get_authorize_url() was synchronous and fell back to constructing
{issuer}/authorize when the discovery cache was empty. This produced
incorrect URLs for providers like Keycloak whose authorization
endpoint is {issuer}/protocol/openid-connect/auth.
Made get_authorize_url() async so it can call get_discovery() to
fetch the real authorization_endpoint from .well-known/openid-configuration
before the first redirect. The discovery document is cached after the
initial fetch.
Backend:
- POST /api/admin/users — admin-only user creation endpoint
- username & password required, email optional (auto-generated placeholder)
- role, quota_bytes, active all configurable
- creates personal folder automatically
- PUT /api/admin/users/{id}/password — admin password reset
- GET/PUT /api/admin/settings/registration — toggle public registration
- Supports env var OXICLOUD_DISABLE_REGISTRATION override
- Blocks POST /api/auth/register when disabled
- AdminCreateUserDto, AdminResetPasswordDto added to settings DTOs
- registration_enabled field added to DashboardStatsDto
Frontend (admin.html):
- 'Create User' button in Users tab with full modal form
(username, password, email, role, quota)
- 'Reset Password' button per user in actions column
- 'Allow public self-registration' toggle in Dashboard > System
with warning banner when disabled
Closes#85
- Fix showShareDialog: add try-catch, null checks, prevent textContent
from destroying header icon (use span child instead)
- Capture file/folder target before closeContextMenu to prevent race
- createSharedLink now calls real backend POST /api/shares instead of
localStorage-only mock (still caches locally for offline compat)
- Fix share_handler.rs: use OptionalAuthUser instead of AuthUser to
prevent 401 when auth is disabled (same pattern as delete/trash)
- Add null-safety to closeShareDialog
- Reset new-share-section on dialog open
- Add ?metadata=true support to GET /api/files/{id} to return JSON metadata
instead of binary content (was the root cause of favorites not loading)
- Fix favorites loadFileDetails to use metadata endpoint with auth headers
- Add star icon on favorited files/folders in grid view (top-left corner)
- Add star icon on favorited files/folders in list view (next to name)
- Refresh file view when toggling favorites so star appears/disappears
- Add CSS styles for .favorite-star and .favorite-star-inline
- Fix rename: context menu was nullifying target reference before rename dialog could use it
- Fix delete files/folders: auth extractors were mandatory, causing 401 when auth not configured
- Fix view-file: async fetch race condition with context menu cleanup
- Fix orphaned ID mappings on file deletion
- Fix Authorization: Bearer null headers sent without token
- Add OptionalUserId and OptionalAuthUser infallible extractors
Three bugs caused 403 errors when creating the first admin on fresh
Docker deployments (Unraid, Komodo):
1. db.rs: Schema application failures were silently swallowed. The app
started with no tables, causing all auth queries to fail. Now the
startup aborts if schema cannot be applied, with a fallback
statement-by-statement executor that handles dollar-quoted blocks.
Retries increased to 5 with 2s intervals.
2. auth_application_service.rs: count_admin_users() used fragile string
matching (contains "does not exist")) on multi-layer wrapped errors.
count_all_users() rejected admin creation on any DB error. Both now
allow admin creation on any error for bootstrap scenarios.
3. auth_handler.rs: Redundant 60-line handler-level admin detection
duplicated service-layer logic and generated noisy ERROR logs on
fresh installs. Removed entirely - service layer handles it all.
Closes#81
Security fixes for OIDC authentication flow:
1. CSRF state validation (High): State nonce is now stored server-side
and validated on callback (single-use, 600s TTL)
2. PKCE S256 (Medium): code_challenge/code_verifier pair generated per
RFC 9126, sent in authorize URL and token exchange
3. Nonce in ID token (Medium): Random nonce included in authorize URL,
verified against ID token claims to prevent token replay
4. Secure token delivery (Medium): Tokens no longer in URL fragments.
One-time exchange code redirected to frontend, tokens retrieved via
POST /api/auth/oidc/exchange endpoint (60s TTL, single-use)
5. Registration guard (Low): POST /api/auth/register returns 403 when
disable_password_login is active in OIDC-only mode
- Move WebDAV routes to top-level (out of /api nest) for proper path handling
- Add trailing slash routes and HEAD method support
- Refactor all 12 handlers to use Axum State extractor instead of req.extensions()
- Fix MOVE handler to support rename (same-folder move) via rename_file service
- Add Overwrite header support in MOVE/COPY operations
- Add extract_webdav_path() helper for consistent path parsing
- Add precondition_failed variant to AppError
- All 17 integration tests passing: OPTIONS, PROPFIND, MKCOL, PUT, GET, HEAD,
PROPPATCH, COPY, MOVE, LOCK, DELETE (files and folders)
- Remove Serialize/Deserialize from File, Folder, Session, User, Contact entities
- Create contact_persistence_dto.rs for JSONB persistence in infrastructure layer
- Update contact_pg_repository to use persistence DTOs
- Fix dependency on zip crate (downgrade from 7.2.0 to 2.1.0)
- Fix unused variable warnings in main.rs
- Move PathService import from domain to infrastructure
- Add missing fields to CoreServices and RepositoryServices
- Create proper service initialization in main.rs
Clean Architecture improvements:
- Domain layer no longer depends on serde framework
- Persistence concerns isolated to infrastructure layer
- TokenClaims in auth_service.rs is only exception (required for JWT)
Dionisio