38cf93e5ae
feat: replace onboarding for explicit user linking
2026-03-14 13:23:22 -04:00
684a95b5e8
fix: harden user linking and session pruning
...
Security:
- Add unique constraint on headscale_user_id to prevent hijacking
- linkHeadscaleUser now rejects already-claimed Headscale users
- Onboarding dropdown filters out claimed users
- onboarding-skip action redirects on rejected claims
Maintenance:
- Replace probabilistic session pruning with setInterval (15m)
- Move pruning out of request path into server startup
Co-authored-by: Amp <amp@ampcode.com >
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:55 -04:00
0f8e192b5c
feat: initial auth rework
2026-03-07 17:10:34 -05:00
64edd2041b
fix first user owner assignment on OIDC login
2026-02-27 13:56:15 +02:00
403f9c9b0b
feat: add lazy retrying oidc connector
2026-01-16 00:33:10 -05:00
7a345d118c
feat: check and warn for pkce errors if possible
2026-01-11 14:55:23 -05:00
8948d440fc
Improve OIDC error logging
2025-12-08 10:55:19 +01:00
3a3e5ca65e
feat: pkce
2025-12-04 11:37:22 -05:00
199ef46ee1
fix: correctly passthrough and handle a new OIDC redirect_uri system
2025-12-04 10:34:48 -05:00
ba61656fb0
feat: cleanup oidc logic and surface errors better
2025-12-04 00:44:31 -05:00
86184e3420
feat: overhaul config loading
2025-12-01 02:46:22 -05:00
d3d7c7cc0e
feat: better error handling for oidc api key
...
This also ships with a better error page
2025-11-28 17:54:52 -05:00
bda9dedbfd
fix: if there are 0 admins, promote next admin on oidc login
2025-08-28 17:37:12 -04:00
4351e1fcb3
feat: support gravatar profile pictures for oidc
2025-08-21 12:16:18 -04:00
d2c4f5eb2b
feat: completely overhaul the auth model
...
* Cookies are now encrypted JWTs (GHSA-wrqq-v7qw-r5w7)
* Authentication is stored in the SQLite database (auto-migrated)
* Session logic is much cleaner
2025-08-19 17:52:16 -04:00
34cfee7cff
feat: reach an initial working stage
2025-03-24 16:15:38 -04:00
6108de52e7
feat: switch to a central singleton handler
...
This also adds support for Headscale TLS installations
2025-03-17 22:21:16 -04:00
f5436f5ee3
feat: respect context in server
2025-02-19 18:09:42 -05:00
76d263b7e6
feat: switch to config file system
2025-02-13 12:35:12 -05:00
bd11453593
fix: store oidc redirect_uri in session for parity
2025-01-18 08:18:19 +00:00
5569ba4660
feat: rework oidc to be more resilient
...
This includes setting a custom redirect URI, handling errors, and using a better library.
As an API decision I've also disabled per session API keys as it clutters up too much.
2025-01-10 13:55:24 +05:30
f3c9d8b54c
style: run biome lint
2025-01-06 08:19:40 +05:30
aa9872a45b
chore: switch to react-router v7
2025-01-06 08:19:40 +05:30
50e43bc0c3
feat: refactor/reorganize auth routes
2024-12-08 13:27:51 -05:00
Aarnav Tale