dandri/matrix-authentication-service
1
0
Fork 0
mirror of https://github.com/element-hq/matrix-authentication-service.git synced 2026-08-14 11:19:57 +00:00
Code Issues Packages Projects Releases Wiki Activity
7,735 Commits 75 Branches 100 Tags
ec014867e718f0ca1fb87cd2dcaaab14d33101cd
Commit Graph
7735 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Quentin Gliech ec014867e7 Send a Content-Security-Policy header on every response 
Each router gets the policy for the kind of route it serves, applied with
`SetResponseHeaderLayer::if_not_present` so that a more specific inner
router or handler wins: the SPA shell routes live inside the
server-rendered `human_router` and set their own, the password
registration page is the only one which trusts the captcha provider's
origins, and the two Swagger UI pages are quarantined behind theirs
inside the admin API router.

The catch-all sits at the top level, next to `X-Content-Type-Options:
nosniff` and the existing `X-Frame-Options: DENY`, so nothing can ship
headerless by accident. That also gives the compat SSO redirect pages
security headers, which they had none of. The 404 page is the one
handler which sets its own: it is registered outside every router, so it
would otherwise inherit a policy which blocks its own stylesheet.

The upstream back-channel logout endpoint moves to `api_router`. It is
called by the upstream provider rather than by a browser, and was only
in the human router by accident, picking up a page policy, the
`X-Frame-Options` header and the HTML error wrapper it has no use for.
The `HttpResource` which mounts it changes from `human` to `oauth`.

The SPA shell carries a temporary `style-src 'unsafe-inline'` concession
for the `<style>` elements vaul and react-remove-scroll inject at
runtime, to be removed with the compound-web migration to base-ui. It is
deliberately scoped there and not on the server-rendered pages, which
are the auth-critical ones.
 2026-08-10 14:39:37 +02:00
Quentin Gliech efc98a48d2 Add a builder for per-route Content-Security-Policy headers 
Rather than one lowest-common-denominator policy, each kind of route gets
the strictest policy it can bear: the server-rendered pages, the account
SPA shell, the Swagger UI, and a locked-down catch-all for everything
else. They are computed once at startup from the site configuration and
the `UrlBuilder` — the captcha provider origins, the plan-management
iframe origin and a possible cross-origin assets host are the only
dynamic inputs — and stored as prebuilt `HeaderValue`s.

The `form_post` authorization response is the one per-response case, as
its `form-action` names the redirect URI of the grant being completed.
 2026-08-10 14:39:36 +02:00
Quentin Gliech c47540c850 Merge all the pending PRs 2026-08-07 19:44:48 +02:00
Quentin Gliech cacc757cef Emit a modulepreload for dynamically imported chunks in include_asset 
Now that the translations are lazily imported JS chunks rather than plain JSON
assets, `include_asset('locales/<lang>.json')` resolves to a manifest entry
flagged `isDynamicEntry`. Those must not be evaluated eagerly with a `<script>`
tag, so emit the same `modulepreload` hint we already use for imported chunks,
integrity included, and drop the now-unreachable top-level JSON preload.
 2026-08-07 17:59:27 +02:00
Quentin Gliech 5d7a66557a Load frontend translations with dynamic imports instead of fetch 
`import.meta.glob` now generates lazy loaders for the locale JSON modules
rather than hashed asset URLs, so `Backend.read` awaits an `import()` instead
of doing a `fetch`. This puts translation loading under the `script-src` CSP
directive instead of `connect-src`, and lets the browser preload them as
modules, which the `<link rel="preload" as="fetch">` hint never really did
because of the credentials-mode mismatch.

Dynamic imports are cached for the lifetime of the page, so locale
hot-reloading now triggers a full page reload in dev instead of asking i18next
to re-read its resources.
 2026-08-07 17:59:26 +02:00
Quentin Gliech c3b5fa3b0c Remove the GraphQL playground 
The interactive playground page and its route/config option are gone; the GraphQL API itself (POST /graphql) is unaffected. External GraphQL usage is deprecated anyway in favour of the REST admin API.
 2026-08-07 12:26:42 +02:00
Quentin Gliech 28ffb064bf Move the Swagger UI OAuth2 redirect script to a frontend entrypoint 2026-08-07 12:24:36 +02:00
Quentin Gliech 62ccbdf6f1 Render the CAPTCHA widgets with React on server-rendered pages 
Instead of provider-specific markup and script tags in the head, the
captcha.form() template macro now emits a placeholder element carrying
the CAPTCHA configuration in data attributes, on which a new entrypoint
mounts the React Captcha component. The widget still injects its hidden
response field inside the form, so the server-side verification flow is
unchanged.

This is the first use of inline React components to progressively
enhance server-rendered pages.
 2026-08-07 10:28:09 +02:00
Quentin Gliech 162e024ca0 Add a React component to render CAPTCHA widgets 
Adds a reusable Captcha React component along with the type
definitions for the supported providers (hCaptcha, Cloudflare
Turnstile, Google reCAPTCHA). The provider SDKs are lazy-loaded by the
component itself, suspending the tree while they load.
 2026-08-07 10:28:09 +02:00
Quentin Gliech 3b6e865e12 Rename the WithCaptcha template context field to captcha_config 
The field name is now more descriptive of what it actually is – the
configuration of the CAPTCHA provider – and aligns with the key used
when passing it to the client-side React form.
 2026-08-07 10:28:09 +02:00
Quentin Gliech ded9de23db Move the form_post auto-submit script to a frontend entrypoint 2026-08-07 10:25:04 +02:00
Quentin GliechandGitHub 28338969e1 build(deps-dev): bump storybook from 10.4.6 to 10.5.3 in the storybook group across 1 directory (#5897) 2026-08-07 10:23:10 +02:00
Quentin GliechandGitHub 2df5d84439 build(deps): bump EmbarkStudios/cargo-deny-action from 2.0.20 to 2.1.1 (#5891) 2026-08-07 10:19:05 +02:00
dependabot[bot]andGitHub e7cb472bc8 build(deps): bump EmbarkStudios/cargo-deny-action from 2.0.20 to 2.1.1 
Bumps [EmbarkStudios/cargo-deny-action](https://github.com/embarkstudios/cargo-deny-action) from 2.0.20 to 2.1.1.
- [Release notes](https://github.com/embarkstudios/cargo-deny-action/releases)
- [Commits](https://github.com/embarkstudios/cargo-deny-action/compare/bb137d7af7e4fb67e5f82a49c4fce4fad40782fe...3c6349835b2b7b196a839186cb8b78e02f7b5f25)

---
updated-dependencies:
- dependency-name: EmbarkStudios/cargo-deny-action
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-07 08:03:01 +00:00
dependabot[bot]andGitHub bc2587bd2e build(deps-dev): bump storybook 
Bumps the storybook group with 1 update in the / directory: [storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core).


Updates `storybook` from 10.4.6 to 10.5.3
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.5.3/code/core)

---
updated-dependencies:
- dependency-name: storybook
  dependency-version: 10.5.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: storybook
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-07 07:59:31 +00:00
Quentin GliechandGitHub 63cb828dea build(deps): bump the tanstack-router group across 1 directory with 2 updates (#5901) 2026-08-07 09:55:13 +02:00
Quentin Gliech 300ede9fe8 Regenerate src/routeTree.gen.ts 2026-08-07 09:39:09 +02:00
dependabot[bot]andGitHub 6ed06dde73 build(deps): bump the tanstack-router group across 1 directory with 2 updates 
Bumps the tanstack-router group with 2 updates in the / directory: [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) and [@tanstack/router-plugin](https://github.com/TanStack/router/tree/HEAD/packages/router-plugin).


Updates `@tanstack/react-router` from 1.170.17 to 1.170.18
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.18/packages/react-router)

Updates `@tanstack/router-plugin` from 1.168.19 to 1.168.23
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/router-plugin/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/router-plugin@1.168.23/packages/router-plugin)

---
updated-dependencies:
- dependency-name: "@tanstack/react-router"
  dependency-version: 1.170.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tanstack-router
- dependency-name: "@tanstack/router-plugin"
  dependency-version: 1.168.22
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: tanstack-router
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-06 19:51:31 +00:00
Quentin GliechandGitHub 205d31d109 Revert "build(deps-dev): bump the graphql-codegen group" (#5909) 2026-08-06 18:44:06 +02:00
Quentin Gliech e58527d807 Revert "build(deps-dev): bump the graphql-codegen group across 1 directory with 2 updates" 
This reverts commit dca32d3871.
 2026-08-06 17:03:04 +02:00
Quentin GliechandGitHub c8609fbce5 build(deps-dev): bump the graphql-codegen group with 2 updates (#5900) 2026-08-05 13:48:20 +02:00
Quentin GliechandGitHub a5800983b8 build(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.2 (#5888) 2026-08-05 13:37:38 +02:00
Quentin GliechandGitHub ee0db1548a build(deps): bump the i18next group with 3 updates (#5899) 2026-08-05 13:37:14 +02:00
dependabot[bot]andGitHub dca32d3871 build(deps-dev): bump the graphql-codegen group across 1 directory with 2 updates 
Bumps the graphql-codegen group with 2 updates in the / directory: [@graphql-codegen/cli](https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/graphql-codegen-cli) and [@graphql-codegen/client-preset](https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/presets/client).


Updates `@graphql-codegen/cli` from 7.1.3 to 7.2.0
- [Release notes](https://github.com/dotansimha/graphql-code-generator/releases)
- [Changelog](https://github.com/dotansimha/graphql-code-generator/blob/master/packages/graphql-codegen-cli/CHANGELOG.md)
- [Commits](https://github.com/dotansimha/graphql-code-generator/commits/@graphql-codegen/cli@7.2.0/packages/graphql-codegen-cli)

Updates `@graphql-codegen/client-preset` from 6.0.1 to 6.1.0
- [Release notes](https://github.com/dotansimha/graphql-code-generator/releases)
- [Changelog](https://github.com/dotansimha/graphql-code-generator/blob/master/packages/presets/client/CHANGELOG.md)
- [Commits](https://github.com/dotansimha/graphql-code-generator/commits/@graphql-codegen/client-preset@6.1.0/packages/presets/client)

---
updated-dependencies:
- dependency-name: "@graphql-codegen/cli"
  dependency-version: 7.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: graphql-codegen
- dependency-name: "@graphql-codegen/client-preset"
  dependency-version: 6.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: graphql-codegen
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-05 11:34:26 +00:00
Quentin GliechandGitHub 396f4419ca build(deps): bump opentelemetry-semantic-conventions from 0.32.0 to 0.32.1 in the opentelemetry group (#5892) 2026-08-05 13:31:09 +02:00
Quentin GliechandGitHub 5258872dad build(deps-dev): bump the vite group across 1 directory with 2 updates (#5906) 2026-08-05 13:30:32 +02:00
Quentin GliechandGitHub b58efe2a73 build(deps): bump docker/login-action from 4.2.0 to 4.4.0 (#5889) 2026-08-05 13:28:31 +02:00
Quentin GliechandGitHub 0a6564d4cd build(deps): bump socket2 from 0.6.4 to 0.6.5 (#5895) 2026-08-05 13:28:08 +02:00
Quentin GliechandGitHub 9dcd8ad254 build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#5890) 2026-08-05 13:25:16 +02:00
Quentin GliechandGitHub 5ede8ad3ab build(deps): bump docker/metadata-action from 6.1.0 to 6.2.0 (#5887) 2026-08-05 13:24:00 +02:00
dependabot[bot]andGitHub c9e44c8bb8 build(deps): bump the i18next group across 1 directory with 3 updates 
Bumps the i18next group with 3 updates in the / directory: [i18next](https://github.com/i18next/i18next), [react-i18next](https://github.com/i18next/react-i18next) and [i18next-cli](https://github.com/i18next/i18next-cli).


Updates `i18next` from 26.3.4 to 26.3.6
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](https://github.com/i18next/i18next/compare/v26.3.4...v26.3.6)

Updates `react-i18next` from 17.0.8 to 17.0.10
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](https://github.com/i18next/react-i18next/compare/v17.0.8...v17.0.10)

Updates `i18next-cli` from 1.65.0 to 1.66.2
- [Changelog](https://github.com/i18next/i18next-cli/blob/main/CHANGELOG.md)
- [Commits](https://github.com/i18next/i18next-cli/compare/v1.65.0...v1.66.2)

---
updated-dependencies:
- dependency-name: i18next
  dependency-version: 26.3.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: i18next
- dependency-name: i18next-cli
  dependency-version: 1.66.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: i18next
- dependency-name: react-i18next
  dependency-version: 17.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: i18next
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-05 11:12:26 +00:00
dependabot[bot]andGitHub 3c1c0705b8 build(deps-dev): bump the vite group across 1 directory with 2 updates 
Bumps the vite group with 2 updates in the / directory: [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `@vitejs/plugin-react` from 6.0.3 to 6.0.4
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.4/packages/plugin-react)

Updates `vite` from 8.1.3 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.1.5/packages/vite)

---
updated-dependencies:
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: vite
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: vite
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-05 11:11:26 +00:00
dependabot[bot]andGitHub 0949eb68f0 build(deps): bump opentelemetry-semantic-conventions 
Bumps the opentelemetry group with 1 update in the / directory: [opentelemetry-semantic-conventions](https://github.com/open-telemetry/opentelemetry-rust).


Updates `opentelemetry-semantic-conventions` from 0.32.0 to 0.32.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-rust/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-rust/blob/main/docs/release_0.32.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-rust/compare/opentelemetry-semantic-conventions-0.32.0...opentelemetry-semantic-conventions-0.32.1)

---
updated-dependencies:
- dependency-name: opentelemetry-semantic-conventions
  dependency-version: 0.32.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: opentelemetry
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-05 11:09:55 +00:00
dependabot[bot]andGitHub a288db8d80 build(deps): bump socket2 from 0.6.4 to 0.6.5 
Bumps [socket2](https://github.com/rust-lang/socket2) from 0.6.4 to 0.6.5.
- [Release notes](https://github.com/rust-lang/socket2/releases)
- [Changelog](https://github.com/rust-lang/socket2/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rust-lang/socket2/commits/v0.6.5)

---
updated-dependencies:
- dependency-name: socket2
  dependency-version: 0.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-05 11:09:45 +00:00
Quentin GliechandGitHub 7084ae1752 build(deps): bump clap from 4.5.50 to 4.5.60 (#5896) 2026-08-05 13:08:25 +02:00
dependabot[bot]andGitHub 54d8cfcc45 build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v6.4.0...v7)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-05 11:08:05 +00:00
dependabot[bot]andGitHub e47779f8ef build(deps): bump docker/login-action from 4.2.0 to 4.4.0 
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.2.0 to 4.4.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/650006c6eb7dba73a995cc03b0b2d7f5ca915bee...af1e73f918a031802d376d3c8bbc3fe56130a9b0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-05 11:07:36 +00:00
dependabot[bot]andGitHub cbf91149d5 build(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.2 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.2.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/b4309332981a82ec1c5618f44dd2e27cc8bfbfda...3d0d9888cb7fd7b750713d6e236d1fcb99157228)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-05 11:07:17 +00:00
dependabot[bot]andGitHub 6e77139c37 build(deps): bump docker/metadata-action from 6.1.0 to 6.2.0 
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 6.1.0 to 6.2.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](https://github.com/docker/metadata-action/compare/80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9...dc802804100637a589fabce1cb79ff13a1411302)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-05 11:07:07 +00:00
Quentin GliechandGitHub 2a2741ee00 Read javascript entrypoints configuration from data attributes (#5886) 2026-08-05 13:05:37 +02:00
dependabot[bot]andGitHub 313ba9f72f build(deps): bump clap from 4.5.50 to 4.5.60 
Bumps [clap](https://github.com/clap-rs/clap) from 4.5.50 to 4.5.60.
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.5.50...clap_complete-v4.5.60)

---
updated-dependencies:
- dependency-name: clap
  dependency-version: 4.5.60
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-04 19:07:05 +00:00
matrixbotandGitHub 6193fc3569 Automatic merge back to main (#5905) 2026-08-04 21:04:07 +02:00
github-actions[bot]andGitHub f28451c4e5 1.22.0 v1.22.0 2026-08-04 18:47:51 +00:00
matrixbotandGitHub 0ed1f96c27 Translations updates for v1.22 (#5904) 2026-08-04 20:24:11 +02:00
github-actions[bot]andGitHub 24b2bc3c57 Translations updates 2026-08-04 18:03:18 +00:00
Quentin GliechandGitHub d174b4a71c Ignore RUSTSEC-2026-0222 as we are not affected by it (#5903) 2026-08-04 18:18:09 +02:00
Quentin Gliech 9c8a56903c Ignore RUSTSEC-2026-0222 as we are not affected by it 2026-08-04 17:49:08 +02:00
Quentin Gliech a1bfbb6cdd Read the entrypoint configuration from data attributes 
Instead of injecting configuration through inline <script> tags setting
window globals, server-rendered templates now carry the configuration
as data attributes on the entrypoint mount node, validated client-side
with a valibot schema over element.dataset. This removes all inline
scripts from the templates, which is friendlier to CSP, and gives the
frontend runtime-validated, typed configuration.

The DOM read and the wiring now happen in the entrypoints themselves:
main.tsx parses the mount node dataset, owns the QueryClient, and
injects the basepath and GraphQL endpoint into the router and request
layer instead of those being module-scope singletons.
 2026-07-30 20:51:01 +02:00
matrixbotandGitHub 19f3d146a5 Automatic merge back to main (#5884) 2026-07-30 19:01:57 +02:00
github-actions[bot]andGitHub 735fd4254b 1.22.0-rc.0 v1.22.0-rc.0 2026-07-30 16:44:29 +00:00