117815ef4d
feat(user): show if user is online
2026-08-21 19:34:11 +02:00
ec9b5087f3
refactor(User): apply changes on frontend
2026-08-21 17:10:02 +02:00
a11ae679cf
refactor(User): move UserDto to PublicUserDto
2026-08-21 16:10:51 +02:00
d17b3b6bd3
refactor(User): wire /api/auth/me to SelfUserDto and /api/admin/users to FullUserDto
2026-08-21 15:43:43 +02:00
ec70b21c6e
refactor(User): clear separation PublicUserDto, FullUserDto, SelfUserDto
2026-08-21 14:29:36 +02:00
cc3be1ec38
refactor: apply clippy recos for rustc 1.98.0
2026-08-21 14:27:42 +02:00
20e6e05bb4
feat(sessions): identify online sessions (connected users)
...
identify online session by writing the `last_seen_at`
information is stored in a map and flush each 30s to prevent performance impact on pgsql
2026-08-20 10:40:27 +02:00
0d5a726ef4
feat(oidc): explicit rejection reason
...
Show explicitly login rejection (for example when a user does not have a valid
email reported from OIDC but email verification is set)
2026-08-14 13:38:24 +02:00
1104a4cb06
fix(user-pref): permit edition of user prefs for OIDC account
2026-08-13 20:39:55 +02:00
06aff99fa3
Merge pull request #635 from swissiety/rfc-6868-param-encoding
...
fix(vcard): add RFC 6868 parameter value encoding
2026-08-12 10:32:26 +02:00
e0654cd848
feat(openapi): implement missing routes
...
Admin:
- /api/admin/drives, /api/admin/drives/{id}, /api/admin/drives/{id}/members, /api/admin/drives/{id}/members/{kind}/{sid}
- /api/admin/jobs/{name}/pause, /api/admin/jobs/{name}/runs/{id}/findings, /api/admin/jobs/runs/purge
- /api/admin/smtp/info, /api/admin/smtp/test
- /api/admin/storage/entries/{name}/rotate
- /api/admin/users/{id}/promote-to-internal
Auth:
- /api/auth/dpop/bind
- /api/auth/magic-link/send
- /api/auth/me/profile
- /api/auth/upgrade-to-internal
Drives / grants / trash / users / dedup:
- /api/drives/{id}, /api/drives/{id}/members (get + delete), /api/drives/{id}/policies, /api/drives/{id}/quota
- /api/grants/{id}/notify
- /api/trash/drive/{drive_id}
- /api/users/{id}
- /api/dedup/check-batch
Faces
- /api/people — cluster list (PersonDto[])
- /api/people/{id}/photos — file ids for one person
- /api/people/{id} — rename (or clear name)
- /api/people/merge — merge two clusters
- /api/people/recluster — re-run clustering
- /api/people/data — nuke all face data
- /api/people/faces/{file_id} — face boxes per photo (FaceBoxDto[])
2026-08-09 17:58:06 +02:00
d1436077f2
feat(dpop): wire audit event on dpop bound to session
2026-08-09 17:14:53 +02:00
a34da40ce9
feat(sessions): clean expired sessions (exp > 3month)
2026-08-09 16:36:42 +02:00
d638566d04
feat(openapi): add sessions + opaque
2026-08-09 16:36:42 +02:00
a7df46f8f8
feat(sessions): show session origin in admin panel + test
2026-08-09 16:36:42 +02:00
763ee82028
security(session): do not expose 'sid' from OIDC
...
prefer exposing origin of the session: passwod, opaque, magic_link, oidc, unknown
2026-08-09 16:36:42 +02:00
c28eb9b42e
fix(oidc): stamp id_token + sid to session
2026-08-09 16:36:42 +02:00
950c8c0f38
feat(dpop): provide nonce on immediate login
...
provide the DPoP nonce via cookie on login, this reduce the amount of API call
and prevent having any first call returning in 401
2026-08-09 16:36:42 +02:00
6a0911d560
fix(thumbnail): prevent upsampling
2026-08-09 13:26:09 +02:00
69c57e1e24
feat(dpop): client now aware if session if bound
...
this prevent client to try binding and creating
- unnecessary call
- unnecessary warning in server log
2026-08-09 12:05:56 +02:00
6a434aebe6
refactor(dpop): apply clippy
2026-08-09 11:46:51 +02:00
10d831b204
feat(session): ensure dpop even with OIDC
2026-08-09 10:41:34 +02:00
bee856fbd0
feat(session): handle sessions for admin
2026-08-09 10:41:34 +02:00
1b9d812175
feat(telemetry): add /metrics prommetheus exporter
2026-08-09 10:41:34 +02:00
80f2f67db6
feat(dpop): server request dpop on all /api/*
2026-08-09 10:35:52 +02:00
d0712817c5
refactor(dpop): apply clippy
2026-08-09 02:18:02 +02:00
34d80d70b8
feat(dpop): release route that must not dpop protected (temp version)
2026-08-09 01:56:13 +02:00
82bd2e4d22
fix(dpop): do not sign GET /... tumbnail/images/ basic assets
...
no need sign this simole GET to this simplify
an hijacked session could retreive these assets but cannot get the list of them
2026-08-09 01:56:08 +02:00
8d6e03a4bb
feat(DPoP): check requests and 401 on failure
2026-08-09 01:56:07 +02:00
4c2b244166
feat(DPoP): add logout
2026-08-09 01:56:07 +02:00
811c7b0f12
feat(DPoP): add API test
2026-08-09 01:56:07 +02:00
5c4354bc67
feat(DPoP): add anti replay cache
2026-08-09 01:56:07 +02:00
2e6789e506
feat(DPoP): add verification + X-Forwarded-Host X-Forwarded-Proto
2026-08-09 01:56:07 +02:00
8b79e26329
feat(DPoP): bing ceremony on login
2026-08-09 01:56:07 +02:00
7fc68c50d5
feat(DPoP): add schema & session & PG repos
2026-08-09 01:56:07 +02:00
4c34b25a7b
feat(oidc): support of +alias email (clean it up to reconciliate)
2026-08-08 22:21:55 +02:00
4d6c4bb92e
feat(oidc): improve error handling
2026-08-08 20:44:27 +02:00
fa7b651897
feat(oidc): provide reason of autolink failure
2026-08-08 20:09:02 +02:00
e9495a63ad
feat(oidc): permit auto/manual oidc account link/unlink
...
link are checking that email matches, +email alias are normalize into email
if email is already used on another account, link is not possible
not usurpation risk as the IDP is choosen by the admin
2026-08-08 19:21:13 +02:00
d8b3f2e026
refactor(oidc): migrate provider into issuer
...
this make OIDC compliant with the invariant binding (issuer and subject)
admin can now rename their provider without breaking
clarifing federation_kind: report the kind of federation wired not the allowed login method
hybryd login method are still allowed
2026-08-08 16:37:45 +02:00
10a8dd7d8b
refactor(oidc): prep. support of Open Cloud Mesh
...
add federation kind (OCM, OIDC, MagicLink)
rename oidc_provider into federation_issuer
rename oidc_subject into federation_subject
2026-08-08 15:10:26 +02:00
21607e3e7f
feat(opaque): improve password change
...
- rebuild the opaque envoloppe
- revoke all other useer's sessions
- send a security email to user
2026-08-06 20:52:17 +02:00
1a701b3a64
fix(opaque): fix integration test
2026-08-05 23:13:51 +02:00
94e5b9e355
feat(opaque): permits ksf values change
...
KSF values are stored per user, if admin change value, client will detect it and regenerate the envelop
This pervent users being stuck
2026-08-05 22:52:19 +02:00
84a1b0e005
feat(admin/user): show users auth method + add cli to recover broken opaque login
2026-08-05 21:13:21 +02:00
c4bf2568ba
feat(opaque): lower KSF values to support old clients (memory intensive)
2026-08-05 20:48:55 +02:00
c95d108bf8
feat(opaque): show users migrated in admin panel
2026-08-04 23:58:59 +02:00
baac330389
fix(opaque): fix cookie setting
2026-08-04 23:58:23 +02:00
906934ba25
fix(opaque): use safe url base64
2026-08-04 23:32:33 +02:00
2de476d281
feat(pass reset): request a pass change on 1st login
2026-08-04 23:32:30 +02:00
Edouard Vanbelle