| Age | Commit message (Collapse) | Author | |
|---|---|---|---|
| 2024-08-14 | fix: import timedelta in jwks | John Nduli | |
| 2024-08-14 | refactor: move newest_jwk_with_rotation function to jwks.py | John Nduli | |
| We have a similar jwk module in gn2 that does similar functionality. Moving the newest_jwk_with_rotation function to the module ensures that there's some consistency between both modules so that when we ever want to remove the duplication (e.g. by creating some python pip package) it's easier. | |||
| 2024-08-14 | docs: update documentation to reflect new secrets handling | John Nduli | |
| 2024-08-13 | Emails: Make "From" address configurable | Frederick Muriuki Muriithi | |
| We are running GeneNetwork in different environments. Each environment could have it's own separate domain, and need a different sender email to allow the underlying services to allow the emails through. | |||
| 2024-08-08 | Fix bug with sending e-mails | zsloan | |
| We changed the from address from genenetwork.org to uthsc.edu, which seems to have fixed the issue with e-mails not being properly sent. We also stopped activating tls | |||
| 2024-08-08 | Bug: Prevent fall-through to verification if code is expired. | Frederick Muriuki Muriithi | |
| 2024-08-08 | Get data from form too. | Frederick Muriuki Muriithi | |
| 2024-08-08 | Forward email to email verification page. | Frederick Muriuki Muriithi | |
| 2024-08-07 | Log out user registration errors at the `ERROR` log-level. | Frederick Muriuki Muriithi | |
| 2024-08-07 | Log out exceptions at the `ERROR` log level | Frederick Muriuki Muriithi | |
| Log out any unhandled exceptions at the `ERROR` log level to ensure that any and all unhandled errors show up in the logs under normal running of the application. | |||
| 2024-08-05 | Fix linting errors. | Frederick Muriuki Muriithi | |
| 2024-08-02 | feat: improve local set up utility functions | John Nduli | |
| Ensures running `init_dev_users` and `init_dev_clients` multiple times succeeds and updates the local database entry. Also provide a custom flag to set the gn2's client url and add jwt-bearer to list of accepted grants. | |||
| 2024-08-02 | fix: use json to support parsing oauth2 requests | John Nduli | |
| The local sign in request used by gn2 uses json. However, the default parsing assumes form data, see: - https://github.com/lepture/authlib/blob/v1.2.0/authlib/integrations/flask_oauth2/authorization_server.py#L72 - https://github.com/lepture/authlib/blob/v1.2.0/authlib/integrations/flask_helpers.py#L5 We create a custom Authorization server that defaults to `use_json=True` when creating the oauth request object | |||
| 2024-08-01 | Handle generic exception and return a value.enable-key-rotation | Frederick Muriuki Muriithi | |
| 2024-07-31 | Add missing image for favicon.ico | Frederick Muriuki Muriithi | |
| 2024-07-31 | Update all endpoints to use the `client_secret_post` auth method. | Frederick Muriuki Muriithi | |
| 2024-07-31 | Use customised JWTBearerToken class | Frederick Muriuki Muriithi | |
| 2024-07-31 | Extend default JWTBearerToken to include a user member. | Frederick Muriuki Muriithi | |
| 2024-07-31 | Authenticate JWTs using all available keys. | Frederick Muriuki Muriithi | |
| 2024-07-31 | Add endpoint for favicon.ico | Frederick Muriuki Muriithi | |
| Helps with silencing NotFound errors in the logs. | |||
| 2024-07-31 | Add some debug logging for errors. | Frederick Muriuki Muriithi | |
| 2024-07-31 | Bug: Pass in app rather than path. | Frederick Muriuki Muriithi | |
| 2024-07-31 | Fetch a client's JWKs from a URI | Frederick Muriuki Muriithi | |
| 2024-07-31 | Enable registration of a public-jwks-uri for every client | Frederick Muriuki Muriithi | |
| 2024-07-31 | Fix styling: Use bootstrap styling. | Frederick Muriuki Muriithi | |
| 2024-07-31 | Remove the `CLIENTS_SSL_PUBLIC_KEYS_DIR` configuration | Frederick Muriuki Muriithi | |
| Moving forward, each client will advertise it's current JWKs at a known endpoint, and we'll use those, rather than having a configuration that requires manual update of the certificates. This will make it easier to implement key rotation on the clients too. | |||
| 2024-07-31 | Enable external configuration of session expiry period | Frederick Muriuki Muriithi | |
| Enable passing in the number of minutes that a session can be valid for. This enables the length of time that the session can last to be configurable rather than hard-coded. | |||
| 2024-07-31 | Ignore warning from mypy. | Frederick Muriuki Muriithi | |
| 2024-07-31 | Validate JWTs against all existing JWKs. | Frederick Muriuki Muriithi | |
| 2024-07-31 | Remove obsoleted SSL_PRIVATE_KEY configuration | Frederick Muriuki Muriithi | |
| With the key rotation in place, eliminate the use of the SSL_PRIVATE_KEY configuration which pointed to a specific non-changing JWK. | |||
| 2024-07-31 | Update datetime references on changed import. | Frederick Muriuki Muriithi | |
| 2024-07-31 | Retrieve newest JWK, creating a new JWK where necessary. | Frederick Muriuki Muriithi | |
| To help with key rotation, we fetch the latest key, creating a new JWK in any of the following 2 conditions: * There is no JWK in the first place * The "newest" key is older than a specified number of days | |||
| 2024-07-31 | Simplify jwks_directory() function | Frederick Muriuki Muriithi | |
| Pass in the app object rather than a path and compute the secrets directory within the function. | |||
| 2024-07-30 | JWT refresh: Deactivate the checks and revocation | Frederick Muriuki Muriithi | |
| The checks for whether a token is already linked, and then revoking it and raising an error were causing issues in multi-threaded environments, where there'd be multiple requests to the auth server all using an expired token. This just links the refresh token and avoids the check and revocation for the time being. | |||
| 2024-07-18 | List any/all existing JWKs | Frederick Muriuki Muriithi | |
| List any/all existing JWKs that the server currently supports. | |||
| 2024-07-18 | Add module to handle JWK files | Frederick Muriuki Muriithi | |
| 2024-07-17 | Add non-interactive script to assign make data public by default. | Frederick Muriuki Muriithi | |
| 2024-07-17 | Remove flask CLI command | Frederick Muriuki Muriithi | |
| We run the scripts directly, not via flask. | |||
| 2024-07-12 | Remove fieldset that breaks UI in google-chrome. | Frederick Muriuki Muriithi | |
| 2024-06-25 | Roles: Get rid of use of GroupRole; use Role directly for resources | Frederick Muriuki Muriithi | |
| The GroupRole idea was flawed, and led to a critical bug that would have allowed privilege escalation. This uses the Role directly acting on a specific resource when assigning said role to a user. | |||
| 2024-06-20 | Reorganise test fixtures. Fix tests and issues caught. | Frederick Muriuki Muriithi | |
| Reorganise test fixtures to more closely follow the design of the auth system. Fix the broken tests due to refactors and fix all issues caught by the running tests. | |||
| 2024-06-18 | fix mypy errors | Frederick Muriuki Muriithi | |
| 2024-06-17 | Fix mypy errors | Frederick Muriuki Muriithi | |
| 2024-06-17 | Remove obsolete endpoint. | Frederick Muriuki Muriithi | |
| 2024-06-17 | Fix linting errors | Frederick Muriuki Muriithi | |
| 2024-06-17 | Remove deprecated endpoint. | Frederick Muriuki Muriithi | |
| 2024-06-17 | Retrieve complete list of a users roles on a particular resource. | Frederick Muriuki Muriithi | |
| 2024-06-17 | Bug: use or's short-circuiting to prevent evaluation of statements | Frederick Muriuki Muriithi | |
| Without the `or` later statements were being evaluated, before the final value was computed. This commit short-circuits that behaviour. | |||
| 2024-06-17 | Improve error-handling. | Frederick Muriuki Muriithi | |
| 2024-06-17 | Fix linting errors. | Frederick Muriuki Muriithi | |
 |
index : gn-auth | |
| GN authentication and authorization service |
| aboutsummaryrefslogtreecommitdiff |