026-07-13 21:21:26 +02:00
0296d157a3
chore: remove deprecated playwright wrapped
2026-07-13 21:21:26 +02:00
5aaf49859e
feat(user-perf): add ui user-perf + dotfile filter
...
- add resource kind filter (file, folder, drive) in shared section (localStorage stored)
- add user preferences serverside store
- add client side dotfile filter (show/hide dotfiles) (user perf stored, default: dotfiles are shown)
for security trashed dotfile are always displayed
protection added: if a folder has only hidden items, a notification invite user to display it
if a user rename or create a hidden item, a notification tells it to user
2026-07-13 20:27:52 +02:00
fe66a379b7
docs(drive): add drive doc
...
documentation for users
2026-07-13 19:16:23 +02:00
05ef55a8e0
fix(nc): login OIDC + drive picker
...
ensure OIDC is supported during nextcloud login
flow is:
1. nextcloud
2. oxicloud login ( direct pass or OIDC according config)
3. drive picker (if user has multiple drive)
4. success page + backchannel login to nextcloud
2026-07-13 18:30:20 +02:00
06da428493
Merge pull request #572 from EdouardVanbelle/feat/nextcloud-chrooted-drive
...
feat/nextcloud chrooted drive
2026-07-13 09:37:10 +02:00
e71ef59a04
Merge pull request #571 from EdouardVanbelle/fix/cached-elements
...
fix(front): unregister cache prio to 0.8.0
2026-07-13 09:36:51 +02:00
22e09c09be
Merge pull request #538 from swissiety/webdav-litmus-compliance
...
implement dead properties for nextcloud handler and fixup frontend migration leftover
2026-07-13 09:36:43 +02:00
8301e0c2cb
Merge pull request #569 from EdouardVanbelle/feat/grants-cleanup
...
feat(grant): clean up expired grants
2026-07-13 09:36:29 +02:00
7011fdff5a
Merge origin/main into webdav-litmus-compliance
2026-07-12 22:25:12 +02:00
52814b4d7c
fix(nextcloud): fix chroot + synchronisation
...
- add better hurl coverage on nextcloud chrooted login
- fix issue with nextcloud using /{drive name}/~{drive id}/
- fix trashbin handler
confusion username vs {username}~{folder id}
2026-07-12 22:19:45 +02:00
230927a80e
fix(templates): ensure template use frontend css
...
this fix the nextcloud login + drive selector (chroot)
fix also invitation / magic link
also correct the UX: once user has logged in nextcloud, show an explicita page
2026-07-12 22:19:42 +02:00
f854da30f0
refactor: rustc 1.97.0 (useless borrows in formatting)
2026-07-12 22:04:21 +02:00
f4d2a7cd61
fix(front): unregister cache prio to 0.8.0
...
this fix issue https://github.com/AtalayaLabs/OxiCloud/issues/560
previous version where caching assets, now sveltekit is fully autonomous,
use a sw.js that clears the cache and unregisters it self
2026-07-12 22:02:11 +02:00
b6df05f4d8
refactor: rustc 1.97.0 (useless borrows in formatting)
2026-07-12 18:53:39 +02:00
ba620166ee
feat(grant): clean up expired grants
2026-07-12 18:37:13 +02:00
968c768dd4
Merge pull request #567 from moduvoice/i18n/complete-korean
...
i18n: complete Korean (ko) locale
2026-07-12 17:13:09 +02:00
a3801f5836
i18n: complete Korean (ko) locale
...
The ko.json locale existed but was missing 377 of 1392 keys (~27%),
covering entire feature areas added since the initial translation:
admin plugin management, storage/OIDC/SMTP settings, photos, music
playlists, device pairing, search filters, share dialogs, and more.
Filled in all missing keys with natural Korean translations matching
the existing tone and terminology in the file (파일/폴더/공유/업로드
등), verified full key parity with en.json (1392/1392) and matching
{{placeholder}} interpolation tokens on every translated string.
2026-07-11 23:10:35 +07:00
9ed360443a
Merge pull request #531 from illogic-al/fix/pdf-extract-panic-abort
2026-07-09 21:36:43 +02:00
b4c0915bd3
Merge pull request #562 from EdouardVanbelle/fix/front-from-legacy
...
restore frontend features from legacy
2026-07-08 19:00:16 +02:00
b22ba4a26a
Merge pull request #563 from EdouardVanbelle/feat/music-authz
2026-07-08 15:00:03 +02:00
faac580c70
Merge pull request #553 from EdouardVanbelle/feat/caldav-carddav-to-authz
2026-07-08 14:59:47 +02:00
7fb14efa79
Merge pull request #564 from EdouardVanbelle/chore/bump+security
2026-07-08 14:59:20 +02:00
75f067acf5
test(contact+calendar): cover grants tests
2026-07-08 01:04:03 +02:00
c1e46910b0
feat(music): move playlist to authz engine
2026-07-08 01:04:03 +02:00
57bea52125
test(calendar,addressbook): correct test
2026-07-08 01:03:25 +02:00
28108fe8b2
feat(calendar,addressbook): remove share tables
2026-07-08 01:03:25 +02:00
0e341758af
feat(calendar,addressbook): remove old sharing code
2026-07-08 01:03:25 +02:00
a2ad7757c3
feat(calendar,addressbook): add tests for authz
2026-07-08 01:03:25 +02:00
0fcd617fd1
feat(calendar,addressbook): migrate share to authz engine
...
migrate DB entries to authz engine
and wire authz engine to caldav and carddav
2026-07-08 01:03:25 +02:00
b5881c7114
feat(calendar,addressbook): prepare authz engine
2026-07-08 01:03:25 +02:00
484f933f77
security: bump crossbeam-epoch to fix security audit
...
RUSTSEC-2026-0204
2026-07-08 01:01:27 +02:00
ddb6cf3f5d
chore: bump OxiCloud to 0.8.2 to reflect git tag
2026-07-08 01:01:27 +02:00
b9d0b569ba
Merge pull request #561 from EdouardVanbelle/fix/front-user-change
2026-07-07 22:06:24 +02:00
0e71eeb58a
fix(thumbnail): restore thumb gen PDD|img|video
...
client can generate thumbnail for PDF, image, video if not found
2 cases:
- offload CPU to client side
- permit E2EE (encryption)
2026-07-07 21:58:34 +02:00
Edouard Vanbelle