chore: release main (#77)

* chore: release main

* chore: sync Chart.yaml appVersion to v0.8.2

---------

Co-authored-by: garage-ui-release-bot[bot] <285030457+garage-ui-release-bot[bot]@users.noreply.github.com>
Co-authored-by: garage-ui-release-bot[bot] <garage-ui-release-bot[bot]@users.noreply.github.com>

.github/workflows/chart-release.yml

@@ -4,10 +4,13 @@ on:
   push:
     tags:
       - 'garage-ui-chart-v*'
+  workflow_dispatch:
 
 permissions:
   contents: write
   pages: write
+  packages: write
+  id-token: write
 
 jobs:
   release:
@@ -26,7 +29,7 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@v4.3.1
         with:
-          version: v3.19.3
+          version: v4.1.3
 
       - name: Run chart-releaser
         uses: helm/chart-releaser-action@v1.7.0
@@ -35,3 +38,43 @@ jobs:
           skip_existing: true
         env:
           CR_TOKEN: ${{ secrets.HELM_RELEASE_TOKEN }}
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v4.1.2
+
+      - name: Log in to ghcr.io for cosign
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Package and push chart to ghcr.io (OCI)
+        id: oci_push
+        env:
+          GHCR_USER: ${{ github.actor }}
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          chart_version=$(grep -E '^version:' helm/garage-ui/Chart.yaml | awk '{print $2}')
+          echo "Packaging chart version ${chart_version}"
+          helm package helm/garage-ui --destination /tmp/chart
+
+          echo "${GHCR_TOKEN}" | helm registry login ghcr.io \
+            --username "${GHCR_USER}" --password-stdin
+
+          push_output=$(helm push "/tmp/chart/garage-ui-${chart_version}.tgz" \
+            oci://ghcr.io/noooste/charts 2>&1 | tee /dev/stderr)
+
+          digest=$(echo "$push_output" | grep -oE 'sha256:[a-f0-9]{64}' | head -n1)
+          if [ -z "$digest" ]; then
+            echo "Failed to parse pushed digest from helm push output" >&2
+            exit 1
+          fi
+          echo "digest=${digest}" >> "$GITHUB_OUTPUT"
+          echo "Pushed oci://ghcr.io/noooste/charts/garage-ui:${chart_version} (${digest})"
+
+      - name: Sign chart with cosign (keyless)
+        run: |
+          cosign sign --yes \
+            "ghcr.io/noooste/charts/garage-ui@${{ steps.oci_push.outputs.digest }}"

.release-please-manifest.json

@@ -1,4 +1,4 @@
 {
-  ".": "0.8.0",
-  "helm/garage-ui": "0.6.0"
+  ".": "0.8.2",
+  "helm/garage-ui": "0.6.1"
 }

CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.8.2](https://github.com/Noooste/garage-ui/compare/v0.8.1...v0.8.2) (2026-06-07)
+
+
+### Bug Fixes
+
+* **backend:** prevent OIDC login loop from empty cookie name ([#76](https://github.com/Noooste/garage-ui/issues/76)) ([22be89b](https://github.com/Noooste/garage-ui/commit/22be89b2ff86465abb90dab0344ef9366ab181b3))
+
+## [0.8.1](https://github.com/Noooste/garage-ui/compare/v0.8.0...v0.8.1) (2026-05-31)
+
+
+### Bug Fixes
+
+* **frontend:** align three-dot menu item icon spacing and text alignment ([#72](https://github.com/Noooste/garage-ui/issues/72)) ([45f8770](https://github.com/Noooste/garage-ui/commit/45f87707996e92d0f8f75e79c8f60a13556eaf6e))
+
 ## [0.8.0](https://github.com/Noooste/garage-ui/compare/v0.7.0...v0.8.0) (2026-05-31)
 
 

backend/internal/auth/auth.go

@@ -322,8 +322,21 @@ func extractRoles(claims map[string]interface{}, path string) []string {
 	return nil
 }
 
-// extractStringArray converts an interface{} to []string if possible
+// extractStringArray converts an interface{} to []string if possible.
+//
+// A scalar string is treated as a single-element list: IdPs commonly emit a
+// single role as a bare string (e.g. "garage_role": "garage-ui-admin") rather
+// than a one-element array, and discarding it would make admin_role checks
+// fail with a spurious 403, see https://github.com/Noooste/garage-ui/issues/75
 func extractStringArray(value interface{}) []string {
+	// Try a scalar string (single role emitted as a bare value)
+	if str, ok := value.(string); ok {
+		if str == "" {
+			return nil
+		}
+		return []string{str}
+	}
+
 	// Try direct string array
 	if strArray, ok := value.([]string); ok {
 		return strArray

backend/internal/auth/auth_test.go

@@ -564,8 +564,11 @@ func TestExtractRolesFromAccessToken_IntermediateNodeNotMap(t *testing.T) {
 	}
 }
 
-func TestExtractRolesFromAccessToken_FinalValueWrongType(t *testing.T) {
-	// Final value is a plain string, not an array — extractStringArray returns nil.
+func TestExtractRolesFromAccessToken_ScalarStringRoleReturnsSingleElement(t *testing.T) {
+	// A role_attribute_path that resolves to a scalar string (common when an IdP
+	// emits a single role, e.g. "garage_role": "garage-ui-admin") must be treated
+	// as a one-element role list, not silently discarded. Discarding it caused
+	// admin_role (singular) + scalar claim to yield roles=[] and a spurious 403.
 	tok := makeAccessToken(t, map[string]any{
 		"roles": "admin",
 	})
@@ -574,8 +577,25 @@ func TestExtractRolesFromAccessToken_FinalValueWrongType(t *testing.T) {
 			OIDC: config.OIDCConfig{RoleAttributePath: "roles"},
 		},
 	}
+	got := svc.ExtractRolesFromAccessToken(tok)
+	if len(got) != 1 || got[0] != "admin" {
+		t.Errorf("got %v, want [admin]", got)
+	}
+}
+
+func TestExtractRolesFromAccessToken_EmptyScalarStringReturnsNil(t *testing.T) {
+	// An empty scalar must not produce a [""] role, which would never match a
+	// configured admin role and only muddies logs.
+	tok := makeAccessToken(t, map[string]any{
+		"roles": "",
+	})
+	svc := &Service{
+		authConfig: &config.AuthConfig{
+			OIDC: config.OIDCConfig{RoleAttributePath: "roles"},
+		},
+	}
 	if got := svc.ExtractRolesFromAccessToken(tok); got != nil {
-		t.Errorf("expected nil for non-array roles, got %v", got)
+		t.Errorf("expected nil for empty scalar role, got %v", got)
 	}
 }
 

backend/internal/config/config.go

@@ -168,6 +168,10 @@ func Load(configPath string, opts ...LoadOption) (*Config, error) {
 	viper.SetDefault("garage.force_path_style", true)
 	viper.SetDefault("logging.level", "info")
 	viper.SetDefault("logging.format", "text")
+	viper.SetDefault("auth.oidc.cookie_name", "garage_session")
+	viper.SetDefault("auth.oidc.cookie_http_only", true)
+	viper.SetDefault("auth.oidc.cookie_same_site", "lax")
+	viper.SetDefault("auth.oidc.session_max_age", 86400)
 
 	// If garage.toml path is provided, parse it and set values as viper
 	// defaults. Defaults sit below config-file and env-var values in viper's

backend/internal/config/config_test.go

@@ -490,6 +490,103 @@ func TestLoad_EnvOverridesToml(t *testing.T) {
 	}
 }
 
+// oidcValidYAML is a minimal configuration that enables OIDC and passes
+// Validate, but deliberately omits auth.oidc.cookie_name.
+const oidcValidYAML = `
+server:
+  host: "0.0.0.0"
+  port: 8080
+  root_url: "https://garage.example.com"
+garage:
+  endpoint: http://garage:3900
+  admin_endpoint: http://garage:3903
+  admin_token: supersecret
+auth:
+  oidc:
+    enabled: true
+    client_id: "garage-ui"
+    issuer_url: "https://idp.example.com/realms/main"
+    scopes:
+      - openid
+    admin_roles:
+      - "garage-ui-admin"
+`
+
+func TestLoad_OIDCCookieNameDefaultsWhenUnset(t *testing.T) {
+	resetViper(t)
+	path := writeConfigFile(t, oidcValidYAML)
+
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	// An empty cookie name makes Fiber silently drop the session Set-Cookie
+	// (net/http rejects empty cookie names), which manifests as an OIDC login
+	// loop. A non-empty default prevents that footgun.
+	if cfg.Auth.OIDC.CookieName != "garage_session" {
+		t.Errorf("CookieName = %q, want garage_session (default)", cfg.Auth.OIDC.CookieName)
+	}
+}
+
+func TestLoad_OIDCCookieNameExplicitValueWins(t *testing.T) {
+	resetViper(t)
+	path := writeConfigFile(t, oidcValidYAML+"    cookie_name: \"custom_session\"\n")
+
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.Auth.OIDC.CookieName != "custom_session" {
+		t.Errorf("CookieName = %q, want custom_session (explicit override)", cfg.Auth.OIDC.CookieName)
+	}
+}
+
+func TestLoad_OIDCCookieDefaultsWhenUnset(t *testing.T) {
+	resetViper(t)
+	path := writeConfigFile(t, oidcValidYAML)
+
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	// HTTPOnly must default to true: a session cookie readable from JavaScript
+	// is an XSS token-theft risk.
+	if !cfg.Auth.OIDC.CookieHTTPOnly {
+		t.Errorf("CookieHTTPOnly = false, want true (default)")
+	}
+	// SessionMaxAge must default to a positive value so the cookie's MaxAge
+	// agrees with the 24h JWT instead of becoming a session-only cookie.
+	if cfg.Auth.OIDC.SessionMaxAge != 86400 {
+		t.Errorf("SessionMaxAge = %d, want 86400 (default)", cfg.Auth.OIDC.SessionMaxAge)
+	}
+	if cfg.Auth.OIDC.CookieSameSite != "lax" {
+		t.Errorf("CookieSameSite = %q, want lax (default)", cfg.Auth.OIDC.CookieSameSite)
+	}
+}
+
+func TestLoad_OIDCCookieDefaultsCanBeOverridden(t *testing.T) {
+	resetViper(t)
+	yaml := oidcValidYAML +
+		"    cookie_http_only: false\n" +
+		"    session_max_age: 3600\n" +
+		"    cookie_same_site: \"strict\"\n"
+	path := writeConfigFile(t, yaml)
+
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.Auth.OIDC.CookieHTTPOnly {
+		t.Errorf("CookieHTTPOnly = true, want false (explicit override)")
+	}
+	if cfg.Auth.OIDC.SessionMaxAge != 3600 {
+		t.Errorf("SessionMaxAge = %d, want 3600 (explicit override)", cfg.Auth.OIDC.SessionMaxAge)
+	}
+	if cfg.Auth.OIDC.CookieSameSite != "strict" {
+		t.Errorf("CookieSameSite = %q, want strict (explicit override)", cfg.Auth.OIDC.CookieSameSite)
+	}
+}
+
 func TestEffectiveAdminRoles(t *testing.T) {
 	tests := []struct {
 		name       string

frontend/package-lock.json

@@ -21,7 +21,7 @@
         "react-dom": "^19.2.0",
         "react-dropzone": "^14.3.8",
         "react-hook-form": "^7.66.1",
-        "react-router-dom": "^7.14.1",
+        "react-router-dom": "^7.16.0",
         "recharts": "^3.5.0",
         "sonner": "^2.0.7",
         "tailwind-merge": "^3.4.0",
@@ -4839,9 +4839,9 @@
       }
     },
     "node_modules/react-router": {
-      "version": "7.14.1",
-      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.14.1.tgz",
-      "integrity": "sha512-5BCvFskyAAVumqhEKh/iPhLOIkfxcEUz8WqFIARCkMg8hZZzDYX9CtwxXA0e+qT8zAxmMC0x3Ckb9iMONwc5jg==",
+      "version": "7.16.0",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.16.0.tgz",
+      "integrity": "sha512-wArC8lVyJb3+jM9OpDyW6hLCizACWkvQR/sSGqSs+o5uEXEtGlqdZ4v8hENR3Jad6i+LRkK93q/+bQAcvl6V1A==",
       "license": "MIT",
       "dependencies": {
         "cookie": "^1.0.1",
@@ -4861,12 +4861,12 @@
       }
     },
     "node_modules/react-router-dom": {
-      "version": "7.14.1",
-      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.14.1.tgz",
-      "integrity": "sha512-ZkrQuwwhGibjQLqH1eCdyiZyLWglPxzxdl5tgwgKEyCSGC76vmAjleGocRe3J/MLfzMUIKwaFJWpFVJhK3d2xA==",
+      "version": "7.16.0",
+      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.16.0.tgz",
+      "integrity": "sha512-kMUAbimWB5FVbF4Bce4bJsiKJWLIUHq/mEG8+CFDnCSgltptBiG5nguducmsJeGKytlCvQud9Qhzpn49iduTlA==",
       "license": "MIT",
       "dependencies": {
-        "react-router": "7.14.1"
+        "react-router": "7.16.0"
       },
       "engines": {
         "node": ">=20.0.0"

frontend/package.json

@@ -23,7 +23,7 @@
     "react-dom": "^19.2.0",
     "react-dropzone": "^14.3.8",
     "react-hook-form": "^7.66.1",
-    "react-router-dom": "^7.14.1",
+    "react-router-dom": "^7.16.0",
     "recharts": "^3.5.0",
     "sonner": "^2.0.7",
     "tailwind-merge": "^3.4.0",

frontend/src/components/ui/dropdown-menu.tsx

@@ -151,7 +151,7 @@ const DropdownMenuItem = React.forwardRef<HTMLDivElement, React.HTMLAttributes<H
       <div
         ref={ref}
         className={cn(
-          'relative flex cursor-pointer select-none items-center rounded-sm px-2 py-1.5 text-sm outline-none transition-colors hover:bg-accent hover:text-accent-foreground focus:bg-accent focus:text-accent-foreground data-[disabled]:pointer-events-none',
+          'relative flex cursor-pointer select-none items-center gap-2 rounded-sm px-2 py-1.5 text-sm outline-none transition-colors hover:bg-accent hover:text-accent-foreground focus:bg-accent focus:text-accent-foreground data-[disabled]:pointer-events-none [&_svg]:h-4 [&_svg]:w-4 [&_svg]:shrink-0',
           className
         )}
         onClick={(e) => {

frontend/src/pages/AccessControl.tsx

@@ -635,7 +635,7 @@ export function AccessControl() {
                                   setDeleteDialogOpen(true);
                                 }}
                               >
-                                <Trash2 className="mr-2 h-4 w-4" />
+                                <Trash2 className="h-4 w-4" />
                                 Delete
                               </DropdownMenuItem>
                             </DropdownMenuContent>

helm/garage-ui/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.6.1](https://github.com/Noooste/garage-ui/compare/garage-ui-chart-v0.6.0...garage-ui-chart-v0.6.1) (2026-05-31)
+
+
+### Features
+
+* Publish Helm chart to GHCR ([#70](https://github.com/Noooste/garage-ui/issues/70)) ([1c9043c](https://github.com/Noooste/garage-ui/commit/1c9043c6973c3ffc3fc29cc65b342b35dfa84ae0))
+
 ## [0.6.0](https://github.com/Noooste/garage-ui/compare/garage-ui-chart-v0.5.0...garage-ui-chart-v0.6.0) (2026-05-31)
 
 

helm/garage-ui/Chart.yaml

@@ -3,8 +3,8 @@ name: garage-ui
 description: A Helm chart for Garage UI - Web interface for Garage S3 object storage
 icon: https://helm.noste.dev/garage.png
 type: application
-version: 0.6.0
-appVersion: v0.8.0
+version: 0.6.1
+appVersion: v0.8.2
 keywords:
   - garage
   - s3

helm/garage-ui/README.md

@@ -93,6 +93,28 @@ If you've cloned the repository:
 helm install garage-ui ./helm/garage-ui -f my-values.yaml
 ```
 
+### Installing from the OCI registry (ghcr.io)
+
+The chart is published as an OCI artifact to GitHub Container Registry. No
+`helm repo add` is required:
+
+```bash
+helm install garage-ui oci://ghcr.io/noooste/charts/garage-ui \
+  --version <x.y.z> -f my-values.yaml
+```
+
+The chart is signed with [cosign](https://docs.sigstore.dev/) using keyless
+signing. To verify the signature before installing:
+
+```bash
+cosign verify ghcr.io/noooste/charts/garage-ui:<x.y.z> \
+  --certificate-identity-regexp 'https://github.com/Noooste/garage-ui/.+' \
+  --certificate-oidc-issuer https://token.actions.githubusercontent.com
+```
+
+The chart also remains available from the classic Helm repository at
+`https://helm.noste.dev`.
+
 ### Installing with inline values
 
 You can also set values directly on the command line:

release-please-config.json

@@ -9,7 +9,12 @@
       "component": "garage-ui",
       "include-component-in-tag": false,
       "changelog-path": "CHANGELOG.md",
-      "exclude-paths": ["helm/garage-ui"]
+      "exclude-paths": [
+        "helm/garage-ui",
+        ".github",
+        "docs",
+        "scripts"
+      ]
     },
     "helm/garage-ui": {
       "release-type": "helm",