Dan Milne
e36a9a781a
Add new claims to the discovery endpoint
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-12-31 17:27:28 +11:00
Dan Milne
d036e25fef
Add auth_time, acr and azp support for OIDC claims
2025-12-31 17:07:54 +11:00
Dan Milne
fcdd2b6de7
Continue adding auth_time - need it in the refresh token too, so we can accurately create new access tokens.
2025-12-31 16:57:28 +11:00
Dan Milne
3939ea773f
We already have a login_time stored - the time stamp of the Session instance creation ( created after successful login ).
2025-12-31 16:45:45 +11:00
Dan Milne
4b4afe277e
Include auth_time in ID token. Switch from upsert -> find_and_create_by so we actually get sid values for consent on the creation of the record
2025-12-31 16:36:32 +11:00
Dan Milne
364e6e21dd
Fixes for tests and AR Encryption
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-12-31 16:08:05 +11:00
Dan Milne
9d352ab8ec
Fix tests - add missing files
2025-12-31 16:01:31 +11:00
Dan Milne
d1d4ac745f
Version bump
2025-12-31 15:48:52 +11:00
Dan Milne
3db466f5a2
Switch Access / Refresh tokens / Auth Code from bcrypt ( and plain ) to hmac. BCrypt is for low entropy passwords and prevents dictionary attacks - HMAC is suitable for 256-bit random data.
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-12-31 15:48:32 +11:00
Dan Milne
7c6ae7ab7e
Store only HMAC'd Auth codes, rather than plain text auth codes.
2025-12-31 15:00:00 +11:00
Dan Milne
ed7ceedef5
Include the hash of the access token in the JWT / ID Token under the key at_hash as per the requirements. Update the discovery endpoint to describe subject_type as 'pairwise', rather than 'public', since we do pairwise subject ids.
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-12-31 14:45:38 +11:00
Dan Milne
40815d3576
Use SolidQueue in production. Use the find_by_token method, rather than iterating over refresh tokens, as we already fixed for tokens
2025-12-31 14:32:34 +11:00
Dan Milne
a17c08c890
Improve the README
2025-12-31 14:31:53 +11:00
Dan Milne
4f31fadc6c
Improve the README and remove incorrect claims.
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-12-31 12:17:15 +11:00
Dan Milne
29c0981a59
Improve readme and tests
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-12-31 11:56:09 +11:00
Dan Milne
9d402fcd92
Clean up and secure web_authn controller
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-12-31 11:44:11 +11:00
Dan Milne
9530c8284f
Version bump
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-12-31 10:35:27 +11:00
Dan Milne
bb5aa2e6d6
Add rails encryption for totp - allow configuration of encryption secrets from env, or derive them from SECRET_KEY_BASE. Don't leak email address via web_authn, rate limit web_authn, escape oidc state value, require password for changing email address, allow settings the hmac secret for token prefix generation
2025-12-31 10:33:56 +11:00
Dan Milne
cc7beba9de
PKCE is now default enabled. You can now create public / no-secret apps OIDC apps
2025-12-31 09:22:18 +11:00
Dan Milne
00eca6d8b2
Default deny forward_auth requests
2025-12-30 16:04:01 +11:00
Dan Milne
32235f9647
version bump
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-12-30 11:58:31 +11:00
Dan Milne
71d59e7367
Remove plain text token from everywhere
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-12-30 11:58:11 +11:00
Dan Milne
99c3ac905f
Add a token prefix column, generate the token_prefix and the token_digest, removing the plaintext token from use.
2025-12-30 09:45:16 +11:00
Dan Milne
0761c424c1
Fix tests. Remove tests which test rails functionality
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-12-30 00:18:19 +11:00
Dan Milne
2a32d75895
Fix tests - don't test standard rails features
2025-12-29 19:45:01 +11:00
Dan Milne
4c1df53fd5
Fix more tests
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-12-29 19:22:08 +11:00
Dan Milne
acab15ce30
Fix more tests
2025-12-29 18:48:41 +11:00
Dan Milne
0361bfe470
Fix forward_auth bugs - including disabled apps still working. Fix forward_auth tests
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-12-29 15:37:12 +11:00
Dan Milne
5b9d15584a
Add more rate limiting, and more restrictive headers
2025-12-29 13:29:14 +11:00
Dan Milne
898fd69a5d
Add permissions initializer and missing image paste controller
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-12-29 13:27:30 +11:00
Dan Milne
9cf01f7c7a
Bump versoin
2025-12-28 14:43:26 +11:00
Dan Milne
ab362aabac
Remove the rate limit for the forward auth system
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-12-28 14:40:53 +11:00
Dan Milne
283feea175
Update depenencies, bump versoin
2025-11-30 23:13:25 +11:00
Dan Milne
7af8624bf8
Handle empty backchannel logout urls
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-11-27 19:19:34 +11:00
Dan Milne
f8543f98cc
Add a subdirectory for active storage
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-11-27 19:12:09 +11:00
Dan Milne
6be23c2c37
Add backchannel logout, per application logout.
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-11-27 16:38:27 +11:00
Dan Milne
eb2d7379bf
Backchannel complete - improve oidc credential display
2025-11-27 11:52:25 +11:00
Dan Milne
67d86e5835
Add Icons for apps
2025-11-25 19:11:22 +11:00
Dan Milne
d6029556d3
Add OIDC fixes, add prefered_username, add application-user claims
2025-11-25 16:29:40 +11:00
Dan Milne
7796c38c08
Add pairwise SID with a UUIDv4, a significatant upgrade over User.id.to_s. Complete allowing admin to enforce TOTP per user
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-11-23 11:16:06 +11:00
Dan Milne
e882a4d6d1
More complete oidc
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-11-18 20:03:03 +11:00
Dan Milne
ab0085e9c9
More complete oidc
2025-11-18 20:02:45 +11:00
Dan Milne
1ee3302319
Improvements derived from rodauth-oauth
2025-11-12 22:17:55 +11:00
Dan Milne
67f28faaca
Improve some front end views. More descriptive error condition reporting. Updates to CLINCH_HOST for better WEBAUTHN
2025-11-12 16:24:05 +11:00
Dan Milne
33ad956508
Add test
2025-11-12 15:50:04 +11:00
Dan Milne
11ec753c68
Bump up the forward auth token ttl, fix leaking of error data
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-11-09 12:27:53 +11:00
Dan Milne
4df2eee4d9
Bug fix for domain names with empty string instead of null. Form errors and some security fixes
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-11-09 12:22:41 +11:00
Dan Milne
d9f11abbbf
Fixes for OIDC and HTML
2025-11-09 12:04:26 +11:00
Dan Milne
c92e69fa4a
Add PCKE
2025-11-09 11:54:45 +11:00
Dan Milne
038801f34b
Add pkce
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-11-09 10:21:29 +11:00
Dan Milne
8e0b2c28eb
CSP fixes
2025-11-08 20:01:07 +11:00
Dan Milne
f02665f690
Consolidate all the error messages - add some stimulus controller.
2025-11-07 16:58:28 +11:00
Dan Milne
631b2b53bb
Fix CSP reporting endpoitn. Fix the SER for CSP
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-11-04 23:22:15 +11:00
Dan Milne
6049429a41
Fix mobile view menu popout. Add an option SENTRY_DSN support, which uses rails event reporting
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-11-04 23:16:28 +11:00
Dan Milne
2b15aa2c40
Add sentry, set csp reporting API
2025-11-04 22:58:32 +11:00
Dan Milne
4f5974dd37
bah
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-11-04 21:33:52 +11:00
Dan Milne
5de53f1841
bug fix
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-11-04 21:21:00 +11:00
Dan Milne
73b2ae2f02
Add some docs
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-11-04 21:13:46 +11:00
Dan Milne
4c5ac344bd
Bug updating OIDC apps. Update readme
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-11-04 20:14:41 +11:00
Dan Milne
044b9239d6
Ok - this time add the new controllers we stripped out of inline and add back the csp
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-11-04 18:55:20 +11:00
Dan Milne
e9b1995e89
Remove unneeded stuff
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-11-04 18:47:31 +11:00
Dan Milne
fb14ce032f
Strip out more inline javascript code. Encrypt backup codes and treat the backup codes attribute as a json array
2025-11-04 18:46:11 +11:00
Dan Milne
bf104a9983
Fix CSP errors - migrate inline JS to stimulus controllers. Add a URL for applications so users can discover them
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-11-04 17:06:53 +11:00
Dan Milne
ec13dd2b60
Fix storing passkeys
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-11-04 16:32:50 +11:00
Dan Milne
57abc0b804
Add webauthn
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-11-04 16:20:11 +11:00
Dan Milne
19bfc21f11
Move sessions into their own view for easier management
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-11-04 15:19:39 +11:00
Dan Milne
ef15db77f9
Massive refactor. Merge forward_auth into App, remove references to unimplemented OIDC federation and SAML features. Add group and user custom claims. Groups now allocate which apps a user can use
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-11-04 13:21:55 +11:00
Dan Milne
4d1bc1ab66
Update readme
2025-10-29 22:39:49 +11:00
Dan Milne
517029247d
Update the .env.example file
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-10-29 16:35:27 +11:00
Dan Milne
bfcc5cdc84
More nuanced domain fetching for host validation
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-10-29 16:31:56 +11:00
Dan Milne
81871426e9
Update docs
2025-10-29 16:08:49 +11:00
Dan Milne
ddcb297c74
Add comprhensive csp polices and reporting endpoint. Add environment support require for protecting against rebinding attacks on ip addresses
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-10-29 15:37:53 +11:00
Dan Milne
6f7de94623
Rate limit the forward_auth controller
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-10-29 13:55:36 +11:00
Dan Milne
baa75a3456
Use the IPAddr library to detect ipv4 and ipv6 addresses
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-10-29 13:47:23 +11:00
Dan Milne
c3205abffa
Improve finding the requested host's domain for setting the domain cookie
2025-10-29 13:47:23 +11:00
Dan Milne
a2008d0750
remove incorrectly named files
2025-10-28 09:01:42 +11:00
Dan Milne
810561d74b
Rename thumbshots
2025-10-28 09:01:42 +11:00
Dan Milne
2ee895888d
Add screenshots
2025-10-28 09:01:42 +11:00
Dan Milne
6c9fc429f1
Increase thumb
2025-10-28 09:01:42 +11:00
Dan Milne
7d200b849e
Add a screenshot
2025-10-28 09:01:42 +11:00
Dan Milne
7074242907
Update docs. Implemented a one-time token to work around domain cookies not being immediately return by the browser. Reduce db queries on /api/verify requests.
2025-10-28 08:27:19 +11:00
Dan Milne
da6fd5b800
More logs
2025-10-28 08:27:19 +11:00
Dan Milne
cfab21b130
More tests
2025-10-28 08:27:19 +11:00
Dan Milne
c80bcafdb7
Bug fix
2025-10-28 08:27:19 +11:00
Dan Milne and GitHub
f050541e14
Merge pull request #1 from dkam/dependabot/github_actions/actions/upload-artifact-5
...
Bump actions/upload-artifact from 4 to 5
2025-10-27 20:05:01 +11:00
Dan Milne
431e947a4c
Some more tests. Fix invitation link and password reset links. After creating their account and setting a password, the user is logged in
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-10-26 23:09:38 +11:00
Dan Milne
8dd3e60071
Add a list_sign_in_at field for users so magick links work
2025-10-26 22:40:54 +11:00
Dan Milne
e4e7a0873e
Fixes
2025-10-26 22:03:03 +11:00
Dan Milne
b5b1d94d47
Fix the CLINCH_HOST issue.
2025-10-26 21:59:27 +11:00
Dan Milne
52cfd6122c
Typo. More tests
2025-10-26 20:42:18 +11:00
Dan Milne
87796e0478
Type
2025-10-26 20:28:14 +11:00
Dan Milne
227e29ce0a
Fix/add some tests. Configure email sending address
2025-10-26 20:13:39 +11:00
Dan Milne and Claude
d98f777e7d
Refactor email delivery and background jobs system
...
- Switch from SolidQueue to async job processor for simpler background job handling
- Remove SolidQueue gem and related configuration files
- Add letter_opener gem for development email preview
- Fix invitation email template issues (invitation_login_token method and route helper)
- Configure SMTP settings via environment variables in application.rb
- Add email delivery configuration banner on admin users page
- Improve admin users page with inline action buttons and SMTP configuration warnings
- Update development and production environments to use async processor
- Add helper methods to detect SMTP configuration and filter out localhost settings
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-Authored-By: Claude <noreply@anthropic.com >
2025-10-26 16:30:02 +11:00
Dan Milne
88428bfd97
Add configuration foward-auth headers
2025-10-26 14:41:20 +11:00
Dan Milne
2679634a2b
Port 3000
2025-10-25 16:00:09 +11:00
Dan Milne
2d5823213c
Update readme
2025-10-25 13:50:15 +11:00
Dan Milne
5921cf82c2
Add invite button and routes for resending invitations
2025-10-25 13:49:10 +11:00
Dan Milne
df834b6e57
Add license
2025-10-25 13:34:33 +11:00
Dan Milne
39757a43dc
Add an invite system
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-10-24 23:26:07 +11:00
Dan Milne
5463723455
Increase the thing
CI / scan_ruby (push) Has been cancelled
CI / scan_js (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / system-test (push) Has been cancelled
2025-10-24 20:48:58 +11:00
Dan Milne