a1efe36ff1
fix: rename pending approval to no access
...
Member role simply has no UI permissions — not a pending state.
Co-authored-by: Amp <amp@ampcode.com >
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:58 -04:00
270b99f063
fix: show linked user in onboarding + pending approval screen
...
- Onboarding now shows which Headscale user was auto-linked
- Members (no ui_access) see a 'Pending Approval' page instead of
being silently logged out — their session stays valid
- Sign out button on the pending page so users can switch accounts
Co-authored-by: Amp <amp@ampcode.com >
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:58 -04:00
434f886034
feat: admin UI for Headscale user linking + skip onboarding
...
- Add 'Link Headscale user' option in user menu (admin-only, OIDC users)
- Dialog shows only unclaimed Headscale users
- New link_user action in user-actions with claim validation
- Onboarding now allows skipping the link step with clear messaging
- Users who skip are told they can ask an admin to link later
Co-authored-by: Amp <amp@ampcode.com >
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:57 -04:00
684a95b5e8
fix: harden user linking and session pruning
...
Security:
- Add unique constraint on headscale_user_id to prevent hijacking
- linkHeadscaleUser now rejects already-claimed Headscale users
- Onboarding dropdown filters out claimed users
- onboarding-skip action redirects on rejected claims
Maintenance:
- Replace probabilistic session pruning with setInterval (15m)
- Move pruning out of request path into server startup
Co-authored-by: Amp <amp@ampcode.com >
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:55 -04:00
45984ec639
chore: remove deprecated oidc.user_storage_file option
...
The flat-file user store has been deprecated for several versions.
All user data now lives in the SQL database. Removes the config field,
nix option, docs, and migration logic.
Co-authored-by: Amp <amp@ampcode.com >
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:49 -04:00
c7f3b60b62
flake.lock: Update
...
Flake lock file updates:
• Updated input 'nixpkgs':
'github:nixos/nixpkgs/c0f3d81' (2026-02-27)
→ 'github:nixos/nixpkgs/917fec9' (2026-03-05)
2026-03-08 08:33:58 +00:00
0f8e192b5c
feat: initial auth rework
2026-03-07 17:10:34 -05:00
6d70497758
revert: remove this useless contribution
2026-03-07 15:15:05 -05:00
f4a2811afb
chore: general cleanup/pr improvements
2026-03-07 15:12:50 -05:00
5f2cbebbcd
chore: condense/cleanup bad tests
2026-03-07 15:11:15 -05:00
da3132323c
Merge pull request #480 from drifterza/fix/issue-266-owner-assignment
2026-03-07 14:52:02 -05:00
cb97b73abd
Merge pull request #477 from drifterza/fix/issue-427-hostinfo-update-frequency
2026-03-07 14:51:15 -05:00
432cd29cd0
Merge pull request #478 from drifterza/fix/issue-453-self-service-preauth-keys
2026-03-07 14:50:12 -05:00
1feb109a36
Merge pull request #475 from drifterza/fix/issue-474-api-key-bad-request
2026-03-07 14:48:32 -05:00
f6613f1faf
Merge pull request #484 from tale/update_flake_lock_action
2026-03-07 14:47:36 -05:00
210d473bc2
Fix link to Headplane configuration file in docker.md
2026-03-07 14:47:21 -05:00
67b1611d13
Fix link to Headplane configuration file in docker.md
...
Updated the link to the completed configuration file for Headplane in the Docker installation documentation.
2026-03-02 21:02:27 +01:00
df11aefd0c
chore: update github actions/issues workflows
2026-03-01 13:45:36 -05:00
f9dc9d454b
flake.lock: Update
...
Flake lock file updates:
• Updated input 'nixpkgs':
'github:nixos/nixpkgs/d1c15b7' (2026-02-16)
→ 'github:nixos/nixpkgs/c0f3d81' (2026-02-27)
2026-03-01 08:33:20 +00:00
64edd2041b
fix first user owner assignment on OIDC login
2026-02-27 13:56:15 +02:00
1462016a39
Add self-service pre-auth keys for auditor role
...
Closes #453
2026-02-27 12:21:16 +02:00
779103147d
add refresh interval tests
2026-02-27 11:30:19 +02:00
be79413178
fix: refresh agent HostInfo periodically using cache_ttl ( #427 )
...
Previously REFRESH was only sent once at startup, causing version info
to stay stale. Now the agent refreshes peer data at the cache_ttl
interval (default 3 minutes).
2026-02-27 11:26:06 +02:00
787f8decbc
fix: return login errors to form instead of throwing ( #474 )
...
Throwing data() in React Router v7 actions goes to ErrorBoundary instead
of returning to the component. Changed validation errors to return
directly so the login form can display them properly.
2026-02-27 10:55:42 +02:00
0cff389051
chore: v0.6.2
2026-02-26 18:22:12 -05:00
3c5a653942
Merge pull request #469 from drifterza/feature/oidc-pending-approval
2026-02-26 18:03:26 -05:00
2e5bb791e8
use LiveDataProvider auto-refresh for pending approval page
...
Replaces manual refresh button with automatic 3-second polling.
Adds unit tests for the live data hook behavior.
2026-02-27 00:55:55 +02:00
ab3c4f7819
fix: serve favicon through the prefix
2026-02-26 01:23:02 -05:00
b2db6efd63
fix: use correct versions for the UI
2026-02-26 01:23:02 -05:00
937bc4a667
chore: update deps
2026-02-26 01:23:02 -05:00
9f4a7dc6e0
chore: update changelog
2026-02-26 01:23:02 -05:00
2afc11f652
Merge pull request #466 from drifterza/feature/list-all-preauth-keys
2026-02-26 00:47:07 -05:00
624b9ab479
list all preauth keys without user filter
...
headscale 0.28 added GET /v1/preauthkey without a user param
which returns all keys including tag-only ones. this change
adds getAllPreAuthKeys() and uses it when available, falling
back to per-user fetching on older versions.
the UI now handles keys where user is null, showing them as
Tag Only in the filter dropdown.
closes #432
Amp-Thread-ID: https://ampcode.com/threads/T-019c9861-2d45-73ef-ab94-5fce62f63670
Co-authored-by: Amp <amp@ampcode.com >
2026-02-26 00:40:31 -05:00
dde72ae4ed
Merge pull request #465 from drifterza/feature/preauth-key-tags
2026-02-26 00:04:02 -05:00
20c2a71713
Merge pull request #454 from z0w13/patch-1
2026-02-25 20:35:13 -05:00
2fdbf4abea
Merge pull request #467 from drifterza/feature/tag-node-operations
2026-02-25 20:34:49 -05:00
5e0ac88189
Merge pull request #461 from tale/update_flake_lock_action
2026-02-25 20:34:28 -05:00
4cb231deb1
Merge pull request #463 from drifterza/feature/oidc-enabled-flag
2026-02-25 20:33:34 -05:00
2a66e02bd4
Merge pull request #462 from PriceChild/patch-1
...
0.6.2-beta.5 config updates in Nix
2026-02-25 20:33:26 -05:00
a385c72d90
Merge pull request #470 from drifterza/fix/preauth-keys-oidc-users
...
Fix pre-auth keys not showing for OIDC users without username
2026-02-25 20:31:39 -05:00
4f59f4c77b
Add user utility functions and tests for OIDC user filtering
2026-02-24 19:05:45 +02:00
20297c6800
fix pre-auth keys not showing for oidc users without username
2026-02-24 18:40:09 +02:00
7c39f8f3a8
add tests for role assignment upsert behavior
2026-02-24 17:39:42 +02:00
2e6b387d67
fix role assignment for users without headplane db record
2026-02-24 17:37:09 +02:00
5e45295523
align pending approval page styling with login page
2026-02-24 17:19:46 +02:00
a6b25b3ba3
add pending approval page for OIDC users without ui_access
2026-02-24 15:32:34 +02:00
badefc7f85
fix: handle null user for tag-only nodes in Headscale 0.28+
...
In Headscale 0.28+, nodes can be registered with tag-only preauth keys
which have no associated user. This change updates the Machine type to
make user optional and adds null checks throughout the codebase where
node.user is accessed.
Fixes tag node operations (rename, add tags) that previously failed
with 'Unexpected Server Error' when accessing node.user.providerId
on nodes without a user association.
Refs: #432
2026-02-24 13:32:41 +02:00
30dd718d68
add oidc.enabled flag for helm and config generation
...
allows defining oidc config without enabling it
2026-02-24 10:43:28 +02:00
c96249f41e
add tag-only preauth keys for headscale 0.28
...
allows creating keys with acl tags but no user
2026-02-24 10:25:51 +02:00
c60a47b968
Missing oidc options
2026-02-23 23:08:43 +00:00
Aarnav Tale