100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Dan MilneandClaude Opus 4	b7fa49953c	Revoke full token chain on OIDC authorization-code replay ... The replay handler previously used a created_at time-range filter to target access tokens and called update_all(expires_at:), which left revoked_at nil, skipped refresh tokens entirely, and could miss or falsely catch tokens from concurrent flows. Add an oidc_authorization_code FK on both token tables, carry it through refresh-token rotation, and use the association to revoke every descendant via revoke! (which sets revoked_at and cascades access -> refresh). Co-Authored-By: Claude Opus 4 <noreply@anthropic.com>	2026-04-20 17:39:08 +10:00
Dan MilneandClaude Opus 4	b7dd3c02e7	Extract client_id and redirect_uri validation into before_actions ... The authorize action opened with ~55 lines of parameter validation that ran before any business logic. Move the two RFC 6749 §4.1.2.1 checks (client_id lookup, redirect_uri registration) into set_application and validate_redirect_uri before_actions. The action body now starts at the point where errors may legitimately redirect back to the client. Co-Authored-By: Claude Opus 4 <noreply@anthropic.com>	2026-04-20 17:29:36 +10:00
Dan MilneandClaude Opus 4	17a464fd15	Fix OIDC claims validation against undefined scopes variable ... The authorize action called validate_claims_against_scopes with requested_scopes before that local was assigned (assignment was ~100 lines later), raising NameError whenever a client passed a claims= parameter. Move the scope normalization above the claims validation. Co-Authored-By: Claude Opus 4 <noreply@anthropic.com>	2026-04-20 17:26:46 +10:00
Dan MilneandClaude Opus 4.6	9197524c88	Add remember me checkbox, center and narrow sign-in form ... - Add "Remember me for 30 days" checkbox (30-day vs 24-hour session expiry) - Center heading and constrain form width to max-w-md - Preserve remember_me preference through TOTP and WebAuthn auth flows Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-11 11:22:51 +10:00
Dan MilneandClaude Opus 4.6	2235924f37	Harden OIDC, add SVG sanitization, improve form UX and security defaults ... Remove PKCE plain method support (S256 only), enforce openid scope requirement, filter to supported scopes, strip reserved claims from custom claims as defense-in-depth, sanitize SVG icons with Loofah, add global input padding, switch session cookies to SameSite=Lax, use Session.active scope, and remove unsafe-eval from CSP. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-06 21:06:51 +10:00
Dan MilneandClaude Opus 4.6	c7d9df48b5	Remove auto-trigger of passkey authentication on page load ... Safari's WebAuthn dialog can become undismissable when invoked without a user gesture. Always require the user to click "Continue with Passkey" instead of auto-triggering navigator.credentials.get(). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-22 00:38:48 +11:00
Dan MilneandClaude Opus 4.6	3d98261a51	Add dark mode with toggle and localStorage persistence ... Uses Tailwind v4 class-based dark mode with a Stimulus controller for toggling. Respects prefers-color-scheme as default, prevents FOUC with an inline script, and persists the user's choice in localStorage. All views updated with dark: variants for backgrounds, text, borders, badges, buttons, and form inputs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-22 00:37:58 +11:00
Dan MilneandClaude Opus 4.6	43958f50ce	Add @tailwindcss/forms plugin and improve application form UX ... Install @tailwindcss/forms to fix missing padding on form inputs across the app. Move the Application Type selector earlier in the new application form (after slug, before description) so it gates type-specific fields sooner. On the edit page, replace the confusing disabled dropdown with a read-only badge since the type can't be changed after creation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-22 00:36:37 +11:00
Dan MilneandClaude Opus 4.6	d8d8000b92	Add tests for forward auth cache gaps: invalidation, rate limiting, and debounce ... - Test ApplicationGroup cache busting on add and remove - Test first failure persists in rate limit cache (increment fallback) - Test bearer token failures count toward rate limit - Test rd parameter rejected for deactivated applications - Test last_activity_at updates after debounce window expires - Test successful requests don't reset failure counter Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-21 23:59:18 +11:00
Dan MilneandClaude Opus 4.6	6844c5fab3	Clean up forward auth caching: remove duplication, fix rate limiting, and plug cache gaps ... - Remove duplicated app_allows_user_cached?/headers_for_user_cached methods; call model methods directly - Fix sliding-window rate limit bug by using increment instead of write (avoids TTL reset) - Use cached app lookup in validate_redirect_url instead of hitting DB on every unauthorized request - Add cache busting to ApplicationGroup so group assignment changes invalidate the cache - Eager-load user groups (includes(user: :groups)) to eliminate N+1 queries - Replace pluck(:name) with map(&:name) to use already-loaded associations - Remove hardcoded fallback domain, dead methods, and unnecessary comments - Fix test indentation and make group-order assertions deterministic Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-21 23:54:19 +11:00
Dan MilneandClaude Opus 4.6	5505f99287	Add rate limiting and in-memory caching for forward auth endpoint ... Rate limit failed attempts (50/min per IP) with 429 + Retry-After. Cache forward auth applications in a dedicated MemoryStore (8MB LRU) to avoid loading all apps from SQLite on every request. Debounce last_activity_at writes to at most once per minute per session. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-07 11:15:54 +11:00
Dan MilneandClaude Opus 4.6	1b691ad341	Bump Rails from 8.1.1 to 8.1.2 ... Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-07 11:11:13 +11:00
Dan MilneandClaude Opus 4.6	f65df76d99	Show user-friendly error when passkey authentication fails ... Add error target to login page so WebAuthn errors are visible instead of only appearing in the console. Use a helpful fallback message that suggests a browser extension may be interfering. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-05 23:11:43 +11:00
Dan MilneandClaude Opus 4.6	c5898bd9a4	Add passkey option on TOTP page and auto-trigger passkey for TOTP users ... When a user has both passkeys and TOTP configured, auto-trigger the passkey flow on login to save them from the password→TOTP path. Also add a "Use Passkey Instead" button on the TOTP verification page as an escape hatch for users who end up there. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-05 23:09:01 +11:00
Dan MilneandClaude Opus 4.6	9dbde8ea31	Fix README: don't claim OIDC certification, just conformance ... Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-05 22:39:10 +11:00
Dan MilneandClaude Opus 4.6	191a7b5fb3	Update README: add API keys docs, VoidAuth, highlight conformance ... - Document API keys / bearer tokens for forward auth - Add VoidAuth to alternatives list - Move OIDC conformance certification and test counts to top - Update Ruby requirement to 4.0+, test count to 450 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-05 22:36:12 +11:00
Dan Milne	7a9348c1f1	Add voidauth to the list of alternatives	2026-03-05 22:30:08 +11:00
Dan Milne	225d8ae5ca	Update the README	2026-03-05 22:27:24 +11:00
Dan MilneandClaude Opus 4.6	65c19fa732	Upgrade to Ruby 4.0.1, bump version to 0.9.0 ... Replace CGI.parse (removed in Ruby 4.0) with Rack::Utils.parse_query in application controller, sessions controller, and OIDC tests. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-05 21:52:11 +11:00
Dan MilneandClaude Opus 4.6	fd8785a43d	Add API keys / bearer tokens for forward auth ... Enables server-to-server authentication for forward auth applications (e.g., video players accessing WebDAV) where browser cookies aren't available. API keys use clk_ prefixed tokens stored as HMAC hashes. Bearer token auth is checked before cookie auth in /api/verify. Invalid tokens return 401 JSON (no redirect). Requests without bearer tokens fall through to existing cookie flow unchanged. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-05 21:45:40 +11:00
Dan Milne	444ae6291c	Add missing files, fix formatting	2026-01-05 23:34:11 +11:00
Dan Milne	233fb723d5	More accurate language around passing the OpenID Conformance tests	2026-01-05 23:32:34 +11:00
Dan Milne	cc6d4fcc65	Add test files, update checklist	2026-01-05 23:28:55 +11:00
Dan Milne	5268f10eb3	Don't allow claim escalation	2026-01-05 16:40:11 +11:00
Dan Milne	5c5662eaab	Expose 'username' via forward auth headers	2026-01-05 15:12:24 +11:00
Dan Milne	27d77ebf47	Expose 'username' via forward auth headers	2026-01-05 15:12:02 +11:00
Dan Milne	ba08158c85	Bug fix for background jobs	2026-01-05 14:43:06 +11:00
Dan Milne	a6480b0860	Verion Bump	2026-01-05 13:08:22 +11:00
Dan Milne	75cc223329	303 is the correct response	2026-01-05 13:05:24 +11:00
Dan Milne	46ae65f4d2	Move the 'remove_query_param' to the application controller	2026-01-05 13:03:03 +11:00
Dan Milne	95d0d844e9	Add a method to remove parameters from urls, so we can redirect without risk of infinite redirect. Fix a bunch of redirects to login afer being foced to log out. Add missing migrations	2026-01-05 13:01:32 +11:00
Dan Milne	524a7719c3	Merge branch 'main' into feature/claims	2026-01-05 12:11:53 +11:00
Dan Milne	8110d547dd	Fix bug with session deletion when logout forced and we have a redirect to follow	2026-01-05 12:11:52 +11:00
Dan Milne	25e1043312	Add skip-consent, correctly use 303, rather than 302, actually rename per app 'logout' to 'require re-auth'. Add helper methods for token lifetime - allowing 10d for 10days for example.	2026-01-05 12:03:01 +11:00
Dan Milne	074a734c0c	Accidentally added skip-consent to this branch	2026-01-05 12:01:04 +11:00
Dan Milne	4a48012a82	Add claims support	2026-01-05 12:00:29 +11:00
Dan Milne	e631f606e7	Better error messages	2026-01-03 12:29:27 +11:00
Dan Milne	f4a697ae9b	More OpenID Conformance test fixes - work with POST, correct auth code character set, correct no-store cache headers	2026-01-03 12:28:43 +11:00
Dan Milne	16e34ffaf0	Updates for oidc conformance	2026-01-03 10:11:10 +11:00
Dan Milne	0bb84f08d6	OpenID conformance test: we get a warning for not having a value for every claim. But we can explictly list support claims. Nothing we can do about a warning in the complience.	2026-01-02 16:35:12 +11:00
Dan Milne	182682024d	OpenID Conformance: Include all required scopes when profile is requested, even if they're empty	2026-01-02 15:47:40 +11:00
Dan Milne	b517ebe809	OpenID conformance test: Allow posting the access token in the body for userinfo endpoint	2026-01-02 15:41:07 +11:00
Dan Milne	dd8bd15a76	CSRF issue with API endpoint	2026-01-02 15:29:34 +11:00
Dan Milne	f67a73821c	OpenID Conformance: user info endpoint should support get and post requets, not just get	2026-01-02 15:26:39 +11:00
Dan Milne	b09ddf6db5	OpenID Conformance: We need to return to the redirect_uri in the case of errors.	2026-01-02 15:12:55 +11:00
Dan Milne	abbb11a41d	Return only scopes requested, add tests ( OpenID conformance test )	2026-01-02 14:55:06 +11:00
Dan Milne	b2030df8c2	Return only scopes requested ( OpenID conformance test. Update README	2026-01-02 14:05:54 +11:00
Dan Milne	07cddf5823	Version bump	2026-01-02 12:57:28 +11:00
Dan Milne	46aa983189	Don't use secret scanner for trivy - github already does it and it's hard to ignore the test key	2026-01-02 12:56:03 +11:00
Dan Milne	d0d79ee1da	Try ignore capybara's test tripping trivy	2026-01-02 12:52:24 +11:00
Dan Milne	2f6a2c7406	Update ruby 3.4.6 -> 3.4.7. Update gems. Add trivy scanning and ignore unfixable Debian CVEs. Ignore a test fixture key for Capybara	2026-01-02 12:48:40 +11:00
Dan Milne	5137a25626	Add remainging rate limits. Add docker compose production example. Update beta-checklist.	2026-01-02 12:14:13 +11:00
Dan Milne	fed7c3cedb	Some beta-checklist updates	2026-01-02 11:53:41 +11:00
Dan Milne	e288fcad7c	Remove old docs	2026-01-01 21:04:26 +11:00
Dan Milne	c1c6e0112e	ADd backup / restore documentation	2026-01-01 15:40:49 +11:00
Dan Milne	7f834fb7fa	Version bump	2026-01-01 15:27:19 +11:00
Dan Milne	ae99d3d9cf	Fix webauthn bug. Fix tests. Update docs	2026-01-01 15:24:56 +11:00
Dan Milne	1afcd041f9	Update README, fix a test	2026-01-01 15:17:28 +11:00
Dan Milne	71198340d0	fix tests and add a Claude.md file	2026-01-01 15:11:46 +11:00
Dan Milne	d597ca8810	Fix tests	2026-01-01 14:52:24 +11:00
Dan Milne	9b81aee490	Fix linting error	2026-01-01 13:45:10 +11:00
Dan Milne	265518ab25	Move integration tests into right directory	2026-01-01 13:43:13 +11:00
Dan Milne	adb789bbea	Fix StandardRB	2026-01-01 13:35:37 +11:00
Dan Milne	93a0edb0a2	StandardRB fixes	2026-01-01 13:29:44 +11:00
Dan Milne	7d3af2bcec	SRB fixes	2026-01-01 13:19:17 +11:00
Dan Milne	c03034c49f	Add files to support brakeman and standardrb. Fix some SRB warnings	2026-01-01 13:18:30 +11:00
Dan Milne	9234904e47	Add security-todo and beta-checklists, and some security rake tasks	2026-01-01 13:06:54 +11:00
Dan Milne	e36a9a781a	Add new claims to the discovery endpoint	2025-12-31 17:27:28 +11:00
Dan Milne	d036e25fef	Add auth_time, acr and azp support for OIDC claims	2025-12-31 17:07:54 +11:00
Dan Milne	fcdd2b6de7	Continue adding auth_time - need it in the refresh token too, so we can accurately create new access tokens.	2025-12-31 16:57:28 +11:00
Dan Milne	3939ea773f	We already have a login_time stored - the time stamp of the Session instance creation ( created after successful login ).	2025-12-31 16:45:45 +11:00
Dan Milne	4b4afe277e	Include auth_time in ID token. Switch from upsert -> find_and_create_by so we actually get sid values for consent on the creation of the record	2025-12-31 16:36:32 +11:00
Dan Milne	364e6e21dd	Fixes for tests and AR Encryption	2025-12-31 16:08:05 +11:00
Dan Milne	9d352ab8ec	Fix tests - add missing files	2025-12-31 16:01:31 +11:00
Dan Milne	d1d4ac745f	Version bump	2025-12-31 15:48:52 +11:00
Dan Milne	3db466f5a2	Switch Access / Refresh tokens / Auth Code from bcrypt ( and plain ) to hmac. BCrypt is for low entropy passwords and prevents dictionary attacks - HMAC is suitable for 256-bit random data.	2025-12-31 15:48:32 +11:00
Dan Milne	7c6ae7ab7e	Store only HMAC'd Auth codes, rather than plain text auth codes.	2025-12-31 15:00:00 +11:00
Dan Milne	ed7ceedef5	Include the hash of the access token in the JWT / ID Token under the key at_hash as per the requirements. Update the discovery endpoint to describe subject_type as 'pairwise', rather than 'public', since we do pairwise subject ids.	2025-12-31 14:45:38 +11:00
Dan Milne	40815d3576	Use SolidQueue in production. Use the find_by_token method, rather than iterating over refresh tokens, as we already fixed for tokens	2025-12-31 14:32:34 +11:00
Dan Milne	a17c08c890	Improve the README	2025-12-31 14:31:53 +11:00
Dan Milne	4f31fadc6c	Improve the README and remove incorrect claims.	2025-12-31 12:17:15 +11:00
Dan Milne	29c0981a59	Improve readme and tests	2025-12-31 11:56:09 +11:00
Dan Milne	9d402fcd92	Clean up and secure web_authn controller	2025-12-31 11:44:11 +11:00
Dan Milne	9530c8284f	Version bump	2025-12-31 10:35:27 +11:00
Dan Milne	bb5aa2e6d6	Add rails encryption for totp - allow configuration of encryption secrets from env, or derive them from SECRET_KEY_BASE. Don't leak email address via web_authn, rate limit web_authn, escape oidc state value, require password for changing email address, allow settings the hmac secret for token prefix generation	2025-12-31 10:33:56 +11:00
Dan Milne	cc7beba9de	PKCE is now default enabled. You can now create public / no-secret apps OIDC apps	2025-12-31 09:22:18 +11:00
Dan Milne	00eca6d8b2	Default deny forward_auth requests	2025-12-30 16:04:01 +11:00
Dan Milne	32235f9647	version bump	2025-12-30 11:58:31 +11:00
Dan Milne	71d59e7367	Remove plain text token from everywhere	2025-12-30 11:58:11 +11:00
Dan Milne	99c3ac905f	Add a token prefix column, generate the token_prefix and the token_digest, removing the plaintext token from use.	2025-12-30 09:45:16 +11:00
Dan Milne	0761c424c1	Fix tests. Remove tests which test rails functionality	2025-12-30 00:18:19 +11:00
Dan Milne	2a32d75895	Fix tests - don't test standard rails features	2025-12-29 19:45:01 +11:00
Dan Milne	4c1df53fd5	Fix more tests	2025-12-29 19:22:08 +11:00
Dan Milne	acab15ce30	Fix more tests	2025-12-29 18:48:41 +11:00
Dan Milne	0361bfe470	Fix forward_auth bugs - including disabled apps still working. Fix forward_auth tests	2025-12-29 15:37:12 +11:00
Dan Milne	5b9d15584a	Add more rate limiting, and more restrictive headers	2025-12-29 13:29:14 +11:00
Dan Milne	898fd69a5d	Add permissions initializer and missing image paste controller	2025-12-29 13:27:30 +11:00
Dan Milne	9cf01f7c7a	Bump versoin	2025-12-28 14:43:26 +11:00
Dan Milne	ab362aabac	Remove the rate limit for the forward auth system	2025-12-28 14:40:53 +11:00
Dan Milne	283feea175	Update depenencies, bump versoin	2025-11-30 23:13:25 +11:00