Dan Milne 7c6ae7ab7e Store only HMAC'd Auth codes, rather than plain text auth codes.

2025-12-31 15:00:00 +11:00

..

concerns

Add a token prefix column, generate the token_prefix and the token_digest, removing the plaintext token from use.

2025-12-30 09:45:16 +11:00

application_group.rb

First crack

2025-10-23 16:45:00 +11:00

application_record.rb

First commit

2025-10-23 16:19:56 +11:00

application_user_claim.rb

Add OIDC fixes, add prefered_username, add application-user claims

2025-11-25 16:29:40 +11:00

application.rb

PKCE is now default enabled. You can now create public / no-secret apps OIDC apps

2025-12-31 09:22:18 +11:00

current.rb

First crack

2025-10-23 16:45:00 +11:00

group.rb

Add OIDC fixes, add prefered_username, add application-user claims

2025-11-25 16:29:40 +11:00

oidc_access_token.rb

Add a token prefix column, generate the token_prefix and the token_digest, removing the plaintext token from use.

2025-12-30 09:45:16 +11:00

oidc_authorization_code.rb

Store only HMAC'd Auth codes, rather than plain text auth codes.

2025-12-31 15:00:00 +11:00

oidc_refresh_token.rb

Use SolidQueue in production. Use the find_by_token method, rather than iterating over refresh tokens, as we already fixed for tokens

2025-12-31 14:32:34 +11:00

oidc_user_consent.rb

Add pairwise SID with a UUIDv4, a significatant upgrade over User.id.to_s. Complete allowing admin to enforce TOTP per user

2025-11-23 11:16:06 +11:00

session.rb

First crack

2025-10-23 16:45:00 +11:00

user_group.rb

First crack

2025-10-23 16:45:00 +11:00

user.rb

Add rails encryption for totp - allow configuration of encryption secrets from env, or derive them from SECRET_KEY_BASE. Don't leak email address via web_authn, rate limit web_authn, escape oidc state value, require password for changing email address, allow settings the hmac secret for token prefix generation

2025-12-31 10:33:56 +11:00

webauthn_credential.rb

Add webauthn

2025-11-04 16:20:11 +11:00