62475193ff
feat(admin): improve admin panel
...
normalise admin > users, sessions, drives
2026-08-09 10:41:34 +02:00
10d831b204
feat(session): ensure dpop even with OIDC
2026-08-09 10:41:34 +02:00
bee856fbd0
feat(session): handle sessions for admin
2026-08-09 10:41:34 +02:00
1b9d812175
feat(telemetry): add /metrics prommetheus exporter
2026-08-09 10:41:34 +02:00
80f2f67db6
feat(dpop): server request dpop on all /api/*
2026-08-09 10:35:52 +02:00
93eb67f99b
feat(dpop): add service worker to sign requests
...
this will permit GET to resources and then to remove directly signing requests
2026-08-09 04:18:20 +02:00
7529914e32
feat(dpop): test XHR request + test session refresh
2026-08-09 02:25:43 +02:00
a218199a02
plan(dpop): remind the choice of opened GET path
2026-08-09 02:18:31 +02:00
d0712817c5
refactor(dpop): apply clippy
2026-08-09 02:18:02 +02:00
97a56899df
refactor(dpop): apply prettier
2026-08-09 02:09:31 +02:00
34d80d70b8
feat(dpop): release route that must not dpop protected (temp version)
2026-08-09 01:56:13 +02:00
15da1a50bd
fix(dpop): fix issue with sveltekit and playwright
...
await page.waitForLoadState('networkidle') is the key before starting
2026-08-09 01:56:08 +02:00
a7653339b1
fix(dpop): sign XmlHttpReq + refresh
2026-08-09 01:56:08 +02:00
82bd2e4d22
fix(dpop): do not sign GET /... tumbnail/images/ basic assets
...
no need sign this simole GET to this simplify
an hijacked session could retreive these assets but cannot get the list of them
2026-08-09 01:56:08 +02:00
8222dbbd47
chore(dpop): propagate X-Forwarded-* in vite dev mode
2026-08-09 01:56:08 +02:00
a8e801d1f9
feat(dpop): add documentation
2026-08-09 01:56:07 +02:00
56726618dc
feat(dpop): upgrade migration id
2026-08-09 01:56:07 +02:00
8d6e03a4bb
feat(DPoP): check requests and 401 on failure
2026-08-09 01:56:07 +02:00
ed99b08e62
feat(DPoP): UI: bcast events to support multi tab
...
add also playwright test with the multi tab
2026-08-09 01:56:07 +02:00
4c2b244166
feat(DPoP): add logout
2026-08-09 01:56:07 +02:00
811c7b0f12
feat(DPoP): add API test
2026-08-09 01:56:07 +02:00
5c4354bc67
feat(DPoP): add anti replay cache
2026-08-09 01:56:07 +02:00
2e6789e506
feat(DPoP): add verification + X-Forwarded-Host X-Forwarded-Proto
2026-08-09 01:56:07 +02:00
514bbc35ab
feat(DPoP): add nonce on client side
2026-08-09 01:56:07 +02:00
8b79e26329
feat(DPoP): bing ceremony on login
2026-08-09 01:56:07 +02:00
fed265c70f
feat(DPoP): add frontend dpop library
2026-08-09 01:56:07 +02:00
7fc68c50d5
feat(DPoP): add schema & session & PG repos
2026-08-09 01:56:07 +02:00
5fed90d3ea
Merge pull request #660 from EdouardVanbelle/feat/federation-identity-rename
2026-08-09 01:07:46 +02:00
4c34b25a7b
feat(oidc): support of +alias email (clean it up to reconciliate)
2026-08-08 22:21:55 +02:00
bd8e77c3dd
chore(i18n): add helper for translations
2026-08-08 22:21:55 +02:00
f33d54703c
fix(oidc): fix race on logout
2026-08-08 21:19:21 +02:00
9d80bddb5f
feat(oidc): apply i18n
2026-08-08 20:49:09 +02:00
4d6c4bb92e
feat(oidc): improve error handling
2026-08-08 20:44:27 +02:00
93bb114e21
feat(oidc): admin / my account: correct style
2026-08-08 20:21:34 +02:00
fa7b651897
feat(oidc): provide reason of autolink failure
2026-08-08 20:09:02 +02:00
30bf64667c
feat(oidc): test auto/manual oidc account link/unlink
2026-08-08 19:52:49 +02:00
e9495a63ad
feat(oidc): permit auto/manual oidc account link/unlink
...
link are checking that email matches, +email alias are normalize into email
if email is already used on another account, link is not possible
not usurpation risk as the IDP is choosen by the admin
2026-08-08 19:21:13 +02:00
d8b3f2e026
refactor(oidc): migrate provider into issuer
...
this make OIDC compliant with the invariant binding (issuer and subject)
admin can now rename their provider without breaking
clarifing federation_kind: report the kind of federation wired not the allowed login method
hybryd login method are still allowed
2026-08-08 16:37:45 +02:00
10a8dd7d8b
refactor(oidc): prep. support of Open Cloud Mesh
...
add federation kind (OCM, OIDC, MagicLink)
rename oidc_provider into federation_issuer
rename oidc_subject into federation_subject
2026-08-08 15:10:26 +02:00
521040521d
Merge pull request #659 from EdouardVanbelle/chore/worktree
...
chore(build): add support of git worktree
2026-08-08 01:53:46 +02:00
d547406a09
chore(build): add support of git worktree
...
help build.rs to determine if a build is necessary when working in a git worktree
2026-08-07 20:42:17 +02:00
37613bed6e
Merge pull request #646 from EdouardVanbelle/feat/opaque-auth
2026-08-07 20:28:07 +02:00
21607e3e7f
feat(opaque): improve password change
...
- rebuild the opaque envoloppe
- revoke all other useer's sessions
- send a security email to user
2026-08-06 20:52:17 +02:00
60cf9d976b
feat(opaque): prepare removal of Argon legacy password for the future
2026-08-05 23:14:37 +02:00
1a701b3a64
fix(opaque): fix integration test
2026-08-05 23:13:51 +02:00
94e5b9e355
feat(opaque): permits ksf values change
...
KSF values are stored per user, if admin change value, client will detect it and regenerate the envelop
This pervent users being stuck
2026-08-05 22:52:19 +02:00
84a1b0e005
feat(admin/user): show users auth method + add cli to recover broken opaque login
2026-08-05 21:13:21 +02:00
c4bf2568ba
feat(opaque): lower KSF values to support old clients (memory intensive)
2026-08-05 20:48:55 +02:00
c95d108bf8
feat(opaque): show users migrated in admin panel
2026-08-04 23:58:59 +02:00
baac330389
fix(opaque): fix cookie setting
2026-08-04 23:58:23 +02:00
Edouard Vanbelle