Users with stored remoteStorage authorizations now jump straight to the connected apps dashboard from the services dashboard, instead of the storage info page.
Store only SHA256(token) in a new token_digest column and use the digest for the Redis authorization keys instead of the plaintext token. The plaintext is now held in memory only for issuance.
This is the expand step: the plaintext token column stays in place so the old code can keep running during the deploy. A follow-up migration will drop it once rs:rekey_tokens has re-keyed Redis and confirmed no plaintext keys remain.
Refs #259
The exact issuance and expiry times in the device rows' hover titles were
rendered in UTC, which reads as wrong to anyone not living there.
- Mark the dates with a <time> element carrying the absolute (UTC) timestamp,
rather than a custom data attribute whose name claimed to hold local time
- Rewrite those titles in the browser's own zone, keeping the server's UTC
rendering as the fallback for when JavaScript is unavailable
- Only convert values that carry an explicit offset, so a date-only <time> is
not read as UTC midnight and shifted onto the previous day
- Give the revoke button a little more room from the device name and dates
Part of #254
Revoking a device redirected away from the storage dashboard, which closed the
details modal and reloaded the page. Refreshing the affected parts instead
keeps the modal open and shows the change where it happened.
- Extract the card and the modal's access list into their own components, so
either can be re-rendered without touching the modal's open state, and share
the group summaries between the components
- Derive the app's DOM ids from its client_id (the grouping key) and the device
row ids from the authorization, through one helper used by both the templates
and the controller
- Revoke one of several devices as a Turbo Stream: remove the row and refresh
the card behind the modal and the access list
- Revoke an app's last device with a redirect, so the dashboard re-renders
itself and grouping, sorting and the empty state stay in one place
- Fade the removed row out, deferring Turbo's own removal until the animation
has ended
Part of #254
Tokens issued before user agents were captured cannot be attributed to a
single device, and the per-app tokens issued earlier could even be reused
from several devices at once.
- Add RemoteStorageAuthorization#device_label, falling back to
"Unknown device(s)" so the card and the details modal share one source
- Show a lower-bound device count with a "+" whenever an app has such a
token, so it reads as "could be more" instead of claiming a number we
cannot support
- Drop the now-redundant device-name wrapper from the details modal
Part of #254
Visual refinement pass on the connected-apps dashboard introduced for #254.
Card:
- Restructure into a header row (app icon, name, host, chevron) with the
device/category summary as a full-width footer, so the icon aligns with
the name and the metrics sit on a consistent baseline
- Always show the host alongside the app name, except when it is identical
- Render the icon fallback as a neutral rounded tile instead of a faint
watermark, and stop distorting real icons (object-contain)
- Summarise the union of the app's scopes, with monitor/folder icons
Details modal:
- Replace the duplicated blue buttons with a secondary Close and a primary
Launch app, split 50:50 on desktop like the consent dialog
- Tighten the header, section spacing and device rows; hide a redundant host
- Add exact date/time tooltips to the connected and expiry labels
- Align the scope-list folder icons with their labels
Misc:
- Use fewer near-identical grays across the cards and modal
- Drop the redundant top margin on the app grid
Part of #254
Show the union of the app's authorizations' scopes in the modal's Access
section too, so it matches the card's summary, and cover the union
summary with a feature spec.
Part of #254
- Move the app display name and a root-access helper onto
RemoteStorageAuthorization, used by both components and the controller,
removing the duplicated fallback chain and the unused OauthHelper includes
- Summarise the card's categories from the union of the app's authorizations'
scopes, so an older token with broader access is not understated
Part of #254
- One card per app (grouped by client_id) showing distinct device and
category counts; the whole card opens the details modal (with hover and
focus highlight) instead of a separate Details button
- Details modal: access list styled like the OAuth consent dialog via a
shared RsScopeListComponent, plus per-token device, connected date and
expiry, each with its own Revoke
- "folder" -> "category" in the card, modal, consent dialog and the
auth-created notification
- Make revoke a real DELETE: it was a GET link that Turbo 8's
prefetch-on-hover fired on its own, silently deleting authorizations.
Missing or foreign authorizations now return 404 instead of 500.
- Move "Launch app" to the app level
(GET /services/storage/apps/:client_id/launch); no token id in the URL
Part of #254
Replace the hand-rolled user-agent regexes with the device_detector gem.
Its UA database recognises many more clients (and, e.g., GNOME Web when
its UA carries the Epiphany token). WebKit "Safari" user agents on Linux
(WebKitGTK, which GNOME Web sends) are labelled "WebKit on Linux", since
Safari never runs on Linux.
Part of #254
- Rework RsAuthComponent into a card that shows the app, its device, an
access summary and the permission status
- Group connected apps by app and device, so repeated authorizations for
the same app and device (e.g. after a browser update) are shown together,
each with its own revoke action
- Add RsAuthDetailsModalComponent with the full scope list, device,
connected tokens and permission expiry, plus Launch and Revoke actions
(built on the existing ModalComponent)
- Add RemoteStorageAuthorization#device_name (parsed from the user agent)
and #expired?
Part of #254
Add an explicit spec for the storage-first handoff (remoteStorage spec
section 11): launching an app passes only `#remotestorage=<address>`,
never an access token. The app then runs the application-first
(now PKCE-capable) flow itself.
Part of #254
- Add user_agent to remote_storage_authorizations and rs_authorization_codes
- Capture the browser's user agent at consent, carry it on the authorization
code, and store it on the authorization when the code is exchanged
- Store it directly for the implicit flow too
With the reuse shortcut gone, each authorization is already a distinct
per-device token; this adds the metadata needed to label and display them.
Part of #254
- Enqueue the expiry job and the "app connected" notification on
after_commit instead of after_create, so they only fire once the (now
transactional) code exchange commits
- Enforce the PKCE code_challenge format (43-128 unreserved chars, S256)
with model validations, not only at the controller
- Drop the now-unused RsAuthorizationCode#expired?
- Cover the client_id-vs-stored-client_id check
Part of #254
- Make authorization-code redemption atomic: claim the code with a guarded
delete inside the transaction that creates the authorization, so concurrent
exchanges can't both issue a token (RFC 6749 4.1.3)
- Compare the token request's client_id host to the code's stored client_id
(defense-in-depth alongside the exact redirect_uri match)
- Reject unknown response_type values with unsupported_response_type
- Validate the PKCE code_challenge (43-128 unreserved chars, S256) so a client
can't persist an over-long or malformed challenge
- Return invalid_request for missing token-endpoint parameters, and set
Cache-Control: no-store on error responses too
- Use the right separator when the redirect_uri already has a query string
- Look codes up through the active scope; drop the unused consume!; serialize
permissions as JSON
- Purge abandoned authorization codes via a recurring Solid Queue task
Part of #254
The code is redeemed by the client immediately in the OAuth callback, so
a 60-second window is plenty (and matches common practice; RFC 6749 caps
authorization codes at 10 minutes).
Part of #254
Implements the optional OAuth 2.0 Authorization Code grant with PKCE
(RFC 7636) for remoteStorage, as described in the remoteStorage spec
(section 10.1).
- Advertise the authorization and token endpoints plus the supported
code_challenge method (S256) in WebFinger, and bump the advertised
spec version to draft-dejong-remotestorage-27
- Add RsAuthorizationCode: a short-lived (5 min), single-use authorization
code stored only as a SHA256 digest
- Add RsOauthManager services for issuing and exchanging codes, including
S256 verification
- Add a cross-origin POST /rs/oauth/token endpoint that exchanges a code
(and code_verifier) for an access token, with CORS and no CSRF token
- Consent dialog now carries response_type / code_challenge through the
form and redirects with the code in the query string for the code flow
- Remove the existing-token reuse shortcut so every authorization results
in a distinct authorization (and token)
Part of #254
The admin "Default services" setting writes the LDAP serviceEnabled
attribute, but remoteStorage access was also gated behind an unused
per-user Flipper flag that nothing ever enabled, so remoteStorage was
inaccessible for everyone.
Gate remoteStorage on service_enabled? like the other services, and make
the admin toggle reflect the LDAP attribute (this also fixes it reading
current_user instead of the user being viewed). E-Mail keeps its Flipper
gate for now.
Wire Users::DeviseController as Devise parent controller with the
Turbo-aware responder, so failed form submissions (login, password
reset) render correctly as HTML with 422 status instead of
unprocessable turbo-stream content that Turbo silently drops.
Also fixes a NameError in the responder (rendering_options ->
error_rendering_options) and removes the dead TurboController.
raucao