575 Commits

Author SHA1 Message Date
Aarnav Tale b7a85684a9 fix: tweak card styling to have better contrast 2026-03-14 13:22:23 -04:00
Aarnav Tale e1808bee1e fix: use currentColor on the svgs 2026-03-14 13:22:09 -04:00
Aarnav Tale 6470f5a821 feat: refactor several components and clean up ui 2026-03-09 22:09:58 -04:00
Aarnav Tale a53fd31d27 chore: combine link usage 2026-03-09 13:56:03 -04:00
Aarnav Tale 37d0080cba feat: cleanup button + add correct focus rings 2026-03-09 00:17:39 -04:00
Aarnav Tale 0ce411e92b feat: switch to mist color from tailwind 2026-03-08 23:48:03 -04:00
Aarnav Tale a967731461 feat: add a temp no access page 2026-03-08 17:34:58 -04:00
Aarnav Tale a1efe36ff1 fix: rename pending approval to no access
Member role simply has no UI permissions — not a pending state.

Co-authored-by: Amp <amp@ampcode.com>
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:58 -04:00
Aarnav Tale 270b99f063 fix: show linked user in onboarding + pending approval screen
- Onboarding now shows which Headscale user was auto-linked
- Members (no ui_access) see a 'Pending Approval' page instead of
  being silently logged out — their session stays valid
- Sign out button on the pending page so users can switch accounts

Co-authored-by: Amp <amp@ampcode.com>
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:58 -04:00
Aarnav Tale 434f886034 feat: admin UI for Headscale user linking + skip onboarding
- Add 'Link Headscale user' option in user menu (admin-only, OIDC users)
- Dialog shows only unclaimed Headscale users
- New link_user action in user-actions with claim validation
- Onboarding now allows skipping the link step with clear messaging
- Users who skip are told they can ask an admin to link later

Co-authored-by: Amp <amp@ampcode.com>
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:57 -04:00
Aarnav Tale 684a95b5e8 fix: harden user linking and session pruning
Security:
- Add unique constraint on headscale_user_id to prevent hijacking
- linkHeadscaleUser now rejects already-claimed Headscale users
- Onboarding dropdown filters out claimed users
- onboarding-skip action redirects on rejected claims

Maintenance:
- Replace probabilistic session pruning with setInterval (15m)
- Move pruning out of request path into server startup

Co-authored-by: Amp <amp@ampcode.com>
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:55 -04:00
Aarnav Tale 45984ec639 chore: remove deprecated oidc.user_storage_file option
The flat-file user store has been deprecated for several versions.
All user data now lives in the SQL database. Removes the config field,
nix option, docs, and migration logic.

Co-authored-by: Amp <amp@ampcode.com>
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:49 -04:00
Aarnav Tale 0f8e192b5c feat: initial auth rework 2026-03-07 17:10:34 -05:00
Aarnav Tale f4a2811afb chore: general cleanup/pr improvements 2026-03-07 15:12:50 -05:00
Aarnav Tale da3132323c Merge pull request #480 from drifterza/fix/issue-266-owner-assignment 2026-03-07 14:52:02 -05:00
Aarnav Tale cb97b73abd Merge pull request #477 from drifterza/fix/issue-427-hostinfo-update-frequency 2026-03-07 14:51:15 -05:00
Aarnav Tale 432cd29cd0 Merge pull request #478 from drifterza/fix/issue-453-self-service-preauth-keys 2026-03-07 14:50:12 -05:00
drifterza 64edd2041b fix first user owner assignment on OIDC login 2026-02-27 13:56:15 +02:00
drifterza 1462016a39 Add self-service pre-auth keys for auditor role
Closes #453
2026-02-27 12:21:16 +02:00
drifterza be79413178 fix: refresh agent HostInfo periodically using cache_ttl (#427)
Previously REFRESH was only sent once at startup, causing version info
to stay stale. Now the agent refreshes peer data at the cache_ttl
interval (default 3 minutes).
2026-02-27 11:26:06 +02:00
drifterza 787f8decbc fix: return login errors to form instead of throwing (#474)
Throwing data() in React Router v7 actions goes to ErrorBoundary instead
of returning to the component. Changed validation errors to return
directly so the login form can display them properly.
2026-02-27 10:55:42 +02:00
Aarnav Tale 3c5a653942 Merge pull request #469 from drifterza/feature/oidc-pending-approval 2026-02-26 18:03:26 -05:00
drifterza 2e5bb791e8 use LiveDataProvider auto-refresh for pending approval page
Replaces manual refresh button with automatic 3-second polling.
Adds unit tests for the live data hook behavior.
2026-02-27 00:55:55 +02:00
Aarnav Tale ab3c4f7819 fix: serve favicon through the prefix 2026-02-26 01:23:02 -05:00
drifterza 624b9ab479 list all preauth keys without user filter
headscale 0.28 added GET /v1/preauthkey without a user param
which returns all keys including tag-only ones. this change
adds getAllPreAuthKeys() and uses it when available, falling
back to per-user fetching on older versions.

the UI now handles keys where user is null, showing them as
Tag Only in the filter dropdown.

closes #432

Amp-Thread-ID: https://ampcode.com/threads/T-019c9861-2d45-73ef-ab94-5fce62f63670
Co-authored-by: Amp <amp@ampcode.com>
2026-02-26 00:40:31 -05:00
Aarnav Tale dde72ae4ed Merge pull request #465 from drifterza/feature/preauth-key-tags 2026-02-26 00:04:02 -05:00
Aarnav Tale 2fdbf4abea Merge pull request #467 from drifterza/feature/tag-node-operations 2026-02-25 20:34:49 -05:00
Aarnav Tale 4cb231deb1 Merge pull request #463 from drifterza/feature/oidc-enabled-flag 2026-02-25 20:33:34 -05:00
drifterza 4f59f4c77b Add user utility functions and tests for OIDC user filtering 2026-02-24 19:05:45 +02:00
drifterza 20297c6800 fix pre-auth keys not showing for oidc users without username 2026-02-24 18:40:09 +02:00
drifterza 2e6b387d67 fix role assignment for users without headplane db record 2026-02-24 17:37:09 +02:00
drifterza 5e45295523 align pending approval page styling with login page 2026-02-24 17:19:46 +02:00
drifterza a6b25b3ba3 add pending approval page for OIDC users without ui_access 2026-02-24 15:32:34 +02:00
drifterza badefc7f85 fix: handle null user for tag-only nodes in Headscale 0.28+
In Headscale 0.28+, nodes can be registered with tag-only preauth keys
which have no associated user. This change updates the Machine type to
make user optional and adds null checks throughout the codebase where
node.user is accessed.

Fixes tag node operations (rename, add tags) that previously failed
with 'Unexpected Server Error' when accessing node.user.providerId
on nodes without a user association.

Refs: #432
2026-02-24 13:32:41 +02:00
drifterza 30dd718d68 add oidc.enabled flag for helm and config generation
allows defining oidc config without enabling it
2026-02-24 10:43:28 +02:00
drifterza c96249f41e add tag-only preauth keys for headscale 0.28
allows creating keys with acl tags but no user
2026-02-24 10:25:51 +02:00
Aarnav Tale 0080cddb55 chore: fix some test issues 2026-02-08 11:11:44 -05:00
Aarnav Tale 0b8ae8fa2d feat: fix pre-auth-key dialog to be usable again 2026-02-08 11:09:03 -05:00
Paul Kronenwetter 0d0b5f88a1 chore(machines): conditionally show owner change menu item based on version
Adds conditional rendering for the "Change owner" menu item in machine management, hiding it for versions 0.28.0-beta.1 and above. This prevents users from attempting to change node ownership on newer versions where this functionality is not supported. The change involves passing a new `supportsNodeOwnerChange` prop through the component hierarchy and updating the menu rendering logic accordingly.
2026-02-06 13:47:36 -05:00
Aarnav Tale fad0c99fc9 feat: official 0.28 support possibly 2026-02-06 00:11:26 -05:00
Aarnav Tale 696e08dbcc feat: normalize node tags before leaving the api 2026-01-24 20:30:57 -05:00
Paul Kronenwetter 5777a5f509 Support previous API interface as well 2026-01-24 20:30:57 -05:00
Paul Kronenwetter c61a9119a7 Address tags incompatiblity introduced in 0.28.0-beta.2
From change (#2993)[https://github.com/juanfont/headscale/pull/2993]
2026-01-24 20:30:57 -05:00
Aarnav Tale 1a1d7dbe6a feat: fix api-key login on headscale 0.28+ 2026-01-24 12:58:07 -05:00
Aarnav Tale 403f9c9b0b feat: add lazy retrying oidc connector 2026-01-16 00:33:10 -05:00
Aarnav Tale 2618cdd9f6 fix: strengthen the proc scanner for headscale 2026-01-16 00:20:26 -05:00
Aarnav Tale 034ba25ce3 feat: switch to oxc linting/formatting 2026-01-15 22:09:58 -05:00
Aarnav Tale 0df4130217 fix: return container width back to 96rem 2026-01-15 21:55:36 -05:00
Aarnav Tale 62325f7c86 chore: fallback to client_secret_post for OIDC 2026-01-15 21:54:55 -05:00
Aarnav Tale 0fb02d0d8b feat: implement better token auth endpoint method heuristic for oidc 2026-01-13 22:17:17 -05:00