38cf93e5ae
feat: replace onboarding for explicit user linking
2026-03-14 13:23:22 -04:00
6470f5a821
feat: refactor several components and clean up ui
2026-03-09 22:09:58 -04:00
a53fd31d27
chore: combine link usage
2026-03-09 13:56:03 -04:00
684a95b5e8
fix: harden user linking and session pruning
...
Security:
- Add unique constraint on headscale_user_id to prevent hijacking
- linkHeadscaleUser now rejects already-claimed Headscale users
- Onboarding dropdown filters out claimed users
- onboarding-skip action redirects on rejected claims
Maintenance:
- Replace probabilistic session pruning with setInterval (15m)
- Move pruning out of request path into server startup
Co-authored-by: Amp <amp@ampcode.com >
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:55 -04:00
0f8e192b5c
feat: initial auth rework
2026-03-07 17:10:34 -05:00
f4a2811afb
chore: general cleanup/pr improvements
2026-03-07 15:12:50 -05:00
da3132323c
Merge pull request #480 from drifterza/fix/issue-266-owner-assignment
2026-03-07 14:52:02 -05:00
64edd2041b
fix first user owner assignment on OIDC login
2026-02-27 13:56:15 +02:00
787f8decbc
fix: return login errors to form instead of throwing ( #474 )
...
Throwing data() in React Router v7 actions goes to ErrorBoundary instead
of returning to the component. Changed validation errors to return
directly so the login form can display them properly.
2026-02-27 10:55:42 +02:00
2e5bb791e8
use LiveDataProvider auto-refresh for pending approval page
...
Replaces manual refresh button with automatic 3-second polling.
Adds unit tests for the live data hook behavior.
2026-02-27 00:55:55 +02:00
5e45295523
align pending approval page styling with login page
2026-02-24 17:19:46 +02:00
a6b25b3ba3
add pending approval page for OIDC users without ui_access
2026-02-24 15:32:34 +02:00
1a1d7dbe6a
feat: fix api-key login on headscale 0.28+
2026-01-24 12:58:07 -05:00
403f9c9b0b
feat: add lazy retrying oidc connector
2026-01-16 00:33:10 -05:00
7a345d118c
feat: check and warn for pkce errors if possible
2026-01-11 14:55:23 -05:00
7b4966be02
feat: track headscale acl response changes
2025-12-13 16:34:23 -05:00
8948d440fc
Improve OIDC error logging
2025-12-08 10:55:19 +01:00
3a3e5ca65e
feat: pkce
2025-12-04 11:37:22 -05:00
3eff763436
docs: create initial sso page
2025-12-04 10:52:16 -05:00
6ad0847653
fix: the login page would crash if OIDC is not enabled correctly
2025-12-04 10:39:24 -05:00
199ef46ee1
fix: correctly passthrough and handle a new OIDC redirect_uri system
2025-12-04 10:34:48 -05:00
ba61656fb0
feat: cleanup oidc logic and surface errors better
2025-12-04 00:44:31 -05:00
86184e3420
feat: overhaul config loading
2025-12-01 02:46:22 -05:00
d3d7c7cc0e
feat: better error handling for oidc api key
...
This also ships with a better error page
2025-11-28 17:54:52 -05:00
444b2325fb
feat: fix acl api logic to work correctly
2025-11-04 23:51:36 -05:00
d68737e410
feat: switch machine apis to new runtime api client
2025-11-04 22:44:58 -05:00
a68aedc297
feat: create type-safe API object for Headscale
2025-11-04 22:40:57 -05:00
ce4be73faf
feat: add a warning banner on the login page for misconfigured cookies
2025-11-02 13:54:45 -05:00
eb4669498a
feat: overhaul oidc work
2025-08-28 22:55:26 -04:00
bda9dedbfd
fix: if there are 0 admins, promote next admin on oidc login
2025-08-28 17:37:12 -04:00
4351e1fcb3
feat: support gravatar profile pictures for oidc
2025-08-21 12:16:18 -04:00
d2c4f5eb2b
feat: completely overhaul the auth model
...
* Cookies are now encrypted JWTs (GHSA-wrqq-v7qw-r5w7)
* Authentication is stored in the SQLite database (auto-migrated)
* Session logic is much cleaner
2025-08-19 17:52:16 -04:00
fb3bc35b40
fix: handle the login form state and report errors correctly on api key login
2025-05-25 11:02:19 -04:00
9b09b13b5f
feat: do not login loop if disable_api_key_login is true
2025-04-03 12:57:55 -04:00
34cfee7cff
feat: reach an initial working stage
2025-03-24 16:15:38 -04:00
6108de52e7
feat: switch to a central singleton handler
...
This also adds support for Headscale TLS installations
2025-03-17 22:21:16 -04:00
01f432cedc
feat: support oidc client_secret_path with env interpolation
2025-03-11 18:15:56 -04:00
f5436f5ee3
feat: respect context in server
2025-02-19 18:09:42 -05:00
76d263b7e6
feat: switch to config file system
2025-02-13 12:35:12 -05:00
287ac2dff0
feat: unify all colors
2025-02-04 17:21:03 -05:00
28e40eecbf
fix: switch to new aria components
2025-01-28 16:02:47 -05:00
ec36876b9f
feat: begin redesign and component unification
2025-01-19 15:24:03 +00:00
bd11453593
fix: store oidc redirect_uri in session for parity
2025-01-18 08:18:19 +00:00
1b45b0917f
fix: handle headscale unavailability gracefully
2025-01-17 11:45:36 +00:00
5569ba4660
feat: rework oidc to be more resilient
...
This includes setting a custom redirect URI, handling errors, and using a better library.
As an API decision I've also disabled per session API keys as it clutters up too much.
2025-01-10 13:55:24 +05:30
6745ee8529
fix: resolve type errors and lint components/routes
2025-01-06 08:19:41 +05:30
7217659720
fix: prevent cookie manager from racing env init
...
this fixes a bug where using LOAD_ENV_FILE did not work with COOKIE_SECRET
2025-01-06 08:19:40 +05:30
f3c9d8b54c
style: run biome lint
2025-01-06 08:19:40 +05:30
aa9872a45b
chore: switch to react-router v7
2025-01-06 08:19:40 +05:30
50e43bc0c3
feat: refactor/reorganize auth routes
2024-12-08 13:27:51 -05:00
Aarnav Tale