0439175e73
feat(auth): support role sync on re-login
2026-06-22 16:40:29 -04:00
0c4d175eb7
feat(auth): support deriving roles from the IDP
...
Closes HP-352.
2026-06-20 11:53:09 -04:00
96f2721272
feat(auth): support reverse-proxy driven proxy auth
...
Closes HP-353.
2026-06-20 11:41:44 -04:00
7901f37002
fix: correctly handle user id passthrough on headscale actions
2026-05-30 17:14:28 -04:00
b961b339bb
feat: add support for OIDC logouts
...
Closes HP-407.
2026-04-26 20:36:52 -04:00
4b47b1bbed
chore: update auth-service to not be class based
2026-04-03 16:57:39 -04:00
4cd0c1e206
fix: use headscale.api_key where possible
2026-04-03 16:34:50 -04:00
838a2cd732
fix: store profile picture in db to prevent header overload
2026-03-30 13:58:29 -04:00
5f81822366
feat: correct package.json dependencies and remove libsql
2026-03-17 13:31:35 -04:00
a26faab139
feat: add ownership transfer support
2026-03-14 15:17:45 -04:00
e255407115
feat: redo user page to match account linking
2026-03-14 14:56:04 -04:00
38cf93e5ae
feat: replace onboarding for explicit user linking
2026-03-14 13:23:22 -04:00
6470f5a821
feat: refactor several components and clean up ui
2026-03-09 22:09:58 -04:00
434f886034
feat: admin UI for Headscale user linking + skip onboarding
...
- Add 'Link Headscale user' option in user menu (admin-only, OIDC users)
- Dialog shows only unclaimed Headscale users
- New link_user action in user-actions with claim validation
- Onboarding now allows skipping the link step with clear messaging
- Users who skip are told they can ask an admin to link later
Co-authored-by: Amp <amp@ampcode.com >
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:57 -04:00
684a95b5e8
fix: harden user linking and session pruning
...
Security:
- Add unique constraint on headscale_user_id to prevent hijacking
- linkHeadscaleUser now rejects already-claimed Headscale users
- Onboarding dropdown filters out claimed users
- onboarding-skip action redirects on rejected claims
Maintenance:
- Replace probabilistic session pruning with setInterval (15m)
- Move pruning out of request path into server startup
Co-authored-by: Amp <amp@ampcode.com >
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:55 -04:00
45984ec639
chore: remove deprecated oidc.user_storage_file option
...
The flat-file user store has been deprecated for several versions.
All user data now lives in the SQL database. Removes the config field,
nix option, docs, and migration logic.
Co-authored-by: Amp <amp@ampcode.com >
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:49 -04:00
0f8e192b5c
feat: initial auth rework
2026-03-07 17:10:34 -05:00
Aarnav Tale