ItalyPaleAle and Claude Opus 5
cea1267f37
feat: add FRANCIS_HOST to connect to a standalone Francis runtime
...
FRANCIS_HOST decides where the Francis actor runtime lives. When it is
empty or set to "embedded" (the default), Pocket ID starts the runtime inside its own process, backed by its own database.
Any other value is the address, or a comma-separated list of addresses, of a standalone Francis runtime. Pocket ID then connects to it as a remote actor host and starts no embedded runtime.
Note: connecting to a standalone runtime also needs FRANCIS_HOST_PSK or FRANCIS_HOST_JWT, and optionally (but recommended) FRANCIS_CA.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com >
Claude-Session: https://claude.ai/code/session_01DMgoTZtznSjP4SHTaHbRen
2026-09-15 16:02:05 +00:00
Elias Schneider
5cbacd81e6
fix: limit JPG and PNG pixels to prevent decompression bomb
2026-09-15 14:51:06 +02:00
Alessandro (Ale) Segala
de2780bbef
fix: serve bundled logo if no custom logo is set ( #1748 )
2026-09-14 11:33:31 +02:00
Alessandro (Ale) Segala
33090fa3e1
feat: use HS256 for Pocket ID's own session tokens + fixes ( #1733 )
2026-09-07 15:27:08 +02:00
Alessandro (Ale) Segala
01cc44246a
chore: upgrade jwx to v4 ( #1730 )
2026-08-31 14:12:35 -07:00
Alessandro (Ale) Segala
fa8aa44706
chore: update Francis to rc.2 ( #1728 )
2026-08-31 05:15:48 -07:00
Alessandro (Ale) Segala and copilot-swe-agent[bot]
7c79a9e14b
feat: add explicit public keys for federated client credentials ( #1702 )
...
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com >
2026-08-28 21:12:15 +00:00
Kyle Mendell
d75523fed0
feat: list allowed groups when hovering over allowed group count ( #1671 )
2026-08-25 18:30:16 +02:00
Alessandro (Ale) Segala and Elias Schneider
29a6fd6c29
feat: show admin UI warning for SQLite on networked filesystem ( #1713 )
...
Co-authored-by: Elias Schneider <login@eliasschneider.com >
2026-08-24 15:03:31 -07:00
Alessandro (Ale) Segala and copilot-swe-agent[bot]
8c095afd78
refactor: migrate SCIM sync to actor + add tests ( #1680 )
...
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com >
2026-08-18 21:54:06 +02:00
Elias Schneider
a487c78550
feat: reduce one time access code length for better UX
2026-08-18 21:31:22 +02:00
Elias Schneider
915a6bcf08
feat: allow admins to auto grant APIs to CIMD clients ( #1692 )
2026-08-18 20:02:14 +02:00
Alessandro (Ale) Segala
155a1fcba0
feat: support multiple client secrets per OIDC client ( #1679 )
2026-08-11 00:54:52 +00:00
Elias Schneider
3ca9a55c71
feat: hide apps without launch url on My Apps page
2026-08-10 22:53:35 +02:00
Elias Schneider
0c9a03e519
feat: add animated logo as default logo
2026-08-08 20:50:37 +02:00
Alessandro (Ale) Segala and Kyle Mendell
563c0f93a6
refactor: migrate LDAP sync to an actor ( #1651 )
...
Co-authored-by: Kyle Mendell <kmendell@ofkm.us >
2026-08-07 09:18:30 -07:00
Alessandro (Ale) Segala
22e3909c6c
refactor: move GeoLite to its own package ( #1647 )
2026-08-05 22:12:19 +02:00
Alessandro (Ale) Segala
1c9233c236
fix: make OIDC client token lifetimes optional ( #1650 )
2026-08-05 20:11:40 +00:00
08407ae564
feat: include Francis data in Pocket ID backups ( #1645 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Elias Schneider <login@eliasschneider.com >
2026-08-05 19:57:38 +00:00
Elias Schneider
5d43c4aaeb
feat: add ability to customize session duration of clients ( #1641 )
2026-08-03 23:23:29 +02:00
Elias Schneider
7a4d0dd275
refactor: standardize API error handling ( #1635 )
2026-08-02 23:36:06 +02:00
Elias Schneider
598895e7c5
fix: session revoke fails if orphaned session tokens exist
2026-08-02 18:31:15 +02:00
Jean-François Roy and Elias Schneider
1934efa84c
feat: implement OAuth Client ID Metadata Document ( #1525 ) ( #1526 )
...
Co-authored-by: Elias Schneider <login@eliasschneider.com >
2026-08-02 15:05:39 +00:00
Elias Schneider
7c55bdf115
feat: make oauth access tokens RFC 9068 compliant
2026-08-02 15:59:21 +02:00
2ef7c93fee
feat: migrate app locks to Francis ( #1624 )
...
Co-authored-by: Elias Schneider <login@eliasschneider.com >
Co-authored-by: Kyle Mendell <kmendell@ofkm.us >
2026-07-29 22:15:40 +02:00
Elias Schneider and ItalyPaleAle
e1fd1d320f
feat: add qr code alternative sign in method ( #1594 )
...
Co-authored-by: ItalyPaleAle <43508+ItalyPaleAle@users.noreply.github.com >
2026-07-28 01:30:13 +02:00
Elias Schneider
43aaccd5bf
refactor: modularize email module and use actor for email verification ( #1625 )
2026-07-27 20:00:59 +02:00
Elias Schneider
6bd4679bab
tests: correctly close filesystems
2026-07-26 23:30:36 +02:00
Markus Schanz
9f559788a4
feat: add support for declaritive client secret configuration ( #1619 )
2026-07-26 16:27:42 +02:00
Alessandro (Ale) Segala and Elias Schneider
a1b4e1d2b2
feat: migrate one-time and signup tokens to an actor ( #1611 )
...
Co-authored-by: Elias Schneider <login@eliasschneider.com >
2026-07-26 15:32:43 +02:00
Markus Schanz
80c7c4aaf1
feat: add declaritive user id configuration ( #1622 )
2026-07-25 23:43:16 +02:00
Elias Schneider
e10f66c07a
fix: show only accessible clients on "My Apps" page
2026-07-22 18:33:57 +02:00
Elias Schneider
ad06ea6e00
fix: datatype mismatch between postgres and sqlite causes import to fail
2026-07-22 18:13:13 +02:00
Alessandro (Ale) Segala and Claude
2cfbcb4b67
refactor: use actors for db configuration ( #1604 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2026-07-20 08:48:05 +02:00
Alessandro (Ale) Segala
b254d969a5
fix: sync group membership for users added at creation time ( #1600 )
2026-07-17 11:15:00 -07:00
Alessandro (Ale) Segala
cfda5f693b
refactor: manage instance ID in the KV table ( #1579 )
2026-07-11 16:16:05 +02:00
Sean McKenzie and Elias Schneider
6734585712
feat: add description field to oidc clients ( #1547 )
...
Co-authored-by: Elias Schneider <login@eliasschneider.com >
2026-07-08 13:41:51 +02:00
Elias Schneider
c85a4e63da
fix: disable one time access token exchange for disabled users
2026-07-08 12:04:16 +02:00
Elias Schneider
ce7d3a7e1d
tests(unit): fix wrong migration name
2026-07-08 11:51:43 +02:00
Elias Schneider and Alessandro Segala
09d196f7c5
feat: add OAuth APIs with scoped permissions ( #1542 )
...
Co-authored-by: Alessandro (Ale) Segala <43508+ItalyPaleAle@users.noreply.github.com >
2026-07-06 12:25:02 -07:00
Alessandro (Ale) Segala
eefd51cc4d
fix: various bugs in observability / OTel ( #1564 )
2026-07-05 14:14:39 -07:00
Alessandro (Ale) Segala
f68ad42618
chore: use go-kit for sending emails ( #1565 )
2026-07-05 13:10:11 -07:00
9607495ab4
refactor: integrate Francis actor framework for background jobs, cron scheduling, and rate limiting ( #1556 )
...
Co-authored-by: Elias Schneider <login@eliasschneider.com >
Co-authored-by: Claude <noreply@anthropic.com >
2026-07-03 08:36:45 +02:00
Elias Schneider
ecad31cae2
refactor: migrate signup functionality to single usersignup module
2026-06-30 20:53:31 +02:00
Elias Schneider
58fcf7cbe6
refactor: migrate Webauthn functionality to single webauthn module
2026-06-29 14:05:07 +02:00
Elias Schneider
9fce987106
refactor: migrate API key functionality to single apikey module
2026-06-29 12:11:18 +02:00
97bd466f38
feat: prompt admin with PKCE client support hint ( #1499 )
...
Co-authored-by: james <james@goldfish.net >
Co-authored-by: Alessandro (Ale) Segala <43508+ItalyPaleAle@users.noreply.github.com >
Co-authored-by: Elias Schneider <login@eliasschneider.com >
Co-authored-by: Kyle Mendell <kmendell@ofkm.us >
2026-06-28 11:10:30 -07:00
Elias Schneider
d467855870
feat: add ability to skip consent for client
2026-06-26 23:35:26 +02:00
Elias Schneider
519cda0eef
refactor: remove dead code
2026-06-22 21:58:55 +02:00
Elias Schneider
8158452b37
refactor: use fosite for OAuth 2.0 logic ( #1520 )
2026-06-22 18:42:02 +02:00
