da066f47fa
Music Player & Playlist Manager
2026-04-08 15:14:03 +03:00
badf35f08f
chore: remove all executable attributes on non bash files
2026-04-01 23:14:42 +02:00
f2d35ca792
feat: auto-persist JWT secret, remove setup token requirement
...
- JWT secret auto-generates and persists to <STORAGE_PATH>/.jwt_secret
- Remove setup token: first admin setup is open until system initialized
- Fix schema.sql: move CREATE EXTENSION pg_trgm/ltree to top
- Update login UI and auth.js to remove setup token fields
2026-03-05 22:12:53 +01:00
81987e9321
fix: URL-decode DAV paths with spaces + feat: app passwords for Basic Auth
...
Bug fix:
- URL-decode paths in extract_webdav_path(), extract_caldav_path(),
extract_carddav_path() so folders with spaces (e.g. 'My Folder') no
longer return 404 when accessed via encoded URIs (%20)
- Properly encode href values in PROPFIND/PROPPATCH/LOCK XML responses
- Decode Destination header in MOVE/COPY operations
New feature - App Passwords (API keys for DAV clients):
- POST /api/auth/app-passwords → create (shows token once)
- GET /api/auth/app-passwords → list (prefix only)
- DELETE /api/auth/app-passwords/:id → revoke
- Auth middleware now accepts both Bearer JWT and Basic Auth
- Argon2 hashed, scoped (webdav/caldav/carddav), optional expiry
- Compatible with DAVx5, Thunderbird, rclone, curl
Tested: 12/12 E2E tests pass (create, list, WebDAV/CalDAV/CardDAV
Basic Auth, URL-decode with spaces, wrong password 401, revoke, post-
revoke 401).
2026-03-01 20:34:12 +01:00
48d853360e
feat: implement OAuth 2.0 Device Authorization Grant (RFC 8628) for WebDAV/CalDAV/CardDAV
...
Adds full Device Authorization Grant flow so DAV clients (rclone, etc.)
can authenticate without browser-based OAuth redirects.
New files:
- Domain entity: DeviceCode with status lifecycle (pending/authorized/denied/expired)
- Port: DeviceCodeStoragePort trait (7 async methods)
- DTOs: request/response types for all device auth endpoints
- Repository: DeviceCodePgRepository (PostgreSQL implementation)
- Service: DeviceAuthService (initiate, verify, approve, deny, poll, cleanup)
- Handler: 6 HTTP endpoints (2 public + 4 protected)
- Static: device-verify.html verification page served at /device
Flow:
1. Client POST /api/auth/device/authorize → device_code + user_code
2. User opens /device?code=XXXX in browser, approves
3. Client polls POST /api/auth/device/token → receives JWT tokens
4. Client uses Bearer token with existing WebDAV/CalDAV/CardDAV middleware
Schema: auth.device_codes table + device_code_status enum added to schema.sql
Closes #152
2026-03-01 11:54:43 +01:00
4c98c5a657
style: apply cargo fmt to entire codebase
...
Standardize code formatting across all 173 Rust source files
using rustfmt. No functional changes - purely cosmetic.
This establishes a consistent code style baseline for the
project going forward.
2026-02-14 01:29:34 +01:00
c952e82b27
refactoring hexagonal architecture
2026-02-06 20:57:00 +01:00
52d8250d51
adding card dav and cald dav
2025-04-13 01:04:04 +02:00
3a4cb75ac7
configuring backend topology
2025-03-28 12:38:48 +01:00
38b0e9594b
fix auth errors and add primigenial paper trash
2025-03-24 16:47:42 +01:00
cafad0fbfd
adding user authentication
2025-03-20 09:22:31 +01:00
fe19bc8505
Initial commit
2025-03-17 21:28:08 +01:00
Andrey Tkachenko