Commit Graph
172 Commits
Author SHA1 Message Date
Owen Schwartz 3392120855 Merge pull request #3172 from Gulianrdgd/feature-response-headers
Feature response headers
2026-09-21 15:16:24 -04:00
Blacks-Army 8e2f9ea5ef Add HTTP method matching to resource rules
Resolves #1408.

A rule with match "METHOD" carries a comma-separated list of HTTP
methods in its value, e.g. "POST,PUT", and applies when the request
method is in that list. This makes it possible to leave GET public
while sending POST and PUT to auth, which rules could not express
before because both share the same path.

No new columns: the methods live in the existing rule value, so this
needs no migration and every existing rule keeps working unchanged.

The UI offers the ten registered methods. Blueprints and the API
accept any method token, so extension methods such as the WebDAV verbs
can be targeted too, and the UI preserves them when a rule set that
way is edited later.
2026-09-19 20:00:01 +02:00
Owen 1bc5fbbf0f Always pull all of the users for the blueprints 2026-09-03 12:02:41 -04:00
Owen e0937a3afa Add validation for health check hostname
Fixes #3677
2026-09-02 10:42:59 -04:00
miloschwartz 2f013335f9 make user lookup deterministic in blueprints by sorting 2026-09-01 15:36:39 -04:00
Julian van der HorstandClaude Opus 5 6ad09adefa Merge upstream/dev into feature-response-headers
Resolve conflicts against upstream's refactors:

- server/db/sqlite/schema/schema.ts: adopt upstream's reindented
  sqliteTable(name, cols, indexes) form for sites/resources, re-applying
  the headers -> requestHeaders/responseHeaders split. Kept in sync with
  the Postgres schema.
- server/lib/traefik/headersMiddleware.ts: extend upstream's extracted
  buildCustomHeadersMiddleware helper to take requestHeaders and
  responseHeaders and emit both customRequestHeaders and
  customResponseHeaders.
- server/lib/traefik/getTraefikConfig.ts and
  server/private/lib/traefik/getTraefikConfig.ts: keep upstream's helper
  extraction and appendPathMatch refactor, dropping the superseded inline
  blocks.

Also carry the feature forward onto code that moved upstream:

- The resource settings UI moved from resources/proxy/[niceId]/proxy to
  resources/public/[niceId]/http, which dropped this branch's changes in
  the previous merge. Re-add the request/response header inputs there and
  rename the vestigial headers field on the tcp page.
- messages/da-DK.json is new upstream and still had the old customHeaders
  key; rename it in line with the other locales.

Per the contributing docs, versioned migrations are intentionally omitted
so maintainers can write them at release time.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-01 13:40:49 +02:00
Alejandro Argueta 7cda28d685 Update RuleSchema to allow COUNTRY_IS_NOT rules to be created via blueprints as well. 2026-08-27 14:18:48 -07:00
Owen 23764feb4f Move the messaging out of the transaction 2026-08-25 09:27:02 -04:00
Owen 87a3e5ceea Generate the cert properly 2026-08-17 13:45:51 -04:00
Owen 11daf4f927 Move certificates 2026-08-17 12:00:12 -04:00
Owen b51aecf45a Remove advanced resources paywall 2026-08-17 12:00:12 -04:00
Owen 3a18a3994f Fix private resource ssl when applying through blueprints 2026-08-14 14:21:00 -04:00
Owen 193f6da8d1 Handle the list of models without allow/block 2026-08-14 12:23:20 -04:00
Owen 954dc8d1d9 Handle overlapping fullDomain properly 2026-08-14 12:23:20 -04:00
Owen c8f170d197 Allow budgets to be set on the resources 2026-08-14 11:43:01 -04:00
Owen 4989d1e31a Allow overlapping domains on public inference resources 2026-08-14 11:43:01 -04:00
Owen 574ae8f5f9 Include inference support in blueprints 2026-08-14 10:51:59 -04:00
Owen 03118f1ede Support labels on blueprints
Ref https://github.com/orgs/fosrl/discussions/2849
2026-08-14 09:16:50 -04:00
Owen 295e38d2af Remove arbitrary max 50 limit from email whitelist
Fix #3568
2026-08-12 09:11:10 -04:00
miloschwartz f47c94d05b check idp org ownership on save policy closes #3290 2026-07-29 09:38:15 -04:00
Owen 9a9ae649ef Add default to path
Fix #3484
2026-07-27 10:02:32 -04:00
Owen 55f3807491 Enforce uniqueness of aliases in blueprints 2026-07-16 15:10:38 -04:00
Owen e1bc0b7efd Make sure the enabled gets set to false 2026-07-10 15:36:05 -04:00
Owen 5ef068c8dc Set the resource from the site 2026-07-10 15:31:37 -04:00
Owen 609fb357bb Support enable in the blueprints 2026-07-10 15:16:50 -04:00
Owen 8d018fe47d Clean up 2026-07-09 21:28:48 -04:00
Milo Schwartz 1e7863ce4f Merge pull request #3342 from Fredkiss3/feat/geoip-country-is-not-rule
feat: add country `is not` rule in resource policies
2026-07-07 21:18:43 -04:00
Julian van der Horst a8c1ddb448 Merge should be complete 2026-07-07 11:57:43 +02:00
Julian van der Horst de67f06b43 Merge remote-tracking branch 'upstream/dev' into feature-response-headers
# Conflicts:
#	server/db/pg/schema/schema.ts
#	server/lib/blueprints/proxyResources.ts
#	server/routers/resource/getResource.ts
#	src/app/[orgId]/settings/resources/proxy/[niceId]/proxy/page.tsx
#	src/components/HealthCheckCredenza.tsx
2026-07-07 11:13:15 +02:00
Owen 71da22328c Quiet logs 2026-07-06 14:44:30 -04:00
Fred KISSIE 11c30b8b27 Merge branch 'dev' into feat/geoip-country-is-not-rule 2026-07-03 22:50:56 +02:00
Owen 2f2b7f43c1 Add usage tracking to blueprints 2026-06-29 16:13:12 -04:00
Fred KISSIE 8d29602929 🏷️ fix types 2026-06-29 18:06:03 +02:00
Fred KISSIE 697be01411 Merge branch 'dev' into feat/geoip-country-is-not-rule 2026-06-27 02:05:02 +02:00
Owen 35dffe71cb Make error statement debug 2026-06-26 14:40:31 -04:00
Fred KISSIE e54bd25516 🚧 add country is not rule 2026-06-25 20:28:57 +02:00
Owen 80b66cf9b9 Add locks to rebuilds 2026-06-24 14:13:11 -04:00
Owen 7731849a2f Standardize db rebuildClientAssociationsFromClient 2026-06-23 17:14:40 -04:00
Owen bf604f25e9 Show the input validation in the error report 2026-06-22 15:11:50 -04:00
Owen 3fd5c98def Fix #3252 2026-06-12 14:44:45 -07:00
Owen 5baf0c3c09 Use ssh like mode host 2026-06-11 11:11:50 -07:00
Owen f186e7e99e Dont allow asn or country without having maxmind 2026-06-09 16:02:52 -07:00
Owen dd54be523f Dont need to check user exists for the whitelist 2026-06-09 15:26:35 -07:00
Owen 8daf7c2872 Rename and add browser target update 2026-06-07 12:07:08 -07:00
Owen d1af7a153f Enforece some more things on the types 2026-06-05 16:57:53 -07:00
Owen 7b7ff51289 Add target mode and auth token 2026-06-05 15:37:21 -07:00
Owen c9cb28af45 Rename to public-policies 2026-06-05 14:30:36 -07:00
Owen 67b08ca61e Properly do disable enterprise features this time 2026-06-04 21:18:04 -07:00
Owen 614df75880 Add policy to blueprints 2026-06-04 21:18:04 -07:00
Owen 676cf37ee2 Make sure things are paywalled in the blueprints 2026-06-04 21:18:04 -07:00