0439175e73
feat(auth): support role sync on re-login
2026-06-22 16:40:29 -04:00
a3cd8444a3
chore(auth): add more informative logs
2026-06-22 16:40:29 -04:00
5d6eef5843
feat: update to the v8 middleware api
2026-06-20 12:38:09 -04:00
3f9dcd5eb4
feat: update build for react router v8
2026-06-20 12:09:42 -04:00
0c4d175eb7
feat(auth): support deriving roles from the IDP
...
Closes HP-352.
2026-06-20 11:53:09 -04:00
56c5e5ac8c
feat: make api calls more resilient and stuff
2026-05-25 17:14:26 -04:00
0512565f8e
feat: replace openapi hashing system with /version
...
Apparently I didn't use my brain cells and rely on the /version
endpoint that Headscale has exposed since 0.26 (our lowest supported
version). Switching to that significantly simplifies the API surface.
2026-05-25 11:51:02 -04:00
d4eee702e9
refactor(server): replace AppContext undefined sentinels with Feature<T>
...
Co-authored-by: Amp <amp@ampcode.com >
Amp-Thread-ID: https://ampcode.com/threads/T-019e5550-4435-7118-8393-cdcc97042178
2026-05-23 16:56:34 -04:00
b961b339bb
feat: add support for OIDC logouts
...
Closes HP-407.
2026-04-26 20:36:52 -04:00
1259642f8a
feat: replace openid-client with clean-room oidc system
2026-04-03 16:36:27 -04:00
4cd0c1e206
fix: use headscale.api_key where possible
2026-04-03 16:34:50 -04:00
838a2cd732
fix: store profile picture in db to prevent header overload
2026-03-30 13:58:29 -04:00
2e2d5d1dff
Update oidc-callback.ts
2026-03-24 11:48:20 +00:00
38cf93e5ae
feat: replace onboarding for explicit user linking
2026-03-14 13:23:22 -04:00
684a95b5e8
fix: harden user linking and session pruning
...
Security:
- Add unique constraint on headscale_user_id to prevent hijacking
- linkHeadscaleUser now rejects already-claimed Headscale users
- Onboarding dropdown filters out claimed users
- onboarding-skip action redirects on rejected claims
Maintenance:
- Replace probabilistic session pruning with setInterval (15m)
- Move pruning out of request path into server startup
Co-authored-by: Amp <amp@ampcode.com >
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:55 -04:00
0f8e192b5c
feat: initial auth rework
2026-03-07 17:10:34 -05:00
64edd2041b
fix first user owner assignment on OIDC login
2026-02-27 13:56:15 +02:00
403f9c9b0b
feat: add lazy retrying oidc connector
2026-01-16 00:33:10 -05:00
7a345d118c
feat: check and warn for pkce errors if possible
2026-01-11 14:55:23 -05:00
8948d440fc
Improve OIDC error logging
2025-12-08 10:55:19 +01:00
3a3e5ca65e
feat: pkce
2025-12-04 11:37:22 -05:00
199ef46ee1
fix: correctly passthrough and handle a new OIDC redirect_uri system
2025-12-04 10:34:48 -05:00
ba61656fb0
feat: cleanup oidc logic and surface errors better
2025-12-04 00:44:31 -05:00
86184e3420
feat: overhaul config loading
2025-12-01 02:46:22 -05:00
d3d7c7cc0e
feat: better error handling for oidc api key
...
This also ships with a better error page
2025-11-28 17:54:52 -05:00
bda9dedbfd
fix: if there are 0 admins, promote next admin on oidc login
2025-08-28 17:37:12 -04:00
4351e1fcb3
feat: support gravatar profile pictures for oidc
2025-08-21 12:16:18 -04:00
d2c4f5eb2b
feat: completely overhaul the auth model
...
* Cookies are now encrypted JWTs (GHSA-wrqq-v7qw-r5w7)
* Authentication is stored in the SQLite database (auto-migrated)
* Session logic is much cleaner
2025-08-19 17:52:16 -04:00
34cfee7cff
feat: reach an initial working stage
2025-03-24 16:15:38 -04:00
6108de52e7
feat: switch to a central singleton handler
...
This also adds support for Headscale TLS installations
2025-03-17 22:21:16 -04:00
f5436f5ee3
feat: respect context in server
2025-02-19 18:09:42 -05:00
76d263b7e6
feat: switch to config file system
2025-02-13 12:35:12 -05:00
bd11453593
fix: store oidc redirect_uri in session for parity
2025-01-18 08:18:19 +00:00
5569ba4660
feat: rework oidc to be more resilient
...
This includes setting a custom redirect URI, handling errors, and using a better library.
As an API decision I've also disabled per session API keys as it clutters up too much.
2025-01-10 13:55:24 +05:30
f3c9d8b54c
style: run biome lint
2025-01-06 08:19:40 +05:30
aa9872a45b
chore: switch to react-router v7
2025-01-06 08:19:40 +05:30
50e43bc0c3
feat: refactor/reorganize auth routes
2024-12-08 13:27:51 -05:00
Aarnav Tale