55 Commits

Include renames

Author	SHA1	Message	Date
raucao	295261b332	Address review findings in the PKCE flow ... - Make authorization-code redemption atomic: claim the code with a guarded delete inside the transaction that creates the authorization, so concurrent exchanges can't both issue a token (RFC 6749 4.1.3) - Compare the token request's client_id host to the code's stored client_id (defense-in-depth alongside the exact redirect_uri match) - Reject unknown response_type values with unsupported_response_type - Validate the PKCE code_challenge (43-128 unreserved chars, S256) so a client can't persist an over-long or malformed challenge - Return invalid_request for missing token-endpoint parameters, and set Cache-Control: no-store on error responses too - Use the right separator when the redirect_uri already has a query string - Look codes up through the active scope; drop the unused consume!; serialize permissions as JSON - Purge abandoned authorization codes via a recurring Solid Queue task Part of #254	2026-11-03 11:40:18 +04:00
raucao	8dd0bf10ce	Add PKCE support to remoteStorage OAuth ... Implements the optional OAuth 2.0 Authorization Code grant with PKCE (RFC 7636) for remoteStorage, as described in the remoteStorage spec (section 10.1). - Advertise the authorization and token endpoints plus the supported code_challenge method (S256) in WebFinger, and bump the advertised spec version to draft-dejong-remotestorage-27 - Add RsAuthorizationCode: a short-lived (5 min), single-use authorization code stored only as a SHA256 digest - Add RsOauthManager services for issuing and exchanging codes, including S256 verification - Add a cross-origin POST /rs/oauth/token endpoint that exchanges a code (and code_verifier) for an access token, with CORS and no CSRF token - Consent dialog now carries response_type / code_challenge through the form and redirects with the code in the query string for the code flow - Remove the existing-token reuse shortcut so every authorization results in a distinct authorization (and token) Part of #254	2026-11-03 09:17:43 +04:00
raucao	89184cd851	Redirect to root after password reset	2026-08-10 11:22:03 -06:00
raucao	d58c995230	Admin users page: filter by username ... Allow admins to filter the user list/index by username (partial matches allowed)	2026-08-10 10:36:05 -06:00
raucao	5f276ff349	Queue XmppSetAvatarJob when new avatar is uploaded ... And let job do nothing in development for now	2025-05-15 22:04:25 +04:00
raucao	582d339c0a	Remove feature gate for avatar upload	2025-05-14 18:55:26 +04:00
raucao	17ffbde03a	WIP Store avatars as ActiveStorage attachments ... Also push to LDAP as jpegPhoto	2025-05-11 18:43:21 +04:00
raucao	9e2210c45b	Store avatars as binary instead of base64	2025-05-10 20:58:36 +04:00
raucao	3042a02a17	Allow users to update their OpenPGP pubkey	2024-09-23 18:13:39 +02:00
raucao	ba683a7b95	Move some Rails app services to UserManager namespace	2024-09-23 16:03:02 +02:00
raucao	51a3cb60ec	Merge pull request 'Add custom LDAP attributes to schema' (#181) from feature/custom_ldap_attributes into master ... Reviewed-on: #181 Reviewed-by: greg <greg@noreply.kosmos.org>	2024-03-19 14:46:44 +00:00
raucao	5a3adba603	Move nostr pubkeys to LDAP attribute ... closes #173	2024-03-17 11:04:11 +01:00
raucao	3715cb518b	User Settings: Rename Experiments to Nostr ... And use a nostr icon	2024-03-16 16:03:15 +01:00
raucao	e3b96d5cff	Merge branch 'master' into feature/donations_btcpay	2024-03-03 12:50:16 +01:00
raucao	51f4556ede	Refactor admin settings routes ... This is much cleaner, and semantically more correct.	2024-03-02 14:22:08 +00:00
raucao	079ee8833c	Implement bitcoin donations via BTCPay	2024-03-02 14:31:48 +01:00
raucao	822a2dc018	Fix specs	2024-03-01 17:15:02 +01:00
raucao	2753388e1e	Add specs for admin user management	2024-02-10 12:53:11 +01:00
raucao	179a82d2dd	Use keyword arguments for ApplicationService calls ... Not all services are using keywords, which breaks those calls in Ruby 3	2024-02-02 15:50:25 +02:00
raucao	84220beb1c	Merge pull request 'Add email service and settings' (#154) from feature/email_service into master ... Reviewed-on: #154 Reviewed-by: galfert <garret.alfert@gmail.com>	2024-01-22 09:01:18 +00:00
raucao	b4f0c60ea0	Update nostr gem, switch to Ruby for bech32 encoding	2024-01-15 12:54:58 +03:00
raucao	7b71f2cf76	Revert "Fix fixture file" ... This reverts commit c7b137e5eb.	2024-01-10 18:35:04 +03:00
raucao	c7b137e5eb	Fix fixture file	2024-01-10 18:30:19 +03:00
raucao	958d18d61a	Add email service and settings	2024-01-10 18:30:05 +03:00
Râu Cao	56c127ca0c	Only allow primary domain for RS ... Replace user addresses with usernames in the respective URLs	2023-11-01 21:46:38 +01:00
Râu Cao	d939f5d649	Merge branch 'master' into feature/btcpay_configs	2023-09-20 19:12:24 +02:00
raucao	7a5fd46835	Merge pull request 'Add user avatars to LDAP, upload on profile settings page' (#148) from feature/123-user_avatars into master ... Reviewed-on: #148 Reviewed-by: galfert <garret.alfert@gmail.com>	2023-09-13 13:01:25 +00:00
Râu Cao	dfcdbec0dd	Add specs for avatar upload	2023-09-07 11:42:42 +02:00
Râu Cao	5a5f62e98a	Refactor BTCPay service and API, add lightning balance	2023-09-04 16:02:54 +02:00
Râu Cao	fcb6923c92	Fix wrong redirect after sign-in for RS OAuth ... We use a custom auth method to pre-fill the username when reaching the RS OAuth while signed out. However, it needs to redirect back to the RS OAuth page after sign-in, and not to the root path.	2023-09-04 11:33:16 +02:00
Râu Cao	ba0cbba96b	Add feature spec for RS OAuth dialog	2023-08-01 13:01:41 +02:00
Râu Cao	e4ed797920	Adjust specs	2023-06-22 13:57:55 +02:00
Râu Cao	93740f17ef	Allow editing and resetting of all admin setting strings	2023-06-22 13:48:29 +02:00
Râu Cao	4551a14362	Fix path	2023-06-16 14:55:11 +02:00
Râu Cao	e8bbe6c713	Let user remove nostr pubkey from account	2023-06-16 14:34:32 +02:00
Râu Cao	49de4007ab	Settings page for adding verified nostr pubkeys	2023-06-16 14:22:30 +02:00
Râu Cao	51489a83ab	Use feature block for email update specs	2023-05-28 15:25:53 +02:00
Râu Cao	05426e4ced	Add specs for display name update	2023-05-28 15:25:42 +02:00
Râu Cao	134c81460a	Allow email address updates on account settings page	2023-05-25 16:58:53 +02:00
galfert	9e74c89a80	Fix failing spec expectation when using Ruby 3.x	2023-04-10 23:03:59 +02:00
galfert	9b89101afc	Basic RemoteStorage settings	2023-04-08 21:49:16 +02:00
Râu Cao	fa56d6b772	Refactor toggles to work without JS, add specs	2023-03-15 09:03:39 +00:00
raucao	84337c3a7d	Merge pull request 'Add lndhub admin panel, quick stats for admin pages' (#80) from feature/admin_stats into master ... Reviewed-on: #80 Reviewed-by: bumi <bumi@noreply.kosmos.org>	2023-02-23 07:43:15 +00:00
Râu Cao	b67d6139ac	Fix password validation during password reset ... fixes #28	2023-02-19 15:54:55 +08:00
Râu Cao	b9259958f4	Add spec to prove issue #28	2023-02-19 14:41:45 +08:00
Râu Cao	f3f967f9f7	Prevent signups with reserved usernames ... closes #12	2023-02-19 12:12:00 +08:00
Râu Cao	9407c7a94d	Add username format restrictions	2023-02-19 12:04:24 +08:00
Râu Cao	df3ec9f90a	Add spec for updating reserved usernames setting	2023-02-19 11:56:34 +08:00
Râu Cao	25a0723166	Make admin flag persist for subsequent calls in spec	2023-02-19 11:55:53 +08:00
basti	eda1f3999f	Update validation message in spec ... They seem to have shortened the default message.	2022-02-12 14:10:04 -06:00