Contre and Claude Sonnet 4.6
e1b1e722e7
fix(acl): only let a label provider define ACLs for domains it routes
...
The app name fallback matches any domain that starts with the app name,
so an app named myapp served on myapp.example.com also defined the ACLs
of myapp.evil.com. Behind a proxy with a catch-all route, a request can
be authorized against the wrong app that way.
Label providers now receive the domain being authorized. The Kubernetes
provider keeps the hosts of every Ingress, HTTPRoute and GRPCRoute it
watches and withholds the apps of the resources that do not route the
domain, which bounds the name fallback to the hosts a resource actually
serves. Wildcard hostnames keep matching as a suffix, so nested
subdomains stay resolvable by app name.
Container labels carry no routing information, so the Docker provider
cannot narrow its results down and keeps yielding every app.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-08-19 12:18:02 +02:00
Contre and Claude Sonnet 4.6
3a216e95e2
Merge branch 'main' into feat/k8s_gateways
...
Reapply the Gateway API support on top of the KubernetesService rework
from main, which moved the service to ding-managed watchers and a
Lookup based LabelProvider, and started requiring an app to match a host
the resource actually routes.
Ingresses declare their hosts in spec.rules[].host while HTTPRoutes and
GRPCRoutes use spec.hostnames, so host extraction is now dispatched per
resource kind. Route hostnames may carry the Gateway API wildcard label,
which is matched as a suffix, and routes without hostnames are skipped
since the hosts of the gateway listeners they attach to cannot be
resolved from the route alone.
The cache key gains the resource kind because an Ingress and an
HTTPRoute may share a name within a namespace, and the catch-all path
warning is extended to HTTPRoute path matches.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-08-19 12:03:13 +02:00
3e25c6af46
chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 ( #1079 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Stavros <steveiliop56@gmail.com >
2026-08-18 20:14:45 +03:00
296c7110c6
chore(deps): bump pnpm/action-setup from 6.0.9 to 6.0.10 ( #1077 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Stavros <steveiliop56@gmail.com >
2026-08-18 20:14:38 +03:00
a62e946988
chore(deps): bump the minor-patch group with 5 updates ( #1081 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-18 19:59:22 +03:00
d933ff3905
chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 ( #1076 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Stavros <steveiliop56@gmail.com >
2026-08-18 19:58:15 +03:00
e993202a0b
chore(deps): bump docker/setup-docker-action from 5.3.0 to 5.4.0 ( #1075 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Stavros <steveiliop56@gmail.com >
2026-08-18 19:58:02 +03:00
275a63a942
chore(deps): bump the minor-patch group across 1 directory with 5 updates ( #1083 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-18 19:57:43 +03:00
a0a10cbc70
chore(deps): bump github/codeql-action/upload-sarif from 4.37.6 to 4.37.7 ( #1082 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-18 19:56:42 +03:00
Stavros and GitHub
0c47e68c09
feat: do not show oidc consent screen every time ( #989 )
2026-08-17 02:44:48 +03:00
Stavros and GitHub
61f65cfaa7
docs: add agents.md file ( #1071 )
2026-08-13 17:34:17 +03:00
Stavros and GitHub
46c8c58f45
fix: preserve query parameters for login ( #1068 )
2026-08-13 17:30:53 +03:00
Stavros and GitHub
5f03ccbcc8
feat: add simple e2e tests ( #1014 )
2026-08-13 17:30:38 +03:00
Stavros and GitHub
03841cf838
New Crowdin updates ( #1058 )
2026-08-13 15:55:25 +03:00
37272e4f4a
chore(deps): bump JamesIves/github-sponsors-readme-action from 1.6.0 to 1.6.1 ( #1069 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Stavros <steveiliop56@gmail.com >
2026-08-13 15:53:37 +03:00
e4bc5e9f42
chore(deps): bump the minor-patch group across 1 directory with 14 updates ( #1074 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-13 15:53:21 +03:00
20595b6793
chore(deps): bump github/codeql-action/upload-sarif from 4.37.4 to 4.37.6 ( #1065 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Stavros <steveiliop56@gmail.com >
2026-08-13 15:52:04 +03:00
01d316f27f
chore(deps): bump modernc.org/sqlite from 1.55.0 to 1.56.0 in the minor-patch group ( #1064 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-13 15:51:56 +03:00
e0394781f7
chore(deps): bump node from 26.5-alpine3.23 to 26.7-alpine3.23 ( #1067 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-13 15:50:00 +03:00
a0d24cf566
chore(deps): bump pnpm/action-setup from 6.0.9 to 6.0.10 ( #1062 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-13 15:46:59 +03:00
tsushanth and GitHub
f9939538b9
Remote-Name header returns capitalized uid instead of LDAP cn — cn attribute never fetched ( #1072 )
2026-08-13 15:37:03 +03:00
ad700e75e0
chore(deps): bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.4 ( #1054 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-30 19:36:24 +03:00
6d5563db2c
fix: clean request path before acls ( #1055 )
...
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-07-30 19:35:31 +03:00
Stavros
cbd92a1104
chore: use dependabot 3 day default cooldown
2026-07-30 12:29:05 +03:00
470b596281
chore(deps): bump the minor-patch group across 1 directory with 23 updates ( #1053 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-30 12:22:48 +03:00
efcb1b64ea
chore(deps): bump the minor-patch group across 1 directory with 3 updates ( #1051 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-30 12:20:48 +03:00
04eb1feb34
chore(deps): bump docker/login-action from 4.4.0 to 4.6.0 ( #1052 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-30 12:18:26 +03:00
8f029b45ad
chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 ( #1040 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-30 12:17:30 +03:00
8ff7a8597d
chore(deps): bump github/codeql-action/upload-sarif from 4.37.1 to 4.37.3 ( #1035 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-30 12:16:48 +03:00
a2c1ea865d
chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 ( #1031 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-30 12:15:44 +03:00
Stavros
2d19d5c3d4
chore: add selfh.st to sponsors section
2026-07-28 12:38:25 +03:00
Stavros
1db1714971
chore: remove unused make commands
2026-07-28 12:23:51 +03:00
Stavros
c7077a7c84
fix: do not allow empty ingresses
2026-07-21 00:37:13 +03:00
Stavros and GitHub
80bc87188e
refactor: rework acl fetching for kubernetes and docker ( #1028 )
2026-07-20 16:39:15 +03:00
Stavros and GitHub
0e7bdf6cd5
feat: experimental option to run tinyauth in oauth bridge mode ( #1027 )
2026-07-20 00:03:26 +03:00
Stavros
4db1b33034
fix: allow for oauth auto redirect in oidc authorization
2026-07-19 13:34:05 +03:00
Stavros
f6637c0f65
fix: don't force login_for=app in continue page
2026-07-19 13:03:55 +03:00
Stavros and GitHub
f43d690320
refactor: rework scheme validation in oauth controller and frontend ( #1026 )
2026-07-19 00:41:28 +03:00
Stavros
50c25e4478
fix: fix domain validator with port but no scheme and https or http
2026-07-18 18:17:24 +03:00
Stavros
d6087dc45e
fix: allow for mismatching protocol in trusted domain check - ui warnings
2026-07-18 18:06:26 +03:00
Stavros
6efb970673
fix: fix lint errors
2026-07-18 17:52:08 +03:00
a9221ece92
chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 ( #1012 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-18 17:10:09 +03:00
d5b7e60362
chore(deps): bump the minor-patch group across 1 directory with 4 updates ( #1020 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-18 17:09:38 +03:00
4d8cd86eec
chore(deps): bump the minor-patch group with 2 updates ( #1018 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-18 17:09:17 +03:00
504866a432
chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 ( #1019 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-18 17:08:27 +03:00
Stavros
0c1a64d47d
fix: make login_for optional
2026-07-18 17:05:52 +03:00
Stavros
a79438d6ec
fix: fix typo
2026-07-18 16:47:53 +03:00
Stavros
286aad2e08
test: remove obsolete test case
2026-07-18 16:37:52 +03:00
Stavros
5091fc2d7a
fix: suppress irrelevant debugs logs in acls service
2026-07-18 16:30:12 +03:00
Stavros
0fc87ad58f
fix: support for parent trusted domain, fixes #1021
2026-07-18 16:30:12 +03:00
ContreandClaude Sonnet 4.6
tsushanthandGitHub