921cbef152
test(oidc): test back-channel logout
2026-08-03 22:26:43 +02:00
acd4420fe3
feat(oidc): impl back channel logout
2026-08-03 08:00:13 +02:00
166b8c4891
feat(oidc): RP initiator logout
...
request token invalidation to IdP (OIDC) on logout
2026-08-03 07:59:14 +02:00
5ebe2d3bae
feat(oidc): add auto-redirect for OIDC
...
add `auto_redirect_if_standalone_oidc` in `OXICLOUD_AUTH_POLICIES`
let admin decide to redirect immediately to IdP if OIDC is the only auth method enabled
2026-08-03 01:01:00 +02:00
b91f2fab2b
feat(oidc): add oidc method in OXICLOUD_AUTH_METHODS
...
permit an admin to specify `oidc` only as the only method to login/register
note that if OIDC is enabled, the engine always append oidc in OXICLOUD_AUTH_METHODS
we could move to an explicit declaration in a major release
2026-08-03 00:49:40 +02:00
02db85c040
Merge pull request #657 from EdouardVanbelle/fix/services-use-blob-abstraction
...
fix: prevent services accessing directly to localstorage (audio, media metadata and face indexing)
2026-08-02 23:46:44 +02:00
7663f803d3
fix: fix services accessig directly to localstorage
...
Prevent services accessing directly to localstorage and prefer using an astraction layer
to expose full blob. The abstraction layer (dedup services) will cover backend storage
election (local, s3, ...), encryption, etc
This change permit audio_metadata_service, media_metadaa_service, face_indexing_service to handle
blobs without worring of the backend.
note: prefered way to handle blob is the streamed way. Some services may not have this possibility
2026-08-02 22:20:46 +02:00
74866bea81
Merge pull request #656 from EdouardVanbelle/feat/storage-key-rotation
2026-08-02 18:10:45 +02:00
6ab87d83e8
docs(backend-storage): explain design including the blob header
2026-08-02 17:38:47 +02:00
8b0fb03b5c
feat(recoverable jobs): clarify life cycle pause vs cancel
...
a job can be paused/resumed
a job as an exclusibity by it's name
if you want to run another job with same name:
either cancel the first one, or wait of it's terminaison
pause does not permit to run the other job, this can create
race conditions
2026-08-02 17:38:44 +02:00
5eec0fb36e
fix(migration): recover the main banner progression on server restart
2026-08-02 16:25:47 +02:00
07802e01f8
feat(recoverable job): add pause/resume capability
2026-08-02 16:17:15 +02:00
c00451fc88
feat(admin): better refresh in admin section when storage is in migration
2026-08-02 15:59:38 +02:00
58c24bd150
feat(storage migration): make logs more verbose
2026-08-02 15:55:30 +02:00
49a4c53eed
feat(admin storage): show finger print on key generation
2026-08-02 15:26:41 +02:00
015f2da0f7
refactor(backend): normalize naming convention to backend rather storage
...
no ambiguity with the backend rather storage
2026-08-02 14:56:29 +02:00
a10d3254bf
fix(storage migration): overwrite target blob if mismatch
...
if target blob already exists, migration will check the blob
if header is already with the targeted key (or no key if not ciphered) no need write
otherwise write the blob (that will convert any blob with no header into the correct version)
2026-08-02 14:56:29 +02:00
9902a6f8fe
refactor(usage_reconcile): explicit naming to prevent confusion with storage (backend)
2026-08-02 14:56:29 +02:00
db5ae1cc90
fix(storage migration): do not flip storage backend on migration error
2026-08-02 14:56:29 +02:00
6b3d36730c
fix(blob consistency): fix report of unreadable blob
2026-08-02 14:56:26 +02:00
d4cb0c53d5
feat(blob): add a safety net on blob without header
...
function read_dispatch:
the reader use th header to determined if file is encrypted
and which key (fingerprint) was used
if blob was recorded in legacy format (no header), it tries all attached keys on storage
last safety net: if none matched, do a blake3 on file, if it matches the file is
stored in clear (no cipher)
otherwise:
- blob is corrupted
- key is lost
2026-08-02 14:56:26 +02:00
c0878a7928
fix(storage-usage): keep trashed files in usage till they a permenently deleted
2026-08-02 14:56:26 +02:00
4297d8139a
feat(admin dashboard): clarify quota usage vs backend usage
2026-08-02 14:56:22 +02:00
dd1528de92
feat(rotate-key): show finger print + way to know if can remove key
2026-08-02 04:26:47 +02:00
47246592b7
fix(blob_consistency): raise a finding if decipher fails
2026-08-02 02:40:33 +02:00
120dd09885
fix(decypher): try to decipher even with old format
2026-08-02 02:40:33 +02:00
0a41f561d0
feat(rotate-key): add report + key fingerprint in hexdigit fmt
2026-08-02 02:40:33 +02:00
ddede168f9
feat(job): delete temp files at boot time (only possible case: crash)
2026-08-02 02:40:33 +02:00
bc481bdd99
feat(job): fix key rotation on local storage (replace blob)
2026-08-02 02:40:33 +02:00
e12d8bcb90
feat(job): show if a job is recverable
2026-08-02 02:40:33 +02:00
a58351b7ad
feat(storage key rot): add admin panel
2026-08-02 02:40:33 +02:00
a9d5aae781
feat(storage key rot): add rotate services
2026-08-02 02:40:33 +02:00
30b0000c26
feat(storage key rot): add blob/chunk creation with the header
2026-08-02 02:40:33 +02:00
9485ee5540
feat(storage key rot): add blob header engine
2026-08-02 02:40:33 +02:00
e164689771
feat(storage key rot): remove dead born OXICLOUD_STORAGE_<N>_ENCRYPTION_CIPHER
...
+ alway ovewrite on storage migration (got issue when migrating with blob already existing and a key change)
2026-08-02 02:40:33 +02:00
03c8f87f1f
feat(storage key rot): prepare format <cipher1>:<key2>,<cipher2>:<key2>,...
2026-08-02 02:40:33 +02:00
4cb73eaf39
plan(storage-key-rotation): add a key rotation + header version blob
2026-08-02 02:40:33 +02:00
0660ac1e6c
Merge pull request #654 from EdouardVanbelle/feat/storage-migration
2026-08-02 00:15:53 +02:00
f1c72f8837
test(storage): adapt playwright admin tests
2026-08-01 20:35:04 +02:00
836c7a57c1
audit(RUSTSEC-2026-0222): inhibit alert, wasmtime plugin are not used per today
2026-08-01 20:30:33 +02:00
88921c975a
fix(hurl test): add new job
2026-08-01 20:08:17 +02:00
c31b8b814d
fix(oidc): change the test
2026-08-01 19:58:38 +02:00
bbfb106a32
feat(maintenance): add a maintenance notification during backend migration
2026-08-01 18:46:17 +02:00
142afecbbf
feat(storage): add a guide on storage
2026-08-01 17:50:35 +02:00
f409658c96
feat(storage): hot swap backend on migrate
2026-08-01 17:11:07 +02:00
8329b4aa56
feat(storage): improve admin panel
2026-08-01 17:10:06 +02:00
cc439aaff9
fix(dedup): fix informations
2026-08-01 16:20:49 +02:00
f949939508
feat(storage): add cmd option --select-storage
2026-08-01 14:36:24 +02:00
d7c19570a5
feat(storage): wire choice of storage
2026-08-01 14:19:14 +02:00
2de71b6d9a
feat(storage): add readonly during storage migration
2026-08-01 13:43:04 +02:00
Edouard Vanbelle