1a8306f3db
feat(login): prevent login form flash on OIDC callback
2026-08-14 13:38:24 +02:00
0d5a726ef4
feat(oidc): explicit rejection reason
...
Show explicitly login rejection (for example when a user does not have a valid
email reported from OIDC but email verification is set)
2026-08-14 13:38:24 +02:00
4154019603
feat(ui:delta): add heartbeat on worker
2026-08-14 01:52:53 +02:00
24da7443de
feat(ui delta upload): user can change oxi.UPLOAD_BATCH_BYTES
...
```
oxi.UPLOAD_BATCH_BYTES // get current value
oxi.UPLOAD_BATCH_BYTES=1024*1024 // change values
```
values are stored in localstorage, default is 8*1024*1024
2026-08-14 01:52:14 +02:00
ef465b99de
feat(ui:delta upload): warn user if refresh page during upload
2026-08-14 01:52:14 +02:00
e357caf43b
feat(ui): add a logger to change log level and permit better diagnostics
...
in this case logs are added in the delta upload worker
you can increase verbosity from console via:
```javascript
// Usage:
oxi.setLogLevel('oxi:upload', 'debug') // deep dive
oxi.setLogLevel('oxi:upload', 'warn') // quiet
oxi.log.setLevel('debug') // everything to debug
```
values are stored in localstorage
example:
```
oxi.setLogLevel('oxi:upload', 'debug');
'oxi:upload → debug'
deltaUpload.ts:120 [f32ce1] delta start {file: 'Revue de presseg.odp', size: 23658927}
deltaUpload.ts:185 [f32ce1] worker: worker start {file: 'Revue de presseg.odp', size: 23658927}
deltaUpload.ts:186 [f32ce1] worker: wasm loaded
deltaUpload.ts:186 [f32ce1] worker: hashed — blake3=150edbc35f3475a0bdeecd15fe5278dda305ce3b27e53e9c40515a69f0b883f3 (76 chunks)
deltaUpload.ts:186 [f32ce1] worker: negotiate: 76 hashes → 76 missing, 0 dedup'd
deltaUpload.ts:186 [f32ce1] worker: chunk PUT: 28 chunks, 8825338 bytes
deltaUpload.ts:186 [f32ce1] worker: chunk PUT: 29 chunks, 8950230 bytes
deltaUpload.ts:186 [f32ce1] worker: chunk PUT: 19 chunks, 5883663 bytes
deltaUpload.ts:186 [f32ce1] worker: ✅ committed — uploaded 23 658 927 B (no dedup, blake3=150edbc35f3475a0bdeecd15fe5278dda305ce3b27e53e9c40515a69f0b883f3)
deltaUpload.ts:185 [f32ce1] worker: commit HTTP 201 {blake3: '150edbc35f3475a0bdeecd15fe5278dda305ce3b27e53e9c40515a69f0b883f3', uploadedBytes: 23658927, reusedBytes: 0, totalBytes: 23658927, attempt: 0}
deltaUpload.ts:213 [f32ce1] delta done {file: 'Revue de presseg.odp', blake3: '150edbc35f3475a0bdeecd15fe5278dda305ce3b27e53e9c40515a69f0b883f3', savedBytes: 0, uploadedBytes: 23658927}
```
2026-08-14 01:52:03 +02:00
b1493e2d0e
Merge pull request #671 from EdouardVanbelle/i18n/context-translation
2026-08-13 16:58:42 +02:00
27ab392a35
i18n: fix uncontexted strings
...
For example jobs where translated into "employment" in other language
Remove english text in other languages
2026-08-13 00:30:55 +02:00
5a82aa1511
feat(session): UI: improve admin > sessions view
2026-08-11 23:50:43 +02:00
2be2928ddc
i18n: update all languages
2026-08-09 20:37:09 +02:00
c61341b890
test(login): fix login logout test
2026-08-09 16:36:42 +02:00
a7df46f8f8
feat(sessions): show session origin in admin panel + test
2026-08-09 16:36:42 +02:00
763ee82028
security(session): do not expose 'sid' from OIDC
...
prefer exposing origin of the session: passwod, opaque, magic_link, oidc, unknown
2026-08-09 16:36:42 +02:00
950c8c0f38
feat(dpop): provide nonce on immediate login
...
provide the DPoP nonce via cookie on login, this reduce the amount of API call
and prevent having any first call returning in 401
2026-08-09 16:36:42 +02:00
2eb1e8a1d5
feat(logout): improve logout flow
2026-08-09 16:36:19 +02:00
321f3ad733
i18n(session): add missing translations
2026-08-09 14:04:42 +02:00
bbef8afb7b
fix(logout): reduce unwanted API call during logout
...
- stop trying to refresh session
- display "successfully signed out" rather "your session is expired"
2026-08-09 13:51:35 +02:00
69c57e1e24
feat(dpop): client now aware if session if bound
...
this prevent client to try binding and creating
- unnecessary call
- unnecessary warning in server log
2026-08-09 12:05:56 +02:00
107dbfc731
fix(login): fix race in autofocus
2026-08-09 11:46:53 +02:00
69c342f2ed
refactor(dpop): apply typescript prettier
2026-08-09 11:46:53 +02:00
62475193ff
feat(admin): improve admin panel
...
normalise admin > users, sessions, drives
2026-08-09 10:41:34 +02:00
10d831b204
feat(session): ensure dpop even with OIDC
2026-08-09 10:41:34 +02:00
bee856fbd0
feat(session): handle sessions for admin
2026-08-09 10:41:34 +02:00
93eb67f99b
feat(dpop): add service worker to sign requests
...
this will permit GET to resources and then to remove directly signing requests
2026-08-09 04:18:20 +02:00
7529914e32
feat(dpop): test XHR request + test session refresh
2026-08-09 02:25:43 +02:00
97a56899df
refactor(dpop): apply prettier
2026-08-09 02:09:31 +02:00
15da1a50bd
fix(dpop): fix issue with sveltekit and playwright
...
await page.waitForLoadState('networkidle') is the key before starting
2026-08-09 01:56:08 +02:00
a7653339b1
fix(dpop): sign XmlHttpReq + refresh
2026-08-09 01:56:08 +02:00
8222dbbd47
chore(dpop): propagate X-Forwarded-* in vite dev mode
2026-08-09 01:56:08 +02:00
8d6e03a4bb
feat(DPoP): check requests and 401 on failure
2026-08-09 01:56:07 +02:00
ed99b08e62
feat(DPoP): UI: bcast events to support multi tab
...
add also playwright test with the multi tab
2026-08-09 01:56:07 +02:00
4c2b244166
feat(DPoP): add logout
2026-08-09 01:56:07 +02:00
514bbc35ab
feat(DPoP): add nonce on client side
2026-08-09 01:56:07 +02:00
8b79e26329
feat(DPoP): bing ceremony on login
2026-08-09 01:56:07 +02:00
fed265c70f
feat(DPoP): add frontend dpop library
2026-08-09 01:56:07 +02:00
4c34b25a7b
feat(oidc): support of +alias email (clean it up to reconciliate)
2026-08-08 22:21:55 +02:00
f33d54703c
fix(oidc): fix race on logout
2026-08-08 21:19:21 +02:00
9d80bddb5f
feat(oidc): apply i18n
2026-08-08 20:49:09 +02:00
4d6c4bb92e
feat(oidc): improve error handling
2026-08-08 20:44:27 +02:00
93bb114e21
feat(oidc): admin / my account: correct style
2026-08-08 20:21:34 +02:00
e9495a63ad
feat(oidc): permit auto/manual oidc account link/unlink
...
link are checking that email matches, +email alias are normalize into email
if email is already used on another account, link is not possible
not usurpation risk as the IDP is choosen by the admin
2026-08-08 19:21:13 +02:00
d8b3f2e026
refactor(oidc): migrate provider into issuer
...
this make OIDC compliant with the invariant binding (issuer and subject)
admin can now rename their provider without breaking
clarifing federation_kind: report the kind of federation wired not the allowed login method
hybryd login method are still allowed
2026-08-08 16:37:45 +02:00
21607e3e7f
feat(opaque): improve password change
...
- rebuild the opaque envoloppe
- revoke all other useer's sessions
- send a security email to user
2026-08-06 20:52:17 +02:00
94e5b9e355
feat(opaque): permits ksf values change
...
KSF values are stored per user, if admin change value, client will detect it and regenerate the envelop
This pervent users being stuck
2026-08-05 22:52:19 +02:00
84a1b0e005
feat(admin/user): show users auth method + add cli to recover broken opaque login
2026-08-05 21:13:21 +02:00
c95d108bf8
feat(opaque): show users migrated in admin panel
2026-08-04 23:58:59 +02:00
2de476d281
feat(pass reset): request a pass change on 1st login
2026-08-04 23:32:30 +02:00
39ea00fff3
test(opaque): fix playwright scenarios
2026-08-04 07:03:08 +02:00
903d769e03
feat(opaque): handle the force password change
2026-08-04 07:03:08 +02:00
fac65a7c4d
feat(opaque): add lookup identifier (with anti-enum)
2026-08-04 07:03:08 +02:00
Edouard Vanbelle