95aab1f3a7
fix(logo): specify localisation of oxicloud logo for browsers
2026-05-19 17:28:12 +02:00
6f4abfcec4
refactor(js): avoid use of window.XXX and move to import/export
...
- change worker: do not cache html pages (not necessary)
- remove use of window.XXX and maximize import/export,
this will provide more clarety,
show circular dependencies + you will benefit IDE help
2026-04-14 19:05:01 +02:00
5f87dbf612
fix(device-verify): includes main.css + rename class to avoid collision
2026-04-11 18:58:38 +02:00
badf35f08f
chore: remove all executable attributes on non bash files
2026-04-01 23:14:42 +02:00
f2d35ca792
feat: auto-persist JWT secret, remove setup token requirement
...
- JWT secret auto-generates and persists to <STORAGE_PATH>/.jwt_secret
- Remove setup token: first admin setup is open until system initialized
- Fix schema.sql: move CREATE EXTENSION pg_trgm/ltree to top
- Update login UI and auth.js to remove setup token fields
2026-03-05 22:12:53 +01:00
b503e08384
security: fix vulnerabilities 1-7 from security audit
...
- Fix #1 : Share handler IDOR - enforce owner check on share operations
- Fix #2 : list_files_query IDOR - bind folder queries to authenticated user
- Fix #3 : Dedup handler IDOR - restrict dedup operations to file owner
- Fix #4 : Trash handler OptionalAuthUser - require full AuthUser
- Fix #5 : Error info leakage - sanitize 500 error responses
- Fix #6 : Chunked upload IDOR - bind upload sessions to user_id,
add verify_session_owner() check on all session operations
- Fix #7 : CSP unsafe-inline removal - migrate all inline scripts,
styles and event handlers to external files, tighten CSP to
script-src 'self'; style-src 'self'
New files:
- static/js/core/theme-init.js (render-blocking theme init)
- static/js/core/sw-register.js (service worker registration)
- static/css/views/device-verify.css (extracted inline styles)
- static/js/views/device-verify/device-verify.js (extracted inline script)
2026-03-05 13:15:34 +01:00
d2c08d31ba
feat(security): HttpOnly cookies + CSP headers + CSRF double-submit protection
...
- Migrate auth tokens from localStorage to HttpOnly SameSite=Lax cookies
- Add cookie_auth.rs: helpers for setting/clearing auth + CSRF cookies
- Update auth middleware: 3-method auth (Bearer → Basic → Cookie)
- Add 5 security headers: CSP, X-Content-Type-Options, X-Frame-Options,
Referrer-Policy, Permissions-Policy
- Implement CSRF double-submit cookie pattern (csrf.rs middleware)
- Set CSRF cookie on login/refresh/oidc-exchange, clear on logout
- CookieAuthenticated marker skips CSRF for Bearer/Basic clients
- Frontend: strip all localStorage token refs from 14 JS files
- Frontend: csrf.js utility + all 52 mutating fetch/XHR calls protected
- 121 tests passing, 0 warnings
2026-03-03 01:10:50 +01:00
48d853360e
feat: implement OAuth 2.0 Device Authorization Grant (RFC 8628) for WebDAV/CalDAV/CardDAV
...
Adds full Device Authorization Grant flow so DAV clients (rclone, etc.)
can authenticate without browser-based OAuth redirects.
New files:
- Domain entity: DeviceCode with status lifecycle (pending/authorized/denied/expired)
- Port: DeviceCodeStoragePort trait (7 async methods)
- DTOs: request/response types for all device auth endpoints
- Repository: DeviceCodePgRepository (PostgreSQL implementation)
- Service: DeviceAuthService (initiate, verify, approve, deny, poll, cleanup)
- Handler: 6 HTTP endpoints (2 public + 4 protected)
- Static: device-verify.html verification page served at /device
Flow:
1. Client POST /api/auth/device/authorize → device_code + user_code
2. User opens /device?code=XXXX in browser, approves
3. Client polls POST /api/auth/device/token → receives JWT tokens
4. Client uses Bearer token with existing WebDAV/CalDAV/CardDAV middleware
Schema: auth.device_codes table + device_code_status enum added to schema.sql
Closes #152
2026-03-01 11:54:43 +01:00
Edouard Vanbelle