| Age | Commit message (Collapse) | Author | |
|---|---|---|---|
| 2024-08-20 | Handle the "GET" part of the change-password request | Frederick Muriuki Muriithi | |
| - Delete any expired tokens - Display the UI if token is valid, else redirect with error notification. | |||
| 2024-08-20 | Pass GET parameters for correct redirection. | Frederick Muriuki Muriithi | |
| 2024-08-20 | Fix query: Replace any existing token. | Frederick Muriuki Muriithi | |
| 2024-08-19 | Generate token and send out "Forgot Password" email | Frederick Muriuki Muriithi | |
| * Generate token to use for verifying the password-change request * Send out email with token | |||
| 2024-08-19 | Show "Forgot Password" link. | Frederick Muriuki Muriithi | |
| Provide the user with the "Forgot Password" link, if the backend supports it. | |||
| 2024-08-15 | Fix a bunch of linting errors. | Frederick Muriuki Muriithi | |
| 2024-08-15 | Reduce UI complexity | Frederick Muriuki Muriithi | |
| Providing both the "Enter Verification Token" and the "Send Verification Email" elements of the same user interface seems to confuse users. This commit ensures that the system will provide one or the other, but not both, depending on whether or not there is a pending verification token present for the user. | |||
| 2024-08-15 | Import specific classes from the datetime module. | Frederick Muriuki Muriithi | |
| 2024-08-15 | fix: bugs with generating auth tokens | John Nduli | |
| 2024-08-15 | fix: bugs in masquerade api | John Nduli | |
| 2024-08-14 | fix: import timedelta in jwks | John Nduli | |
| 2024-08-14 | refactor: move newest_jwk_with_rotation function to jwks.py | John Nduli | |
| We have a similar jwk module in gn2 that does similar functionality. Moving the newest_jwk_with_rotation function to the module ensures that there's some consistency between both modules so that when we ever want to remove the duplication (e.g. by creating some python pip package) it's easier. | |||
| 2024-08-13 | Emails: Make "From" address configurable | Frederick Muriuki Muriithi | |
| We are running GeneNetwork in different environments. Each environment could have it's own separate domain, and need a different sender email to allow the underlying services to allow the emails through. | |||
| 2024-08-08 | Bug: Prevent fall-through to verification if code is expired. | Frederick Muriuki Muriithi | |
| 2024-08-08 | Get data from form too. | Frederick Muriuki Muriithi | |
| 2024-08-08 | Forward email to email verification page. | Frederick Muriuki Muriithi | |
| 2024-08-07 | Log out user registration errors at the `ERROR` log-level. | Frederick Muriuki Muriithi | |
| 2024-08-05 | Fix linting errors. | Frederick Muriuki Muriithi | |
| 2024-08-02 | fix: use json to support parsing oauth2 requests | John Nduli | |
| The local sign in request used by gn2 uses json. However, the default parsing assumes form data, see: - https://github.com/lepture/authlib/blob/v1.2.0/authlib/integrations/flask_oauth2/authorization_server.py#L72 - https://github.com/lepture/authlib/blob/v1.2.0/authlib/integrations/flask_helpers.py#L5 We create a custom Authorization server that defaults to `use_json=True` when creating the oauth request object | |||
| 2024-08-01 | Handle generic exception and return a value.enable-key-rotation | Frederick Muriuki Muriithi | |
| 2024-07-31 | Update all endpoints to use the `client_secret_post` auth method. | Frederick Muriuki Muriithi | |
| 2024-07-31 | Use customised JWTBearerToken class | Frederick Muriuki Muriithi | |
| 2024-07-31 | Extend default JWTBearerToken to include a user member. | Frederick Muriuki Muriithi | |
| 2024-07-31 | Authenticate JWTs using all available keys. | Frederick Muriuki Muriithi | |
| 2024-07-31 | Bug: Pass in app rather than path. | Frederick Muriuki Muriithi | |
| 2024-07-31 | Fetch a client's JWKs from a URI | Frederick Muriuki Muriithi | |
| 2024-07-31 | Enable registration of a public-jwks-uri for every client | Frederick Muriuki Muriithi | |
| 2024-07-31 | Enable external configuration of session expiry period | Frederick Muriuki Muriithi | |
| Enable passing in the number of minutes that a session can be valid for. This enables the length of time that the session can last to be configurable rather than hard-coded. | |||
| 2024-07-31 | Ignore warning from mypy. | Frederick Muriuki Muriithi | |
| 2024-07-31 | Validate JWTs against all existing JWKs. | Frederick Muriuki Muriithi | |
| 2024-07-31 | Remove obsoleted SSL_PRIVATE_KEY configuration | Frederick Muriuki Muriithi | |
| With the key rotation in place, eliminate the use of the SSL_PRIVATE_KEY configuration which pointed to a specific non-changing JWK. | |||
| 2024-07-31 | Update datetime references on changed import. | Frederick Muriuki Muriithi | |
| 2024-07-31 | Retrieve newest JWK, creating a new JWK where necessary. | Frederick Muriuki Muriithi | |
| To help with key rotation, we fetch the latest key, creating a new JWK in any of the following 2 conditions: * There is no JWK in the first place * The "newest" key is older than a specified number of days | |||
| 2024-07-31 | Simplify jwks_directory() function | Frederick Muriuki Muriithi | |
| Pass in the app object rather than a path and compute the secrets directory within the function. | |||
| 2024-07-30 | JWT refresh: Deactivate the checks and revocation | Frederick Muriuki Muriithi | |
| The checks for whether a token is already linked, and then revoking it and raising an error were causing issues in multi-threaded environments, where there'd be multiple requests to the auth server all using an expired token. This just links the refresh token and avoids the check and revocation for the time being. | |||
| 2024-07-18 | List any/all existing JWKs | Frederick Muriuki Muriithi | |
| List any/all existing JWKs that the server currently supports. | |||
| 2024-07-18 | Add module to handle JWK files | Frederick Muriuki Muriithi | |
| 2024-07-17 | Add non-interactive script to assign make data public by default. | Frederick Muriuki Muriithi | |
| 2024-06-25 | Roles: Get rid of use of GroupRole; use Role directly for resources | Frederick Muriuki Muriithi | |
| The GroupRole idea was flawed, and led to a critical bug that would have allowed privilege escalation. This uses the Role directly acting on a specific resource when assigning said role to a user. | |||
| 2024-06-20 | Reorganise test fixtures. Fix tests and issues caught. | Frederick Muriuki Muriithi | |
| Reorganise test fixtures to more closely follow the design of the auth system. Fix the broken tests due to refactors and fix all issues caught by the running tests. | |||
| 2024-06-18 | fix mypy errors | Frederick Muriuki Muriithi | |
| 2024-06-17 | Fix mypy errors | Frederick Muriuki Muriithi | |
| 2024-06-17 | Remove obsolete endpoint. | Frederick Muriuki Muriithi | |
| 2024-06-17 | Fix linting errors | Frederick Muriuki Muriithi | |
| 2024-06-17 | Remove deprecated endpoint. | Frederick Muriuki Muriithi | |
| 2024-06-17 | Retrieve complete list of a users roles on a particular resource. | Frederick Muriuki Muriithi | |
| 2024-06-17 | Bug: use or's short-circuiting to prevent evaluation of statements | Frederick Muriuki Muriithi | |
| Without the `or` later statements were being evaluated, before the final value was computed. This commit short-circuits that behaviour. | |||
| 2024-06-17 | Fix linting errors. | Frederick Muriuki Muriithi | |
| 2024-06-17 | Create a resource role. | Frederick Muriuki Muriithi | |
| 2024-06-17 | Don't save the resource-owner role as a resource role | Frederick Muriuki Muriithi | |
| The 'resource-owner' role is a system-default role that applies to most resources, but should not be editable by users. This commit removes the code that was linking the role with each resource, leading it to being presented to the user as a editable role. | |||
 |
index : gn-auth | |
| GN authentication and authorization service |
| aboutsummaryrefslogtreecommitdiff |