cjw/Oxicloud
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
2,085 Commits 2 Branches 0 Tags
67032d9afacf63e058fab46e1712cc85e2bcd193
Commit Graph

2085 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Edouard Vanbelle d1436077f2 feat(dpop): wire audit event on dpop bound to session 2026-08-09 17:14:53 +02:00
Edouard Vanbelle bbc1e77e33 test(jobs): remove hardcoded number of jobs in tests 2026-08-09 17:03:27 +02:00
Edouard Vanbelle c61341b890 test(login): fix login logout test 2026-08-09 16:36:42 +02:00
Edouard Vanbelle 3b11b804e2 docs: add DPoP and Opaque on main page 2026-08-09 16:36:42 +02:00
Edouard Vanbelle a34da40ce9 feat(sessions): clean expired sessions (exp > 3month) 2026-08-09 16:36:42 +02:00
Edouard Vanbelle d638566d04 feat(openapi): add sessions + opaque 2026-08-09 16:36:42 +02:00
Edouard Vanbelle a7df46f8f8 feat(sessions): show session origin in admin panel + test 2026-08-09 16:36:42 +02:00
Edouard Vanbelle 763ee82028 security(session): do not expose 'sid' from OIDC 
prefer exposing origin of the session: passwod, opaque, magic_link, oidc, unknown
 2026-08-09 16:36:42 +02:00
Edouard Vanbelle c28eb9b42e fix(oidc): stamp id_token + sid to session 2026-08-09 16:36:42 +02:00
Edouard Vanbelle 950c8c0f38 feat(dpop): provide nonce on immediate login 
provide the DPoP nonce via cookie on login, this reduce the amount of API call
and prevent having any first call returning in 401
 2026-08-09 16:36:42 +02:00
Edouard Vanbelle 2eb1e8a1d5 feat(logout): improve logout flow 2026-08-09 16:36:19 +02:00
Edouard Vanbelle 321f3ad733 i18n(session): add missing translations 2026-08-09 14:04:42 +02:00
Edouard Vanbelle bbef8afb7b fix(logout): reduce unwanted API call during logout 
- stop trying to refresh session
- display "successfully signed out" rather "your session is expired"
 2026-08-09 13:51:35 +02:00
Edouard Vanbelle f4e923e381 fix(test): fix CRC error in png samples 2026-08-09 13:26:40 +02:00
Edouard Vanbelle 6a0911d560 fix(thumbnail): prevent upsampling 2026-08-09 13:26:09 +02:00
Edouard Vanbelle a9eaa3fd74 fix(test): fix playwright to suport OPAQUE+DPOP 2026-08-09 13:10:09 +02:00
Edouard Vanbelle 9e94cb398c test(dpop): OPAQUE + DPOP required for e2e tests 2026-08-09 12:31:39 +02:00
Edouard Vanbelle 11c7f9440e chore(e2e): remove old playwright test (wired to vanilla JS) 2026-08-09 12:27:31 +02:00
Edouard Vanbelle 69c57e1e24 feat(dpop): client now aware if session if bound 
this prevent client to try binding and creating
- unnecessary call
- unnecessary warning in server log
 2026-08-09 12:05:56 +02:00
Edouard Vanbelle df9a6babbb fix(tests): prevent playwrigt test to load default .env 2026-08-09 11:46:53 +02:00
Edouard Vanbelle 107dbfc731 fix(login): fix race in autofocus 2026-08-09 11:46:53 +02:00
Edouard Vanbelle 69c342f2ed refactor(dpop): apply typescript prettier 2026-08-09 11:46:53 +02:00
Edouard Vanbelle 6a434aebe6 refactor(dpop): apply clippy 2026-08-09 11:46:51 +02:00
Edouard Vanbelle 62475193ff feat(admin): improve admin panel 
normalise admin > users, sessions, drives
 2026-08-09 10:41:34 +02:00
Edouard Vanbelle 10d831b204 feat(session): ensure dpop even with OIDC 2026-08-09 10:41:34 +02:00
Edouard Vanbelle bee856fbd0 feat(session): handle sessions for admin 2026-08-09 10:41:34 +02:00
Edouard Vanbelle 1b9d812175 feat(telemetry): add /metrics prommetheus exporter 2026-08-09 10:41:34 +02:00
Edouard Vanbelle 80f2f67db6 feat(dpop): server request dpop on all /api/* 2026-08-09 10:35:52 +02:00
Edouard Vanbelle 93eb67f99b feat(dpop): add service worker to sign requests 
this will permit GET to resources and then to remove directly signing requests
 2026-08-09 04:18:20 +02:00
Edouard Vanbelle 7529914e32 feat(dpop): test XHR request + test session refresh 2026-08-09 02:25:43 +02:00
Edouard Vanbelle a218199a02 plan(dpop): remind the choice of opened GET path 2026-08-09 02:18:31 +02:00
Edouard Vanbelle d0712817c5 refactor(dpop): apply clippy 2026-08-09 02:18:02 +02:00
Edouard Vanbelle 97a56899df refactor(dpop): apply prettier 2026-08-09 02:09:31 +02:00
Edouard Vanbelle 34d80d70b8 feat(dpop): release route that must not dpop protected (temp version) 2026-08-09 01:56:13 +02:00
Edouard Vanbelle 15da1a50bd fix(dpop): fix issue with sveltekit and playwright 
await page.waitForLoadState('networkidle') is the key before starting
 2026-08-09 01:56:08 +02:00
Edouard Vanbelle a7653339b1 fix(dpop): sign XmlHttpReq + refresh 2026-08-09 01:56:08 +02:00
Edouard Vanbelle 82bd2e4d22 fix(dpop): do not sign GET /... tumbnail/images/ basic assets 
no need sign this simole GET to this simplify
an hijacked session could retreive these assets but cannot get the list of them
 2026-08-09 01:56:08 +02:00
Edouard Vanbelle 8222dbbd47 chore(dpop): propagate X-Forwarded-* in vite dev mode 2026-08-09 01:56:08 +02:00
Edouard Vanbelle a8e801d1f9 feat(dpop): add documentation 2026-08-09 01:56:07 +02:00
Edouard Vanbelle 56726618dc feat(dpop): upgrade migration id 2026-08-09 01:56:07 +02:00
Edouard Vanbelle 8d6e03a4bb feat(DPoP): check requests and 401 on failure 2026-08-09 01:56:07 +02:00
Edouard Vanbelle ed99b08e62 feat(DPoP): UI: bcast events to support multi tab 
add also playwright test with the multi tab
 2026-08-09 01:56:07 +02:00
Edouard Vanbelle 4c2b244166 feat(DPoP): add logout 2026-08-09 01:56:07 +02:00
Edouard Vanbelle 811c7b0f12 feat(DPoP): add API test 2026-08-09 01:56:07 +02:00
Edouard Vanbelle 5c4354bc67 feat(DPoP): add anti replay cache 2026-08-09 01:56:07 +02:00
Edouard Vanbelle 2e6789e506 feat(DPoP): add verification + X-Forwarded-Host X-Forwarded-Proto 2026-08-09 01:56:07 +02:00
Edouard Vanbelle 514bbc35ab feat(DPoP): add nonce on client side 2026-08-09 01:56:07 +02:00
Edouard Vanbelle 8b79e26329 feat(DPoP): bing ceremony on login 2026-08-09 01:56:07 +02:00
Edouard Vanbelle fed265c70f feat(DPoP): add frontend dpop library 2026-08-09 01:56:07 +02:00
Edouard Vanbelle 7fc68c50d5 feat(DPoP): add schema & session & PG repos 2026-08-09 01:56:07 +02:00