Leo Vasanko
e1e4a211ec
Fix missing credential_uuid in admin user detail API that was causing linkage between sessions and their passkeys not show up.
2025-12-09 15:34:05 +00:00
LeoVasanko
c605926c30
Implement code word based remote authentication ( #1 )
...
Add comprehensive remote authentication system allowing users to log in from one device by authenticating from another trusted device. Features include:
- Proof of Work (PoW) protection using PBKDF2-SHA512 to prevent abuse
- Simple pairing codes (3 words) protected by dynamic PoW difficulty
- Autocomplete pairing code input with error checking
- Real-time WebSocket communication between devices
Unlike device addition links and reset links with QR codes that only allow adding an authentication method, and that work offline over the duration of several days, this mechanism is strictly online, with 5 minute time limit.
2025-12-08 23:56:48 +00:00
Leo Vasanko
2bac94a548
API tests added with near-complete coverage over user and admin APIs. 60% overall backend. (not including E2E test in coverage)
2025-12-06 04:45:26 +00:00
Leo Vasanko
bfa3281aca
Added E2E restricted API flow tests and fixed earlier failing tests. All passing. Coverage 51% backend, 74% frontend.
2025-12-06 03:43:28 +00:00
Leo Vasanko
0203bce05e
Cleanup of origins handling. Added site_url and site_path such that these can be determined reliably, and we print it in the startbox.
2025-12-06 03:39:05 +00:00
Leo Vasanko
8d723155ba
Fixed and updated E2E test suite. Added user credential registration tests. Coverage for backend and frontend.
2025-12-06 00:52:35 +00:00
Leo Vasanko
0b17681907
Changed origin config to take multiple origins and if any are configured, restrict access to these. Removed bootstrap name options of created org and user (both can be easily renamed from web ui). Cleanup.
2025-12-06 00:51:18 +00:00
Leo Vasanko
da503a3081
More robust server startup, startup logo and info screen, renewed devmode script.
2025-12-05 19:06:42 +00:00
Leo Vasanko
8b98cb6325
Updated documentation.
2025-12-05 16:15:50 +00:00
Leo Vasanko
4b16037426
Project renamed to Paskia.
2025-12-05 13:24:34 +00:00
Leo Vasanko
9d7ace8fb5
Refactor dev mode into a source repo script (remove dev subcommand from package).
2025-12-05 13:08:44 +00:00
Leo Vasanko
39c06620c4
Updated E2E tests.
2025-12-04 04:44:58 +00:00
Leo Vasanko
8011a0d910
Make dev mode run without static files, only serving assets in production.
2025-12-03 22:15:26 -06:00
Leo Vasanko
4c34217846
Cleanup old hostapp files (finished, working).
2025-12-03 22:06:54 -06:00
Leo Vasanko
5c72777c2f
Missing new component.
2025-12-03 22:03:33 -06:00
Leo Vasanko
18eed4654f
Integrate host app to main app (WIP).
2025-12-03 22:00:47 -06:00
Leo Vasanko
b373a84065
Admin app simplification by using API auth properly. Implemented promise to keep request blocked by permission check while the user authenticates, fixing concurrent requests.
2025-12-03 21:19:40 -06:00
Leo Vasanko
7983d9b170
Brought examples directly to front page.
2025-12-03 21:10:08 -06:00
Leo Vasanko
bc4254ad18
Fix view switching of restricted app.
2025-12-03 19:46:36 -06:00
Leo Vasanko
d541377798
Make restricted app use simple fetch that doesn't do API authentication (recursively).
2025-12-03 18:20:14 -06:00
Leo Vasanko
7c82727d28
Fixed and simplified examples.
2025-12-03 18:08:52 -06:00
Leo Vasanko
afbd9606db
Revert earlier change to iframe srcdoc, using src instead, because srcdoc was not compatible with all passkey implementations (BitWarden).
2025-12-03 18:01:47 -06:00
Leo Vasanko
9b73684082
Log authentication options on the client.
2025-12-03 17:07:44 -06:00
Leo Vasanko
9786c2a5a8
Improved dialog layout with separate mobile portrait mode.
2025-12-03 16:06:32 -06:00
Leo Vasanko
3e10e082e2
Fix infinitely nested login iframes when the restricted app notices it needs login.
2025-12-03 15:56:17 -06:00
Leo Vasanko
7a70c933c9
Various fixes and cleanup, regressions from prior commits.
2025-12-03 15:40:59 -06:00
Leo Vasanko
6a7b1a876e
Fix syntax error in reset app created by earlier commit.
2025-12-03 14:31:13 -06:00
Leo Vasanko
ad63d3fb3a
Better static files handling on backend, when in dev mode: fetch from vite.
2025-12-03 14:30:02 -06:00
Leo Vasanko
9488f69e53
Update forward API to return in JSON iframe srcdoc with options injected. (currently broken in dev mode).
2025-12-03 13:58:18 -06:00
Leo Vasanko
1610869fae
Fix fetch timeout rolling while in authentication flow. Now each fetch gets a fresh timeout.
2025-12-03 13:35:44 -06:00
Leo Vasanko
219dd70665
Viewing linked passkeys/sessions (by clicking either one of them).
2025-12-03 13:21:52 -06:00
Leo Vasanko
4306323c44
Consistently use apiJson for fetches, with timeout and proper error handling (less code duplication).
2025-12-03 13:00:24 -06:00
Leo Vasanko
ceb99de738
Improved auth profile UX, consistent transparent-blur dialog background everywhere.
2025-12-03 12:30:23 -06:00
Leo Vasanko
ad374f5dda
Formatting, tidy up, transparent auth dialog background.
2025-12-03 11:33:24 -06:00
Leo Vasanko
1ffc918a88
Improved apiFetch and jsonFetch functions.
2025-12-03 11:26:38 -06:00
Leo Vasanko
1f75e0a305
Make auth/admin apps API calls use apiFetch, a new function that asks for permission by iframe if needed. Implement max-age checks for API authz.verify as well along with a custom exception type that carries metadata.
2025-12-03 11:17:02 -06:00
Leo Vasanko
7b0a9c2a2a
Reload backend only on changes on the backend or frontend-build within, not outside that in the repo.
2025-12-03 10:58:48 -06:00
Leo Vasanko
1c985527cf
Add E2E tests to register and verify passkey.
2025-12-03 02:52:39 +00:00
Leo Vasanko
6003189da2
Always use timezone aware UTC time.
2025-12-03 01:36:15 +00:00
Leo Vasanko
2e9895443b
Improved session list IP handling. Hovering sessions shows Same IP on matching sessions.
2025-12-03 01:32:05 +00:00
Leo Vasanko
bd13dbd1a0
Implement session termination in admin API, for completeness.
2025-12-03 01:20:52 +00:00
Leo Vasanko
ca8d65ad25
Improved profile view layout.
2025-12-03 01:04:07 +00:00
Leo Vasanko
70411fa77b
Improved profile view layout.
2025-12-03 00:52:52 +00:00
Leo Vasanko
3967e93c37
Fix examples folder serving broken a couple of commits ago.
2025-12-03 00:06:32 +00:00
Leo Vasanko
10ce0126b0
Implement metadata for RestrictedForward, set by /auth/api/forward endpoint when returning the app. Use this to implement support for time-based reauth requirement.
2025-12-02 23:39:31 +00:00
Leo Vasanko
aed48de38e
Vite proxy config simplified. Renaming /auth/restricted to have a trailing slash for better Vite compatibility.
2025-12-02 22:41:12 +00:00
Leo Vasanko
c83450dace
Major refactor of frontend source tree such that paths better match where they are served.
2025-12-02 22:09:07 +00:00
Leo Vasanko
123a62549b
Refactor restricted app paths and naming.
2025-12-02 19:10:13 +00:00
Leo Vasanko
2a5f06d707
Moved the restricted-api iframe src to /auth/api/restricted and removed the endpoint of the other restricted app.
2025-12-02 18:34:59 +00:00
Leo Vasanko
3441a7a2b3
Remove backend access control, now that the profile and admin apps handle that via API.
2025-12-02 18:25:58 +00:00
Leo Vasanko
LeoVasanko