4 Commits

Include renames

Author	SHA1	Message	Date
iamdoubz	97e67e347d	auth: security audit fixes, rate limits on every route ... Two separate reviews of the SSO branch and all 207 API routes (spec 12 §8.6). Every route was guarded as meant. Fixed, each with a test: - login: a directory 503 counts as a failed sign-in; a locked directory account is a refused password, not "unavailable" - open redirect after OpenID sign-in (a tab in next) - directory email matching only for non-admins without their own password; others connect on My settings (POST /api/me/identities/ldap); only admins disconnect a directory account - OpenID session check reads the refreshed ID token's claims too - connect is POST /api/auth/oidc/connect (CSRF header) - stored bind password, client secret and SMTP password tied to their server - 409 role_managed when a provider sets the role; empty Contrack PATCH is a 400 - @fastify/rate-limit on every route (RATE_LIMIT_PER_MINUTE), 10/min on Test buttons; a password asked again shares the login limiter Live tests pass against lldap 0.6.3, Samba 4 AD and Keycloak 26.8.1.	2026-10-26 09:46:23 -05:00
iamdoubz	19610777a4	auth: directory leavers check, dashboard warning, Samba AD check (S5) ... Spec 12 S5: job directoryCheck (hourly) looks up every active user with a directory account; one deleted, disabled there or no longer matched by the user filter is disabled here, sessions ended. Nothing changes when the directory is unreachable or a run would disable most people; the last admin with a password is kept; nobody is re-enabled. Dashboard warning directory_check (system.directoryWarning). The by-id search is a filter object: ldapts string filters send bytes >= 0x80 as UTF-8, so AD's objectGUID never matched. Live test against a Samba 4 AD DC: nested-group admin, the disabled bit, objectGUID, a deleted user disabled.	2026-10-26 07:47:12 -05:00
iamdoubz	b06335586b	auth: sign in with LDAP/LDAPS, directory settings and Test (S4) ... Spec 12 S4: the login form checks the SelfPhoneNG password first, then the directory (ldapts, service-account search, the user's own bind on a second connection). Presets for lldap, AD, FreeIPA and OpenLDAP; Test with an optional test login. A directory account connects by email, never makes a user; adminFilter sets the role (applyRole shared with OpenID). One Disconnect route per kind (oidc, ldap). Live test against lldap 0.6.3 over LDAPS.	2026-10-25 18:39:52 -05:00
iamdoubz	73963ee3a3	auth: OpenID session check, live Keycloak test, sign-in guide (S3) ... Spec 12 S3: job oidcCheck refreshes every OpenID session at the provider every 15 minutes and applies groups and role again; invalid_grant ends the session, an outage doesn't. A live test makes a throwaway Keycloak realm and signs in through its login form (passed against 26.8.1). NODE_EXTRA_CA_CERTS for a private CA. Admin guide: docs/admin-guide/sign-in.md.	2026-10-25 15:14:59 -05:00