b961b339bb
feat: add support for OIDC logouts
...
Closes HP-407.
2026-04-26 20:36:52 -04:00
61e7303363
fix: handle URI components in provider ID
2026-04-06 21:19:27 -04:00
4b47b1bbed
chore: update auth-service to not be class based
2026-04-03 16:57:39 -04:00
1259642f8a
feat: replace openid-client with clean-room oidc system
2026-04-03 16:36:27 -04:00
4cd0c1e206
fix: use headscale.api_key where possible
2026-04-03 16:34:50 -04:00
838a2cd732
fix: store profile picture in db to prevent header overload
2026-03-30 13:58:29 -04:00
5f81822366
feat: correct package.json dependencies and remove libsql
2026-03-17 13:31:35 -04:00
8f6fe05c83
fix: actually fix type errors
2026-03-16 23:41:09 -04:00
a26faab139
feat: add ownership transfer support
2026-03-14 15:17:45 -04:00
e255407115
feat: redo user page to match account linking
2026-03-14 14:56:04 -04:00
38cf93e5ae
feat: replace onboarding for explicit user linking
2026-03-14 13:23:22 -04:00
6470f5a821
feat: refactor several components and clean up ui
2026-03-09 22:09:58 -04:00
434f886034
feat: admin UI for Headscale user linking + skip onboarding
...
- Add 'Link Headscale user' option in user menu (admin-only, OIDC users)
- Dialog shows only unclaimed Headscale users
- New link_user action in user-actions with claim validation
- Onboarding now allows skipping the link step with clear messaging
- Users who skip are told they can ask an admin to link later
Co-authored-by: Amp <amp@ampcode.com >
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:57 -04:00
684a95b5e8
fix: harden user linking and session pruning
...
Security:
- Add unique constraint on headscale_user_id to prevent hijacking
- linkHeadscaleUser now rejects already-claimed Headscale users
- Onboarding dropdown filters out claimed users
- onboarding-skip action redirects on rejected claims
Maintenance:
- Replace probabilistic session pruning with setInterval (15m)
- Move pruning out of request path into server startup
Co-authored-by: Amp <amp@ampcode.com >
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:55 -04:00
45984ec639
chore: remove deprecated oidc.user_storage_file option
...
The flat-file user store has been deprecated for several versions.
All user data now lives in the SQL database. Removes the config field,
nix option, docs, and migration logic.
Co-authored-by: Amp <amp@ampcode.com >
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:49 -04:00
0f8e192b5c
feat: initial auth rework
2026-03-07 17:10:34 -05:00
1462016a39
Add self-service pre-auth keys for auditor role
...
Closes #453
2026-02-27 12:21:16 +02:00
2e6b387d67
fix role assignment for users without headplane db record
2026-02-24 17:37:09 +02:00
403f9c9b0b
feat: add lazy retrying oidc connector
2026-01-16 00:33:10 -05:00
62325f7c86
chore: fallback to client_secret_post for OIDC
2026-01-15 21:54:55 -05:00
0fb02d0d8b
feat: implement better token auth endpoint method heuristic for oidc
2026-01-13 22:17:17 -05:00
3d71049afe
fix: accept the full discovered oidc configuration
2025-12-12 21:26:35 +01:00
3a3e5ca65e
feat: pkce
2025-12-04 11:37:22 -05:00
199ef46ee1
fix: correctly passthrough and handle a new OIDC redirect_uri system
2025-12-04 10:34:48 -05:00
a824ea3dcf
chore: spammy log cleanup
2025-12-04 03:37:48 -05:00
ba61656fb0
feat: cleanup oidc logic and surface errors better
2025-12-04 00:44:31 -05:00
d3d7c7cc0e
feat: better error handling for oidc api key
...
This also ships with a better error page
2025-11-28 17:54:52 -05:00
b1c93512df
feat: support custom cookie options
2025-11-02 14:04:38 -05:00
eb4669498a
feat: overhaul oidc work
2025-08-28 22:55:26 -04:00
d7b1e19985
chore: add deprecation notice for oidc user file
2025-08-21 12:37:25 -04:00
cd4e8f8399
chore: handle empty (already migrated) user oidc file
2025-08-21 11:49:17 -04:00
d2c4f5eb2b
feat: completely overhaul the auth model
...
* Cookies are now encrypted JWTs (GHSA-wrqq-v7qw-r5w7)
* Authentication is stored in the SQLite database (auto-migrated)
* Session logic is much cleaner
2025-08-19 17:52:16 -04:00
8cb91cd45b
feat: overhaul hp_agent lifecycle handling
...
* Added backoff and liveness probes for better management
* Switched IPC to a simple text based system
* Lookups don't directly touch the agent now
* Use the database as a source of truth
2025-08-19 00:10:06 -04:00
8a9235836a
fix: agent inherits UID/GID from the parent process
2025-08-05 13:16:02 -04:00
b18147fa82
feat: cleanup removal of old ssh plexer and logic
...
we also have added the necessary logic to auto prune ephemeral nodes because
headscale doesn't seem to automatically remove them. this change made use of a database
which is now stored in the persistent headplane directory.
2025-06-20 00:14:00 -04:00
7dfcbef774
feat: initial webssh tooling
2025-06-16 11:44:59 -04:00
0276a500c7
fix: attempt to auto create agent work_dir if missing
2025-05-25 11:02:19 -04:00
662c38ea44
fix: handle newlines in provided secret paths
2025-05-25 11:02:19 -04:00
39d6602263
fix: use descriptive error messages
2025-05-25 11:02:19 -04:00
8c01fcfe89
fix: only return queried machines from an agent
2025-05-25 11:02:19 -04:00
c5e6a6c407
feat: switch away from websocket to stdout messaging for agent
2025-05-25 11:02:19 -04:00
169a7b14d0
feat: support oidc restriction management in the settings
2025-05-25 11:02:19 -04:00
3a5ab68432
chore: defer the path based config loading till 0.6.1. ( #223 )
2025-05-23 10:46:14 -04:00
8ea8c7195f
Implement path-based secret loading
2025-05-19 16:38:35 -04:00
69c6fc4847
chore: v0.5.8
2025-04-03 13:11:33 -04:00
6a94e815f2
feat: improve error returning and parsing logic
2025-04-03 12:57:06 -04:00
d5fb8a2966
feat: support skipping onboarding
2025-04-03 12:57:06 -04:00
7d61ad50c4
feat: oops commit the user role change page
2025-04-03 12:57:06 -04:00
d698cf5478
fix: open file in a+ to avoid read issues
2025-04-02 13:40:01 -04:00
80c987f383
feat: implement onboarding for non-registered users
2025-04-02 13:26:58 -04:00
Aarnav Tale