b961b339bb
feat: add support for OIDC logouts
...
Closes HP-407.
2026-04-26 20:36:52 -04:00
bdcd4c5bad
Merge pull request #518 from Kroppeb/fix/wrong-url-in-help-message
2026-04-06 21:42:48 -04:00
1259642f8a
feat: replace openid-client with clean-room oidc system
2026-04-03 16:36:27 -04:00
4cd0c1e206
fix: use headscale.api_key where possible
2026-04-03 16:34:50 -04:00
b2dfa773b0
fix: change oidc config error notice url
2026-04-01 22:17:11 +02:00
838a2cd732
fix: store profile picture in db to prevent header overload
2026-03-30 13:58:29 -04:00
2c57187628
feat: switch to a generalized api key config
2026-03-27 13:32:59 -04:00
2e2d5d1dff
Update oidc-callback.ts
2026-03-24 11:48:20 +00:00
7403ebea06
feat: switch form fields to base-ui
2026-03-19 12:35:25 -04:00
941971b8c7
feat: replace button and toast provider with base-ui
2026-03-19 12:35:24 -04:00
27f8fa0b42
feat: swap button and decompose dialog components
2026-03-16 23:32:05 -04:00
38cf93e5ae
feat: replace onboarding for explicit user linking
2026-03-14 13:23:22 -04:00
6470f5a821
feat: refactor several components and clean up ui
2026-03-09 22:09:58 -04:00
a53fd31d27
chore: combine link usage
2026-03-09 13:56:03 -04:00
684a95b5e8
fix: harden user linking and session pruning
...
Security:
- Add unique constraint on headscale_user_id to prevent hijacking
- linkHeadscaleUser now rejects already-claimed Headscale users
- Onboarding dropdown filters out claimed users
- onboarding-skip action redirects on rejected claims
Maintenance:
- Replace probabilistic session pruning with setInterval (15m)
- Move pruning out of request path into server startup
Co-authored-by: Amp <amp@ampcode.com >
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:55 -04:00
0f8e192b5c
feat: initial auth rework
2026-03-07 17:10:34 -05:00
f4a2811afb
chore: general cleanup/pr improvements
2026-03-07 15:12:50 -05:00
da3132323c
Merge pull request #480 from drifterza/fix/issue-266-owner-assignment
2026-03-07 14:52:02 -05:00
64edd2041b
fix first user owner assignment on OIDC login
2026-02-27 13:56:15 +02:00
787f8decbc
fix: return login errors to form instead of throwing ( #474 )
...
Throwing data() in React Router v7 actions goes to ErrorBoundary instead
of returning to the component. Changed validation errors to return
directly so the login form can display them properly.
2026-02-27 10:55:42 +02:00
2e5bb791e8
use LiveDataProvider auto-refresh for pending approval page
...
Replaces manual refresh button with automatic 3-second polling.
Adds unit tests for the live data hook behavior.
2026-02-27 00:55:55 +02:00
5e45295523
align pending approval page styling with login page
2026-02-24 17:19:46 +02:00
a6b25b3ba3
add pending approval page for OIDC users without ui_access
2026-02-24 15:32:34 +02:00
1a1d7dbe6a
feat: fix api-key login on headscale 0.28+
2026-01-24 12:58:07 -05:00
403f9c9b0b
feat: add lazy retrying oidc connector
2026-01-16 00:33:10 -05:00
7a345d118c
feat: check and warn for pkce errors if possible
2026-01-11 14:55:23 -05:00
7b4966be02
feat: track headscale acl response changes
2025-12-13 16:34:23 -05:00
8948d440fc
Improve OIDC error logging
2025-12-08 10:55:19 +01:00
3a3e5ca65e
feat: pkce
2025-12-04 11:37:22 -05:00
3eff763436
docs: create initial sso page
2025-12-04 10:52:16 -05:00
6ad0847653
fix: the login page would crash if OIDC is not enabled correctly
2025-12-04 10:39:24 -05:00
199ef46ee1
fix: correctly passthrough and handle a new OIDC redirect_uri system
2025-12-04 10:34:48 -05:00
ba61656fb0
feat: cleanup oidc logic and surface errors better
2025-12-04 00:44:31 -05:00
86184e3420
feat: overhaul config loading
2025-12-01 02:46:22 -05:00
d3d7c7cc0e
feat: better error handling for oidc api key
...
This also ships with a better error page
2025-11-28 17:54:52 -05:00
444b2325fb
feat: fix acl api logic to work correctly
2025-11-04 23:51:36 -05:00
d68737e410
feat: switch machine apis to new runtime api client
2025-11-04 22:44:58 -05:00
a68aedc297
feat: create type-safe API object for Headscale
2025-11-04 22:40:57 -05:00
ce4be73faf
feat: add a warning banner on the login page for misconfigured cookies
2025-11-02 13:54:45 -05:00
eb4669498a
feat: overhaul oidc work
2025-08-28 22:55:26 -04:00
bda9dedbfd
fix: if there are 0 admins, promote next admin on oidc login
2025-08-28 17:37:12 -04:00
4351e1fcb3
feat: support gravatar profile pictures for oidc
2025-08-21 12:16:18 -04:00
d2c4f5eb2b
feat: completely overhaul the auth model
...
* Cookies are now encrypted JWTs (GHSA-wrqq-v7qw-r5w7)
* Authentication is stored in the SQLite database (auto-migrated)
* Session logic is much cleaner
2025-08-19 17:52:16 -04:00
fb3bc35b40
fix: handle the login form state and report errors correctly on api key login
2025-05-25 11:02:19 -04:00
9b09b13b5f
feat: do not login loop if disable_api_key_login is true
2025-04-03 12:57:55 -04:00
34cfee7cff
feat: reach an initial working stage
2025-03-24 16:15:38 -04:00
6108de52e7
feat: switch to a central singleton handler
...
This also adds support for Headscale TLS installations
2025-03-17 22:21:16 -04:00
01f432cedc
feat: support oidc client_secret_path with env interpolation
2025-03-11 18:15:56 -04:00
f5436f5ee3
feat: respect context in server
2025-02-19 18:09:42 -05:00
76d263b7e6
feat: switch to config file system
2025-02-13 12:35:12 -05:00
Aarnav Tale