4 Commits

Include renames

Author	SHA1	Message	Date
iamdoubz	1db5aa22dc	security: sign-in by email and connecting accounts (08 §7 #1 #2 #5 #8) ... Matching by email skips admins and anyone with a connected account, in both directions. A connected directory account is only swapped by an admin, and an OpenID connect finishes only in the browser whose session asked.	2026-10-28 16:01:56 -05:00
iamdoubz	97e67e347d	auth: security audit fixes, rate limits on every route ... Two separate reviews of the SSO branch and all 207 API routes (spec 12 §8.6). Every route was guarded as meant. Fixed, each with a test: - login: a directory 503 counts as a failed sign-in; a locked directory account is a refused password, not "unavailable" - open redirect after OpenID sign-in (a tab in next) - directory email matching only for non-admins without their own password; others connect on My settings (POST /api/me/identities/ldap); only admins disconnect a directory account - OpenID session check reads the refreshed ID token's claims too - connect is POST /api/auth/oidc/connect (CSRF header) - stored bind password, client secret and SMTP password tied to their server - 409 role_managed when a provider sets the role; empty Contrack PATCH is a 400 - @fastify/rate-limit on every route (RATE_LIMIT_PER_MINUTE), 10/min on Test buttons; a password asked again shares the login limiter Live tests pass against lldap 0.6.3, Samba 4 AD and Keycloak 26.8.1.	2026-10-26 09:46:23 -05:00
iamdoubz	73963ee3a3	auth: OpenID session check, live Keycloak test, sign-in guide (S3) ... Spec 12 S3: job oidcCheck refreshes every OpenID session at the provider every 15 minutes and applies groups and role again; invalid_grant ends the session, an outage doesn't. A live test makes a throwaway Keycloak realm and signs in through its login form (passed against 26.8.1). NODE_EXTRA_CA_CERTS for a private CA. Admin guide: docs/admin-guide/sign-in.md.	2026-10-25 15:14:59 -05:00
iamdoubz	06b3a73edc	auth: sign in with OpenID Connect, connect and disconnect, sign-in modes (S2) ... Spec 12 S2: openid-client 6.8 (decision 0004). Discovery, PKCE + state + nonce, ID token signatures checked, userinfo always read. Users connect their OpenID account from My account and sign in either way; no accounts are made; a user without a password is matched once by verified email. auth.mode mixed and oidc (admins keep a password way in), role from adminGroups, allowedGroups, signing out at the provider. Settings -> Sign-in with Test. Tested against a fake provider with RS256 and ES256 keys.	2026-10-25 14:13:27 -05:00