15da1a50bd
fix(dpop): fix issue with sveltekit and playwright
...
await page.waitForLoadState('networkidle') is the key before starting
2026-08-09 01:56:08 +02:00
a7653339b1
fix(dpop): sign XmlHttpReq + refresh
2026-08-09 01:56:08 +02:00
8222dbbd47
chore(dpop): propagate X-Forwarded-* in vite dev mode
2026-08-09 01:56:08 +02:00
8d6e03a4bb
feat(DPoP): check requests and 401 on failure
2026-08-09 01:56:07 +02:00
ed99b08e62
feat(DPoP): UI: bcast events to support multi tab
...
add also playwright test with the multi tab
2026-08-09 01:56:07 +02:00
4c2b244166
feat(DPoP): add logout
2026-08-09 01:56:07 +02:00
514bbc35ab
feat(DPoP): add nonce on client side
2026-08-09 01:56:07 +02:00
8b79e26329
feat(DPoP): bing ceremony on login
2026-08-09 01:56:07 +02:00
fed265c70f
feat(DPoP): add frontend dpop library
2026-08-09 01:56:07 +02:00
4c34b25a7b
feat(oidc): support of +alias email (clean it up to reconciliate)
2026-08-08 22:21:55 +02:00
f33d54703c
fix(oidc): fix race on logout
2026-08-08 21:19:21 +02:00
9d80bddb5f
feat(oidc): apply i18n
2026-08-08 20:49:09 +02:00
4d6c4bb92e
feat(oidc): improve error handling
2026-08-08 20:44:27 +02:00
93bb114e21
feat(oidc): admin / my account: correct style
2026-08-08 20:21:34 +02:00
e9495a63ad
feat(oidc): permit auto/manual oidc account link/unlink
...
link are checking that email matches, +email alias are normalize into email
if email is already used on another account, link is not possible
not usurpation risk as the IDP is choosen by the admin
2026-08-08 19:21:13 +02:00
d8b3f2e026
refactor(oidc): migrate provider into issuer
...
this make OIDC compliant with the invariant binding (issuer and subject)
admin can now rename their provider without breaking
clarifing federation_kind: report the kind of federation wired not the allowed login method
hybryd login method are still allowed
2026-08-08 16:37:45 +02:00
21607e3e7f
feat(opaque): improve password change
...
- rebuild the opaque envoloppe
- revoke all other useer's sessions
- send a security email to user
2026-08-06 20:52:17 +02:00
94e5b9e355
feat(opaque): permits ksf values change
...
KSF values are stored per user, if admin change value, client will detect it and regenerate the envelop
This pervent users being stuck
2026-08-05 22:52:19 +02:00
84a1b0e005
feat(admin/user): show users auth method + add cli to recover broken opaque login
2026-08-05 21:13:21 +02:00
c95d108bf8
feat(opaque): show users migrated in admin panel
2026-08-04 23:58:59 +02:00
2de476d281
feat(pass reset): request a pass change on 1st login
2026-08-04 23:32:30 +02:00
39ea00fff3
test(opaque): fix playwright scenarios
2026-08-04 07:03:08 +02:00
903d769e03
feat(opaque): handle the force password change
2026-08-04 07:03:08 +02:00
fac65a7c4d
feat(opaque): add lookup identifier (with anti-enum)
2026-08-04 07:03:08 +02:00
ebe76ffac2
feat(opaque): Silent migration on legacy login
2026-08-04 07:03:08 +02:00
bd8384c9b5
feat(opaque): add change password
2026-08-04 07:03:08 +02:00
0e395ae15f
feat(auth): bring opaque (RFC 9807) auth
...
OPAQUE (RFC 9807) implementation (using `opaque-ke` crate)
with opaque authentfication, server will never receive the password (in the auth=password mode)
this is a must have to create trust with users to permit end to end encryption in the future
(we cannot know if user use the same password/passphrase for his asymetric key or his oxicloud auth,
this is why server must never have the password)
pass1: prepare server
2026-08-04 07:03:08 +02:00
95104904c4
feat(oidc): reduce amount of page when auto_redirect_to_oidc
2026-08-03 23:00:15 +02:00
166b8c4891
feat(oidc): RP initiator logout
...
request token invalidation to IdP (OIDC) on logout
2026-08-03 07:59:14 +02:00
5ebe2d3bae
feat(oidc): add auto-redirect for OIDC
...
add `auto_redirect_if_standalone_oidc` in `OXICLOUD_AUTH_POLICIES`
let admin decide to redirect immediately to IdP if OIDC is the only auth method enabled
2026-08-03 01:01:00 +02:00
8b0fb03b5c
feat(recoverable jobs): clarify life cycle pause vs cancel
...
a job can be paused/resumed
a job as an exclusibity by it's name
if you want to run another job with same name:
either cancel the first one, or wait of it's terminaison
pause does not permit to run the other job, this can create
race conditions
2026-08-02 17:38:44 +02:00
5eec0fb36e
fix(migration): recover the main banner progression on server restart
2026-08-02 16:25:47 +02:00
07802e01f8
feat(recoverable job): add pause/resume capability
2026-08-02 16:17:15 +02:00
c00451fc88
feat(admin): better refresh in admin section when storage is in migration
2026-08-02 15:59:38 +02:00
49a4c53eed
feat(admin storage): show finger print on key generation
2026-08-02 15:26:41 +02:00
015f2da0f7
refactor(backend): normalize naming convention to backend rather storage
...
no ambiguity with the backend rather storage
2026-08-02 14:56:29 +02:00
4297d8139a
feat(admin dashboard): clarify quota usage vs backend usage
2026-08-02 14:56:22 +02:00
dd1528de92
feat(rotate-key): show finger print + way to know if can remove key
2026-08-02 04:26:47 +02:00
0a41f561d0
feat(rotate-key): add report + key fingerprint in hexdigit fmt
2026-08-02 02:40:33 +02:00
e12d8bcb90
feat(job): show if a job is recverable
2026-08-02 02:40:33 +02:00
a58351b7ad
feat(storage key rot): add admin panel
2026-08-02 02:40:33 +02:00
bbfb106a32
feat(maintenance): add a maintenance notification during backend migration
2026-08-01 18:46:17 +02:00
142afecbbf
feat(storage): add a guide on storage
2026-08-01 17:50:35 +02:00
f409658c96
feat(storage): hot swap backend on migrate
2026-08-01 17:11:07 +02:00
8329b4aa56
feat(storage): improve admin panel
2026-08-01 17:10:06 +02:00
d7c19570a5
feat(storage): wire choice of storage
2026-08-01 14:19:14 +02:00
82a50936d4
feat(storage-migration): move storage mig. to recoverable job
2026-08-01 11:53:51 +02:00
5a87999949
fix(integration test): fix drive test used bytes with grace period
2026-07-30 01:29:09 +02:00
48cbec8fae
feat(admin ui): too many tabs, change display
2026-07-30 01:14:35 +02:00
9fe47a53ea
feat(jobs): add admin call to purge jubs result
2026-07-30 00:39:11 +02:00
Edouard Vanbelle