Claude
7c59dcdb82
refactor: use actors for one-time access and signup tokens
...
Move one-time access tokens and signup tokens onto the Francis actor
framework, so their state is coordinated cluster-wide and expired entries
are purged without the periodic db_cleanup job.
One-time access tokens:
- Each token is its own actor, keyed by the token value, storing the user
ID and optional device token in actor state with a TTL matching the
token's expiration. Expired state is purged automatically.
- Exchange consumes the token by invoking the actor (atomic validate +
delete) outside of any DB transaction, then loads the user and issues an
access token. On a later failure it compensates by restoring the token
(best-effort, using a non-cancelable context).
- The one_time_access_tokens table is dropped; the CLI writes token state
through a minimal, non-running actor host.
Signup tokens:
- A singleton actor holds every signup token in its state and keeps a
single cleanup alarm scheduled for the earliest expiration; when it
fires it purges expired tokens and reschedules. Listing uses Peek.
- Sign-up consumes a token by invoking the actor to atomically increment
its usage count, performs user creation in a transaction, and, on
failure, compensates by releasing the token (best-effort).
- Existing tokens are migrated from the database into the actor state on
first startup; the tables are retained only for that migration.
Also removes ClearOneTimeAccessTokens and ClearSignupTokens, and lets the
importer skip tables no longer present in the schema.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
Claude-Session: https://claude.ai/code/session_01UBMz9v9s8S8RPYNWzshkBu
2026-07-20 21:12:46 +00:00
Alessandro (Ale) Segala
2cfbcb4b67
refactor: use actors for db configuration ( #1604 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2026-07-20 08:48:05 +02:00
github-actions[bot]
472fff33ea
chore: update AAGUIDs ( #1608 )
...
Co-authored-by: stonith404 <58886915+stonith404@users.noreply.github.com >
2026-07-20 08:38:36 +02:00
Alessandro (Ale) Segala
921095f0a2
fix: relax Francis DB usage while HA is still WIP ( #1602 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2026-07-18 21:32:27 +02:00
Alessandro (Ale) Segala
b254d969a5
fix: sync group membership for users added at creation time ( #1600 )
2026-07-17 11:15:00 -07:00
dependabot[bot]
31c416ab2c
chore(deps): Bump the "all-dependencies" group with 3 updates across multiple ecosystems ( #1599 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-17 13:11:40 -05:00
Elias Schneider
807bd9e037
feat: add support for proxy protocol
2026-07-17 10:37:47 +02:00
Elias Schneider
525946e94e
release: 2.11.0
2026-07-13 11:16:16 +02:00
Elias Schneider
bb03660bd7
ci/cd: remove low demand issue closer
2026-07-13 11:08:32 +02:00
Elias Schneider
9714296efb
fix: block link-local addresses in SSRF protection
2026-07-13 11:05:24 +02:00
Elias Schneider
a3f27ec2ec
fix: ignore tab URL hashes in navigation history
2026-07-13 10:52:01 +02:00
Elias Schneider
316cf47ceb
fix: INTERNAL_APP_URL not reflected in UI URLs
2026-07-13 10:51:24 +02:00
dependabot[bot]
ef9ed8de32
chore(deps): Bump the "all-dependencies" group with 3 updates across multiple ecosystems ( #1578 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Elias Schneider <login@eliasschneider.com >
2026-07-13 09:58:41 +02:00
James18232
217bf75b7c
fix: login code mobile ux ( #1584 )
...
Co-authored-by: james <james@goldfish.net >
2026-07-13 09:52:57 +02:00
Elias Schneider
77398a558d
fix: sort signup tokens by creation date explicitly
2026-07-13 09:50:25 +02:00
Elias Schneider
187cd8ddcd
feat: add support for CIDR and IP address lists in TRUST_PROXY
2026-07-13 09:32:05 +02:00
Elias Schneider
d9ead47d19
fix: allow insecure callback URLs by default until next major release
2026-07-13 09:21:53 +02:00
Elias Schneider
7348bdac50
chore(translations): update translations via Crowdin ( #1589 )
2026-07-12 12:48:39 -05:00
Elias Schneider
69a6e22c7c
chore(translations): update translations via Crowdin ( #1577 )
2026-07-11 16:16:47 +02:00
Alessandro (Ale) Segala
cfda5f693b
refactor: manage instance ID in the KV table ( #1579 )
2026-07-11 16:16:05 +02:00
Marco Scabbiolo
ff8e34cccf
fix: postgres migration 20250822 remove public schema references ( #1582 )
...
Co-authored-by: Marco <marco.scabbiolo@redb.ee >
2026-07-11 16:11:07 +02:00
Elias Schneider
ff5e565eeb
docs: update README
2026-07-11 14:54:22 +02:00
Elias Schneider
20254eea7c
release: 2.10.0
2026-07-10 17:08:11 +02:00
Elias Schneider
f62d476c56
chore: upgrade go version
2026-07-10 16:58:27 +02:00
Elias Schneider
119eecefc3
chore(translations): update translations via Crowdin ( #1573 )
2026-07-10 16:25:05 +02:00
Elias Schneider
59a6868ecd
refactor: run formatter
2026-07-10 15:57:17 +02:00
Elias Schneider
2910c517bb
fix: mobile layout improvements
2026-07-10 15:56:47 +02:00
Elias Schneider
da3677f33d
docs: fix wrong OpenAPI documentation
2026-07-10 15:44:28 +02:00
Elias Schneider
968d07229e
docs: add link to API docs
2026-07-10 15:38:29 +02:00
Elias Schneider
28a553f63b
feat: add tab bar navigation for crowded pages
2026-07-10 15:33:02 +02:00
Alessandro (Ale) Segala
b2711ced99
fix: /authorize endpoint crashes when list of scopes is empty ( #1575 )
2026-07-08 17:48:32 -07:00
Sean McKenzie
6734585712
feat: add description field to oidc clients ( #1547 )
...
Co-authored-by: Elias Schneider <login@eliasschneider.com >
2026-07-08 13:41:51 +02:00
Elias Schneider
c85a4e63da
fix: disable one time access token exchange for disabled users
2026-07-08 12:04:16 +02:00
Elias Schneider
ce7d3a7e1d
tests(unit): fix wrong migration name
2026-07-08 11:51:43 +02:00
Elias Schneider
a5f2192d67
tests(e2e): fix migration version in database.json
2026-07-08 11:19:09 +02:00
Elias Schneider
190914fd72
refactor: remove duplicate fosite config properties
2026-07-08 11:01:50 +02:00
Elias Schneider
25dcad757a
feat: add support for unencrypted OIDC request parameter
2026-07-08 10:42:05 +02:00
Elias Schneider
c72da58eaf
refactor: rename migrations
2026-07-07 17:16:10 +02:00
Elias Schneider
f3b6ceb876
fix: add missing burst to rate limit
2026-07-07 14:01:26 +02:00
Elias Schneider
fa2d08cb6d
refactor: remove redundant dtos
2026-07-07 11:51:37 +02:00
Elias Schneider
2f55b7cbc3
fix: device authorization resolve resource creating device_code
2026-07-07 11:51:02 +02:00
Elias Schneider
8035a4c8d5
perf: include permissions in api list response
2026-07-07 11:38:59 +02:00
Elias Schneider
7667377c98
refactor: pass transaction to resolveResource
2026-07-07 11:14:19 +02:00
Elias Schneider
5e2cc6f40e
fix: merge requested scopes instead of replacing them
2026-07-07 11:03:06 +02:00
Elias Schneider
e8cb0c831c
fix: re-check api permissions on access token refresh
2026-07-07 10:58:39 +02:00
Elias Schneider
337fc6fd1e
chore: update Fosite version
2026-07-06 23:43:09 +02:00
Elias Schneider
590feadab9
chore(translations): update translations via Crowdin ( #1569 )
2026-07-06 23:35:03 +02:00
Elias Schneider
9a94aa0694
refactor: move Pocket ID specific logic from Fosite into Pocket ID repo
2026-07-06 23:34:33 +02:00
Elias Schneider
34e9a6d198
fix: restore behavior that unknown scopes get ignored
2026-07-06 22:42:38 +02:00
Elias Schneider
6120bb4dd8
chore(translations): update translations via Crowdin ( #1568 )
2026-07-06 22:24:03 +02:00
