ItalyPaleAle and Claude Opus 5
cea1267f37
feat: add FRANCIS_HOST to connect to a standalone Francis runtime
...
FRANCIS_HOST decides where the Francis actor runtime lives. When it is
empty or set to "embedded" (the default), Pocket ID starts the runtime inside its own process, backed by its own database.
Any other value is the address, or a comma-separated list of addresses, of a standalone Francis runtime. Pocket ID then connects to it as a remote actor host and starts no embedded runtime.
Note: connecting to a standalone runtime also needs FRANCIS_HOST_PSK or FRANCIS_HOST_JWT, and optionally (but recommended) FRANCIS_CA.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com >
Claude-Session: https://claude.ai/code/session_01DMgoTZtznSjP4SHTaHbRen
2026-09-15 16:02:05 +00:00
Elias Schneider
1ee34fddea
chore(deps): update vulnerable packages
2026-09-15 15:30:18 +02:00
Elias Schneider
5cbacd81e6
fix: limit JPG and PNG pixels to prevent decompression bomb
2026-09-15 14:51:06 +02:00
Alessandro (Ale) Segala
de2780bbef
fix: serve bundled logo if no custom logo is set ( #1748 )
2026-09-14 11:33:31 +02:00
Alessandro (Ale) Segala
7ddc5d690b
fix: trim values loaded from _FILE env vars in AppConfig ( #1741 )
2026-09-07 19:10:54 -05:00
c65b77c980
chore(deps): Bump the "all-dependencies" group with 3 updates across multiple ecosystems ( #1739 )
...
Co-authored-by: Kyle Mendell <kyle@pocket-id.org >
Co-authored-by: Kyle Mendell <kmendell@ofkm.us >
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-07 09:24:16 -05:00
Alessandro (Ale) Segala
33090fa3e1
feat: use HS256 for Pocket ID's own session tokens + fixes ( #1733 )
2026-09-07 15:27:08 +02:00
Alessandro (Ale) Segala
01cc44246a
chore: upgrade jwx to v4 ( #1730 )
2026-08-31 14:12:35 -07:00
Alessandro (Ale) Segala
fa8aa44706
chore: update Francis to rc.2 ( #1728 )
2026-08-31 05:15:48 -07:00
Alessandro (Ale) Segala and copilot-swe-agent[bot]
7c79a9e14b
feat: add explicit public keys for federated client credentials ( #1702 )
...
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com >
2026-08-28 21:12:15 +00:00
Elias Schneider
f235104aed
chore(deps): update Go to v1.27.0
2026-08-28 23:02:49 +02:00
Elias Schneider
3657012f93
fix: make sorting of strings case insensitive
2026-08-28 21:49:20 +02:00
Kyle Mendell
d75523fed0
feat: list allowed groups when hovering over allowed group count ( #1671 )
2026-08-25 18:30:16 +02:00
Alessandro (Ale) Segala and Elias Schneider
29a6fd6c29
feat: show admin UI warning for SQLite on networked filesystem ( #1713 )
...
Co-authored-by: Elias Schneider <login@eliasschneider.com >
2026-08-24 15:03:31 -07:00
Alessandro (Ale) Segala and copilot-swe-agent[bot]
8c095afd78
refactor: migrate SCIM sync to actor + add tests ( #1680 )
...
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com >
2026-08-18 21:54:06 +02:00
Elias Schneider
a487c78550
feat: reduce one time access code length for better UX
2026-08-18 21:31:22 +02:00
Elias Schneider
915a6bcf08
feat: allow admins to auto grant APIs to CIMD clients ( #1692 )
2026-08-18 20:02:14 +02:00
Alessandro (Ale) Segala
be4c395528
refactor: move remaining database cleanup jobs to actors ( #1698 )
2026-08-17 08:38:35 +02:00
Elias Schneider
9421d43f8e
fix: ignore trailing slash in resources
2026-08-17 08:34:28 +02:00
Alessandro (Ale) Segala
2dc062ac0f
refactor: move API key cleanup job to actor ( #1687 )
2026-08-15 00:39:02 +02:00
Elias Schneider
1bb21c5d73
refactor: move iss param handling to Fosite
2026-08-12 23:25:35 +02:00
46b8d54e15
feat: serve RFC 8414 authorization server metadata ( #1685 )
...
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com >
Co-authored-by: Elias Schneider <login@eliasschneider.com >
2026-08-12 23:13:05 +02:00
Anthony Clerici
86cf73b86c
docs: add error responses to openapi spec ( #1684 )
2026-08-11 19:26:48 +02:00
Alessandro (Ale) Segala
155a1fcba0
feat: support multiple client secrets per OIDC client ( #1679 )
2026-08-11 00:54:52 +00:00
Elias Schneider
3ca9a55c71
feat: hide apps without launch url on My Apps page
2026-08-10 22:53:35 +02:00
Alessandro (Ale) Segala
84a58cd757
fix: ignore unsupported grant types in client ID metadata documents ( #1682 )
2026-08-10 09:45:34 -07:00
Elias Schneider
0c9a03e519
feat: add animated logo as default logo
2026-08-08 20:50:37 +02:00
Elias Schneider
9e637d5aec
fix: improve validation of app config variables
2026-08-08 16:37:14 +02:00
Alessandro (Ale) Segala and Kyle Mendell
563c0f93a6
refactor: migrate LDAP sync to an actor ( #1651 )
...
Co-authored-by: Kyle Mendell <kmendell@ofkm.us >
2026-08-07 09:18:30 -07:00
Alessandro (Ale) Segala
f8db1d8a86
chore: update francis to beta 21 ( #1669 )
2026-08-07 15:40:14 +00:00
Elias Schneider and Alessandro Segala
d6a47243db
feat: add settings for limiting what passkeys can be used ( #1662 )
...
Co-authored-by: Alessandro (Ale) Segala <43508+ItalyPaleAle@users.noreply.github.com >
2026-08-07 11:17:38 +02:00
Copilot and stonith404
448d271c94
refactor: fix formatting ( #1666 )
...
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com >
Co-authored-by: stonith404 <58886915+stonith404@users.noreply.github.com >
2026-08-07 08:26:45 +02:00
Elias Schneider and Alessandro Segala
06ccadfcd0
fix: separate TLS inputs and preserve certificate reloads ( #1653 )
...
Co-authored-by: Alessandro (Ale) Segala <43508+ItalyPaleAle@users.noreply.github.com >
2026-08-07 00:32:08 +00:00
Alessandro (Ale) Segala
1f9cc5e58e
fix: in non-HA mode, increase AlarmLeaseDuration ( #1660 )
2026-08-06 20:16:48 +02:00
Alessandro (Ale) Segala
22e3909c6c
refactor: move GeoLite to its own package ( #1647 )
2026-08-05 22:12:19 +02:00
Alessandro (Ale) Segala
1c9233c236
fix: make OIDC client token lifetimes optional ( #1650 )
2026-08-05 20:11:40 +00:00
Elias Schneider
95809dd29c
tests: remove invalid unit test
2026-08-05 22:01:43 +02:00
08407ae564
feat: include Francis data in Pocket ID backups ( #1645 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Elias Schneider <login@eliasschneider.com >
2026-08-05 19:57:38 +00:00
Elias Schneider
140b5d3cb4
fix: don't skip rate limits for loopback addresses
2026-08-05 21:49:05 +02:00
Elias Schneider
488c50ef95
fix: respect log level in HTTP request logs
2026-08-04 23:12:22 +02:00
Alessandro (Ale) Segala
a526206669
feat: add observability to actors ( #1646 )
2026-08-04 12:31:11 -07:00
Elias Schneider
2c7d1b63e1
fix: don't rely on content length header for optional json binding
2026-08-04 21:10:17 +02:00
Elias Schneider
5d43c4aaeb
feat: add ability to customize session duration of clients ( #1641 )
2026-08-03 23:23:29 +02:00
Elias Schneider
1238bf0f37
fix: explicitly require JSON for request bodies
2026-08-03 22:58:08 +02:00
Elias Schneider
69d55ada6c
fix: explicitly set SameSite to Lax for cookies
2026-08-03 22:58:01 +02:00
Elias Schneider
db64b150be
fix: disable api key auth for webauthn register endpoints
2026-08-03 20:20:40 +02:00
Elias Schneider
7a4d0dd275
refactor: standardize API error handling ( #1635 )
2026-08-02 23:36:06 +02:00
Elias Schneider
598895e7c5
fix: session revoke fails if orphaned session tokens exist
2026-08-02 18:31:15 +02:00
Jean-François Roy and Elias Schneider
1934efa84c
feat: implement OAuth Client ID Metadata Document ( #1525 ) ( #1526 )
...
Co-authored-by: Elias Schneider <login@eliasschneider.com >
2026-08-02 15:05:39 +00:00
Elias Schneider
7c55bdf115
feat: make oauth access tokens RFC 9068 compliant
2026-08-02 15:59:21 +02:00
