43 Commits

Author	SHA1	Message	Date
Dan Milne	265518ab25	Move integration tests into right directory	2026-01-01 13:43:13 +11:00
Dan Milne	93a0edb0a2	StandardRB fixes	2026-01-01 13:29:44 +11:00
Dan Milne	9234904e47	Add security-todo and beta-checklists, and some security rake tasks	2026-01-01 13:06:54 +11:00
Dan Milne	d036e25fef	Add auth_time, acr and azp support for OIDC claims	2025-12-31 17:07:54 +11:00
Dan Milne	fcdd2b6de7	Continue adding auth_time - need it in the refresh token too, so we can accurately create new access tokens.	2025-12-31 16:57:28 +11:00
Dan Milne	3939ea773f	We already have a login_time stored - the time stamp of the Session instance creation ( created after successful login ).	2025-12-31 16:45:45 +11:00
Dan Milne	4b4afe277e	Include auth_time in ID token. Switch from upsert -> find_and_create_by so we actually get sid values for consent on the creation of the record	2025-12-31 16:36:32 +11:00
Dan Milne	364e6e21dd	Fixes for tests and AR Encryption	2025-12-31 16:08:05 +11:00
Dan Milne	9d352ab8ec	Fix tests - add missing files	2025-12-31 16:01:31 +11:00
Dan Milne	ed7ceedef5	Include the hash of the access token in the JWT / ID Token under the key at_hash as per the requirements. Update the discovery endpoint to describe subject_type as 'pairwise', rather than 'public', since we do pairwise subject ids.	2025-12-31 14:45:38 +11:00
Dan Milne	29c0981a59	Improve readme and tests	2025-12-31 11:56:09 +11:00
Dan Milne	9d402fcd92	Clean up and secure web_authn controller	2025-12-31 11:44:11 +11:00
Dan Milne	cc7beba9de	PKCE is now default enabled. You can now create public / no-secret apps OIDC apps	2025-12-31 09:22:18 +11:00
Dan Milne	00eca6d8b2	Default deny forward_auth requests	2025-12-30 16:04:01 +11:00
Dan Milne	71d59e7367	Remove plain text token from everywhere	2025-12-30 11:58:11 +11:00
Dan Milne	0761c424c1	Fix tests. Remove tests which test rails functionality	2025-12-30 00:18:19 +11:00
Dan Milne	2a32d75895	Fix tests - don't test standard rails features	2025-12-29 19:45:01 +11:00
Dan Milne	4c1df53fd5	Fix more tests	2025-12-29 19:22:08 +11:00
Dan Milne	acab15ce30	Fix more tests	2025-12-29 18:48:41 +11:00
Dan Milne	0361bfe470	Fix forward_auth bugs - including disabled apps still working. Fix forward_auth tests	2025-12-29 15:37:12 +11:00
Dan Milne	5b9d15584a	Add more rate limiting, and more restrictive headers	2025-12-29 13:29:14 +11:00
Dan Milne	d6029556d3	Add OIDC fixes, add prefered_username, add application-user claims	2025-11-25 16:29:40 +11:00
Dan Milne	7796c38c08	Add pairwise SID with a UUIDv4, a significatant upgrade over User.id.to_s. Complete allowing admin to enforce TOTP per user	2025-11-23 11:16:06 +11:00
Dan Milne	ab0085e9c9	More complete oidc	2025-11-18 20:02:45 +11:00
Dan Milne	1ee3302319	Improvements derived from rodauth-oauth	2025-11-12 22:17:55 +11:00
Dan Milne	33ad956508	Add test	2025-11-12 15:50:04 +11:00
Dan Milne	038801f34b	Add pkce	2025-11-09 10:21:29 +11:00
Dan Milne	fb14ce032f	Strip out more inline javascript code. Encrypt backup codes and treat the backup codes attribute as a json array	2025-11-04 18:46:11 +11:00
Dan Milne	ef15db77f9	Massive refactor. Merge forward_auth into App, remove references to unimplemented OIDC federation and SAML features. Add group and user custom claims. Groups now allocate which apps a user can use	2025-11-04 13:21:55 +11:00
Dan Milne	baa75a3456	Use the IPAddr library to detect ipv4 and ipv6 addresses	2025-10-29 13:47:23 +11:00
Dan Milne	cfab21b130	More tests	2025-10-28 08:27:19 +11:00
Dan Milne	431e947a4c	Some more tests. Fix invitation link and password reset links. After creating their account and setting a password, the user is logged in	2025-10-26 23:09:38 +11:00
Dan Milne	8dd3e60071	Add a list_sign_in_at field for users so magick links work	2025-10-26 22:40:54 +11:00
Dan Milne	e4e7a0873e	Fixes	2025-10-26 22:03:03 +11:00
Dan Milne	b5b1d94d47	Fix the CLINCH_HOST issue.	2025-10-26 21:59:27 +11:00
Dan Milne	52cfd6122c	Typo. More tests	2025-10-26 20:42:18 +11:00
Dan Milne	227e29ce0a	Fix/add some tests. Configure email sending address	2025-10-26 20:13:39 +11:00
Dan Milne	d98f777e7d	Refactor email delivery and background jobs system ... - Switch from SolidQueue to async job processor for simpler background job handling - Remove SolidQueue gem and related configuration files - Add letter_opener gem for development email preview - Fix invitation email template issues (invitation_login_token method and route helper) - Configure SMTP settings via environment variables in application.rb - Add email delivery configuration banner on admin users page - Improve admin users page with inline action buttons and SMTP configuration warnings - Update development and production environments to use async processor - Add helper methods to detect SMTP configuration and filter out localhost settings 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-10-26 16:30:02 +11:00
Dan Milne	0af3dbefed	Remember that we concented.	2025-10-24 17:01:03 +11:00
Dan Milne	12e0ef66ed	OIDC app creation with encrypted secrets and application roles	2025-10-24 14:47:24 +11:00
Dan Milne	fc9afcd1b7	Separate Forward auth into it's own models + controller	2025-10-24 10:56:27 +11:00
Dan Milne	56f7dd7b3c	First crack	2025-10-23 16:45:00 +11:00
Dan Milne	1ff0a95392	First commit	2025-10-23 16:19:56 +11:00