paskia

514 Commits 2 Branches 57 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
LeoVasanko	2039c47e46	Tests: align with instance-global OIDC and per-domain auth hosts - '*' origin is wildcard shorthand (https-only outside localhost) - related origins may fall inside another domain's rp-id; the listing wins dispatch, an exact rp-id always wins - shared auth hosts resolve best-suffix; no cross-domain fallback - OIDC codes are host-independent; log censoring path is oidc.key - legacy wildcards convert as-is; legacy OIDC carries over as-is	2026-09-07 06:33:54 +00:00
LeoVasanko	7ff8869e1d	CLI: positional rp-id/rp-name; init adds domains to an existing database - 'paskia init [rp-id] [rp-name]' and 'paskia migrate [rp-id]' are now positional; comma separation and the --rp-id/--rp-name flags are gone. - With an existing paskia.kantadb, init adds the rp-id as a new domain (seeding its OIDC provider) or updates an existing domain's rp-name. - Origin allow-list semantics clarified: the bare '' entry allows anything within the rp-id domain on any scheme and port (also the empty-list default and its display in the admin UI, replacing the synthetic '.rp-id' row); '.x' wildcards are https-only; exact entries match scheme, host and port. Legacy '.rp-id' wildcards migrate to '*' to preserve their any-scheme meaning.	2026-09-07 03:07:38 +00:00
LeoVasanko	f2e6f5784e	Rename realms to domains; object-keyed origins/related config format Finish the realm→domain terminology removal across source, tests, e2e and docs. The stored config drops all lists: Config.domains is keyed by rp-id, DomainConfig.origins/related are objects keyed by host (https:// omitted), values True or OriginEntry(auth_host=True). The default/primary domain concept is gone; ordering is display-time. Tests and e2e updated to the new API shapes (not run). Database re-migrated from the legacy backup into the new format.	2026-09-07 02:05:12 +00:00

Author

SHA1

Message

Date

LeoVasanko

2039c47e46

Tests: align with instance-global OIDC and per-domain auth hosts

- '*' origin is wildcard shorthand (https-only outside localhost)
- related origins may fall inside another domain's rp-id; the listing
  wins dispatch, an exact rp-id always wins
- shared auth hosts resolve best-suffix; no cross-domain fallback
- OIDC codes are host-independent; log censoring path is oidc.key
- legacy wildcards convert as-is; legacy OIDC carries over as-is

2026-09-07 06:33:54 +00:00

LeoVasanko

7ff8869e1d

CLI: positional rp-id/rp-name; init adds domains to an existing database

- 'paskia init [rp-id] [rp-name]' and 'paskia migrate [rp-id]' are now
  positional; comma separation and the --rp-id/--rp-name flags are gone.
- With an existing paskia.kantadb, init adds the rp-id as a new domain
  (seeding its OIDC provider) or updates an existing domain's rp-name.
- Origin allow-list semantics clarified: the bare '*' entry allows
  anything within the rp-id domain on any scheme and port (also the
  empty-list default and its display in the admin UI, replacing the
  synthetic '*.rp-id' row); '*.x' wildcards are https-only; exact entries
  match scheme, host and port. Legacy '*.rp-id' wildcards migrate to '*'
  to preserve their any-scheme meaning.

2026-09-07 03:07:38 +00:00

LeoVasanko

f2e6f5784e

Rename realms to domains; object-keyed origins/related config format

Finish the realm→domain terminology removal across source, tests, e2e
and docs. The stored config drops all lists: Config.domains is keyed by
rp-id, DomainConfig.origins/related are objects keyed by host (https://
omitted), values True or OriginEntry(auth_host=True). The default/primary
domain concept is gone; ordering is display-time. Tests and e2e updated
to the new API shapes (not run). Database re-migrated from the legacy
backup into the new format.

2026-09-07 02:05:12 +00:00