MythEclipse/9router
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,130 Commits 1 Branch 0 Tags
dff648496c6b8ec2f334e90dd3f3ec5060ec3db8
Commit Graph
13 Commits
Author SHA1 Message Date
Duc Nguyen 65197ad11c feat(auth): add native SAML 2.0 SSO integration 
Add SAML 2.0 as a second SSO protocol alongside OIDC under a unified
authMode/ssoType model. SP flows via @node-saml/node-saml: AuthnRequest
generation, ACS POST assertion handling, SP metadata export, and admin
config test endpoint. Replay-protected via saml_state cookie (httpOnly,
SameSite=Lax) matched against InResponseTo; wantAssertionsSigned enforced.

- src/lib/auth/saml.js: SAML instance builder, X.509 cert formatter, claim pickers
- 4 routes under src/app/api/auth/saml/: start, acs, metadata, test
- settingsRepo: ssoType + saml* defaults; login/status routes dispatch by type
- profile page: SSO protocol switcher, IdP metadata XML + cert uploaders
- login page: dynamic SAML sign-in button; Header: SAML user badge
 2026-08-13 17:56:34 +07:00
zmf 8a527fec91 fix(security): SSRF guard on search baseUrl, default-password remote login, and request-details redaction 
- resolveBaseUrl() rejects client-supplied non-public baseUrls via assertPublicUrl (SSRF guard on /v1/search)
- fresh-install remote login with default password returns 403 without issuing a JWT
- /api/usage/request-details redacts request/providerRequest/providerResponse/response payloads
- declare chalk and prop-types in package.json (used but previously undeclared)
 2026-08-13 11:50:25 +07:00
DaDecky ae4f76c433 fix(auth): redirect active sessions from /login 
/api/auth/status did not expose whether the auth cookie corresponds to a
valid dashboard session, so /login could only detect "auth disabled"
(requireLogin === false) and not "already logged in". Add authenticated
to the status response and redirect from /login when it's true.
 2026-08-05 10:27:27 +07:00
EmirhanandCursor 6e9c7bf448 fix(auth): avoid stale redirects after auth changes 
Use full-page navigation after login/logout so the dashboard reloads
with the fresh auth cookie, and mark login/logout responses no-store.

Fixes #2100

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-26 11:39:49 +07:00
decoluaandCursor 7648c3412b fix(auth): real client IP rate-limiting + remote default-password guard 
- Add custom-server.js: inject unspoofable socket IP, strip client XFF
  (wired into Docker CMD + CLI spawn + build-cli copy)
- loginLimiter: key on trusted x-9r-real-ip, TRUST_PROXY opt-in, global fallback
- Force password change on first remote login while default is in use
- Add /api/auth/reset-password (local-only) so CLI reset writes live SQLite
- CLI settings: reset via API instead of stale db.json
- Fix OAuth modals opening duplicate browser tabs on add-connection
- Add cli:pack / cli:publish scripts

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-08 12:10:02 +07:00
decolua 026a7c9b85 Enhance security 2026-05-21 11:33:18 +07:00
Walter Cheng c3d91b019b Add OIDC dashboard auth (#1020) 2026-05-12 09:43:42 +07:00
decolua 41c079baba - Improved dashboard access control by blocking tunnel/Tailscale access when disabled. 2026-04-13 17:38:09 +07:00
Diego SouzaandCursor 3d439839d9 feat(cloud): harden sync/auth flow, SSE fallback, and update changelog 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-02-08 16:45:31 +07:00
decolua 0a394d0d9a fix(auth): allow HTTP for local network 2026-02-04 12:39:26 +07:00
apeltekciandClaude Opus 4.5 7058b062e7 fix: resolve SonarQube findings and Next.js Image warnings 
SonarQube/SonarLint fixes:
- Remove unused imports (useMemo, PROVIDER_ENDPOINTS, updateSettings, APP_CONFIG)
- Add PropTypes validation to all components receiving props
- Fix accessibility issues (semantic buttons, ARIA attributes, form labels)
- Replace array index keys with stable identifiers
- Extract duplicate getStatusDisplay function in providers page
- Fix negated conditions for better readability
- Add node: prefix to Node.js imports in localDb.js
- Fix optional chaining in pricing lookup
- Add explanatory comments to empty catch blocks
- Consolidate duplicate OAuth flow branches
- Change parseInt to Number.parseInt
- Disable false positive rules in VS Code settings

Next.js Image fixes:
- Add style={{ width: "auto", height: "auto" }} to all Image components
- Resolves aspect ratio warnings without triggering lint issues

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-20 13:31:36 +07:00
apeltekci 0848dd5d13 chore: fix build warnings, add deployment config, and cleanup lint errors 
- Fix React Hook dependencies and Image optimization warnings
- Add DATA_DIR and INITIAL_PASSWORD env var support
- Fix Tailwind v4 legacy syntax and suppress CSS directives warnings
- Add PropTypes and remove unused variables
 2026-01-20 12:58:51 +07:00
decolua 23cfb19459 feat: add password change functionality and dependencies 2026-01-09 17:29:11 +07:00