259 Commits

Include renames

Author	SHA1	Message	Date
raucao	8dd0bf10ce	Add PKCE support to remoteStorage OAuth ... Implements the optional OAuth 2.0 Authorization Code grant with PKCE (RFC 7636) for remoteStorage, as described in the remoteStorage spec (section 10.1). - Advertise the authorization and token endpoints plus the supported code_challenge method (S256) in WebFinger, and bump the advertised spec version to draft-dejong-remotestorage-27 - Add RsAuthorizationCode: a short-lived (5 min), single-use authorization code stored only as a SHA256 digest - Add RsOauthManager services for issuing and exchanging codes, including S256 verification - Add a cross-origin POST /rs/oauth/token endpoint that exchanges a code (and code_verifier) for an access token, with CORS and no CSRF token - Consent dialog now carries response_type / code_challenge through the form and redirects with the code in the query string for the code flow - Remove the existing-token reuse shortcut so every authorization results in a distinct authorization (and token) Part of #254	2026-11-03 09:17:43 +04:00
raucao	bc37df52a0	Allow remote access to dev services	2026-10-06 19:34:24 +02:00
raucao	8fae099c12	Gate remoteStorage by serviceEnabled instead of Flipper ... The admin "Default services" setting writes the LDAP serviceEnabled attribute, but remoteStorage access was also gated behind an unused per-user Flipper flag that nothing ever enabled, so remoteStorage was inaccessible for everyone. Gate remoteStorage on service_enabled? like the other services, and make the admin toggle reflect the LDAP attribute (this also fixes it reading current_user instead of the user being viewed). E-Mail keeps its Flipper gate for now.	2026-10-06 15:10:00 +02:00
raucao	c79c421b89	Fix Devise Turbo Stream responses for flash messages ... Wire Users::DeviseController as Devise parent controller with the Turbo-aware responder, so failed form submissions (login, password reset) render correctly as HTML with 422 status instead of unprocessable turbo-stream content that Turbo silently drops. Also fixes a NameError in the responder (rendering_options -> error_rendering_options) and removes the dead TurboController.	2026-08-10 16:37:01 -06:00
raucao	89184cd851	Redirect to root after password reset	2026-08-10 11:22:03 -06:00
raucao	29a9dee1cb	Consume user_return_to on sign-in	2026-08-10 11:21:59 -06:00
raucao	a62d84e20a	Validate rs/oauth redirect_uri before storing return URL	2026-08-10 11:21:33 -06:00
raucao	d58c995230	Admin users page: filter by username ... Allow admins to filter the user list/index by username (partial matches allowed)	2026-08-10 10:36:05 -06:00
raucao	f2e8ca790c	Add Privacy and ToS pages, footer menu	2025-05-30 13:27:15 +04:00
raucao	6014134396	Finish MVP for content editing	2025-05-29 14:18:14 +04:00
raucao	6713665a61	WIP Rename "projects" page, make content editable	2025-05-28 18:42:10 +04:00
raucao	2f86b3c16f	Add admin/editable_contents controller	2025-05-28 18:40:54 +04:00
raucao	c6a187b25a	Limit invitees on admin user page, link to invitations for more	2025-05-28 12:50:10 +04:00
raucao	c99d8545c1	Add username filter to admin invitations index	2025-05-28 12:34:52 +04:00
raucao	e8f912360b	Fix wrong stats number	2025-05-28 12:11:26 +04:00
raucao	c94a0e34d1	Add donations to user details, link to filtered list	2025-05-27 19:04:35 +04:00
raucao	04094efbdb	Add username filter with UI to admin donations page	2025-05-27 18:43:45 +04:00
raucao	71352d13d2	Add pending donations to admin donations index ... And add more info to the details page	2025-05-27 18:08:22 +04:00
raucao	e48132cf5f	Set member status to sustainer upon payment ... Introduces a state machine for the payment status as well. refs #213	2025-05-27 16:39:03 +04:00
raucao	f313686b13	Add settings for member statuses	2025-05-27 14:59:10 +04:00
raucao	393f85e45c	WIP Add member/contributor status to users	2025-05-27 13:32:58 +04:00
greg	308cac5a39	Merge pull request 'Add Mastodon API client, service for syncing avatars and display names' (#225) from feature/mastodon_api into master ... Reviewed-on: #225 Reviewed-by: Greg <greg@noreply.kosmos.org>	2025-05-23 08:48:15 +00:00
raucao	7f766473ab	Fix typo	2025-05-22 13:21:37 +04:00
raucao	71c9bd29ab	Merge branch 'master' into feature/mastodon_api	2025-05-18 14:46:28 +04:00
raucao	e66d134550	Log missing l param for WKD requests, return 400	2025-05-18 14:46:04 +04:00
raucao	11167e3e43	Merge branch 'master' into feature/mastodon_api	2025-05-18 14:37:47 +04:00
raucao	ebbd87368c	Handle l param missing for WKD request	2025-05-18 14:37:22 +04:00
raucao	6730aae2dc	Only update other avatars in one place ... Prevent future mistakes	2025-05-17 18:56:33 +04:00
raucao	a71aa3fda2	Don't queue job when service isn't enabled	2025-05-17 18:56:33 +04:00
raucao	37c59b7b0c	Sync Mastodon IDs/profiles to local accounts ... Add a new service to import some data from Mastodon accounts: * Find users by username, store Mastodon account ID in local db when found * Import display name (don't overwrite existing) * Import avatar (don't overwrite existing)	2025-05-17 18:56:30 +04:00
raucao	dbbf116c52	Fix RS storage-first auth work in dev, remove token ... See https://github.com/remotestorage/remotestorage.js/issues/900	2025-05-16 15:59:40 +04:00
raucao	5f276ff349	Queue XmppSetAvatarJob when new avatar is uploaded ... And let job do nothing in development for now	2025-05-15 22:04:25 +04:00
raucao	a098ea43bb	Add avatar URL to Webfinger when available	2025-05-14 15:39:50 +04:00
raucao	417e346074	Do not use ActiveStorage variants, process original avatar ... Variants are currently broken. So we process the original file with the most common avatar dimensions and stripping metadata, then hash and upload only that version.	2025-05-14 14:42:03 +04:00
raucao	1884f082ee	Add note about variants not working when not generated ad-hoc	2025-05-12 18:07:10 +04:00
raucao	51a3652fc8	Fix S3 keys/paths for user avatars ... Also fixes the avatars controller to work with all back-ends	2025-05-12 16:39:53 +04:00
raucao	46b908839d	Add avatar URL to Discourse Connect ... Discourse should download and set the avatar if the user doesn't have one set yet.	2025-05-12 15:04:56 +04:00
raucao	512f0ccca1	Add controller for rendering avatars on simple URL	2025-05-12 15:04:01 +04:00
raucao	17ffbde03a	WIP Store avatars as ActiveStorage attachments ... Also push to LDAP as jpegPhoto	2025-05-11 18:43:21 +04:00
raucao	eae370b737	Migrate from lockbox to ActiveRecord encryption (1/2)	2025-05-06 18:09:27 +04:00
raucao	646c95ecc2	Fix local/development RS auth URL	2025-04-27 16:09:32 +04:00
raucao	7df56479a4	Fix 500 when pubkey is nil	2025-01-02 08:30:58 -05:00
raucao	729e4fd566	Add WKD policy endpoint	2024-09-26 23:11:21 +02:00
raucao	534e5a9d3c	Gracefully handle wrong capitalization of username	2024-09-25 00:20:30 +02:00
raucao	1b72c97f42	Remove obsolete code	2024-09-25 00:17:30 +02:00
raucao	4a677178e8	Add Web Key Directory endpoint ... Serve public keys in binary and armored text, if they contain a user's account address.	2024-09-23 19:20:10 +02:00
raucao	3042a02a17	Allow users to update their OpenPGP pubkey	2024-09-23 18:13:39 +02:00
raucao	118fddb497	Document URLs for settings controller actions ... No need to read the route sources all the time	2024-09-23 16:07:02 +02:00
raucao	ba683a7b95	Move some Rails app services to UserManager namespace	2024-09-23 16:03:02 +02:00
raucao	27d9f73c61	Set host for RS auth url ... With X-Forwarded-Host set on the proxied request, Rails uses that host for URLs. But we need it to be the accounts domain.	2024-09-14 17:17:09 +02:00