82bd2e4d22
fix(dpop): do not sign GET /... tumbnail/images/ basic assets
...
no need sign this simole GET to this simplify
an hijacked session could retreive these assets but cannot get the list of them
2026-08-09 01:56:08 +02:00
8222dbbd47
chore(dpop): propagate X-Forwarded-* in vite dev mode
2026-08-09 01:56:08 +02:00
a8e801d1f9
feat(dpop): add documentation
2026-08-09 01:56:07 +02:00
56726618dc
feat(dpop): upgrade migration id
2026-08-09 01:56:07 +02:00
8d6e03a4bb
feat(DPoP): check requests and 401 on failure
2026-08-09 01:56:07 +02:00
ed99b08e62
feat(DPoP): UI: bcast events to support multi tab
...
add also playwright test with the multi tab
2026-08-09 01:56:07 +02:00
4c2b244166
feat(DPoP): add logout
2026-08-09 01:56:07 +02:00
811c7b0f12
feat(DPoP): add API test
2026-08-09 01:56:07 +02:00
5c4354bc67
feat(DPoP): add anti replay cache
2026-08-09 01:56:07 +02:00
2e6789e506
feat(DPoP): add verification + X-Forwarded-Host X-Forwarded-Proto
2026-08-09 01:56:07 +02:00
514bbc35ab
feat(DPoP): add nonce on client side
2026-08-09 01:56:07 +02:00
8b79e26329
feat(DPoP): bing ceremony on login
2026-08-09 01:56:07 +02:00
fed265c70f
feat(DPoP): add frontend dpop library
2026-08-09 01:56:07 +02:00
7fc68c50d5
feat(DPoP): add schema & session & PG repos
2026-08-09 01:56:07 +02:00
5fed90d3ea
Merge pull request #660 from EdouardVanbelle/feat/federation-identity-rename
2026-08-09 01:07:46 +02:00
4c34b25a7b
feat(oidc): support of +alias email (clean it up to reconciliate)
2026-08-08 22:21:55 +02:00
bd8e77c3dd
chore(i18n): add helper for translations
2026-08-08 22:21:55 +02:00
f33d54703c
fix(oidc): fix race on logout
2026-08-08 21:19:21 +02:00
9d80bddb5f
feat(oidc): apply i18n
2026-08-08 20:49:09 +02:00
4d6c4bb92e
feat(oidc): improve error handling
2026-08-08 20:44:27 +02:00
93bb114e21
feat(oidc): admin / my account: correct style
2026-08-08 20:21:34 +02:00
fa7b651897
feat(oidc): provide reason of autolink failure
2026-08-08 20:09:02 +02:00
30bf64667c
feat(oidc): test auto/manual oidc account link/unlink
2026-08-08 19:52:49 +02:00
e9495a63ad
feat(oidc): permit auto/manual oidc account link/unlink
...
link are checking that email matches, +email alias are normalize into email
if email is already used on another account, link is not possible
not usurpation risk as the IDP is choosen by the admin
2026-08-08 19:21:13 +02:00
d8b3f2e026
refactor(oidc): migrate provider into issuer
...
this make OIDC compliant with the invariant binding (issuer and subject)
admin can now rename their provider without breaking
clarifing federation_kind: report the kind of federation wired not the allowed login method
hybryd login method are still allowed
2026-08-08 16:37:45 +02:00
10a8dd7d8b
refactor(oidc): prep. support of Open Cloud Mesh
...
add federation kind (OCM, OIDC, MagicLink)
rename oidc_provider into federation_issuer
rename oidc_subject into federation_subject
2026-08-08 15:10:26 +02:00
521040521d
Merge pull request #659 from EdouardVanbelle/chore/worktree
...
chore(build): add support of git worktree
2026-08-08 01:53:46 +02:00
d547406a09
chore(build): add support of git worktree
...
help build.rs to determine if a build is necessary when working in a git worktree
2026-08-07 20:42:17 +02:00
37613bed6e
Merge pull request #646 from EdouardVanbelle/feat/opaque-auth
2026-08-07 20:28:07 +02:00
21607e3e7f
feat(opaque): improve password change
...
- rebuild the opaque envoloppe
- revoke all other useer's sessions
- send a security email to user
2026-08-06 20:52:17 +02:00
60cf9d976b
feat(opaque): prepare removal of Argon legacy password for the future
2026-08-05 23:14:37 +02:00
1a701b3a64
fix(opaque): fix integration test
2026-08-05 23:13:51 +02:00
94e5b9e355
feat(opaque): permits ksf values change
...
KSF values are stored per user, if admin change value, client will detect it and regenerate the envelop
This pervent users being stuck
2026-08-05 22:52:19 +02:00
84a1b0e005
feat(admin/user): show users auth method + add cli to recover broken opaque login
2026-08-05 21:13:21 +02:00
c4bf2568ba
feat(opaque): lower KSF values to support old clients (memory intensive)
2026-08-05 20:48:55 +02:00
c95d108bf8
feat(opaque): show users migrated in admin panel
2026-08-04 23:58:59 +02:00
baac330389
fix(opaque): fix cookie setting
2026-08-04 23:58:23 +02:00
906934ba25
fix(opaque): use safe url base64
2026-08-04 23:32:33 +02:00
2de476d281
feat(pass reset): request a pass change on 1st login
2026-08-04 23:32:30 +02:00
6965855388
reactor(opaque): normalize to OXICLOUD_AUTH_OPAQUE_* variables
2026-08-04 07:31:32 +02:00
6a5b8980ae
chore(migration): update the migration timestamp
2026-08-04 07:18:40 +02:00
39ea00fff3
test(opaque): fix playwright scenarios
2026-08-04 07:03:08 +02:00
526903e0d5
fix(db-migration): keep timestamp order
2026-08-04 07:03:08 +02:00
7781e07b48
feat(oidc): harden email verified cases
2026-08-04 07:03:08 +02:00
5418a5bd34
feat(opaque): add end to end test hurl + binary
2026-08-04 07:03:08 +02:00
903d769e03
feat(opaque): handle the force password change
2026-08-04 07:03:08 +02:00
e8de07768e
feat(opaque): add end to end integration test
2026-08-04 07:03:08 +02:00
168d94370a
feat(opaque): legacy login refuses migrated OPAQUE users
2026-08-04 07:03:08 +02:00
fac65a7c4d
feat(opaque): add lookup identifier (with anti-enum)
2026-08-04 07:03:08 +02:00
ebe76ffac2
feat(opaque): Silent migration on legacy login
2026-08-04 07:03:08 +02:00
Edouard Vanbelle