Leo Vasanko
eece6d4a21
Remove some confusion between exchange and set-session endpoints, all using set-session now with a bearer code. Using codes in remote auth as well. Full separation of cookie and OIDC codes.
2026-02-16 14:26:20 +00:00
Leo Vasanko
e59852b44c
Session keys hardened (namespaced hashes of tokens). Various cleanup.
2026-02-15 20:14:48 +00:00
Leo Vasanko
8132189a04
Rename /auth/restricted/ to auth/restricted/{iframe,oidc} for clarity and separation.
2026-02-15 03:05:11 +00:00
Leo Vasanko
a9cf518296
Add version indication and link to our site on profile page (bottom right corner).
2026-02-11 01:36:58 +00:00
Leo Vasanko
fa378eb82e
Improved client IP and UA handling.
2026-02-05 18:02:23 +00:00
Leo Vasanko
75c592dbc0
Log proper action for delete_session depending on what function it performs: logout, delete_session (user's own) or admin:delete_session.
2026-01-29 22:44:22 +00:00
Leo Vasanko
8749067da7
Add support for perm=foo+bar to specify multiple scopes that are required. Multiple perm args are acceptable too. Pretty logging of permission denied errors.
2026-01-29 21:11:29 +00:00
Leo Vasanko
ba6dea03d3
Add missing context on update_session.
2026-01-29 19:51:56 +00:00
Leo Vasanko
21f3a713f6
Fix a bug with validate returning 401 when a session was refreshed. Simplify & cleanup.
2026-01-28 18:45:02 +00:00
Leo Vasanko
7614d0e8d9
API to use msgspec structs as well.
2026-01-28 18:31:45 +00:00
Leo Vasanko
b79f367495
Implement full ORM. Various other cleanup.
2026-01-28 17:19:56 +00:00
Leo Vasanko
dcc89181b7
Move get_session_context to DB.session_ctx().
2026-01-28 14:52:18 +00:00
Leo Vasanko
4cf0bda26d
Disable API docs that display very much broken due to missing request/response typing.
2026-01-27 23:27:42 +00:00
Leo Vasanko
dea62d799f
Remove unnecessary use of async now that db access doesn't need awaiting.
2026-01-27 23:16:17 +00:00
Leo Vasanko
d40a2b8682
DB transactions cleanup, better actor/user data. Simplified admin API. Use UUID to refer to a specific permission in admin API. Other cleanup.
2026-01-27 21:48:21 +00:00
Leo Vasanko
a54819aba8
Remove most remaining DB getters. Add ws auth chat helper function to avoid repetition, along with the existing register chat in wschat.py.
2026-01-27 20:01:17 +00:00
Leo Vasanko
637b1b95a8
Finalize database API class merge.
2026-01-27 03:00:18 +00:00
Leo Vasanko
73e4d41f04
Refactor API to match database, no _uuid postfixes.
2026-01-27 02:32:46 +00:00
Leo Vasanko
2413a32bda
Update the API to use new naming matching database.
2026-01-27 02:22:29 +00:00
Leo Vasanko
e0e1a644de
Cleanup and bugfixes on Bootstrap and JSONL handling.
2026-01-26 23:54:03 +00:00
Leo Vasanko
f6e995184f
Refactor validate endpoint to return session context, leaving user-info only for extra profile data. Completely separate token-info for reset tokens. Simplified by reusing same data structures in various places and mandating fields to have values not needing fallbacks. Implemented consistent AccessDenied view in profile and admin apps.
2026-01-26 19:40:48 +00:00
Leo Vasanko
21364fc621
Use fastapi-vue-setup, merging its template scripts to old Paskia entry point and devserver. Simplified CLI, no longer uses serve subcommand. Fixed the URL displayed on banner to show to actual frontend/caddy server even in devmode.
2026-01-25 03:15:50 +00:00
Leo Vasanko
6d340ef689
Large refactoring for better JSONL context. Switched back the urlsafe for session tokens that need to be passed in URLs. Other minor fixes.
2026-01-24 00:40:32 +00:00
Leo Vasanko
3f5018918e
Simplify session and reset token formats; removes the token utility functions entirely.
2026-01-23 21:01:45 +00:00
Leo Vasanko
e93578f2e7
Fix actor fields and transactions for API operations as they are recorded to DB.
2026-01-23 20:19:33 +00:00
Leo Vasanko
0674f9ceeb
Database refactor to separate modules.
2026-01-23 18:35:35 +00:00
Leo Vasanko
253387be97
Permissions refactor. Permissions have UUID and scope (previously id) and the latter no longer needs to be unique. Org admin uses a single global permission now. Domain scoped permissions. Removed from user info the admin fields, use effective_permission checks instead.
2026-01-23 13:54:31 +00:00
Leo Vasanko
291e0eae0b
Replace session.renewed with .expiry for consistency with other expiring items. Fix migration script.
2026-01-23 01:39:59 +00:00
Leo Vasanko
ab65f3dae2
Database cleanup: make it synchronous because we work with in-memory data. Defer writes to disk and cleanup to background task. Tests passing.
2026-01-23 01:22:47 +00:00
Leo Vasanko
887c0f92a2
Replace SQL database with JSONL based solution that keeps history.
2026-01-23 00:54:37 +00:00
Leo Vasanko
88743839af
Add missing max-age argument to validate endpoint.
2025-12-19 18:34:01 +00:00
LeoVasanko
c605926c30
Implement code word based remote authentication ( #1 )
...
Add comprehensive remote authentication system allowing users to log in from one device by authenticating from another trusted device. Features include:
- Proof of Work (PoW) protection using PBKDF2-SHA512 to prevent abuse
- Simple pairing codes (3 words) protected by dynamic PoW difficulty
- Autocomplete pairing code input with error checking
- Real-time WebSocket communication between devices
Unlike device addition links and reset links with QR codes that only allow adding an authentication method, and that work offline over the duration of several days, this mechanism is strictly online, with 5 minute time limit.
2025-12-08 23:56:48 +00:00
Leo Vasanko
2bac94a548
API tests added with near-complete coverage over user and admin APIs. 60% overall backend. (not including E2E test in coverage)
2025-12-06 04:45:26 +00:00
Leo Vasanko
0b17681907
Changed origin config to take multiple origins and if any are configured, restrict access to these. Removed bootstrap name options of created org and user (both can be easily renamed from web ui). Cleanup.
2025-12-06 00:51:18 +00:00
Leo Vasanko
4b16037426
Project renamed to Paskia.
2025-12-05 13:24:34 +00:00
Leo Vasanko
LeoVasanko