Quentin Gliech
ea873577aa
Fix many clippy warnings
...
This is because the tracing-attributes update made clippy look at those
again. I've removed the `too_many_lines` lint, as it's not really useful
and we ignore it most of the time anyway.
2025-07-30 14:49:38 +02:00
Andrew Ferrazzutti
d807975137
Decouple (un)locking from (re/de)activation
...
Unify the admin API, CLI, and GraphQL API in not having the unlock
command also reactivate, or the deactivate command also lock.
Still let the unlock command of the CLI and GraphQL API to also
reactivate the target user, albeit as a non-default option.
2025-07-16 14:17:01 -04:00
Andrew Ferrazzutti
6c1afee13d
Separate active state from lock state in admin API
...
- Allow the admin API to deactivate a user without locking it, and to
unlock a user without reactivating it.
- Make unlock-and-reactivate flows unset the "deactivated_at" timestamp.
- Revert adding an "unlock" parameter on `ReactivateUserJob`, as the
option is used only by the admin API which doesn't use a job.
2025-07-16 14:17:01 -04:00
Andrew Ferrazzutti
a8b8c8e31c
Add admin API endpoint to reactivate user
2025-07-16 14:17:01 -04:00
matrixbot
1c36430035
Automatic merge back to main ( #4781 )
2025-07-10 17:28:11 +02:00
Quentin Gliech
620f214cb0
Split the migration in two parts, two transactions.
2025-07-09 15:10:53 +02:00
Quentin Gliech and Copilot
81efccffa9
Only apply the trigger on rows without the id_token_claims set
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2025-07-09 14:55:02 +02:00
Quentin Gliech
9644a2b2f2
Backfill the id_token_claims column in the upstream_oauth_authorization_sessions table
2025-07-09 14:43:47 +02:00
Quentin Gliech
0405e952af
Make email address lookups case-insensitive
2025-07-08 18:01:20 +02:00
Quentin Gliech
8d6621f00e
Log out oauth & compat sessions when receiving a backchannel logout request
2025-07-04 16:27:10 +02:00
Quentin Gliech
e245cd831f
Compose filters for batch logging out of browser sessions
...
Instead of having to load all authentication sessions in memory, we
allow composing browser session filters with a upstream auth sessions
filter
2025-07-04 16:27:10 +02:00
Quentin Gliech
ae06e4b512
storage: allow filtering browser sessions by which upstream session
...
authd them
2025-07-04 16:27:10 +02:00
Quentin Gliech
e28ffccc3a
Backchannel logout behavior settings on upstream providers
2025-07-04 16:27:10 +02:00
Quentin Gliech
835b1b5f58
Allow filtering upstream sessions by sub and sid claims
2025-07-04 16:27:09 +02:00
Quentin Gliech
db65a702a7
storage: list and count methods for upstream oauth sessions
2025-07-04 16:27:09 +02:00
Quentin Gliech
1c6c6ff8fa
Record the decoded ID token claims on upstream auth sessions
2025-07-04 16:27:09 +02:00
Quentin Gliech
c3707c13ae
Add license headers in most files that missed them
2025-06-12 11:01:07 +02:00
Quentin Gliech
3d96dc9d47
Update license headers to match the actual license
2025-06-12 10:32:16 +02:00
Quentin Gliech
97e83e1467
Define all the dependencies at the workspace level
2025-06-10 14:25:38 +02:00
Quentin Gliech
52942ee94e
Admin API to edit registration tokens
2025-06-05 18:22:16 +02:00
Quentin Gliech
c8f2a2146c
Admin API to un-revoke a user registration token.
2025-06-05 16:56:42 +02:00
Quentin Gliech
62cad6a210
List and count methods on the UserRegistrationTokenRepository
2025-06-03 17:42:53 +02:00
Quentin Gliech
ccb971d3d3
Data model and repository for user registration tokens
2025-06-03 17:42:52 +02:00
dependabot[bot]
9aa792a17e
build(deps): bump uuid from 1.16.0 to 1.17.0
...
Bumps [uuid](https://github.com/uuid-rs/uuid ) from 1.16.0 to 1.17.0.
- [Release notes](https://github.com/uuid-rs/uuid/releases )
- [Commits](https://github.com/uuid-rs/uuid/compare/v1.16.0...v1.17.0 )
---
updated-dependencies:
- dependency-name: uuid
dependency-version: 1.17.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2025-05-27 13:27:19 +00:00
Quentin Gliech
e9589ae17e
Don't hold database connections open when talking to the homeserver ( #4527 )
2025-05-09 09:13:42 +02:00
Quentin Gliech
626c9be760
Move the pool acquisition metric logic to the PgRepositoryFactory
2025-05-07 17:09:20 +02:00
Quentin Gliech
03bad37070
Introduce a RepositoryFactory
2025-05-07 17:00:49 +02:00
Quentin Gliech
5d58d9df7c
Don't generate and send a nonce for non-OIDC-compliant auth requests
2025-05-07 15:34:27 +02:00
Doug
2d4f24eed4
Update copyright header
...
sqlx migrate/prepare are both still happy.
2025-05-07 10:26:30 +01:00
Doug
096ce6037d
Add a configuration for forwarding the login hint to the upstream provider.
2025-05-06 17:50:33 +01:00
Quentin Gliech
8bfe2d2092
Allow setting custom names on sessions ( #4459 )
2025-04-30 15:32:25 +02:00
Quentin Gliech
9cfecaf5db
Insert client_name when upserting statically registered clients ( #4417 )
2025-04-30 11:50:49 +02:00
Quentin Gliech
062d554a6f
Avoid deadlocks when updating the last activity of sessions
2025-04-28 09:56:30 +02:00
Quentin Gliech
9a660b211a
storage: methods to set the sessions human name
2025-04-25 16:55:30 +02:00
Quentin Gliech
3b6581ab3d
storage: add a user-provided human name to OAuth 2.0 sessions
2025-04-25 16:55:29 +02:00
Quentin Gliech
b708c403e3
Save the locale detected when starting an authorization grant
2025-04-25 12:55:22 +02:00
Quentin Gliech
60a0285d36
storage: allow setting the human_name when creating compat sessions
2025-04-25 12:55:10 +02:00
Quentin Gliech
0cfea60fa0
Don't parse the user agent unless we need to
2025-04-24 13:13:26 +02:00
Adis Veletanlic
8bf25b9d20
Add client_name to static registrations function and generate new query data
2025-04-16 11:44:58 +02:00
Quentin Gliech
150be9b36a
Create missing indexes for all the foreign keys in the database. ( #4385 )
2025-04-14 16:03:28 +02:00
Quentin Gliech
744bb2c372
Lookup usernames case insensitively ( #4378 )
2025-04-14 15:51:59 +02:00
Quentin Gliech
bd737342b9
Always ask for consent, never for reauth ( #4386 )
2025-04-14 15:51:48 +02:00
Quentin Gliech
58551c9a62
Handle the case where there are multiple users with the same username, but with a different casing.
2025-04-11 15:38:28 +02:00
Quentin Gliech
cf732ac8f0
Always ask for consent, never for reauth
...
Now that we have deduplicated clients, we're in this weird situation
where authorization grants just… go through.
This is because 4 years ago, I designed it to support prompt=consent and
prompt=none, but that never ended up being used/mentioned in the MSCs.
We also had support for max_age, but that required reauthing, which
doesn't work well with upstream providers.
So this removes support for prompt=consent|none and max_age, and makes
sure we always go through the consent page.
Lots of code deleted, yay!
2025-04-10 19:57:45 +02:00
Quentin Gliech
7012fd3855
Also lowercase the username when checking if it exists.
2025-04-10 18:45:13 +02:00
Quentin Gliech
b5ed17dbff
Lookup usernames case insensitively
2025-04-10 18:36:43 +02:00
Quentin Gliech
c861856dff
Create missing indexes for all the foreign keys in the database.
2025-04-10 18:32:40 +02:00
mcalinghee
f2a47f9a88
add login by email + feature flag
2025-04-10 17:57:58 +02:00
Quentin Gliech
2b81c8a42e
Admin API for adding and removing upstream oauth links ( #4255 )
2025-04-09 13:33:16 +02:00
Tonkku
ae2fe1cb3f
Separate spans
2025-04-08 16:54:35 +00:00
Quentin Gliech