LeoVasanko
68dccc1378
OAuth2 OpenID Connect provider support, API and DB refactoring ( #3 )
...
Allows Paskia to authenticate the user to a client site.
- User friendly client registration flow on the admin app
- Redirect-based authentication flow (per spec)
- Backchannel logout both ways to keep sessions synchronized
- Groups integrated with Paskia's permission system
- Adds email, preferred username and telephone fields on user profile
- All new user basic info layout to show the new information, better looks
- API and DB structures redesigned
- Various unrelated fixes to theming and layout
2026-02-18 02:40:27 +00:00
LeoVasanko
f830d7d0ec
More minimalistic light theme. UI hint for org admin user/role management.
2026-02-14 18:36:20 +00:00
LeoVasanko
c1f8020f6b
API cleanup, using msgspec structs rather than raw responses. Admin app cleanup, better breadcrumbs.
2026-02-13 20:09:41 +00:00
LeoVasanko
4ebe5ae968
Style overhaul.
2026-02-11 01:18:19 +00:00
LeoVasanko
291a665e21
Improved UI feedback on registration link creation.
2026-02-05 14:26:11 +00:00
LeoVasanko
0537b85085
Better UI for role deletions.
2026-02-05 14:05:36 +00:00
LeoVasanko
af5a48f565
API/DB cleanup for flat URLs that don't include org where users etc. are referred to. Implement user deletion in admin app and API, UI improvement. Reset token DB factory function revised to create passphrase and key internally. Removed unneeded functions and args, using update_user_role instead of a separate deleted _in_organization function.
2026-02-05 13:57:07 +00:00
LeoVasanko
7e49ef296a
Create a stand-alone paskia npm package (paskia-js). Make the frontend use it (but from source tree to keep synced).
2026-01-29 19:46:26 +00:00
LeoVasanko
433844cf08
Refactor to separate paskia lib functionality generally useful for various apps.
2026-01-29 16:55:46 +00:00
LeoVasanko
1062b5d6c8
Fix background task still running twice, and add a check to prevent that happening again (double expiry).
2026-01-27 23:51:13 +00:00
LeoVasanko
cb84a81a06
Update the API to use new naming matching database.
2026-01-27 02:22:29 +00:00
LeoVasanko
7e568dbd10
Refactor validate endpoint to return session context, leaving user-info only for extra profile data. Completely separate token-info for reset tokens. Simplified by reusing same data structures in various places and mandating fields to have values not needing fallbacks. Implemented consistent AccessDenied view in profile and admin apps.
2026-01-26 19:40:48 +00:00
LeoVasanko
a9ef20969e
Refer permissions by UUID rather than scope.
2026-01-24 00:06:08 +00:00
LeoVasanko
2c783498a4
Better handling of Org Admin permission. More guardrails for Master Admin not locking himself out by changes. Admin app UI improvements.
2026-01-23 15:11:01 +00:00
LeoVasanko
3430c7f0cf
Permissions refactor. Permissions have UUID and scope (previously id) and the latter no longer needs to be unique. Org admin uses a single global permission now. Domain scoped permissions. Removed from user info the admin fields, use effective_permission checks instead.
2026-01-23 13:54:31 +00:00
LeoVasanko
720d875eb5
UX: Close the QR code/link dialog automatically when the code is click-to-copied.
2025-12-10 19:07:56 +00:00
LeoVasanko
3f0de04a49
Fix link copy toast messages, remove custom toast in favor of authStore, remove a component that was no longer used.
2025-12-10 17:18:48 +00:00
LeoVasanko
460094e4dd
Change input placeholder that was improperly triggering Bitwarden to complete username in it. BW does not respect autocomplete at all.
2025-12-10 16:56:19 +00:00
LeoVasanko
ca73febe2f
Implement keyboard navigation using arrow keys in the whole application. ( #2 )
2025-12-10 15:43:40 +00:00
LeoVasanko
1bed2c39d8
Implement code word based remote authentication ( #1 )
...
Add comprehensive remote authentication system allowing users to log in from one device by authenticating from another trusted device. Features include:
- Proof of Work (PoW) protection using PBKDF2-SHA512 to prevent abuse
- Simple pairing codes (3 words) protected by dynamic PoW difficulty
- Autocomplete pairing code input with error checking
- Real-time WebSocket communication between devices
Unlike device addition links and reset links with QR codes that only allow adding an authentication method, and that work offline over the duration of several days, this mechanism is strictly online, with 5 minute time limit.
2025-12-08 23:56:48 +00:00
LeoVasanko
aa4b1bfd42
Viewing linked passkeys/sessions (by clicking either one of them).
2025-12-04 01:21:52 +00:00
LeoVasanko
2ecf8433a1
Consistently use apiJson for fetches, with timeout and proper error handling (less code duplication).
2025-12-04 01:00:24 +00:00
LeoVasanko
547a6cd923
Make auth/admin apps API calls use apiFetch, a new function that asks for permission by iframe if needed. Implement max-age checks for API authz.verify as well along with a custom exception type that carries metadata.
2025-12-03 23:17:02 +00:00
LeoVasanko
f63c62d9ff
Implement session termination in admin API, for completeness.
2025-12-03 01:20:52 +00:00
LeoVasanko
768a4391cf
Improved profile view layout.
2025-12-03 01:03:25 +00:00
LeoVasanko
adbab88c86
Major refactor of frontend source tree such that paths better match where they are served.
2025-12-02 22:09:07 +00:00
LeoVasanko
eedbd4aaa4
Moved the restricted-api iframe src to /auth/api/restricted and removed the endpoint of the other restricted app.
2025-12-02 18:34:59 +00:00
LeoVasanko
2699aaa472
Implement Forbidden view for API calls, cleanup and better UX.
2025-12-02 17:36:37 +00:00
LeoVasanko
5422845192
Better error messages from backend, avoid bad toasts, cleanup of session validation.
2025-12-02 16:37:27 +00:00
LeoVasanko
c1ccb048f0
Update admin app authentication in API mode too, reusing components between it and the main app.
2025-12-02 15:42:55 +00:00
LeoVasanko
a62e8ddf1e
Implement restricted-api for JS-driven auth calls, examples added (WIP!). Layout and styling simplified.
2025-12-02 03:10:16 +00:00
LeoVasanko
01bc39a0e8
A major refactoring for more consistent and stricter flows.
...
- Force using the dedicated authentication site configured via auth-host
- Stricter host validation
- Using the restricted app consistently for all access control (instead of the old loginview).
2025-10-05 03:55:11 +00:00
LeoVasanko
0af7aad28c
Add host-based authentication, UTC timestamps, session management, and secure cookies; fix styling issues; refactor to remove module; update database schema for sessions and reset tokens.
2025-10-04 06:31:54 +00:00
LeoVasanko
2f1578c4bc
Refactor user-profile, restricted access and reset token registration as separate apps so the frontend does not need to guess which context it is running in.
...
Support user-navigable URLs at / as well as /auth/, allowing for a dedicated authentication site with pretty URLs.
2025-10-03 03:42:01 +00:00
LeoVasanko
ea871635e0
Admin app: guard rails extended, consistent styling, also share styling with main app.
2025-10-01 04:38:14 +00:00
LeoVasanko
a7c23b31e7
Admin app divided to separate components.
2025-10-01 00:54:18 +00:00
LeoVasanko
3f45024396
Massive style redesign, WIP.
2025-09-30 09:02:49 +00:00
LeoVasanko
5ad3ccb5ae
Implement breadcrumb navigation.
2025-09-28 08:47:45 +00:00
LeoVasanko
07212ee1de
Major refactoring of admin API (permissions, paths)
2025-09-03 06:08:06 +00:00
LeoVasanko
6e5ea9eac0
Refactor API under /auth/api
2025-09-03 02:32:19 +00:00
LeoVasanko
aed9835098
Better navigation on admin app.
2025-09-02 08:04:56 +00:00
LeoVasanko
54a0d84cb5
Smarter user info
2025-09-02 08:02:52 +00:00
LeoVasanko
a84556509a
Unify user info across admin app and profile view.
2025-09-02 07:56:18 +00:00
LeoVasanko
a526344842
Use rp-name for frontend branding
2025-09-02 06:48:59 +00:00
LeoVasanko
a1d5270dd7
User rename fixes.
2025-09-02 06:20:32 +00:00
LeoVasanko
e1e933c756
Renaming of users in registration, profile and admin app.
2025-09-02 06:13:01 +00:00
LeoVasanko
b9c1fe059c
Crude dialog rather than prompt() for input fields. (needs cleanup)
2025-09-02 05:34:45 +00:00
LeoVasanko
db19ff61f6
Only allow safe characters in permission IDs
2025-08-31 07:10:00 +00:00
LeoVasanko
54cef0f9d6
Fixing cascade.
2025-08-31 02:07:32 +00:00
LeoVasanko
d229ed267c
Actually usable admin panel
2025-08-30 10:38:22 +00:00
LeoVasanko