Andrew Ferrazzutti
d807975137
Decouple (un)locking from (re/de)activation
...
Unify the admin API, CLI, and GraphQL API in not having the unlock
command also reactivate, or the deactivate command also lock.
Still let the unlock command of the CLI and GraphQL API to also
reactivate the target user, albeit as a non-default option.
2025-07-16 14:17:01 -04:00
Andrew Ferrazzutti
6c1afee13d
Separate active state from lock state in admin API
...
- Allow the admin API to deactivate a user without locking it, and to
unlock a user without reactivating it.
- Make unlock-and-reactivate flows unset the "deactivated_at" timestamp.
- Revert adding an "unlock" parameter on `ReactivateUserJob`, as the
option is used only by the admin API which doesn't use a job.
2025-07-16 14:17:01 -04:00
Andrew Ferrazzutti
a8b8c8e31c
Add admin API endpoint to reactivate user
2025-07-16 14:17:01 -04:00
Quentin Gliech
e2aad08006
Miscellaneous housekeeping ( #4735 )
2025-07-16 18:53:59 +02:00
Quentin Gliech
57af270ffa
Allow running jobs from the job queue in tests ( #4775 )
2025-07-11 14:47:23 +02:00
Quentin Gliech
4227341857
Make the task State::clock() return a &dyn Clock instead of a BoxClock
2025-07-09 17:20:03 +02:00
Quentin Gliech
0405e952af
Make email address lookups case-insensitive
2025-07-08 18:01:20 +02:00
Quentin Gliech
8d6621f00e
Log out oauth & compat sessions when receiving a backchannel logout request
2025-07-04 16:27:10 +02:00
Quentin Gliech
e245cd831f
Compose filters for batch logging out of browser sessions
...
Instead of having to load all authentication sessions in memory, we
allow composing browser session filters with a upstream auth sessions
filter
2025-07-04 16:27:10 +02:00
Quentin Gliech
ae06e4b512
storage: allow filtering browser sessions by which upstream session
...
authd them
2025-07-04 16:27:10 +02:00
Quentin Gliech
e28ffccc3a
Backchannel logout behavior settings on upstream providers
2025-07-04 16:27:10 +02:00
Quentin Gliech
835b1b5f58
Allow filtering upstream sessions by sub and sid claims
2025-07-04 16:27:09 +02:00
Quentin Gliech
db65a702a7
storage: list and count methods for upstream oauth sessions
2025-07-04 16:27:09 +02:00
Quentin Gliech
1c6c6ff8fa
Record the decoded ID token claims on upstream auth sessions
2025-07-04 16:27:09 +02:00
Jason Volk
925a41e6a1
Fix rogue invalid characters inside doc comments.
...
Signed-off-by: Jason Volk <jason@zemos.net >
2025-06-30 17:06:58 +00:00
Quentin Gliech
c3707c13ae
Add license headers in most files that missed them
2025-06-12 11:01:07 +02:00
Quentin Gliech
3d96dc9d47
Update license headers to match the actual license
2025-06-12 10:32:16 +02:00
Quentin Gliech
97e83e1467
Define all the dependencies at the workspace level
2025-06-10 14:25:38 +02:00
Quentin Gliech
52942ee94e
Admin API to edit registration tokens
2025-06-05 18:22:16 +02:00
Quentin Gliech
c8f2a2146c
Admin API to un-revoke a user registration token.
2025-06-05 16:56:42 +02:00
Quentin Gliech
62cad6a210
List and count methods on the UserRegistrationTokenRepository
2025-06-03 17:42:53 +02:00
Quentin Gliech
ccb971d3d3
Data model and repository for user registration tokens
2025-06-03 17:42:52 +02:00
Quentin Gliech
e9589ae17e
Don't hold database connections open when talking to the homeserver ( #4527 )
2025-05-09 09:13:42 +02:00
Quentin Gliech
626c9be760
Move the pool acquisition metric logic to the PgRepositoryFactory
2025-05-07 17:09:20 +02:00
Quentin Gliech
03bad37070
Introduce a RepositoryFactory
2025-05-07 17:00:49 +02:00
Quentin Gliech
5d58d9df7c
Don't generate and send a nonce for non-OIDC-compliant auth requests
2025-05-07 15:34:27 +02:00
Doug
096ce6037d
Add a configuration for forwarding the login hint to the upstream provider.
2025-05-06 17:50:33 +01:00
Quentin Gliech
8bfe2d2092
Allow setting custom names on sessions ( #4459 )
2025-04-30 15:32:25 +02:00
Quentin Gliech
9cfecaf5db
Insert client_name when upserting statically registered clients ( #4417 )
2025-04-30 11:50:49 +02:00
Quentin Gliech
9a660b211a
storage: methods to set the sessions human name
2025-04-25 16:55:30 +02:00
Quentin Gliech
b708c403e3
Save the locale detected when starting an authorization grant
2025-04-25 12:55:22 +02:00
Quentin Gliech
60a0285d36
storage: allow setting the human_name when creating compat sessions
2025-04-25 12:55:10 +02:00
Quentin Gliech
0cfea60fa0
Don't parse the user agent unless we need to
2025-04-24 13:13:26 +02:00
Adis Veletanlic
8bf25b9d20
Add client_name to static registrations function and generate new query data
2025-04-16 11:44:58 +02:00
Quentin Gliech
744bb2c372
Lookup usernames case insensitively ( #4378 )
2025-04-14 15:51:59 +02:00
Quentin Gliech
bd737342b9
Always ask for consent, never for reauth ( #4386 )
2025-04-14 15:51:48 +02:00
Quentin Gliech
cf732ac8f0
Always ask for consent, never for reauth
...
Now that we have deduplicated clients, we're in this weird situation
where authorization grants just… go through.
This is because 4 years ago, I designed it to support prompt=consent and
prompt=none, but that never ended up being used/mentioned in the MSCs.
We also had support for max_age, but that required reauthing, which
doesn't work well with upstream providers.
So this removes support for prompt=consent|none and max_age, and makes
sure we always go through the consent page.
Lots of code deleted, yay!
2025-04-10 19:57:45 +02:00
Quentin Gliech
b5ed17dbff
Lookup usernames case insensitively
2025-04-10 18:36:43 +02:00
mcalinghee
77e954e475
correct format and translation
2025-04-10 17:57:58 +02:00
mcalinghee
f2a47f9a88
add login by email + feature flag
2025-04-10 17:57:58 +02:00
Quentin Gliech
2b81c8a42e
Admin API for adding and removing upstream oauth links ( #4255 )
2025-04-09 13:33:16 +02:00
Quentin Gliech
d310f48a7e
compat login: support using client-provided device ID ( #4342 )
2025-04-07 08:52:29 +02:00
Olivier 'reivilibre
a73cb1c2fb
UNFINISHED: finish active sessions when replacing a device
2025-04-04 17:52:08 +01:00
Olivier 'reivilibre
1f2eccc645
compat login (sso): support using client-provided device_id
2025-04-04 16:25:01 +01:00
Quentin Gliech
5c13757e1d
Deduplicate client registrations by hashing the metadata
2025-03-25 15:00:23 +01:00
MTRNord
850a9ed81b
Link removal storage API
...
From #3245 with changes from review
2025-03-17 18:31:11 +02:00
Quentin Gliech
6a37fdfe30
Merge branch 'main' into quenting/dynamic-policy-data
2025-03-14 10:16:16 +01:00
Quentin Gliech
8581ca19ef
Prune stale policy data once a day
2025-03-13 13:40:59 +01:00
Quentin Gliech
69bfdb2d5d
Order the OAuth providers in the UI by their order in the config file
2025-03-12 11:12:55 +01:00
Quentin Gliech
b72b83665e
Repository method to deactivate a user.
2025-03-11 17:35:13 +01:00
Andrew Ferrazzutti