proxy

theta42/proxy

Fork 0

Commit Graph

Author	SHA1	Message	Date
wmantly	f4efdfb957	Release 1.3.0: adopt shared @simpleworkjs/* packages; fix LDAP filter injection Rewire onto the shared @simpleworkjs/oidc-client, /ldap, and /app-stack packages (deleting the byte-identical local forks of the same code), close the LDAP filter-injection in User.get by routing the username through escapeFilter (RFC 4515), align model-redis ^1.6.0 and ldapts ^8.1.8, and unify build_info to {buildVersion, buildHash, buildYear}. package-lock regenerated from the npm registry (no file:/link:), so npm ci is clean in docker builds. Co-Authored-By: Claude <noreply@anthropic.com>	2026-07-25 15:53:30 -04:00
wmantly	87c0d024d5	Per-host SSO: Node auth endpoints + Redis session (#57 ) Adds the /__proxy_auth OIDC flow served on every proxied host: - routes/host_auth.js: /start (PKCE+state, per-host redirect_uri), /callback (exchange, enforce the host allow-list via utils/host_sso.identityAllowed, mint session + set __proxy_sso cookie), /logout. - models/sso_session.js: SsoSession (Redis-backed, TTL'd; read directly by the Lua gate) and HostSsoState (in-flight auth request). - utils/oidc.js: per-host redirect_uri override on buildAuthUrl/exchangeCode. - conf.hostSso (reuses conf.oidc). Allow-list logic unit-tested. Enforcement (Lua gate + nginx location) lands next. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-11 15:41:28 -04:00

Author

SHA1

Message

Date

wmantly

f4efdfb957

Release 1.3.0: adopt shared @simpleworkjs/* packages; fix LDAP filter injection

Rewire onto the shared @simpleworkjs/oidc-client, /ldap, and /app-stack
packages (deleting the byte-identical local forks of the same code), close the
LDAP filter-injection in User.get by routing the username through escapeFilter
(RFC 4515), align model-redis ^1.6.0 and ldapts ^8.1.8, and unify build_info to
{buildVersion, buildHash, buildYear}. package-lock regenerated from the npm
registry (no file:/link:), so npm ci is clean in docker builds.

Co-Authored-By: Claude <noreply@anthropic.com>

2026-07-25 15:53:30 -04:00

wmantly

87c0d024d5

Per-host SSO: Node auth endpoints + Redis session (#57 )

Adds the /__proxy_auth OIDC flow served on every proxied host:
- routes/host_auth.js: /start (PKCE+state, per-host redirect_uri), /callback
  (exchange, enforce the host allow-list via utils/host_sso.identityAllowed,
  mint session + set __proxy_sso cookie), /logout.
- models/sso_session.js: SsoSession (Redis-backed, TTL'd; read directly by the
  Lua gate) and HostSsoState (in-flight auth request).
- utils/oidc.js: per-host redirect_uri override on buildAuthUrl/exchangeCode.
- conf.hostSso (reuses conf.oidc). Allow-list logic unit-tested.

Enforcement (Lua gate + nginx location) lands next.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-11 15:41:28 -04:00

2 Commits