mirror of
https://github.com/tinyauthapp/tinyauth.git
synced 2026-08-27 15:53:32 +08:00
Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Stavros
|
5c2cb08a7a |
@@ -101,6 +101,8 @@ TINYAUTH_AUTH_SESSIONMAXLIFETIME=0
|
|||||||
TINYAUTH_AUTH_LOGINTIMEOUT=300
|
TINYAUTH_AUTH_LOGINTIMEOUT=300
|
||||||
# Maximum login retries.
|
# Maximum login retries.
|
||||||
TINYAUTH_AUTH_LOGINMAXRETRIES=3
|
TINYAUTH_AUTH_LOGINMAXRETRIES=3
|
||||||
|
# Enable lockdown mode after maximum login retries. Lockdown mode limit is calculated automatically.
|
||||||
|
TINYAUTH_AUTH_LOCKDOWNENABLED=true
|
||||||
# Comma-separated list of trusted proxy addresses.
|
# Comma-separated list of trusted proxy addresses.
|
||||||
TINYAUTH_AUTH_TRUSTEDPROXIES=
|
TINYAUTH_AUTH_TRUSTEDPROXIES=
|
||||||
# ACL policy for allow-by-default or deny-by-default, available options are allow and deny, default is allow.
|
# ACL policy for allow-by-default or deny-by-default, available options are allow and deny, default is allow.
|
||||||
|
|||||||
@@ -21,7 +21,7 @@ jobs:
|
|||||||
package_json_file: ./frontend/package.json
|
package_json_file: ./frontend/package.json
|
||||||
|
|
||||||
- name: Setup go
|
- name: Setup go
|
||||||
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
|
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
|
||||||
with:
|
with:
|
||||||
go-version: "^1.26.4"
|
go-version: "^1.26.4"
|
||||||
|
|
||||||
|
|||||||
@@ -23,7 +23,7 @@ jobs:
|
|||||||
REPO: ${{ github.event.repository.name }}
|
REPO: ${{ github.event.repository.name }}
|
||||||
|
|
||||||
- name: Create release
|
- name: Create release
|
||||||
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
|
uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
|
||||||
with:
|
with:
|
||||||
prerelease: true
|
prerelease: true
|
||||||
tag_name: nightly
|
tag_name: nightly
|
||||||
@@ -68,7 +68,7 @@ jobs:
|
|||||||
package_json_file: ./frontend/package.json
|
package_json_file: ./frontend/package.json
|
||||||
|
|
||||||
- name: Install go
|
- name: Install go
|
||||||
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
|
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
|
||||||
with:
|
with:
|
||||||
go-version: "^1.26.4"
|
go-version: "^1.26.4"
|
||||||
|
|
||||||
@@ -117,7 +117,7 @@ jobs:
|
|||||||
package_json_file: ./frontend/package.json
|
package_json_file: ./frontend/package.json
|
||||||
|
|
||||||
- name: Install go
|
- name: Install go
|
||||||
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
|
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
|
||||||
with:
|
with:
|
||||||
go-version: "^1.26.4"
|
go-version: "^1.26.4"
|
||||||
|
|
||||||
@@ -476,7 +476,7 @@ jobs:
|
|||||||
merge-multiple: true
|
merge-multiple: true
|
||||||
|
|
||||||
- name: Release
|
- name: Release
|
||||||
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
|
uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
|
||||||
with:
|
with:
|
||||||
files: binaries/*
|
files: binaries/*
|
||||||
tag_name: nightly
|
tag_name: nightly
|
||||||
|
|||||||
@@ -46,7 +46,7 @@ jobs:
|
|||||||
package_json_file: ./frontend/package.json
|
package_json_file: ./frontend/package.json
|
||||||
|
|
||||||
- name: Install go
|
- name: Install go
|
||||||
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
|
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
|
||||||
with:
|
with:
|
||||||
go-version: "^1.26.4"
|
go-version: "^1.26.4"
|
||||||
|
|
||||||
@@ -92,7 +92,7 @@ jobs:
|
|||||||
package_json_file: ./frontend/package.json
|
package_json_file: ./frontend/package.json
|
||||||
|
|
||||||
- name: Install go
|
- name: Install go
|
||||||
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
|
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
|
||||||
with:
|
with:
|
||||||
go-version: "^1.26.4"
|
go-version: "^1.26.4"
|
||||||
|
|
||||||
@@ -449,6 +449,6 @@ jobs:
|
|||||||
merge-multiple: true
|
merge-multiple: true
|
||||||
|
|
||||||
- name: Release
|
- name: Release
|
||||||
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
|
uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
|
||||||
with:
|
with:
|
||||||
files: binaries/*
|
files: binaries/*
|
||||||
|
|||||||
@@ -38,6 +38,6 @@ jobs:
|
|||||||
retention-days: 5
|
retention-days: 5
|
||||||
|
|
||||||
- name: Upload to code-scanning
|
- name: Upload to code-scanning
|
||||||
uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4
|
uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
|
||||||
with:
|
with:
|
||||||
sarif_file: results.sarif
|
sarif_file: results.sarif
|
||||||
|
|||||||
@@ -62,19 +62,18 @@ If you like, you can help translate Tinyauth into more languages by visiting the
|
|||||||
|
|
||||||
Tinyauth is licensed under the GNU Affero General Public License v3.0. TL;DR — You may copy, distribute and modify the software as long as you track changes/dates in source files. Any modifications to or software including (via compiler) AGPL-licensed code must also be made available under the AGPL along with build & install instructions. If you run a modified version over a network, you must also make the source available to the users of that service. For more information about the license check the [license](LICENSE) file.
|
Tinyauth is licensed under the GNU Affero General Public License v3.0. TL;DR — You may copy, distribute and modify the software as long as you track changes/dates in source files. Any modifications to or software including (via compiler) AGPL-licensed code must also be made available under the AGPL along with build & install instructions. If you run a modified version over a network, you must also make the source available to the users of that service. For more information about the license check the [license](LICENSE) file.
|
||||||
|
|
||||||
|
|
||||||
|
## Hosting Partners
|
||||||
|
|
||||||
|
If you use one of our partners, you can help support us while getting a great hosting deal.
|
||||||
|
|
||||||
|
<div>
|
||||||
|
<a title="InstaPods" target="_blank" href="https://app.instapods.com/dashboard/pods/create?app=tinyauth&ref=tinyauth"><img src="https://instapods.com/deploy-button.svg"></a>
|
||||||
|
</div>
|
||||||
|
|
||||||
## Sponsors
|
## Sponsors
|
||||||
|
|
||||||
A big thank-you to the following individuals and companies
|
A big thank you to the following people for providing me with more coffee:
|
||||||
for their support for Tinyauth.
|
|
||||||
|
|
||||||
### Companies and Organizations
|
|
||||||
|
|
||||||
- [JetBrains for Open-Source](https://jb.gg/OpenSource)
|
|
||||||
- [CodeRabbit AI](https://www.coderabbit.ai)
|
|
||||||
- [Dosu](https://dosu.dev/)
|
|
||||||
- [InstaPods](https://instapods.com) - [Deploy Tinyauth from 3$/month](https://app.instapods.com/dashboard/pods/create?app=tinyauth&ref=tinyauth)
|
|
||||||
|
|
||||||
### Individuals
|
|
||||||
|
|
||||||
<!-- sponsors --><a href="https://github.com/erwinkramer"><img src="https://github.com/erwinkramer.png" width="64px" alt="User avatar: erwinkramer" /></a> <a href="https://github.com/nicotsx"><img src="https://github.com/nicotsx.png" width="64px" alt="User avatar: nicotsx" /></a> <a href="https://github.com/SimpleHomelab"><img src="https://github.com/SimpleHomelab.png" width="64px" alt="User avatar: SimpleHomelab" /></a> <a href="https://github.com/jmadden91"><img src="https://github.com/jmadden91.png" width="64px" alt="User avatar: jmadden91" /></a> <a href="https://github.com/tribor"><img src="https://github.com/tribor.png" width="64px" alt="User avatar: tribor" /></a> <a href="https://github.com/eliasbenb"><img src="https://github.com/eliasbenb.png" width="64px" alt="User avatar: eliasbenb" /></a> <a href="https://github.com/afunworm"><img src="https://github.com/afunworm.png" width="64px" alt="User avatar: afunworm" /></a> <a href="https://github.com/chip-well"><img src="https://github.com/chip-well.png" width="64px" alt="User avatar: chip-well" /></a> <a href="https://github.com/Lancelot-Enguerrand"><img src="https://github.com/Lancelot-Enguerrand.png" width="64px" alt="User avatar: Lancelot-Enguerrand" /></a> <a href="https://github.com/allgoewer"><img src="https://github.com/allgoewer.png" width="64px" alt="User avatar: allgoewer" /></a> <a href="https://github.com/NEANC"><img src="https://github.com/NEANC.png" width="64px" alt="User avatar: NEANC" /></a> <a href="https://github.com/axjab"><img src="https://github.com/axjab.png" width="64px" alt="User avatar: axjab" /></a> <a href="https://github.com/stegratech"><img src="https://github.com/stegratech.png" width="64px" alt="User avatar: stegratech" /></a> <a href="https://github.com/apearson"><img src="https://github.com/apearson.png" width="64px" alt="User avatar: apearson" /></a> <a href="https://github.com/Micky5991"><img src="https://github.com/Micky5991.png" width="64px" alt="User avatar: Micky5991" /></a> <!-- sponsors -->
|
<!-- sponsors --><a href="https://github.com/erwinkramer"><img src="https://github.com/erwinkramer.png" width="64px" alt="User avatar: erwinkramer" /></a> <a href="https://github.com/nicotsx"><img src="https://github.com/nicotsx.png" width="64px" alt="User avatar: nicotsx" /></a> <a href="https://github.com/SimpleHomelab"><img src="https://github.com/SimpleHomelab.png" width="64px" alt="User avatar: SimpleHomelab" /></a> <a href="https://github.com/jmadden91"><img src="https://github.com/jmadden91.png" width="64px" alt="User avatar: jmadden91" /></a> <a href="https://github.com/tribor"><img src="https://github.com/tribor.png" width="64px" alt="User avatar: tribor" /></a> <a href="https://github.com/eliasbenb"><img src="https://github.com/eliasbenb.png" width="64px" alt="User avatar: eliasbenb" /></a> <a href="https://github.com/afunworm"><img src="https://github.com/afunworm.png" width="64px" alt="User avatar: afunworm" /></a> <a href="https://github.com/chip-well"><img src="https://github.com/chip-well.png" width="64px" alt="User avatar: chip-well" /></a> <a href="https://github.com/Lancelot-Enguerrand"><img src="https://github.com/Lancelot-Enguerrand.png" width="64px" alt="User avatar: Lancelot-Enguerrand" /></a> <a href="https://github.com/allgoewer"><img src="https://github.com/allgoewer.png" width="64px" alt="User avatar: allgoewer" /></a> <a href="https://github.com/NEANC"><img src="https://github.com/NEANC.png" width="64px" alt="User avatar: NEANC" /></a> <a href="https://github.com/axjab"><img src="https://github.com/axjab.png" width="64px" alt="User avatar: axjab" /></a> <a href="https://github.com/stegratech"><img src="https://github.com/stegratech.png" width="64px" alt="User avatar: stegratech" /></a> <a href="https://github.com/apearson"><img src="https://github.com/apearson.png" width="64px" alt="User avatar: apearson" /></a> <a href="https://github.com/Micky5991"><img src="https://github.com/Micky5991.png" width="64px" alt="User avatar: Micky5991" /></a> <!-- sponsors -->
|
||||||
|
|
||||||
@@ -82,4 +81,9 @@ for their support for Tinyauth.
|
|||||||
|
|
||||||
- **Freepik** for providing the police hat and badge.
|
- **Freepik** for providing the police hat and badge.
|
||||||
- **Renee French** for the original gopher logo.
|
- **Renee French** for the original gopher logo.
|
||||||
|
- **Coderabbit AI** for providing free AI code reviews.
|
||||||
- **Syrhu** for providing the background image of the app.
|
- **Syrhu** for providing the background image of the app.
|
||||||
|
|
||||||
|
## Star History
|
||||||
|
|
||||||
|
[](https://www.star-history.com/#tinyauthapp/tinyauth&Date)
|
||||||
|
|||||||
Binary file not shown.
|
Before Width: | Height: | Size: 3.7 MiB After Width: | Height: | Size: 3.6 MiB |
@@ -116,11 +116,11 @@ func generateTotpCmd() *cli.Command {
|
|||||||
userStr := fmt.Sprintf("%s:%s:%s", user.Username, user.Password, user.TOTPSecret)
|
userStr := fmt.Sprintf("%s:%s:%s", user.Username, user.Password, user.TOTPSecret)
|
||||||
|
|
||||||
fmt.Print("\nOr add the following TOTP secret to your authenticator app: ")
|
fmt.Print("\nOr add the following TOTP secret to your authenticator app: ")
|
||||||
fmt.Print(colors.blue.Render(secret))
|
fmt.Print(colors.green.Render(secret))
|
||||||
fmt.Print("\n\n")
|
fmt.Print("\n\n")
|
||||||
|
|
||||||
fmt.Printf("Finally, add your user '%s' back to your configuration: ", user.Username)
|
fmt.Printf("Finally, add your user '%s' back to your configuration: ", user.Username)
|
||||||
fmt.Print(colors.blue.Render(userStr))
|
fmt.Print(colors.green.Render(userStr))
|
||||||
fmt.Print("\n")
|
fmt.Print("\n")
|
||||||
|
|
||||||
return nil
|
return nil
|
||||||
|
|||||||
@@ -3,6 +3,7 @@ package main
|
|||||||
import (
|
import (
|
||||||
"fmt"
|
"fmt"
|
||||||
"os"
|
"os"
|
||||||
|
"reflect"
|
||||||
"strings"
|
"strings"
|
||||||
|
|
||||||
"charm.land/huh/v2"
|
"charm.land/huh/v2"
|
||||||
@@ -31,11 +32,10 @@ func main() {
|
|||||||
Configuration: tConfig,
|
Configuration: tConfig,
|
||||||
Resources: loaders,
|
Resources: loaders,
|
||||||
Run: func(_ []string) error {
|
Run: func(_ []string) error {
|
||||||
// enable this on experimental features
|
if !reflect.DeepEqual(model.NewDefaultConfiguration(env).Experimental, tConfig.Experimental) {
|
||||||
//if !reflect.DeepEqual(model.NewDefaultConfiguration(env).Experimental, tConfig.Experimental) {
|
colors := getColors()
|
||||||
// colors := getColors()
|
fmt.Println(colors.yellow.Render("⚠") + " Experimental features are enabled, use with caution. Experimental features may change with each release.")
|
||||||
// fmt.Println(colors.yellow.Render("⚠") + " Experimental features are enabled, use with caution. Experimental features may change with each release.")
|
}
|
||||||
//}
|
|
||||||
return runCmd(*tConfig)
|
return runCmd(*tConfig)
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -32,7 +32,7 @@
|
|||||||
"react": "^19.2.7",
|
"react": "^19.2.7",
|
||||||
"react-dom": "^19.2.7",
|
"react-dom": "^19.2.7",
|
||||||
"react-hook-form": "^7.81.0",
|
"react-hook-form": "^7.81.0",
|
||||||
"react-i18next": "^17.0.10",
|
"react-i18next": "^17.0.9",
|
||||||
"react-markdown": "^10.1.0",
|
"react-markdown": "^10.1.0",
|
||||||
"react-router": "^8.2.0",
|
"react-router": "^8.2.0",
|
||||||
"sonner": "^2.0.7",
|
"sonner": "^2.0.7",
|
||||||
@@ -47,14 +47,14 @@
|
|||||||
"@types/react": "^19.2.17",
|
"@types/react": "^19.2.17",
|
||||||
"@types/react-dom": "^19.2.3",
|
"@types/react-dom": "^19.2.3",
|
||||||
"@vitejs/plugin-react": "^6.0.3",
|
"@vitejs/plugin-react": "^6.0.3",
|
||||||
"eslint": "^10.7.0",
|
"eslint": "^10.6.0",
|
||||||
"eslint-plugin-react-hooks": "^7.0.1",
|
"eslint-plugin-react-hooks": "^7.0.1",
|
||||||
"eslint-plugin-react-refresh": "^0.5.3",
|
"eslint-plugin-react-refresh": "^0.5.3",
|
||||||
"globals": "^17.7.0",
|
"globals": "^17.7.0",
|
||||||
"rollup-plugin-visualizer": "^7.0.1",
|
"rollup-plugin-visualizer": "^7.0.1",
|
||||||
"tw-animate-css": "^1.4.0",
|
"tw-animate-css": "^1.4.0",
|
||||||
"typescript": "~6.0.2",
|
"typescript": "~6.0.2",
|
||||||
"typescript-eslint": "^8.64.0",
|
"typescript-eslint": "^8.63.0",
|
||||||
"vite": "^8.1.5"
|
"vite": "^8.1.4"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
Generated
+122
-122
@@ -28,7 +28,7 @@ importers:
|
|||||||
version: 1.3.0(@types/react@19.2.17)(react@19.2.7)
|
version: 1.3.0(@types/react@19.2.17)(react@19.2.7)
|
||||||
'@tailwindcss/vite':
|
'@tailwindcss/vite':
|
||||||
specifier: ^4.3.2
|
specifier: ^4.3.2
|
||||||
version: 4.3.2(vite@8.1.5(@types/node@26.1.1)(jiti@2.7.0))
|
version: 4.3.2(vite@8.1.4(@types/node@26.1.1)(jiti@2.7.0))
|
||||||
'@tanstack/react-query':
|
'@tanstack/react-query':
|
||||||
specifier: ^5.101.2
|
specifier: ^5.101.2
|
||||||
version: 5.101.2(react@19.2.7)
|
version: 5.101.2(react@19.2.7)
|
||||||
@@ -69,8 +69,8 @@ importers:
|
|||||||
specifier: ^7.81.0
|
specifier: ^7.81.0
|
||||||
version: 7.81.0(react@19.2.7)
|
version: 7.81.0(react@19.2.7)
|
||||||
react-i18next:
|
react-i18next:
|
||||||
specifier: ^17.0.10
|
specifier: ^17.0.9
|
||||||
version: 17.0.10(i18next@26.3.6(typescript@6.0.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@6.0.3)
|
version: 17.0.9(i18next@26.3.6(typescript@6.0.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@6.0.3)
|
||||||
react-markdown:
|
react-markdown:
|
||||||
specifier: ^10.1.0
|
specifier: ^10.1.0
|
||||||
version: 10.1.0(@types/react@19.2.17)(react@19.2.7)
|
version: 10.1.0(@types/react@19.2.17)(react@19.2.7)
|
||||||
@@ -92,10 +92,10 @@ importers:
|
|||||||
devDependencies:
|
devDependencies:
|
||||||
'@eslint/js':
|
'@eslint/js':
|
||||||
specifier: ^10.0.1
|
specifier: ^10.0.1
|
||||||
version: 10.0.1(eslint@10.7.0(jiti@2.7.0))
|
version: 10.0.1(eslint@10.6.0(jiti@2.7.0))
|
||||||
'@tanstack/eslint-plugin-query':
|
'@tanstack/eslint-plugin-query':
|
||||||
specifier: ^5.101.2
|
specifier: ^5.101.2
|
||||||
version: 5.101.2(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)
|
version: 5.101.2(eslint@10.6.0(jiti@2.7.0))(typescript@6.0.3)
|
||||||
'@types/node':
|
'@types/node':
|
||||||
specifier: ^26.1.1
|
specifier: ^26.1.1
|
||||||
version: 26.1.1
|
version: 26.1.1
|
||||||
@@ -107,16 +107,16 @@ importers:
|
|||||||
version: 19.2.3(@types/react@19.2.17)
|
version: 19.2.3(@types/react@19.2.17)
|
||||||
'@vitejs/plugin-react':
|
'@vitejs/plugin-react':
|
||||||
specifier: ^6.0.3
|
specifier: ^6.0.3
|
||||||
version: 6.0.3(vite@8.1.5(@types/node@26.1.1)(jiti@2.7.0))
|
version: 6.0.3(vite@8.1.4(@types/node@26.1.1)(jiti@2.7.0))
|
||||||
eslint:
|
eslint:
|
||||||
specifier: ^10.7.0
|
specifier: ^10.6.0
|
||||||
version: 10.7.0(jiti@2.7.0)
|
version: 10.6.0(jiti@2.7.0)
|
||||||
eslint-plugin-react-hooks:
|
eslint-plugin-react-hooks:
|
||||||
specifier: ^7.0.1
|
specifier: ^7.0.1
|
||||||
version: 7.1.1(eslint@10.7.0(jiti@2.7.0))
|
version: 7.1.1(eslint@10.6.0(jiti@2.7.0))
|
||||||
eslint-plugin-react-refresh:
|
eslint-plugin-react-refresh:
|
||||||
specifier: ^0.5.3
|
specifier: ^0.5.3
|
||||||
version: 0.5.3(eslint@10.7.0(jiti@2.7.0))
|
version: 0.5.3(eslint@10.6.0(jiti@2.7.0))
|
||||||
globals:
|
globals:
|
||||||
specifier: ^17.7.0
|
specifier: ^17.7.0
|
||||||
version: 17.7.0
|
version: 17.7.0
|
||||||
@@ -130,11 +130,11 @@ importers:
|
|||||||
specifier: ~6.0.2
|
specifier: ~6.0.2
|
||||||
version: 6.0.3
|
version: 6.0.3
|
||||||
typescript-eslint:
|
typescript-eslint:
|
||||||
specifier: ^8.64.0
|
specifier: ^8.63.0
|
||||||
version: 8.64.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)
|
version: 8.63.0(eslint@10.6.0(jiti@2.7.0))(typescript@6.0.3)
|
||||||
vite:
|
vite:
|
||||||
specifier: ^8.1.5
|
specifier: ^8.1.4
|
||||||
version: 8.1.5(@types/node@26.1.1)(jiti@2.7.0)
|
version: 8.1.4(@types/node@26.1.1)(jiti@2.7.0)
|
||||||
|
|
||||||
packages:
|
packages:
|
||||||
|
|
||||||
@@ -1272,16 +1272,16 @@ packages:
|
|||||||
'@types/unist@3.0.3':
|
'@types/unist@3.0.3':
|
||||||
resolution: {integrity: sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==}
|
resolution: {integrity: sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==}
|
||||||
|
|
||||||
'@typescript-eslint/eslint-plugin@8.64.0':
|
'@typescript-eslint/eslint-plugin@8.63.0':
|
||||||
resolution: {integrity: sha512-CGvQPBxN3wZLu6Rz2kFUpZeoCm78xUic92ck39KPePkO1NPOwjCqdQnm5Q87tpWw9vcBvW8XLrDXjH9PWYtJ3Q==}
|
resolution: {integrity: sha512-rvwSgqT+DHpWdzfSzPatRLm02a0GlESt++9iy3hLCDY4BgkaLcl8LBi9Yh7XGFBpwcBE/K3024QuXWTpbz4FfQ==}
|
||||||
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
||||||
peerDependencies:
|
peerDependencies:
|
||||||
'@typescript-eslint/parser': ^8.64.0
|
'@typescript-eslint/parser': ^8.63.0
|
||||||
eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
|
eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
|
||||||
typescript: '>=4.8.4 <6.1.0'
|
typescript: '>=4.8.4 <6.1.0'
|
||||||
|
|
||||||
'@typescript-eslint/parser@8.64.0':
|
'@typescript-eslint/parser@8.63.0':
|
||||||
resolution: {integrity: sha512-KA0OshtlcCCXmbfqyZkM5pV3/WNraJf7DkJRLpyrmwPtud57H5BDX7C3k0LPSPxpprfRL+cJDGabF10mvNCoCw==}
|
resolution: {integrity: sha512-gwh4gvvlaVDKKxyfxMG+Gnu1u9X0OQBwyGLkbwB65dIzBKnxeRiJlNFqlI3zwVhNXJIs6qV7mlFCn/BIajlVig==}
|
||||||
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
||||||
peerDependencies:
|
peerDependencies:
|
||||||
eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
|
eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
|
||||||
@@ -1293,8 +1293,8 @@ packages:
|
|||||||
peerDependencies:
|
peerDependencies:
|
||||||
typescript: '>=4.8.4 <6.1.0'
|
typescript: '>=4.8.4 <6.1.0'
|
||||||
|
|
||||||
'@typescript-eslint/project-service@8.64.0':
|
'@typescript-eslint/project-service@8.63.0':
|
||||||
resolution: {integrity: sha512-tk4WpOJ6IEbGrVHaNmM0YRrwAD3exZlIK3iadQNAxh4YKk6jvUQ4ecq18n+v7+meh+cJ3j+D8nbk8sRKhlwLQg==}
|
resolution: {integrity: sha512-e5dh0/UI0ok53AlZ5wRkXCB32z/f2jUZqPR/ygAw5WYaSw8j9EoJWlS7wQjr/dmOaqWjnPIn2m+HhVPCMWGZVQ==}
|
||||||
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
||||||
peerDependencies:
|
peerDependencies:
|
||||||
typescript: '>=4.8.4 <6.1.0'
|
typescript: '>=4.8.4 <6.1.0'
|
||||||
@@ -1303,8 +1303,8 @@ packages:
|
|||||||
resolution: {integrity: sha512-r4d249KbQ1SFdpeStvob8Ih6aPPIzfqllPVOtvhve6ZcpuVcYo5/7zUWckKpHE7StASX4kTKZTLf0WQm/wPkcg==}
|
resolution: {integrity: sha512-r4d249KbQ1SFdpeStvob8Ih6aPPIzfqllPVOtvhve6ZcpuVcYo5/7zUWckKpHE7StASX4kTKZTLf0WQm/wPkcg==}
|
||||||
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
||||||
|
|
||||||
'@typescript-eslint/scope-manager@8.64.0':
|
'@typescript-eslint/scope-manager@8.63.0':
|
||||||
resolution: {integrity: sha512-CXEaFdYXjSTgKhisNkwCcJwTP8Pl+fmRrEQrri4nm3vU743bALrxzLmq7fHG/7e6a5xO0lDYeURpZmBuhHk54w==}
|
resolution: {integrity: sha512-uUyfMWCnDSN8bCpcrY8nGP2BLkQ9Xn0GsipcONcpIDWhwhO4ZSyHvyS14U3X75mzxWxL3I2UZIrenTzdzcJO8A==}
|
||||||
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
||||||
|
|
||||||
'@typescript-eslint/tsconfig-utils@8.62.1':
|
'@typescript-eslint/tsconfig-utils@8.62.1':
|
||||||
@@ -1313,14 +1313,14 @@ packages:
|
|||||||
peerDependencies:
|
peerDependencies:
|
||||||
typescript: '>=4.8.4 <6.1.0'
|
typescript: '>=4.8.4 <6.1.0'
|
||||||
|
|
||||||
'@typescript-eslint/tsconfig-utils@8.64.0':
|
'@typescript-eslint/tsconfig-utils@8.63.0':
|
||||||
resolution: {integrity: sha512-2yo8rRNKuzbVWQp5kslhANqZ2uDAeROQHBRZNPu8JDsHmeFNj/XJJhX/FhNUWmkHHvoNsKa6+tHJiig87EzsQw==}
|
resolution: {integrity: sha512-sUAbkulqBAsncKnbRP3+7CtQFRKicexnj7ZwNC6ddCR7EmrXvjvdCYMJbUIqMd6lwoEriZjwLo08aS5tSjVMHg==}
|
||||||
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
||||||
peerDependencies:
|
peerDependencies:
|
||||||
typescript: '>=4.8.4 <6.1.0'
|
typescript: '>=4.8.4 <6.1.0'
|
||||||
|
|
||||||
'@typescript-eslint/type-utils@8.64.0':
|
'@typescript-eslint/type-utils@8.63.0':
|
||||||
resolution: {integrity: sha512-XWG4Fmmv/6SvyS9nH8jWrKs6terwJvE8cyRt1CzYYqzp9OrPhCT4cMc/f7C6RZCwG+qMmiffJS1/qJP8G1URtg==}
|
resolution: {integrity: sha512-Nzzh/OGxVCOjObjaj1CQF2RUasyYy2Jfuh+zZ3PjLzG2fYRriAiZLib9UKtO+CpQAS3YHiAS+ckZDclwqI1TPA==}
|
||||||
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
||||||
peerDependencies:
|
peerDependencies:
|
||||||
eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
|
eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
|
||||||
@@ -1330,8 +1330,8 @@ packages:
|
|||||||
resolution: {integrity: sha512-ooCzJFaf+Hg+uG6fA3NRFGuFjlfNlDhBthbv4ZPU/0elCAFUfnyXUvf/WOpHz/jYwSmvU2GkR2LtyUfy1AxZ1Q==}
|
resolution: {integrity: sha512-ooCzJFaf+Hg+uG6fA3NRFGuFjlfNlDhBthbv4ZPU/0elCAFUfnyXUvf/WOpHz/jYwSmvU2GkR2LtyUfy1AxZ1Q==}
|
||||||
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
||||||
|
|
||||||
'@typescript-eslint/types@8.64.0':
|
'@typescript-eslint/types@8.63.0':
|
||||||
resolution: {integrity: sha512-qjhfuTfLXjA4IOzXvz0rTjT01BqEiIgPoUeMwiEjnaHKJMTNo8rH5pYW1a2L/0Dnux2fPC85AeyJoWaGa8WxTA==}
|
resolution: {integrity: sha512-xyLtl9DUBBFrcJS4x2pIqGLH68/tC2uOa4Z7pUteW09D3bXnnXUom4dyPikzWgB7llmIc1zoeI3aoUdC4rPK/Q==}
|
||||||
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
||||||
|
|
||||||
'@typescript-eslint/typescript-estree@8.62.1':
|
'@typescript-eslint/typescript-estree@8.62.1':
|
||||||
@@ -1340,8 +1340,8 @@ packages:
|
|||||||
peerDependencies:
|
peerDependencies:
|
||||||
typescript: '>=4.8.4 <6.1.0'
|
typescript: '>=4.8.4 <6.1.0'
|
||||||
|
|
||||||
'@typescript-eslint/typescript-estree@8.64.0':
|
'@typescript-eslint/typescript-estree@8.63.0':
|
||||||
resolution: {integrity: sha512-Pztpsn1aCE1oWDvDEfUk31nngvvF7vUB5SwHFEaZIFpvw7WJtqUHHL4plBZDA9HfWJJjL13BdG0YrJInTUvoVA==}
|
resolution: {integrity: sha512-ygBkU+B7ex5UI/gKhaqexWev79uISfIv7XQCRNYO/jmD8rGLPyWLAb3KMRT6nd8Gt9bmUBi9+iX6tBdYfOY81Q==}
|
||||||
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
||||||
peerDependencies:
|
peerDependencies:
|
||||||
typescript: '>=4.8.4 <6.1.0'
|
typescript: '>=4.8.4 <6.1.0'
|
||||||
@@ -1353,8 +1353,8 @@ packages:
|
|||||||
eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
|
eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
|
||||||
typescript: '>=4.8.4 <6.1.0'
|
typescript: '>=4.8.4 <6.1.0'
|
||||||
|
|
||||||
'@typescript-eslint/utils@8.64.0':
|
'@typescript-eslint/utils@8.63.0':
|
||||||
resolution: {integrity: sha512-aJUGVB3+U0htrrCjoA8qukw8cm8fNCGAxK/tVoS70k8aeb7DETKeFozRiVFIwEeN9WJLsjaP3ph8I60tY2XZoQ==}
|
resolution: {integrity: sha512-fUKaeAvrTuQg/Tgt3nliAUSZHJM6DlCcfyEmxCvlX8kieWSStBX+5O5Fnidtc3i2JrH+9c/GL4RY2iasd/GPTA==}
|
||||||
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
||||||
peerDependencies:
|
peerDependencies:
|
||||||
eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
|
eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
|
||||||
@@ -1364,8 +1364,8 @@ packages:
|
|||||||
resolution: {integrity: sha512-4g3BLxfdTMy8iZG0MaBkadnlRrCJ74cQiFbyEVMrkwIoqdyaXXQM22cotDvrl4x28wgIZ9rEJRoM+mmhSJpJ1g==}
|
resolution: {integrity: sha512-4g3BLxfdTMy8iZG0MaBkadnlRrCJ74cQiFbyEVMrkwIoqdyaXXQM22cotDvrl4x28wgIZ9rEJRoM+mmhSJpJ1g==}
|
||||||
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
||||||
|
|
||||||
'@typescript-eslint/visitor-keys@8.64.0':
|
'@typescript-eslint/visitor-keys@8.63.0':
|
||||||
resolution: {integrity: sha512-mrtuL8Nsn6gi2H4mo5KMTp823M+3Q19Ew/i+Zlikq20tIMm99C3Ez0dCmkWWnxut20esQvTg8aUSEhMcAOXhEw==}
|
resolution: {integrity: sha512-UexrHGnGTpbuQHct2ExOc2ZcFbGUS9FOesCxxqdBGcpI1BxYu/LZ6U8Aq6/72XtF/qRBk9nhuGHFJIXXMhPMdw==}
|
||||||
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
||||||
|
|
||||||
'@ungap/structured-clone@1.3.1':
|
'@ungap/structured-clone@1.3.1':
|
||||||
@@ -1603,8 +1603,8 @@ packages:
|
|||||||
resolution: {integrity: sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==}
|
resolution: {integrity: sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==}
|
||||||
engines: {node: ^20.19.0 || ^22.13.0 || >=24}
|
engines: {node: ^20.19.0 || ^22.13.0 || >=24}
|
||||||
|
|
||||||
eslint@10.7.0:
|
eslint@10.6.0:
|
||||||
resolution: {integrity: sha512-GVTD7s1vdIl6UYvAfriOPeY1Df8LIZjfofLvHwde+erDHGGuHyuM6xoxRxmHiebhYuD2p1vN4wWh0XzPARSGDQ==}
|
resolution: {integrity: sha512-6lVbcqSodALYo+4ELD0heG6lFiFxnLMuLkiMi2qV8LMp54N8tE8FT1GMH+ev4Ti00nFjNze2+Su6DsV5OQW3Dg==}
|
||||||
engines: {node: ^20.19.0 || ^22.13.0 || >=24}
|
engines: {node: ^20.19.0 || ^22.13.0 || >=24}
|
||||||
hasBin: true
|
hasBin: true
|
||||||
peerDependencies:
|
peerDependencies:
|
||||||
@@ -1784,8 +1784,8 @@ packages:
|
|||||||
resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==}
|
resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==}
|
||||||
engines: {node: '>= 4'}
|
engines: {node: '>= 4'}
|
||||||
|
|
||||||
ignore@7.0.6:
|
ignore@7.0.5:
|
||||||
resolution: {integrity: sha512-BAg6QkE8W+TuQLrrw0Ugr7HegXduRuuj8/ti2kSOc+jz1dmx8/WNcjr6XGnq5YpDWxFwwaavqD0+jIUOKelTsw==}
|
resolution: {integrity: sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==}
|
||||||
engines: {node: '>= 4'}
|
engines: {node: '>= 4'}
|
||||||
|
|
||||||
imurmurhash@0.1.4:
|
imurmurhash@0.1.4:
|
||||||
@@ -2071,8 +2071,8 @@ packages:
|
|||||||
ms@2.1.3:
|
ms@2.1.3:
|
||||||
resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
|
resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
|
||||||
|
|
||||||
nanoid@3.3.16:
|
nanoid@3.3.15:
|
||||||
resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==}
|
resolution: {integrity: sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==}
|
||||||
engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
|
engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
|
||||||
hasBin: true
|
hasBin: true
|
||||||
|
|
||||||
@@ -2126,8 +2126,8 @@ packages:
|
|||||||
resolution: {integrity: sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==}
|
resolution: {integrity: sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==}
|
||||||
engines: {node: '>=12'}
|
engines: {node: '>=12'}
|
||||||
|
|
||||||
postcss@8.5.19:
|
postcss@8.5.16:
|
||||||
resolution: {integrity: sha512-Mz8SaolMd8nB+G13WkORcxQKHZ/NE4xXevtkJHVuG+guo9/wYKlIMTKAqGdEmYOXR2ijPjTYNHssizdaVSUNdQ==}
|
resolution: {integrity: sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==}
|
||||||
engines: {node: ^10 || ^12 || >=14}
|
engines: {node: ^10 || ^12 || >=14}
|
||||||
|
|
||||||
powershell-utils@0.1.0:
|
powershell-utils@0.1.0:
|
||||||
@@ -2173,8 +2173,8 @@ packages:
|
|||||||
peerDependencies:
|
peerDependencies:
|
||||||
react: ^16.8.0 || ^17 || ^18 || ^19
|
react: ^16.8.0 || ^17 || ^18 || ^19
|
||||||
|
|
||||||
react-i18next@17.0.10:
|
react-i18next@17.0.9:
|
||||||
resolution: {integrity: sha512-XneHftyYA774MJkkccSkZ5oKrUpCnXIPmxio3wemqrVzCRLWiGXOMbIzObrer03fNDEnm8g8R5yYls4HcE+esg==}
|
resolution: {integrity: sha512-buLzOSqHtXxjf+qgSrLWNTXVZ1jSwO6kUv3uJqSP1roGBPgNnbhFm7OmdVwWcgf2gIbUyP0J333uPyx+Btsi3w==}
|
||||||
peerDependencies:
|
peerDependencies:
|
||||||
i18next: '>= 26.2.0'
|
i18next: '>= 26.2.0'
|
||||||
react: '>= 16.8.0'
|
react: '>= 16.8.0'
|
||||||
@@ -2357,8 +2357,8 @@ packages:
|
|||||||
resolution: {integrity: sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==}
|
resolution: {integrity: sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==}
|
||||||
engines: {node: '>= 0.8.0'}
|
engines: {node: '>= 0.8.0'}
|
||||||
|
|
||||||
typescript-eslint@8.64.0:
|
typescript-eslint@8.63.0:
|
||||||
resolution: {integrity: sha512-0qg+pDNMnqYzqH9AnNK+39tejHvsShUOUUoRUgtnTGE7QuMZhiFDnozq8nHJVq+Wae6NMLKNWLg5WmkcC/ndyQ==}
|
resolution: {integrity: sha512-xgwXyzG4sK9ALkBxbyGkTMMOS+imnW65iPhxCQMK83KhxyoDNW7l+IDqEf9vMdoUidHpOoS967RCq4eMiTexwQ==}
|
||||||
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
|
||||||
peerDependencies:
|
peerDependencies:
|
||||||
eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
|
eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
|
||||||
@@ -2430,8 +2430,8 @@ packages:
|
|||||||
vfile@6.0.3:
|
vfile@6.0.3:
|
||||||
resolution: {integrity: sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q==}
|
resolution: {integrity: sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q==}
|
||||||
|
|
||||||
vite@8.1.5:
|
vite@8.1.4:
|
||||||
resolution: {integrity: sha512-7ULLwsCdYx/nRyrpiEwvqb5TFHrMVZyBt+rg/OAXT7rgj/z+DtTDyKFeLAdDkubDVDKD8jOsndmy7m55XcfUsw==}
|
resolution: {integrity: sha512-bTT9PsdWO+MQMNG9ZXIP/qM9wGh37DFxTV/sPq9cFpHr3w4jkgef032PkAL9jAqhk3Nz8NQw3O8n6/xFkqO4QQ==}
|
||||||
engines: {node: ^20.19.0 || >=22.12.0}
|
engines: {node: ^20.19.0 || >=22.12.0}
|
||||||
hasBin: true
|
hasBin: true
|
||||||
peerDependencies:
|
peerDependencies:
|
||||||
@@ -2647,9 +2647,9 @@ snapshots:
|
|||||||
tslib: 2.8.1
|
tslib: 2.8.1
|
||||||
optional: true
|
optional: true
|
||||||
|
|
||||||
'@eslint-community/eslint-utils@4.9.1(eslint@10.7.0(jiti@2.7.0))':
|
'@eslint-community/eslint-utils@4.9.1(eslint@10.6.0(jiti@2.7.0))':
|
||||||
dependencies:
|
dependencies:
|
||||||
eslint: 10.7.0(jiti@2.7.0)
|
eslint: 10.6.0(jiti@2.7.0)
|
||||||
eslint-visitor-keys: 3.4.3
|
eslint-visitor-keys: 3.4.3
|
||||||
|
|
||||||
'@eslint-community/regexpp@4.12.2': {}
|
'@eslint-community/regexpp@4.12.2': {}
|
||||||
@@ -2670,9 +2670,9 @@ snapshots:
|
|||||||
dependencies:
|
dependencies:
|
||||||
'@types/json-schema': 7.0.15
|
'@types/json-schema': 7.0.15
|
||||||
|
|
||||||
'@eslint/js@10.0.1(eslint@10.7.0(jiti@2.7.0))':
|
'@eslint/js@10.0.1(eslint@10.6.0(jiti@2.7.0))':
|
||||||
optionalDependencies:
|
optionalDependencies:
|
||||||
eslint: 10.7.0(jiti@2.7.0)
|
eslint: 10.6.0(jiti@2.7.0)
|
||||||
|
|
||||||
'@eslint/object-schema@3.0.5': {}
|
'@eslint/object-schema@3.0.5': {}
|
||||||
|
|
||||||
@@ -3607,17 +3607,17 @@ snapshots:
|
|||||||
'@tailwindcss/oxide-win32-arm64-msvc': 4.3.2
|
'@tailwindcss/oxide-win32-arm64-msvc': 4.3.2
|
||||||
'@tailwindcss/oxide-win32-x64-msvc': 4.3.2
|
'@tailwindcss/oxide-win32-x64-msvc': 4.3.2
|
||||||
|
|
||||||
'@tailwindcss/vite@4.3.2(vite@8.1.5(@types/node@26.1.1)(jiti@2.7.0))':
|
'@tailwindcss/vite@4.3.2(vite@8.1.4(@types/node@26.1.1)(jiti@2.7.0))':
|
||||||
dependencies:
|
dependencies:
|
||||||
'@tailwindcss/node': 4.3.2
|
'@tailwindcss/node': 4.3.2
|
||||||
'@tailwindcss/oxide': 4.3.2
|
'@tailwindcss/oxide': 4.3.2
|
||||||
tailwindcss: 4.3.2
|
tailwindcss: 4.3.2
|
||||||
vite: 8.1.5(@types/node@26.1.1)(jiti@2.7.0)
|
vite: 8.1.4(@types/node@26.1.1)(jiti@2.7.0)
|
||||||
|
|
||||||
'@tanstack/eslint-plugin-query@5.101.2(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)':
|
'@tanstack/eslint-plugin-query@5.101.2(eslint@10.6.0(jiti@2.7.0))(typescript@6.0.3)':
|
||||||
dependencies:
|
dependencies:
|
||||||
'@typescript-eslint/utils': 8.62.1(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)
|
'@typescript-eslint/utils': 8.62.1(eslint@10.6.0(jiti@2.7.0))(typescript@6.0.3)
|
||||||
eslint: 10.7.0(jiti@2.7.0)
|
eslint: 10.6.0(jiti@2.7.0)
|
||||||
optionalDependencies:
|
optionalDependencies:
|
||||||
typescript: 6.0.3
|
typescript: 6.0.3
|
||||||
transitivePeerDependencies:
|
transitivePeerDependencies:
|
||||||
@@ -3675,30 +3675,30 @@ snapshots:
|
|||||||
|
|
||||||
'@types/unist@3.0.3': {}
|
'@types/unist@3.0.3': {}
|
||||||
|
|
||||||
'@typescript-eslint/eslint-plugin@8.64.0(@typescript-eslint/parser@8.64.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)':
|
'@typescript-eslint/eslint-plugin@8.63.0(@typescript-eslint/parser@8.63.0(eslint@10.6.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.6.0(jiti@2.7.0))(typescript@6.0.3)':
|
||||||
dependencies:
|
dependencies:
|
||||||
'@eslint-community/regexpp': 4.12.2
|
'@eslint-community/regexpp': 4.12.2
|
||||||
'@typescript-eslint/parser': 8.64.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)
|
'@typescript-eslint/parser': 8.63.0(eslint@10.6.0(jiti@2.7.0))(typescript@6.0.3)
|
||||||
'@typescript-eslint/scope-manager': 8.64.0
|
'@typescript-eslint/scope-manager': 8.63.0
|
||||||
'@typescript-eslint/type-utils': 8.64.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)
|
'@typescript-eslint/type-utils': 8.63.0(eslint@10.6.0(jiti@2.7.0))(typescript@6.0.3)
|
||||||
'@typescript-eslint/utils': 8.64.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)
|
'@typescript-eslint/utils': 8.63.0(eslint@10.6.0(jiti@2.7.0))(typescript@6.0.3)
|
||||||
'@typescript-eslint/visitor-keys': 8.64.0
|
'@typescript-eslint/visitor-keys': 8.63.0
|
||||||
eslint: 10.7.0(jiti@2.7.0)
|
eslint: 10.6.0(jiti@2.7.0)
|
||||||
ignore: 7.0.6
|
ignore: 7.0.5
|
||||||
natural-compare: 1.4.0
|
natural-compare: 1.4.0
|
||||||
ts-api-utils: 2.5.0(typescript@6.0.3)
|
ts-api-utils: 2.5.0(typescript@6.0.3)
|
||||||
typescript: 6.0.3
|
typescript: 6.0.3
|
||||||
transitivePeerDependencies:
|
transitivePeerDependencies:
|
||||||
- supports-color
|
- supports-color
|
||||||
|
|
||||||
'@typescript-eslint/parser@8.64.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)':
|
'@typescript-eslint/parser@8.63.0(eslint@10.6.0(jiti@2.7.0))(typescript@6.0.3)':
|
||||||
dependencies:
|
dependencies:
|
||||||
'@typescript-eslint/scope-manager': 8.64.0
|
'@typescript-eslint/scope-manager': 8.63.0
|
||||||
'@typescript-eslint/types': 8.64.0
|
'@typescript-eslint/types': 8.63.0
|
||||||
'@typescript-eslint/typescript-estree': 8.64.0(typescript@6.0.3)
|
'@typescript-eslint/typescript-estree': 8.63.0(typescript@6.0.3)
|
||||||
'@typescript-eslint/visitor-keys': 8.64.0
|
'@typescript-eslint/visitor-keys': 8.63.0
|
||||||
debug: 4.4.3
|
debug: 4.4.3
|
||||||
eslint: 10.7.0(jiti@2.7.0)
|
eslint: 10.6.0(jiti@2.7.0)
|
||||||
typescript: 6.0.3
|
typescript: 6.0.3
|
||||||
transitivePeerDependencies:
|
transitivePeerDependencies:
|
||||||
- supports-color
|
- supports-color
|
||||||
@@ -3712,10 +3712,10 @@ snapshots:
|
|||||||
transitivePeerDependencies:
|
transitivePeerDependencies:
|
||||||
- supports-color
|
- supports-color
|
||||||
|
|
||||||
'@typescript-eslint/project-service@8.64.0(typescript@6.0.3)':
|
'@typescript-eslint/project-service@8.63.0(typescript@6.0.3)':
|
||||||
dependencies:
|
dependencies:
|
||||||
'@typescript-eslint/tsconfig-utils': 8.64.0(typescript@6.0.3)
|
'@typescript-eslint/tsconfig-utils': 8.63.0(typescript@6.0.3)
|
||||||
'@typescript-eslint/types': 8.64.0
|
'@typescript-eslint/types': 8.63.0
|
||||||
debug: 4.4.3
|
debug: 4.4.3
|
||||||
typescript: 6.0.3
|
typescript: 6.0.3
|
||||||
transitivePeerDependencies:
|
transitivePeerDependencies:
|
||||||
@@ -3726,26 +3726,26 @@ snapshots:
|
|||||||
'@typescript-eslint/types': 8.62.1
|
'@typescript-eslint/types': 8.62.1
|
||||||
'@typescript-eslint/visitor-keys': 8.62.1
|
'@typescript-eslint/visitor-keys': 8.62.1
|
||||||
|
|
||||||
'@typescript-eslint/scope-manager@8.64.0':
|
'@typescript-eslint/scope-manager@8.63.0':
|
||||||
dependencies:
|
dependencies:
|
||||||
'@typescript-eslint/types': 8.64.0
|
'@typescript-eslint/types': 8.63.0
|
||||||
'@typescript-eslint/visitor-keys': 8.64.0
|
'@typescript-eslint/visitor-keys': 8.63.0
|
||||||
|
|
||||||
'@typescript-eslint/tsconfig-utils@8.62.1(typescript@6.0.3)':
|
'@typescript-eslint/tsconfig-utils@8.62.1(typescript@6.0.3)':
|
||||||
dependencies:
|
dependencies:
|
||||||
typescript: 6.0.3
|
typescript: 6.0.3
|
||||||
|
|
||||||
'@typescript-eslint/tsconfig-utils@8.64.0(typescript@6.0.3)':
|
'@typescript-eslint/tsconfig-utils@8.63.0(typescript@6.0.3)':
|
||||||
dependencies:
|
dependencies:
|
||||||
typescript: 6.0.3
|
typescript: 6.0.3
|
||||||
|
|
||||||
'@typescript-eslint/type-utils@8.64.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)':
|
'@typescript-eslint/type-utils@8.63.0(eslint@10.6.0(jiti@2.7.0))(typescript@6.0.3)':
|
||||||
dependencies:
|
dependencies:
|
||||||
'@typescript-eslint/types': 8.64.0
|
'@typescript-eslint/types': 8.63.0
|
||||||
'@typescript-eslint/typescript-estree': 8.64.0(typescript@6.0.3)
|
'@typescript-eslint/typescript-estree': 8.63.0(typescript@6.0.3)
|
||||||
'@typescript-eslint/utils': 8.64.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)
|
'@typescript-eslint/utils': 8.63.0(eslint@10.6.0(jiti@2.7.0))(typescript@6.0.3)
|
||||||
debug: 4.4.3
|
debug: 4.4.3
|
||||||
eslint: 10.7.0(jiti@2.7.0)
|
eslint: 10.6.0(jiti@2.7.0)
|
||||||
ts-api-utils: 2.5.0(typescript@6.0.3)
|
ts-api-utils: 2.5.0(typescript@6.0.3)
|
||||||
typescript: 6.0.3
|
typescript: 6.0.3
|
||||||
transitivePeerDependencies:
|
transitivePeerDependencies:
|
||||||
@@ -3753,7 +3753,7 @@ snapshots:
|
|||||||
|
|
||||||
'@typescript-eslint/types@8.62.1': {}
|
'@typescript-eslint/types@8.62.1': {}
|
||||||
|
|
||||||
'@typescript-eslint/types@8.64.0': {}
|
'@typescript-eslint/types@8.63.0': {}
|
||||||
|
|
||||||
'@typescript-eslint/typescript-estree@8.62.1(typescript@6.0.3)':
|
'@typescript-eslint/typescript-estree@8.62.1(typescript@6.0.3)':
|
||||||
dependencies:
|
dependencies:
|
||||||
@@ -3770,12 +3770,12 @@ snapshots:
|
|||||||
transitivePeerDependencies:
|
transitivePeerDependencies:
|
||||||
- supports-color
|
- supports-color
|
||||||
|
|
||||||
'@typescript-eslint/typescript-estree@8.64.0(typescript@6.0.3)':
|
'@typescript-eslint/typescript-estree@8.63.0(typescript@6.0.3)':
|
||||||
dependencies:
|
dependencies:
|
||||||
'@typescript-eslint/project-service': 8.64.0(typescript@6.0.3)
|
'@typescript-eslint/project-service': 8.63.0(typescript@6.0.3)
|
||||||
'@typescript-eslint/tsconfig-utils': 8.64.0(typescript@6.0.3)
|
'@typescript-eslint/tsconfig-utils': 8.63.0(typescript@6.0.3)
|
||||||
'@typescript-eslint/types': 8.64.0
|
'@typescript-eslint/types': 8.63.0
|
||||||
'@typescript-eslint/visitor-keys': 8.64.0
|
'@typescript-eslint/visitor-keys': 8.63.0
|
||||||
debug: 4.4.3
|
debug: 4.4.3
|
||||||
minimatch: 10.2.5
|
minimatch: 10.2.5
|
||||||
semver: 7.8.5
|
semver: 7.8.5
|
||||||
@@ -3785,24 +3785,24 @@ snapshots:
|
|||||||
transitivePeerDependencies:
|
transitivePeerDependencies:
|
||||||
- supports-color
|
- supports-color
|
||||||
|
|
||||||
'@typescript-eslint/utils@8.62.1(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)':
|
'@typescript-eslint/utils@8.62.1(eslint@10.6.0(jiti@2.7.0))(typescript@6.0.3)':
|
||||||
dependencies:
|
dependencies:
|
||||||
'@eslint-community/eslint-utils': 4.9.1(eslint@10.7.0(jiti@2.7.0))
|
'@eslint-community/eslint-utils': 4.9.1(eslint@10.6.0(jiti@2.7.0))
|
||||||
'@typescript-eslint/scope-manager': 8.62.1
|
'@typescript-eslint/scope-manager': 8.62.1
|
||||||
'@typescript-eslint/types': 8.62.1
|
'@typescript-eslint/types': 8.62.1
|
||||||
'@typescript-eslint/typescript-estree': 8.62.1(typescript@6.0.3)
|
'@typescript-eslint/typescript-estree': 8.62.1(typescript@6.0.3)
|
||||||
eslint: 10.7.0(jiti@2.7.0)
|
eslint: 10.6.0(jiti@2.7.0)
|
||||||
typescript: 6.0.3
|
typescript: 6.0.3
|
||||||
transitivePeerDependencies:
|
transitivePeerDependencies:
|
||||||
- supports-color
|
- supports-color
|
||||||
|
|
||||||
'@typescript-eslint/utils@8.64.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)':
|
'@typescript-eslint/utils@8.63.0(eslint@10.6.0(jiti@2.7.0))(typescript@6.0.3)':
|
||||||
dependencies:
|
dependencies:
|
||||||
'@eslint-community/eslint-utils': 4.9.1(eslint@10.7.0(jiti@2.7.0))
|
'@eslint-community/eslint-utils': 4.9.1(eslint@10.6.0(jiti@2.7.0))
|
||||||
'@typescript-eslint/scope-manager': 8.64.0
|
'@typescript-eslint/scope-manager': 8.63.0
|
||||||
'@typescript-eslint/types': 8.64.0
|
'@typescript-eslint/types': 8.63.0
|
||||||
'@typescript-eslint/typescript-estree': 8.64.0(typescript@6.0.3)
|
'@typescript-eslint/typescript-estree': 8.63.0(typescript@6.0.3)
|
||||||
eslint: 10.7.0(jiti@2.7.0)
|
eslint: 10.6.0(jiti@2.7.0)
|
||||||
typescript: 6.0.3
|
typescript: 6.0.3
|
||||||
transitivePeerDependencies:
|
transitivePeerDependencies:
|
||||||
- supports-color
|
- supports-color
|
||||||
@@ -3812,17 +3812,17 @@ snapshots:
|
|||||||
'@typescript-eslint/types': 8.62.1
|
'@typescript-eslint/types': 8.62.1
|
||||||
eslint-visitor-keys: 5.0.1
|
eslint-visitor-keys: 5.0.1
|
||||||
|
|
||||||
'@typescript-eslint/visitor-keys@8.64.0':
|
'@typescript-eslint/visitor-keys@8.63.0':
|
||||||
dependencies:
|
dependencies:
|
||||||
'@typescript-eslint/types': 8.64.0
|
'@typescript-eslint/types': 8.63.0
|
||||||
eslint-visitor-keys: 5.0.1
|
eslint-visitor-keys: 5.0.1
|
||||||
|
|
||||||
'@ungap/structured-clone@1.3.1': {}
|
'@ungap/structured-clone@1.3.1': {}
|
||||||
|
|
||||||
'@vitejs/plugin-react@6.0.3(vite@8.1.5(@types/node@26.1.1)(jiti@2.7.0))':
|
'@vitejs/plugin-react@6.0.3(vite@8.1.4(@types/node@26.1.1)(jiti@2.7.0))':
|
||||||
dependencies:
|
dependencies:
|
||||||
'@rolldown/pluginutils': 1.0.1
|
'@rolldown/pluginutils': 1.0.1
|
||||||
vite: 8.1.5(@types/node@26.1.1)(jiti@2.7.0)
|
vite: 8.1.4(@types/node@26.1.1)(jiti@2.7.0)
|
||||||
|
|
||||||
acorn-jsx@5.3.2(acorn@8.17.0):
|
acorn-jsx@5.3.2(acorn@8.17.0):
|
||||||
dependencies:
|
dependencies:
|
||||||
@@ -3997,20 +3997,20 @@ snapshots:
|
|||||||
|
|
||||||
escape-string-regexp@4.0.0: {}
|
escape-string-regexp@4.0.0: {}
|
||||||
|
|
||||||
eslint-plugin-react-hooks@7.1.1(eslint@10.7.0(jiti@2.7.0)):
|
eslint-plugin-react-hooks@7.1.1(eslint@10.6.0(jiti@2.7.0)):
|
||||||
dependencies:
|
dependencies:
|
||||||
'@babel/core': 7.29.0
|
'@babel/core': 7.29.0
|
||||||
'@babel/parser': 7.29.3
|
'@babel/parser': 7.29.3
|
||||||
eslint: 10.7.0(jiti@2.7.0)
|
eslint: 10.6.0(jiti@2.7.0)
|
||||||
hermes-parser: 0.25.1
|
hermes-parser: 0.25.1
|
||||||
zod: 4.4.3
|
zod: 4.4.3
|
||||||
zod-validation-error: 4.0.2(zod@4.4.3)
|
zod-validation-error: 4.0.2(zod@4.4.3)
|
||||||
transitivePeerDependencies:
|
transitivePeerDependencies:
|
||||||
- supports-color
|
- supports-color
|
||||||
|
|
||||||
eslint-plugin-react-refresh@0.5.3(eslint@10.7.0(jiti@2.7.0)):
|
eslint-plugin-react-refresh@0.5.3(eslint@10.6.0(jiti@2.7.0)):
|
||||||
dependencies:
|
dependencies:
|
||||||
eslint: 10.7.0(jiti@2.7.0)
|
eslint: 10.6.0(jiti@2.7.0)
|
||||||
|
|
||||||
eslint-scope@9.1.2:
|
eslint-scope@9.1.2:
|
||||||
dependencies:
|
dependencies:
|
||||||
@@ -4023,9 +4023,9 @@ snapshots:
|
|||||||
|
|
||||||
eslint-visitor-keys@5.0.1: {}
|
eslint-visitor-keys@5.0.1: {}
|
||||||
|
|
||||||
eslint@10.7.0(jiti@2.7.0):
|
eslint@10.6.0(jiti@2.7.0):
|
||||||
dependencies:
|
dependencies:
|
||||||
'@eslint-community/eslint-utils': 4.9.1(eslint@10.7.0(jiti@2.7.0))
|
'@eslint-community/eslint-utils': 4.9.1(eslint@10.6.0(jiti@2.7.0))
|
||||||
'@eslint-community/regexpp': 4.12.2
|
'@eslint-community/regexpp': 4.12.2
|
||||||
'@eslint/config-array': 0.23.5
|
'@eslint/config-array': 0.23.5
|
||||||
'@eslint/config-helpers': 0.6.0
|
'@eslint/config-helpers': 0.6.0
|
||||||
@@ -4226,7 +4226,7 @@ snapshots:
|
|||||||
|
|
||||||
ignore@5.3.2: {}
|
ignore@5.3.2: {}
|
||||||
|
|
||||||
ignore@7.0.6: {}
|
ignore@7.0.5: {}
|
||||||
|
|
||||||
imurmurhash@0.1.4: {}
|
imurmurhash@0.1.4: {}
|
||||||
|
|
||||||
@@ -4591,7 +4591,7 @@ snapshots:
|
|||||||
|
|
||||||
ms@2.1.3: {}
|
ms@2.1.3: {}
|
||||||
|
|
||||||
nanoid@3.3.16: {}
|
nanoid@3.3.15: {}
|
||||||
|
|
||||||
natural-compare@1.4.0: {}
|
natural-compare@1.4.0: {}
|
||||||
|
|
||||||
@@ -4648,9 +4648,9 @@ snapshots:
|
|||||||
|
|
||||||
picomatch@4.0.5: {}
|
picomatch@4.0.5: {}
|
||||||
|
|
||||||
postcss@8.5.19:
|
postcss@8.5.16:
|
||||||
dependencies:
|
dependencies:
|
||||||
nanoid: 3.3.16
|
nanoid: 3.3.15
|
||||||
picocolors: 1.1.1
|
picocolors: 1.1.1
|
||||||
source-map-js: 1.2.1
|
source-map-js: 1.2.1
|
||||||
|
|
||||||
@@ -4736,7 +4736,7 @@ snapshots:
|
|||||||
dependencies:
|
dependencies:
|
||||||
react: 19.2.7
|
react: 19.2.7
|
||||||
|
|
||||||
react-i18next@17.0.10(i18next@26.3.6(typescript@6.0.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@6.0.3):
|
react-i18next@17.0.9(i18next@26.3.6(typescript@6.0.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@6.0.3):
|
||||||
dependencies:
|
dependencies:
|
||||||
'@babel/runtime': 7.29.7
|
'@babel/runtime': 7.29.7
|
||||||
html-parse-stringify: 3.0.1
|
html-parse-stringify: 3.0.1
|
||||||
@@ -4923,13 +4923,13 @@ snapshots:
|
|||||||
dependencies:
|
dependencies:
|
||||||
prelude-ls: 1.2.1
|
prelude-ls: 1.2.1
|
||||||
|
|
||||||
typescript-eslint@8.64.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3):
|
typescript-eslint@8.63.0(eslint@10.6.0(jiti@2.7.0))(typescript@6.0.3):
|
||||||
dependencies:
|
dependencies:
|
||||||
'@typescript-eslint/eslint-plugin': 8.64.0(@typescript-eslint/parser@8.64.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)
|
'@typescript-eslint/eslint-plugin': 8.63.0(@typescript-eslint/parser@8.63.0(eslint@10.6.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.6.0(jiti@2.7.0))(typescript@6.0.3)
|
||||||
'@typescript-eslint/parser': 8.64.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)
|
'@typescript-eslint/parser': 8.63.0(eslint@10.6.0(jiti@2.7.0))(typescript@6.0.3)
|
||||||
'@typescript-eslint/typescript-estree': 8.64.0(typescript@6.0.3)
|
'@typescript-eslint/typescript-estree': 8.63.0(typescript@6.0.3)
|
||||||
'@typescript-eslint/utils': 8.64.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)
|
'@typescript-eslint/utils': 8.63.0(eslint@10.6.0(jiti@2.7.0))(typescript@6.0.3)
|
||||||
eslint: 10.7.0(jiti@2.7.0)
|
eslint: 10.6.0(jiti@2.7.0)
|
||||||
typescript: 6.0.3
|
typescript: 6.0.3
|
||||||
transitivePeerDependencies:
|
transitivePeerDependencies:
|
||||||
- supports-color
|
- supports-color
|
||||||
@@ -5010,11 +5010,11 @@ snapshots:
|
|||||||
'@types/unist': 3.0.3
|
'@types/unist': 3.0.3
|
||||||
vfile-message: 4.0.3
|
vfile-message: 4.0.3
|
||||||
|
|
||||||
vite@8.1.5(@types/node@26.1.1)(jiti@2.7.0):
|
vite@8.1.4(@types/node@26.1.1)(jiti@2.7.0):
|
||||||
dependencies:
|
dependencies:
|
||||||
lightningcss: 1.32.0
|
lightningcss: 1.32.0
|
||||||
picomatch: 4.0.5
|
picomatch: 4.0.5
|
||||||
postcss: 8.5.19
|
postcss: 8.5.16
|
||||||
rolldown: 1.1.5
|
rolldown: 1.1.5
|
||||||
tinyglobby: 0.2.17
|
tinyglobby: 0.2.17
|
||||||
optionalDependencies:
|
optionalDependencies:
|
||||||
|
|||||||
@@ -32,8 +32,8 @@ import { useTranslation } from "react-i18next";
|
|||||||
import { useLocation } from "react-router";
|
import { useLocation } from "react-router";
|
||||||
import { useRef } from "react";
|
import { useRef } from "react";
|
||||||
import {
|
import {
|
||||||
searchParamsFromObject,
|
|
||||||
useScreenParams,
|
useScreenParams,
|
||||||
|
recompileScreenParams,
|
||||||
} from "@/lib/hooks/screen-params";
|
} from "@/lib/hooks/screen-params";
|
||||||
import { useMutation } from "@tanstack/react-query";
|
import { useMutation } from "@tanstack/react-query";
|
||||||
import axios from "axios";
|
import axios from "axios";
|
||||||
@@ -70,13 +70,7 @@ export const QuickActions = () => {
|
|||||||
const redirectTimer = useRef<number | null>(null);
|
const redirectTimer = useRef<number | null>(null);
|
||||||
const searchParams = new URLSearchParams(search);
|
const searchParams = new URLSearchParams(search);
|
||||||
const screenParams = useScreenParams(searchParams);
|
const screenParams = useScreenParams(searchParams);
|
||||||
const compiledParams = (() => {
|
const compiledParams = recompileScreenParams(screenParams);
|
||||||
const params = searchParamsFromObject(screenParams).toString();
|
|
||||||
if (params.length > 0) {
|
|
||||||
return `?${params}`;
|
|
||||||
}
|
|
||||||
return "";
|
|
||||||
})();
|
|
||||||
|
|
||||||
const [isOpen, setIsOpen] = useState(false);
|
const [isOpen, setIsOpen] = useState(false);
|
||||||
|
|
||||||
|
|||||||
@@ -1,11 +1,10 @@
|
|||||||
type UseLoginForProps = {
|
type UseLoginForProps = {
|
||||||
login_for?: "oidc" | "app";
|
login_for?: "oidc" | "app";
|
||||||
params: URLSearchParams;
|
compiledParams: string;
|
||||||
};
|
};
|
||||||
|
|
||||||
export const useLoginFor = (props: UseLoginForProps): string => {
|
export const useLoginFor = (props: UseLoginForProps): string => {
|
||||||
const { login_for, params } = props;
|
const { login_for, compiledParams } = props;
|
||||||
const compiledParams = params.toString() ? "?" + params.toString() : "";
|
|
||||||
|
|
||||||
switch (login_for) {
|
switch (login_for) {
|
||||||
case "oidc":
|
case "oidc":
|
||||||
@@ -13,9 +12,6 @@ export const useLoginFor = (props: UseLoginForProps): string => {
|
|||||||
case "app":
|
case "app":
|
||||||
return "/continue" + compiledParams;
|
return "/continue" + compiledParams;
|
||||||
default:
|
default:
|
||||||
if (params.get("redirect_uri")) {
|
|
||||||
return "/continue" + compiledParams
|
|
||||||
}
|
|
||||||
return "/logout";
|
return "/logout";
|
||||||
}
|
}
|
||||||
};
|
};
|
||||||
|
|||||||
@@ -75,21 +75,18 @@ export const useRedirectUri = (
|
|||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
// https://www.geeksforgeeks.org/javascript/how-to-check-if-a-string-is-a-valid-ip-address-format-in-javascript
|
// ported from internal/controller/oauth_controller.go
|
||||||
const isIP = (str: string): boolean => {
|
const getEffectivePort = (url: URL): string => {
|
||||||
const ipv4 =
|
if (url.port) {
|
||||||
/^(\d{1,3}\.){3}\d{1,3}$/;
|
return url.port;
|
||||||
const ipv6 =
|
|
||||||
/^([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$/;
|
|
||||||
return ipv4.test(str) || ipv6.test(str) || str.startsWith("[");
|
|
||||||
}
|
|
||||||
|
|
||||||
const trimPeriod = (str: string): string => {
|
|
||||||
if(str.lastIndexOf('.') === (str.length - 1)){
|
|
||||||
str = str.substring(0, str.length - 1);
|
|
||||||
}
|
}
|
||||||
return str
|
|
||||||
}
|
if (url.protocol == "https:") {
|
||||||
|
return "443";
|
||||||
|
}
|
||||||
|
|
||||||
|
return "80";
|
||||||
|
};
|
||||||
|
|
||||||
export const isTrustedDomain = (
|
export const isTrustedDomain = (
|
||||||
url: URL,
|
url: URL,
|
||||||
@@ -97,15 +94,15 @@ export const isTrustedDomain = (
|
|||||||
cookieDomain: string,
|
cookieDomain: string,
|
||||||
subdomainsEnabled: boolean,
|
subdomainsEnabled: boolean,
|
||||||
): boolean => {
|
): boolean => {
|
||||||
if (isIP(url.hostname)) {
|
if (url.protocol != appUrl.protocol) {
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (url.port != appUrl.port) {
|
if (getEffectivePort(url) != getEffectivePort(appUrl)) {
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (trimPeriod(url.hostname) == trimPeriod(appUrl.hostname)) {
|
if (url.hostname == appUrl.hostname) {
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -113,6 +110,9 @@ export const isTrustedDomain = (
|
|||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
return trimPeriod(url.hostname).endsWith("." + cookieDomain.toLowerCase())
|
if (url.hostname.endsWith("." + cookieDomain.toLowerCase())) {
|
||||||
|| trimPeriod(url.hostname) == cookieDomain.toLowerCase();
|
return true;
|
||||||
|
}
|
||||||
|
|
||||||
|
return false;
|
||||||
};
|
};
|
||||||
|
|||||||
@@ -27,10 +27,16 @@ export function useScreenParams(params: URLSearchParams): ScreenParams {
|
|||||||
return parsed.data;
|
return parsed.data;
|
||||||
}
|
}
|
||||||
|
|
||||||
export function searchParamsFromObject(obj: object): URLSearchParams {
|
export function recompileScreenParams(params: ScreenParams): string {
|
||||||
return new URLSearchParams(
|
const p = new URLSearchParams(
|
||||||
Object.fromEntries(
|
Object.fromEntries(
|
||||||
Object.entries(obj).filter(([, v]) => v !== undefined),
|
Object.entries(params).filter(([, v]) => v !== undefined),
|
||||||
) as Record<string, string>,
|
) as Record<string, string>,
|
||||||
);
|
).toString();
|
||||||
|
|
||||||
|
if (p.length > 0) {
|
||||||
|
return "?" + p;
|
||||||
|
}
|
||||||
|
|
||||||
|
return "";
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -22,7 +22,7 @@ import {
|
|||||||
TooltipTrigger,
|
TooltipTrigger,
|
||||||
} from "@/components/ui/tooltip";
|
} from "@/components/ui/tooltip";
|
||||||
import {
|
import {
|
||||||
searchParamsFromObject,
|
recompileScreenParams,
|
||||||
useScreenParams,
|
useScreenParams,
|
||||||
} from "@/lib/hooks/screen-params";
|
} from "@/lib/hooks/screen-params";
|
||||||
import { useEffect } from "react";
|
import { useEffect } from "react";
|
||||||
@@ -89,13 +89,7 @@ export const AuthorizePage = () => {
|
|||||||
const searchParams = new URLSearchParams(search);
|
const searchParams = new URLSearchParams(search);
|
||||||
const screenParams = useScreenParams(searchParams);
|
const screenParams = useScreenParams(searchParams);
|
||||||
const isOidc = screenParams.login_for === "oidc";
|
const isOidc = screenParams.login_for === "oidc";
|
||||||
const compiledParams = (() => {
|
const compiledParams = recompileScreenParams(screenParams);
|
||||||
const params = searchParamsFromObject(screenParams).toString();
|
|
||||||
if (params.length > 0) {
|
|
||||||
return `?${params}`;
|
|
||||||
}
|
|
||||||
return "";
|
|
||||||
})();
|
|
||||||
|
|
||||||
// TODO: maybe a better way to do this
|
// TODO: maybe a better way to do this
|
||||||
const shouldAutoAuthorize =
|
const shouldAutoAuthorize =
|
||||||
|
|||||||
@@ -13,7 +13,7 @@ import { Navigate, useLocation, useNavigate } from "react-router";
|
|||||||
import { useCallback, useEffect, useRef, useState } from "react";
|
import { useCallback, useEffect, useRef, useState } from "react";
|
||||||
import { useRedirectUri } from "@/lib/hooks/redirect-uri";
|
import { useRedirectUri } from "@/lib/hooks/redirect-uri";
|
||||||
import {
|
import {
|
||||||
searchParamsFromObject,
|
recompileScreenParams,
|
||||||
useScreenParams,
|
useScreenParams,
|
||||||
} from "@/lib/hooks/screen-params";
|
} from "@/lib/hooks/screen-params";
|
||||||
|
|
||||||
@@ -32,13 +32,7 @@ export const ContinuePage = () => {
|
|||||||
const screenParams = useScreenParams(searchParams);
|
const screenParams = useScreenParams(searchParams);
|
||||||
const redirectUri = screenParams.redirect_uri;
|
const redirectUri = screenParams.redirect_uri;
|
||||||
const isAppLogin = screenParams.login_for === "app";
|
const isAppLogin = screenParams.login_for === "app";
|
||||||
const compiledParams = (() => {
|
const recompiledParams = recompileScreenParams(screenParams);
|
||||||
const params = searchParamsFromObject(screenParams).toString();
|
|
||||||
if (params.length > 0) {
|
|
||||||
return `?${params}`;
|
|
||||||
}
|
|
||||||
return "";
|
|
||||||
})();
|
|
||||||
|
|
||||||
const { url, valid, trusted, allowedProto, httpsDowngrade } = useRedirectUri(
|
const { url, valid, trusted, allowedProto, httpsDowngrade } = useRedirectUri(
|
||||||
redirectUri,
|
redirectUri,
|
||||||
@@ -95,7 +89,7 @@ export const ContinuePage = () => {
|
|||||||
}, [shouldAutoRedirect, redirectToTarget]);
|
}, [shouldAutoRedirect, redirectToTarget]);
|
||||||
|
|
||||||
if (!auth.authenticated) {
|
if (!auth.authenticated) {
|
||||||
return <Navigate to={`/login${compiledParams}`} replace />;
|
return <Navigate to={`/login${recompiledParams}`} replace />;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (!hasValidRedirect || !isAppLogin) {
|
if (!hasValidRedirect || !isAppLogin) {
|
||||||
|
|||||||
@@ -12,8 +12,8 @@ import { useTranslation } from "react-i18next";
|
|||||||
import Markdown from "react-markdown";
|
import Markdown from "react-markdown";
|
||||||
import { useLocation } from "react-router";
|
import { useLocation } from "react-router";
|
||||||
import {
|
import {
|
||||||
searchParamsFromObject,
|
recompileScreenParams,
|
||||||
useScreenParams,
|
useScreenParams,
|
||||||
} from "@/lib/hooks/screen-params";
|
} from "@/lib/hooks/screen-params";
|
||||||
|
|
||||||
export const ForgotPasswordPage = () => {
|
export const ForgotPasswordPage = () => {
|
||||||
@@ -22,13 +22,7 @@ export const ForgotPasswordPage = () => {
|
|||||||
const { search } = useLocation();
|
const { search } = useLocation();
|
||||||
const searchParams = new URLSearchParams(search);
|
const searchParams = new URLSearchParams(search);
|
||||||
const screenParams = useScreenParams(searchParams);
|
const screenParams = useScreenParams(searchParams);
|
||||||
const compiledParams = (() => {
|
const compiledParams = recompileScreenParams(screenParams);
|
||||||
const params = searchParamsFromObject(screenParams).toString();
|
|
||||||
if (params.length > 0) {
|
|
||||||
return `?${params}`;
|
|
||||||
}
|
|
||||||
return "";
|
|
||||||
})();
|
|
||||||
|
|
||||||
return (
|
return (
|
||||||
<Card>
|
<Card>
|
||||||
|
|||||||
@@ -26,7 +26,7 @@ import { useTranslation } from "react-i18next";
|
|||||||
import { Navigate, useLocation } from "react-router";
|
import { Navigate, useLocation } from "react-router";
|
||||||
import { toast } from "sonner";
|
import { toast } from "sonner";
|
||||||
import {
|
import {
|
||||||
searchParamsFromObject,
|
recompileScreenParams,
|
||||||
useScreenParams,
|
useScreenParams,
|
||||||
} from "@/lib/hooks/screen-params";
|
} from "@/lib/hooks/screen-params";
|
||||||
import { useLoginFor } from "@/lib/hooks/login-for";
|
import { useLoginFor } from "@/lib/hooks/login-for";
|
||||||
@@ -63,16 +63,13 @@ export const LoginPage = () => {
|
|||||||
|
|
||||||
const searchParams = new URLSearchParams(search);
|
const searchParams = new URLSearchParams(search);
|
||||||
const screenParams = useScreenParams(searchParams);
|
const screenParams = useScreenParams(searchParams);
|
||||||
const compiledParams = (() => {
|
const compiledParams = recompileScreenParams({
|
||||||
const params = searchParamsFromObject(screenParams).toString();
|
...screenParams,
|
||||||
if (params.length > 0) {
|
oidc_prompt: undefined,
|
||||||
return `?${params}`;
|
});
|
||||||
}
|
|
||||||
return "";
|
|
||||||
})();
|
|
||||||
const loginForUrl = useLoginFor({
|
const loginForUrl = useLoginFor({
|
||||||
login_for: screenParams.login_for,
|
login_for: screenParams.login_for,
|
||||||
params: searchParamsFromObject({ ...screenParams, oidc_prompt: undefined}),
|
compiledParams,
|
||||||
});
|
});
|
||||||
|
|
||||||
const [isOauthAutoRedirect, setIsOauthAutoRedirect] = useState(
|
const [isOauthAutoRedirect, setIsOauthAutoRedirect] = useState(
|
||||||
|
|||||||
@@ -17,8 +17,8 @@ import { type UseMutationResult } from "@tanstack/react-query";
|
|||||||
import { type AxiosResponse } from "axios";
|
import { type AxiosResponse } from "axios";
|
||||||
import { useLocation } from "react-router";
|
import { useLocation } from "react-router";
|
||||||
import {
|
import {
|
||||||
searchParamsFromObject,
|
|
||||||
useScreenParams,
|
useScreenParams,
|
||||||
|
recompileScreenParams,
|
||||||
} from "@/lib/hooks/screen-params";
|
} from "@/lib/hooks/screen-params";
|
||||||
|
|
||||||
export const LogoutPage = () => {
|
export const LogoutPage = () => {
|
||||||
@@ -29,13 +29,7 @@ export const LogoutPage = () => {
|
|||||||
const redirectTimer = useRef<number | null>(null);
|
const redirectTimer = useRef<number | null>(null);
|
||||||
const searchParams = new URLSearchParams(search);
|
const searchParams = new URLSearchParams(search);
|
||||||
const screenParams = useScreenParams(searchParams);
|
const screenParams = useScreenParams(searchParams);
|
||||||
const compiledParams = (() => {
|
const compiledParams = recompileScreenParams(screenParams);
|
||||||
const params = searchParamsFromObject(screenParams).toString();
|
|
||||||
if (params.length > 0) {
|
|
||||||
return `?${params}`;
|
|
||||||
}
|
|
||||||
return "";
|
|
||||||
})();
|
|
||||||
|
|
||||||
const logoutMutation = useMutation({
|
const logoutMutation = useMutation({
|
||||||
mutationFn: () => axios.post("/api/user/logout"),
|
mutationFn: () => axios.post("/api/user/logout"),
|
||||||
|
|||||||
@@ -17,7 +17,7 @@ import { useTranslation } from "react-i18next";
|
|||||||
import { Navigate, useLocation } from "react-router";
|
import { Navigate, useLocation } from "react-router";
|
||||||
import { toast } from "sonner";
|
import { toast } from "sonner";
|
||||||
import {
|
import {
|
||||||
searchParamsFromObject,
|
recompileScreenParams,
|
||||||
useScreenParams,
|
useScreenParams,
|
||||||
} from "@/lib/hooks/screen-params";
|
} from "@/lib/hooks/screen-params";
|
||||||
import { useLoginFor } from "@/lib/hooks/login-for";
|
import { useLoginFor } from "@/lib/hooks/login-for";
|
||||||
@@ -32,16 +32,10 @@ export const TotpPage = () => {
|
|||||||
|
|
||||||
const searchParams = new URLSearchParams(search);
|
const searchParams = new URLSearchParams(search);
|
||||||
const screenParams = useScreenParams(searchParams);
|
const screenParams = useScreenParams(searchParams);
|
||||||
const compiledParams = (() => {
|
const compiledParams = recompileScreenParams(screenParams);
|
||||||
const params = searchParamsFromObject(screenParams).toString();
|
|
||||||
if (params.length > 0) {
|
|
||||||
return `?${params}`;
|
|
||||||
}
|
|
||||||
return "";
|
|
||||||
})();
|
|
||||||
const loginForUrl = useLoginFor({
|
const loginForUrl = useLoginFor({
|
||||||
login_for: screenParams.login_for,
|
login_for: screenParams.login_for,
|
||||||
params: searchParamsFromObject(screenParams),
|
compiledParams,
|
||||||
});
|
});
|
||||||
|
|
||||||
const totpMutation = useMutation({
|
const totpMutation = useMutation({
|
||||||
|
|||||||
@@ -9,7 +9,7 @@ require (
|
|||||||
github.com/docker/docker v28.5.2+incompatible
|
github.com/docker/docker v28.5.2+incompatible
|
||||||
github.com/gin-gonic/gin v1.12.0
|
github.com/gin-gonic/gin v1.12.0
|
||||||
github.com/go-jose/go-jose/v4 v4.1.4
|
github.com/go-jose/go-jose/v4 v4.1.4
|
||||||
github.com/go-ldap/ldap/v3 v3.4.14
|
github.com/go-ldap/ldap/v3 v3.4.13
|
||||||
github.com/golang-jwt/jwt/v5 v5.3.1
|
github.com/golang-jwt/jwt/v5 v5.3.1
|
||||||
github.com/golang-migrate/migrate/v4 v4.19.1
|
github.com/golang-migrate/migrate/v4 v4.19.1
|
||||||
github.com/google/go-querystring v1.2.0
|
github.com/google/go-querystring v1.2.0
|
||||||
@@ -24,13 +24,12 @@ require (
|
|||||||
github.com/weppos/publicsuffix-go v0.50.3
|
github.com/weppos/publicsuffix-go v0.50.3
|
||||||
go.uber.org/dig v1.19.0
|
go.uber.org/dig v1.19.0
|
||||||
golang.org/x/crypto v0.54.0
|
golang.org/x/crypto v0.54.0
|
||||||
golang.org/x/net v0.57.0
|
|
||||||
golang.org/x/oauth2 v0.36.0
|
golang.org/x/oauth2 v0.36.0
|
||||||
golang.org/x/tools v0.48.0
|
golang.org/x/tools v0.48.0
|
||||||
gopkg.in/yaml.v3 v3.0.1
|
gopkg.in/yaml.v3 v3.0.1
|
||||||
k8s.io/apimachinery v0.36.2
|
k8s.io/apimachinery v0.36.2
|
||||||
k8s.io/client-go v0.36.2
|
k8s.io/client-go v0.36.2
|
||||||
modernc.org/sqlite v1.54.0
|
modernc.org/sqlite v1.53.0
|
||||||
)
|
)
|
||||||
|
|
||||||
require (
|
require (
|
||||||
@@ -73,7 +72,7 @@ require (
|
|||||||
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
|
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
|
||||||
github.com/gabriel-vasile/mimetype v1.4.12 // indirect
|
github.com/gabriel-vasile/mimetype v1.4.12 // indirect
|
||||||
github.com/gin-contrib/sse v1.1.0 // indirect
|
github.com/gin-contrib/sse v1.1.0 // indirect
|
||||||
github.com/go-asn1-ber/asn1-ber v1.5.8 // indirect
|
github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
|
||||||
github.com/go-logr/logr v1.4.3 // indirect
|
github.com/go-logr/logr v1.4.3 // indirect
|
||||||
github.com/go-logr/stdr v1.2.2 // indirect
|
github.com/go-logr/stdr v1.2.2 // indirect
|
||||||
github.com/go-openapi/jsonreference v0.20.4 // indirect
|
github.com/go-openapi/jsonreference v0.20.4 // indirect
|
||||||
@@ -136,6 +135,7 @@ require (
|
|||||||
golang.org/x/arch v0.22.0 // indirect
|
golang.org/x/arch v0.22.0 // indirect
|
||||||
golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 // indirect
|
golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 // indirect
|
||||||
golang.org/x/mod v0.38.0 // indirect
|
golang.org/x/mod v0.38.0 // indirect
|
||||||
|
golang.org/x/net v0.57.0 // indirect
|
||||||
golang.org/x/sync v0.22.0 // indirect
|
golang.org/x/sync v0.22.0 // indirect
|
||||||
golang.org/x/sys v0.47.0 // indirect
|
golang.org/x/sys v0.47.0 // indirect
|
||||||
golang.org/x/term v0.45.0 // indirect
|
golang.org/x/term v0.45.0 // indirect
|
||||||
@@ -147,7 +147,7 @@ require (
|
|||||||
k8s.io/klog/v2 v2.140.0 // indirect
|
k8s.io/klog/v2 v2.140.0 // indirect
|
||||||
k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
|
k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
|
||||||
k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
|
k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
|
||||||
modernc.org/libc v1.74.1 // indirect
|
modernc.org/libc v1.73.4 // indirect
|
||||||
modernc.org/mathutil v1.7.1 // indirect
|
modernc.org/mathutil v1.7.1 // indirect
|
||||||
modernc.org/memory v1.11.0 // indirect
|
modernc.org/memory v1.11.0 // indirect
|
||||||
rsc.io/qr v0.2.0 // indirect
|
rsc.io/qr v0.2.0 // indirect
|
||||||
|
|||||||
@@ -113,12 +113,12 @@ github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w
|
|||||||
github.com/gin-contrib/sse v1.1.0/go.mod h1:hxRZ5gVpWMT7Z0B0gSNYqqsSCNIJMjzvm6fqCz9vjwM=
|
github.com/gin-contrib/sse v1.1.0/go.mod h1:hxRZ5gVpWMT7Z0B0gSNYqqsSCNIJMjzvm6fqCz9vjwM=
|
||||||
github.com/gin-gonic/gin v1.12.0 h1:b3YAbrZtnf8N//yjKeU2+MQsh2mY5htkZidOM7O0wG8=
|
github.com/gin-gonic/gin v1.12.0 h1:b3YAbrZtnf8N//yjKeU2+MQsh2mY5htkZidOM7O0wG8=
|
||||||
github.com/gin-gonic/gin v1.12.0/go.mod h1:VxccKfsSllpKshkBWgVgRniFFAzFb9csfngsqANjnLc=
|
github.com/gin-gonic/gin v1.12.0/go.mod h1:VxccKfsSllpKshkBWgVgRniFFAzFb9csfngsqANjnLc=
|
||||||
github.com/go-asn1-ber/asn1-ber v1.5.8 h1:H9AZkK22UOmfX8J84ubyaZxKJZ3FMHVwn8swoMML7iQ=
|
github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
|
||||||
github.com/go-asn1-ber/asn1-ber v1.5.8/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
|
github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
|
||||||
github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
|
github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
|
||||||
github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||||
github.com/go-ldap/ldap/v3 v3.4.14 h1:D6PYdEgsaVzsXyr6w/yDC06Ria4uUhWm+Rb+er8lfAs=
|
github.com/go-ldap/ldap/v3 v3.4.13 h1:+x1nG9h+MZN7h/lUi5Q3UZ0fJ1GyDQYbPvbuH38baDQ=
|
||||||
github.com/go-ldap/ldap/v3 v3.4.14/go.mod h1:S4eJUMUNjDkE0ZJtIZdybwyb03sGGLW6gxXT1Hs8VKA=
|
github.com/go-ldap/ldap/v3 v3.4.13/go.mod h1:LxsGZV6vbaK0sIvYfsv47rfh4ca0JXokCoKjZxsszv0=
|
||||||
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
||||||
github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
|
github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
|
||||||
github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
|
github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
|
||||||
@@ -392,20 +392,20 @@ k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a h1:xCeOEAOoGYl2jnJoHkC3hk
|
|||||||
k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
|
k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
|
||||||
k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU=
|
k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU=
|
||||||
k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
|
k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
|
||||||
modernc.org/cc/v4 v4.29.0 h1:CXgwL8cvxmyzBQZzbSl/6xFtMCryb6u8IOqDci39cgc=
|
modernc.org/cc/v4 v4.28.4 h1:Hd/4Es+MBj+/7hSdZaisNyu6bv3V0Dp2MdllyfqaH+c=
|
||||||
modernc.org/cc/v4 v4.29.0/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
|
modernc.org/cc/v4 v4.28.4/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
|
||||||
modernc.org/ccgo/v4 v4.34.6 h1:sBgfIwyN0TQ9C5hwIeuqyeAKyMWnbvj2fvpF4L11uzU=
|
modernc.org/ccgo/v4 v4.34.4 h1:OVnSOWQjVKOYkFxoHYB+qQmSHK5gqMqARM+K9DpR/Ws=
|
||||||
modernc.org/ccgo/v4 v4.34.6/go.mod h1:SZ8YcN9NG7XVsQYdm6jYBvi8PQP1qi+kqB6OhjqI3Fk=
|
modernc.org/ccgo/v4 v4.34.4/go.mod h1:qdKqE8FNIYyysougB1RX9MxCzp5oJOcQXSobANJ4TuE=
|
||||||
modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
|
modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
|
||||||
modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
|
modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
|
||||||
modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
|
modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
|
||||||
modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
|
modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
|
||||||
modernc.org/gc/v3 v3.1.4 h1:2g65LGVSmFQrXeITAw97x7hCRvZFcyE1uDP+7Vng7JI=
|
modernc.org/gc/v3 v3.1.3 h1:6QAplYyVO+KdPW3pGnqmJDUxtkec8ooEWvks/hhU3lc=
|
||||||
modernc.org/gc/v3 v3.1.4/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
|
modernc.org/gc/v3 v3.1.3/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
|
||||||
modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
|
modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
|
||||||
modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
|
modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
|
||||||
modernc.org/libc v1.74.1 h1:bdR4VTKFMC4966QSNZ05XLGI/VwzVa2kTUX51Dm0riQ=
|
modernc.org/libc v1.73.4 h1:+ra4Ui8ngyt8HDcO1FTDPWlkAh6yOdaO2yAoh8MddQA=
|
||||||
modernc.org/libc v1.74.1/go.mod h1:uH4t5bOx3G3g9Xcmj10YKlTcVISlRDwv8VoQJG9n8Os=
|
modernc.org/libc v1.73.4/go.mod h1:DXZ3eO8qMCNn2SnmTNCiC71nJ9Rcq3PsnpU6Vc4rWK8=
|
||||||
modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
|
modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
|
||||||
modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
|
modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
|
||||||
modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
|
modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
|
||||||
@@ -414,8 +414,8 @@ modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
|
|||||||
modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
|
modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
|
||||||
modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
|
modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
|
||||||
modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
|
modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
|
||||||
modernc.org/sqlite v1.54.0 h1:JCxR4qwkJvOaqAoYcgDoO25Nc+ROg6EJ2LfBVzdrgog=
|
modernc.org/sqlite v1.53.0 h1:20WG8N9q4ji/dEqGk4uiI0c6OPjSeLTNYGFCc3+7c1M=
|
||||||
modernc.org/sqlite v1.54.0/go.mod h1:4ntCLuNmnH8+GNqjka1wNg7KJd5/Hi5FYp8K+XQ7GZw=
|
modernc.org/sqlite v1.53.0/go.mod h1:xoEpOIpGrgT48H5iiyt/YXPCZPEzlfmfFwtk8Lklw8s=
|
||||||
modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
|
modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
|
||||||
modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
|
modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
|
||||||
modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
|
modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
|
||||||
|
|||||||
@@ -88,13 +88,17 @@ func (app *BootstrapApp) Setup() error {
|
|||||||
app.log.App.Info().Msgf("Starting Tinyauth version: %s", model.Version)
|
app.log.App.Info().Msgf("Starting Tinyauth version: %s", model.Version)
|
||||||
|
|
||||||
// get app url
|
// get app url
|
||||||
appURL, err := utils.SafeParseAppURL(app.config.AppURL)
|
if app.config.AppURL == "" {
|
||||||
|
return errors.New("app url cannot be empty, perhaps config loading failed")
|
||||||
|
}
|
||||||
|
|
||||||
|
appUrl, err := url.Parse(app.config.AppURL)
|
||||||
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return fmt.Errorf("failed to parse app url: %w", err)
|
return fmt.Errorf("failed to parse app url: %w", err)
|
||||||
}
|
}
|
||||||
|
|
||||||
app.runtime.AppURL = appURL
|
app.runtime.AppURL = strings.ToLower(appUrl.Scheme + "://" + appUrl.Host)
|
||||||
|
|
||||||
// validate session config
|
// validate session config
|
||||||
if app.config.Auth.SessionMaxLifetime != 0 && app.config.Auth.SessionMaxLifetime < app.config.Auth.SessionExpiry {
|
if app.config.Auth.SessionMaxLifetime != 0 && app.config.Auth.SessionMaxLifetime < app.config.Auth.SessionExpiry {
|
||||||
@@ -168,13 +172,7 @@ func (app *BootstrapApp) Setup() error {
|
|||||||
app.runtime.CookieDomain = cookieDomain
|
app.runtime.CookieDomain = cookieDomain
|
||||||
|
|
||||||
// cookie names
|
// cookie names
|
||||||
u, err := url.Parse(app.runtime.AppURL)
|
app.runtime.UUID = utils.GenerateUUID(appUrl.Hostname())
|
||||||
|
|
||||||
if err != nil {
|
|
||||||
return fmt.Errorf("failed to parse app url: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
app.runtime.UUID = utils.GenerateUUID(u.Hostname())
|
|
||||||
|
|
||||||
cookieId := strings.Split(app.runtime.UUID, "-")[0] // first 8 characters of the uuid should be good enough
|
cookieId := strings.Split(app.runtime.UUID, "-")[0] // first 8 characters of the uuid should be good enough
|
||||||
|
|
||||||
|
|||||||
@@ -30,16 +30,6 @@ func (app *BootstrapApp) setupRouter() error {
|
|||||||
if err != nil {
|
if err != nil {
|
||||||
return fmt.Errorf("failed to set trusted proxies: %w", err)
|
return fmt.Errorf("failed to set trusted proxies: %w", err)
|
||||||
}
|
}
|
||||||
|
|
||||||
app.runtime.TrustedProxiesConfigured = true
|
|
||||||
} else {
|
|
||||||
err := engine.SetTrustedProxies(nil)
|
|
||||||
|
|
||||||
if err != nil {
|
|
||||||
return fmt.Errorf("failed to set trusted proxies: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
app.log.App.Warn().Msg("Trusted proxies are not configured, IP access controls will NOT work")
|
|
||||||
}
|
}
|
||||||
|
|
||||||
middlewareProvideFor := []any{
|
middlewareProvideFor := []any{
|
||||||
|
|||||||
@@ -85,8 +85,7 @@ func (app *BootstrapApp) getLabelProvider() (service.LabelProvider, error) {
|
|||||||
err := app.dig.Provide(service.NewKubernetesService)
|
err := app.dig.Provide(service.NewKubernetesService)
|
||||||
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
app.log.App.Warn().Err(err).Msg("Failed to provide kubernetes service")
|
return nil, fmt.Errorf("failed to provide kubernetes service: %w", err)
|
||||||
return nil, nil
|
|
||||||
}
|
}
|
||||||
|
|
||||||
err = app.dig.Invoke(func(k *service.KubernetesService) error {
|
err = app.dig.Invoke(func(k *service.KubernetesService) error {
|
||||||
@@ -95,8 +94,7 @@ func (app *BootstrapApp) getLabelProvider() (service.LabelProvider, error) {
|
|||||||
})
|
})
|
||||||
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
app.log.App.Warn().Err(err).Msg("Failed to invoke kubernetes service")
|
return nil, fmt.Errorf("failed to invoke kubernetes service: %w", err)
|
||||||
return nil, nil
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// Kubernetes will fail to initialize with an error if it cannot connect to the cluster
|
// Kubernetes will fail to initialize with an error if it cannot connect to the cluster
|
||||||
@@ -116,8 +114,7 @@ func (app *BootstrapApp) getLabelProvider() (service.LabelProvider, error) {
|
|||||||
err := app.dig.Provide(service.NewDockerService)
|
err := app.dig.Provide(service.NewDockerService)
|
||||||
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
app.log.App.Warn().Err(err).Msg("Failed to provide docker service")
|
return nil, fmt.Errorf("failed to provide docker service: %w", err)
|
||||||
return nil, nil
|
|
||||||
}
|
}
|
||||||
|
|
||||||
err = app.dig.Invoke(func(d *service.DockerService) error {
|
err = app.dig.Invoke(func(d *service.DockerService) error {
|
||||||
@@ -126,8 +123,7 @@ func (app *BootstrapApp) getLabelProvider() (service.LabelProvider, error) {
|
|||||||
})
|
})
|
||||||
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
app.log.App.Warn().Err(err).Msg("Failed to invoke docker service")
|
return nil, fmt.Errorf("failed to invoke docker service: %w", err)
|
||||||
return nil, nil
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if app.services.dockerService == nil {
|
if app.services.dockerService == nil {
|
||||||
|
|||||||
@@ -313,7 +313,8 @@ func (controller *OAuthController) getCookieDomain() string {
|
|||||||
|
|
||||||
func (controller *OAuthController) isRedirectSafe(redirectURI string) bool {
|
func (controller *OAuthController) isRedirectSafe(redirectURI string) bool {
|
||||||
v := validators.NewDomainValidator(validators.DomainValidatorOptions{
|
v := validators.NewDomainValidator(validators.DomainValidatorOptions{
|
||||||
WithPort: true,
|
WithScheme: true,
|
||||||
|
WithPort: true,
|
||||||
})
|
})
|
||||||
|
|
||||||
_, err := v.SafeHostname(controller.runtime.AppURL)
|
_, err := v.SafeHostname(controller.runtime.AppURL)
|
||||||
@@ -331,7 +332,9 @@ func (controller *OAuthController) isRedirectSafe(redirectURI string) bool {
|
|||||||
|
|
||||||
controller.log.App.Debug().Err(err).Msg("Failed to validate redirect URI")
|
controller.log.App.Debug().Err(err).Msg("Failed to validate redirect URI")
|
||||||
|
|
||||||
if !errors.Is(err, validators.ErrHostnameMismatch) {
|
if errors.Is(err, validators.ErrInvalidURL) ||
|
||||||
|
errors.Is(err, validators.ErrSchemeMismatch) ||
|
||||||
|
errors.Is(err, validators.ErrPortMismatch) {
|
||||||
return false
|
return false
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -348,8 +351,7 @@ func (controller *OAuthController) isRedirectSafe(redirectURI string) bool {
|
|||||||
return false
|
return false
|
||||||
}
|
}
|
||||||
|
|
||||||
if strings.HasSuffix(hostname, "."+strings.ToLower(controller.runtime.CookieDomain)) ||
|
if strings.HasSuffix(hostname, "."+strings.ToLower(controller.runtime.CookieDomain)) {
|
||||||
hostname == controller.runtime.CookieDomain {
|
|
||||||
return true
|
return true
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -81,6 +81,22 @@ func TestOAuthController_isRedirectSafe(t *testing.T) {
|
|||||||
redirectURI: "https://sub.example.com",
|
redirectURI: "https://sub.example.com",
|
||||||
expected: false,
|
expected: false,
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
description: "Cookie domain itself is not a subdomain match",
|
||||||
|
appURL: "https://tinyauth.example.com",
|
||||||
|
cookieDomain: "example.com",
|
||||||
|
subdomainsEnabled: true,
|
||||||
|
redirectURI: "https://example.com",
|
||||||
|
expected: false,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
description: "Different scheme returns false",
|
||||||
|
appURL: "https://tinyauth.example.com",
|
||||||
|
cookieDomain: "example.com",
|
||||||
|
subdomainsEnabled: true,
|
||||||
|
redirectURI: "http://tinyauth.example.com",
|
||||||
|
expected: false,
|
||||||
|
},
|
||||||
{
|
{
|
||||||
description: "Different port returns false",
|
description: "Different port returns false",
|
||||||
appURL: "https://tinyauth.example.com",
|
appURL: "https://tinyauth.example.com",
|
||||||
@@ -105,6 +121,14 @@ func TestOAuthController_isRedirectSafe(t *testing.T) {
|
|||||||
redirectURI: "https:/malicious",
|
redirectURI: "https:/malicious",
|
||||||
expected: false,
|
expected: false,
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
description: "Redirect URI without scheme returns false",
|
||||||
|
appURL: "https://tinyauth.example.com",
|
||||||
|
cookieDomain: "example.com",
|
||||||
|
subdomainsEnabled: true,
|
||||||
|
redirectURI: "tinyauth.example.com",
|
||||||
|
expected: false,
|
||||||
|
},
|
||||||
{
|
{
|
||||||
description: "Relative redirect URI returns false",
|
description: "Relative redirect URI returns false",
|
||||||
appURL: "https://tinyauth.example.com",
|
appURL: "https://tinyauth.example.com",
|
||||||
|
|||||||
@@ -5,7 +5,6 @@ import (
|
|||||||
"errors"
|
"errors"
|
||||||
"fmt"
|
"fmt"
|
||||||
"net/http"
|
"net/http"
|
||||||
"net/url"
|
|
||||||
"slices"
|
"slices"
|
||||||
"strconv"
|
"strconv"
|
||||||
"strings"
|
"strings"
|
||||||
@@ -344,31 +343,27 @@ func (controller *OIDCController) authorizeComplete(c *gin.Context) {
|
|||||||
// Create the authorization code
|
// Create the authorization code
|
||||||
code := controller.oidc.CreateCode(*authorizeReq, *userContext)
|
code := controller.oidc.CreateCode(*authorizeReq, *userContext)
|
||||||
|
|
||||||
cu, err := url.Parse(authorizeReq.RedirectURI)
|
queries, err := query.Values(AuthorizeCallback{
|
||||||
|
Code: code,
|
||||||
|
State: authorizeReq.State,
|
||||||
|
})
|
||||||
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
controller.authorizeError(c, authorizeErrorParams{
|
controller.authorizeError(c, authorizeErrorParams{
|
||||||
err: err,
|
err: err,
|
||||||
reason: "Failed to parse redirect URI",
|
reason: "Failed to build query",
|
||||||
reasonPublic: "Failed to parse redirect URI",
|
reasonPublic: "Failed to build query",
|
||||||
json: true,
|
callback: authorizeReq.RedirectURI,
|
||||||
|
callbackError: "server_error",
|
||||||
|
state: authorizeReq.State,
|
||||||
|
json: true,
|
||||||
})
|
})
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
|
|
||||||
q := cu.Query()
|
|
||||||
|
|
||||||
q.Set("code", code)
|
|
||||||
|
|
||||||
if authorizeReq.State != "" {
|
|
||||||
q.Set("state", authorizeReq.State)
|
|
||||||
}
|
|
||||||
|
|
||||||
cu.RawQuery = q.Encode()
|
|
||||||
|
|
||||||
c.JSON(200, gin.H{
|
c.JSON(200, gin.H{
|
||||||
"status": 200,
|
"status": 200,
|
||||||
"redirect_uri": cu.String(),
|
"redirect_uri": fmt.Sprintf("%s?%s", authorizeReq.RedirectURI, queries.Encode()),
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -644,37 +639,37 @@ func (controller *OIDCController) authorizeError(c *gin.Context, params authoriz
|
|||||||
controller.log.App.Error().Err(params.err).Str("reason", params.reason).Msg("Authorization error")
|
controller.log.App.Error().Err(params.err).Str("reason", params.reason).Msg("Authorization error")
|
||||||
|
|
||||||
if params.callback != "" {
|
if params.callback != "" {
|
||||||
cu, err := url.Parse(params.callback)
|
errorQueries := CallbackError{
|
||||||
|
Error: params.callbackError,
|
||||||
|
}
|
||||||
|
|
||||||
|
if params.reasonPublic != "" {
|
||||||
|
errorQueries.ErrorDescription = params.reasonPublic
|
||||||
|
}
|
||||||
|
|
||||||
|
if params.state != "" {
|
||||||
|
errorQueries.State = params.state
|
||||||
|
}
|
||||||
|
|
||||||
|
queries, err := query.Values(errorQueries)
|
||||||
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
controller.log.App.Error().Err(err).Msg("Failed to parse callback URL")
|
controller.log.App.Error().Err(err).Msg("Failed to build callback error query")
|
||||||
c.AbortWithStatus(http.StatusInternalServerError)
|
c.AbortWithStatus(http.StatusInternalServerError)
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
|
|
||||||
q := cu.Query()
|
redirectUrl := fmt.Sprintf("%s?%s", params.callback, queries.Encode())
|
||||||
|
|
||||||
q.Set("error", params.callbackError)
|
|
||||||
|
|
||||||
if params.reasonPublic != "" {
|
|
||||||
q.Set("error_description", params.reasonPublic)
|
|
||||||
}
|
|
||||||
|
|
||||||
if params.state != "" {
|
|
||||||
q.Set("state", params.state)
|
|
||||||
}
|
|
||||||
|
|
||||||
cu.RawQuery = q.Encode()
|
|
||||||
|
|
||||||
if params.json {
|
if params.json {
|
||||||
c.JSON(200, gin.H{
|
c.JSON(200, gin.H{
|
||||||
"status": 200,
|
"status": 200,
|
||||||
"redirect_uri": cu.String(),
|
"redirect_uri": redirectUrl,
|
||||||
})
|
})
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
|
|
||||||
c.Redirect(http.StatusFound, cu.String())
|
c.Redirect(http.StatusFound, redirectUrl)
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -111,10 +111,9 @@ func (controller *ProxyController) proxyHandler(c *gin.Context) {
|
|||||||
clientIP := c.ClientIP()
|
clientIP := c.ClientIP()
|
||||||
|
|
||||||
aclsCtx := &service.ACLContext{
|
aclsCtx := &service.ACLContext{
|
||||||
ACLs: acls,
|
ACLs: acls,
|
||||||
IP: net.ParseIP(clientIP),
|
IP: net.ParseIP(clientIP),
|
||||||
Path: proxyCtx.Path,
|
Path: proxyCtx.Path,
|
||||||
TrustedProxiesConfigured: controller.runtime.TrustedProxiesConfigured,
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if controller.policyEngine.Evaluate(service.RuleIPBypassed, aclsCtx) {
|
if controller.policyEngine.Evaluate(service.RuleIPBypassed, aclsCtx) {
|
||||||
|
|||||||
@@ -708,7 +708,7 @@ func TestProxyController(t *testing.T) {
|
|||||||
Log: log,
|
Log: log,
|
||||||
})
|
})
|
||||||
|
|
||||||
authService, err := service.NewAuthService(service.AuthServiceInput{
|
authService := service.NewAuthService(service.AuthServiceInput{
|
||||||
Log: log,
|
Log: log,
|
||||||
Config: &cfg,
|
Config: &cfg,
|
||||||
Runtime: &runtime,
|
Runtime: &runtime,
|
||||||
@@ -721,8 +721,6 @@ func TestProxyController(t *testing.T) {
|
|||||||
PolicyEngine: policyEngine,
|
PolicyEngine: policyEngine,
|
||||||
})
|
})
|
||||||
|
|
||||||
require.NoError(t, err)
|
|
||||||
|
|
||||||
for _, test := range tests {
|
for _, test := range tests {
|
||||||
t.Run(test.description, func(t *testing.T) {
|
t.Run(test.description, func(t *testing.T) {
|
||||||
router := gin.Default()
|
router := gin.Default()
|
||||||
|
|||||||
@@ -72,32 +72,11 @@ func (controller *UserController) loginHandler(c *gin.Context) {
|
|||||||
|
|
||||||
controller.log.App.Debug().Str("username", req.Username).Msg("Login attempt")
|
controller.log.App.Debug().Str("username", req.Username).Msg("Login attempt")
|
||||||
|
|
||||||
search, err := controller.auth.SearchUser(req.Username)
|
|
||||||
|
|
||||||
if err != nil {
|
|
||||||
if errors.Is(err, service.ErrUserNotFound) {
|
|
||||||
controller.auth.DummyPasswordCheck(req.Password)
|
|
||||||
controller.log.App.Warn().Str("username", req.Username).Msg("User not found during login attempt")
|
|
||||||
controller.log.AuditLoginFailure(req.Username, "unknown", c.ClientIP(), "user not found")
|
|
||||||
c.JSON(401, gin.H{
|
|
||||||
"status": 401,
|
|
||||||
"message": "Unauthorized",
|
|
||||||
})
|
|
||||||
return
|
|
||||||
}
|
|
||||||
controller.log.App.Error().Err(err).Str("username", req.Username).Msg("Error searching for user during login attempt")
|
|
||||||
c.JSON(500, gin.H{
|
|
||||||
"status": 500,
|
|
||||||
"message": "Internal Server Error",
|
|
||||||
})
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
isLocked, remaining := controller.auth.IsAccountLocked(req.Username)
|
isLocked, remaining := controller.auth.IsAccountLocked(req.Username)
|
||||||
|
|
||||||
if isLocked {
|
if isLocked {
|
||||||
controller.log.App.Warn().Str("username", req.Username).Msg("Account is locked due to too many failed login attempts")
|
controller.log.App.Warn().Str("username", req.Username).Msg("Account is locked due to too many failed login attempts")
|
||||||
controller.log.AuditLoginFailure(req.Username, search.Type.String(), c.ClientIP(), "account locked")
|
controller.log.AuditLoginFailure(req.Username, "local", c.ClientIP(), "account locked")
|
||||||
c.Writer.Header().Add("x-tinyauth-lock-locked", "true")
|
c.Writer.Header().Add("x-tinyauth-lock-locked", "true")
|
||||||
c.Writer.Header().Add("x-tinyauth-lock-reset", time.Now().Add(time.Duration(remaining)*time.Second).Format(time.RFC3339))
|
c.Writer.Header().Add("x-tinyauth-lock-reset", time.Now().Add(time.Duration(remaining)*time.Second).Format(time.RFC3339))
|
||||||
c.JSON(429, gin.H{
|
c.JSON(429, gin.H{
|
||||||
@@ -107,10 +86,44 @@ func (controller *UserController) loginHandler(c *gin.Context) {
|
|||||||
return
|
return
|
||||||
}
|
}
|
||||||
|
|
||||||
|
search, err := controller.auth.SearchUser(req.Username)
|
||||||
|
|
||||||
|
if err != nil {
|
||||||
|
controller.constantTime(func() constantTimeRes {
|
||||||
|
if errors.Is(err, service.ErrUserNotFound) {
|
||||||
|
controller.log.App.Warn().Str("username", req.Username).Msg("User not found during login attempt")
|
||||||
|
controller.auth.RecordLoginAttempt(req.Username, false)
|
||||||
|
controller.log.AuditLoginFailure(req.Username, "unknown", c.ClientIP(), "user not found")
|
||||||
|
return constantTimeRes{
|
||||||
|
Code: 401,
|
||||||
|
Res: gin.H{
|
||||||
|
"status": 401,
|
||||||
|
"message": "Unauthorized",
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
controller.log.App.Error().Err(err).Str("username", req.Username).Msg("Error searching for user during login attempt")
|
||||||
|
return constantTimeRes{
|
||||||
|
Code: 500,
|
||||||
|
Res: gin.H{
|
||||||
|
"status": 500,
|
||||||
|
"message": "Internal Server Error",
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}, func(res constantTimeRes) {
|
||||||
|
c.JSON(res.Code, res.Res)
|
||||||
|
}, time.Millisecond*45)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
if err := controller.auth.CheckUserPassword(*search, req.Password); err != nil {
|
if err := controller.auth.CheckUserPassword(*search, req.Password); err != nil {
|
||||||
controller.log.App.Warn().Str("username", req.Username).Msg("Invalid password during login attempt")
|
controller.log.App.Warn().Str("username", req.Username).Msg("Invalid password during login attempt")
|
||||||
controller.auth.RecordLoginAttempt(req.Username, false)
|
controller.auth.RecordLoginAttempt(req.Username, false)
|
||||||
controller.log.AuditLoginFailure(req.Username, search.Type.String(), c.ClientIP(), "invalid password")
|
if search.Type == model.UserLocal {
|
||||||
|
controller.log.AuditLoginFailure(req.Username, "local", c.ClientIP(), "invalid password")
|
||||||
|
} else {
|
||||||
|
controller.log.AuditLoginFailure(req.Username, "ldap", c.ClientIP(), "invalid password")
|
||||||
|
}
|
||||||
c.JSON(401, gin.H{
|
c.JSON(401, gin.H{
|
||||||
"status": 401,
|
"status": 401,
|
||||||
"message": "Unauthorized",
|
"message": "Unauthorized",
|
||||||
@@ -211,7 +224,11 @@ func (controller *UserController) loginHandler(c *gin.Context) {
|
|||||||
|
|
||||||
controller.log.App.Info().Str("username", req.Username).Msg("Login successful")
|
controller.log.App.Info().Str("username", req.Username).Msg("Login successful")
|
||||||
|
|
||||||
controller.log.AuditLoginSuccess(req.Username, search.Type.String(), c.ClientIP())
|
if search.Type == model.UserLocal {
|
||||||
|
controller.log.AuditLoginSuccess(req.Username, "local", c.ClientIP())
|
||||||
|
} else {
|
||||||
|
controller.log.AuditLoginSuccess(req.Username, "ldap", c.ClientIP())
|
||||||
|
}
|
||||||
|
|
||||||
controller.auth.RecordLoginAttempt(req.Username, true)
|
controller.auth.RecordLoginAttempt(req.Username, true)
|
||||||
|
|
||||||
@@ -458,3 +475,18 @@ func (controller *UserController) tailscaleHandler(c *gin.Context) {
|
|||||||
"message": "Login successful",
|
"message": "Login successful",
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
|
type constantTimeRes struct {
|
||||||
|
Code int
|
||||||
|
Res any
|
||||||
|
}
|
||||||
|
|
||||||
|
func (controller *UserController) constantTime(f func() constantTimeRes, rf func(res constantTimeRes), targetTime time.Duration) {
|
||||||
|
tStart := time.Now()
|
||||||
|
res := f()
|
||||||
|
tEnd := time.Now()
|
||||||
|
if tEnd.Sub(tStart) < targetTime {
|
||||||
|
time.Sleep(targetTime - tEnd.Sub(tStart))
|
||||||
|
}
|
||||||
|
rf(res)
|
||||||
|
}
|
||||||
|
|||||||
@@ -542,8 +542,7 @@ func TestUserController(t *testing.T) {
|
|||||||
Runtime: &runtime,
|
Runtime: &runtime,
|
||||||
Ctx: ctx,
|
Ctx: ctx,
|
||||||
})
|
})
|
||||||
|
authService := service.NewAuthService(service.AuthServiceInput{
|
||||||
authService, err := service.NewAuthService(service.AuthServiceInput{
|
|
||||||
Log: log,
|
Log: log,
|
||||||
Config: &cfg,
|
Config: &cfg,
|
||||||
Runtime: &runtime,
|
Runtime: &runtime,
|
||||||
@@ -556,8 +555,6 @@ func TestUserController(t *testing.T) {
|
|||||||
PolicyEngine: policyEngine,
|
PolicyEngine: policyEngine,
|
||||||
})
|
})
|
||||||
|
|
||||||
require.NoError(t, err)
|
|
||||||
|
|
||||||
beforeEach := func() {
|
beforeEach := func() {
|
||||||
// Clear failed login attempts before each test
|
// Clear failed login attempts before each test
|
||||||
authService.ClearLoginAttempts()
|
authService.ClearLoginAttempts()
|
||||||
|
|||||||
@@ -2,7 +2,6 @@ package middleware
|
|||||||
|
|
||||||
import (
|
import (
|
||||||
"context"
|
"context"
|
||||||
"errors"
|
|
||||||
"fmt"
|
"fmt"
|
||||||
"net/http"
|
"net/http"
|
||||||
"strings"
|
"strings"
|
||||||
@@ -245,9 +244,6 @@ func (m *ContextMiddleware) basicAuth(username string, password string) (*model.
|
|||||||
search, err := m.auth.SearchUser(username)
|
search, err := m.auth.SearchUser(username)
|
||||||
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
if errors.Is(err, service.ErrUserNotFound) {
|
|
||||||
m.auth.DummyPasswordCheck(password)
|
|
||||||
}
|
|
||||||
return nil, nil, fmt.Errorf("error searching for user: %w", err)
|
return nil, nil, fmt.Errorf("error searching for user: %w", err)
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -282,7 +278,7 @@ func (m *ContextMiddleware) basicAuth(username string, password string) (*model.
|
|||||||
}
|
}
|
||||||
userContext.Provider = model.ProviderLocal
|
userContext.Provider = model.ProviderLocal
|
||||||
case model.UserLDAP:
|
case model.UserLDAP:
|
||||||
user, err := m.auth.GetLDAPUser(search.Username)
|
user, err := m.auth.GetLDAPUser(username)
|
||||||
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, nil, fmt.Errorf("error retrieving ldap user details: %w", err)
|
return nil, nil, fmt.Errorf("error retrieving ldap user details: %w", err)
|
||||||
|
|||||||
@@ -264,8 +264,7 @@ func TestContextMiddleware(t *testing.T) {
|
|||||||
Runtime: &runtime,
|
Runtime: &runtime,
|
||||||
Ctx: ctx,
|
Ctx: ctx,
|
||||||
})
|
})
|
||||||
|
authService := service.NewAuthService(service.AuthServiceInput{
|
||||||
authService, err := service.NewAuthService(service.AuthServiceInput{
|
|
||||||
Log: log,
|
Log: log,
|
||||||
Config: &cfg,
|
Config: &cfg,
|
||||||
Runtime: &runtime,
|
Runtime: &runtime,
|
||||||
@@ -278,8 +277,6 @@ func TestContextMiddleware(t *testing.T) {
|
|||||||
PolicyEngine: policyEngine,
|
PolicyEngine: policyEngine,
|
||||||
})
|
})
|
||||||
|
|
||||||
require.NoError(t, err)
|
|
||||||
|
|
||||||
contextMiddleware := NewContextMiddleware(ContextMiddlewareInput{
|
contextMiddleware := NewContextMiddleware(ContextMiddlewareInput{
|
||||||
Log: log,
|
Log: log,
|
||||||
RuntimeConfig: &runtime,
|
RuntimeConfig: &runtime,
|
||||||
|
|||||||
+19
-18
@@ -49,6 +49,7 @@ func NewDefaultConfiguration(runtimeEnv RuntimeEnv) *Config {
|
|||||||
ACLs: ACLsConfig{
|
ACLs: ACLsConfig{
|
||||||
Policy: "allow",
|
Policy: "allow",
|
||||||
},
|
},
|
||||||
|
LockdownEnabled: true,
|
||||||
},
|
},
|
||||||
UI: UIConfig{
|
UI: UIConfig{
|
||||||
Title: "Tinyauth",
|
Title: "Tinyauth",
|
||||||
@@ -101,23 +102,22 @@ func NewDefaultConfiguration(runtimeEnv RuntimeEnv) *Config {
|
|||||||
}
|
}
|
||||||
|
|
||||||
type Config struct {
|
type Config struct {
|
||||||
AppURL string `description:"The base URL where the app is hosted." yaml:"appUrl,omitempty"`
|
AppURL string `description:"The base URL where the app is hosted." yaml:"appUrl,omitempty"`
|
||||||
ConfigFile string `description:"Path to config file." yaml:"-" gen:"include"`
|
ConfigFile string `description:"Path to config file." yaml:"-" gen:"include"`
|
||||||
LabelProvider string `description:"Label provider to use for ACLs (auto, docker, kubernetes or none to disable). auto detects the environment." yaml:"labelProvider,omitempty"`
|
LabelProvider string `description:"Label provider to use for ACLs (auto, docker, kubernetes or none to disable). auto detects the environment." yaml:"labelProvider,omitempty"`
|
||||||
Database DatabaseConfig `description:"Database configuration." yaml:"database,omitempty"`
|
Database DatabaseConfig `description:"Database configuration." yaml:"database,omitempty"`
|
||||||
Analytics AnalyticsConfig `description:"Analytics configuration." yaml:"analytics,omitempty"`
|
Analytics AnalyticsConfig `description:"Analytics configuration." yaml:"analytics,omitempty"`
|
||||||
Resources ResourcesConfig `description:"Resources configuration." yaml:"resources,omitempty"`
|
Resources ResourcesConfig `description:"Resources configuration." yaml:"resources,omitempty"`
|
||||||
Server ServerConfig `description:"Server configuration." yaml:"server,omitempty"`
|
Server ServerConfig `description:"Server configuration." yaml:"server,omitempty"`
|
||||||
Auth AuthConfig `description:"Authentication configuration." yaml:"auth,omitempty"`
|
Auth AuthConfig `description:"Authentication configuration." yaml:"auth,omitempty"`
|
||||||
Apps map[string]App `description:"Application ACLs configuration." yaml:"apps,omitempty"`
|
Apps map[string]App `description:"Application ACLs configuration." yaml:"apps,omitempty"`
|
||||||
OAuth OAuthConfig `description:"OAuth configuration." yaml:"oauth,omitempty"`
|
OAuth OAuthConfig `description:"OAuth configuration." yaml:"oauth,omitempty"`
|
||||||
OIDC OIDCConfig `description:"OIDC configuration." yaml:"oidc,omitempty"`
|
OIDC OIDCConfig `description:"OIDC configuration." yaml:"oidc,omitempty"`
|
||||||
UI UIConfig `description:"UI customization." yaml:"ui,omitempty"`
|
UI UIConfig `description:"UI customization." yaml:"ui,omitempty"`
|
||||||
LDAP LDAPConfig `description:"LDAP configuration." yaml:"ldap,omitempty"`
|
LDAP LDAPConfig `description:"LDAP configuration." yaml:"ldap,omitempty"`
|
||||||
// enable the cli warning on experimental features
|
Experimental ExperimentalConfig `description:"Experimental features, use with caution." yaml:"experimental,omitempty"`
|
||||||
//Experimental ExperimentalConfig `description:"Experimental features, use with caution." yaml:"experimental,omitempty"`
|
Tailscale TailscaleConfig `description:"Tailscale configuration." yaml:"tailscale,omitempty"`
|
||||||
Tailscale TailscaleConfig `description:"Tailscale configuration." yaml:"tailscale,omitempty"`
|
Log LogConfig `description:"Logging configuration." yaml:"log,omitempty"`
|
||||||
Log LogConfig `description:"Logging configuration." yaml:"log,omitempty"`
|
|
||||||
}
|
}
|
||||||
|
|
||||||
type DatabaseConfig struct {
|
type DatabaseConfig struct {
|
||||||
@@ -151,6 +151,7 @@ type AuthConfig struct {
|
|||||||
SessionMaxLifetime int `description:"Maximum session lifetime in seconds." yaml:"sessionMaxLifetime,omitempty"`
|
SessionMaxLifetime int `description:"Maximum session lifetime in seconds." yaml:"sessionMaxLifetime,omitempty"`
|
||||||
LoginTimeout int `description:"Login timeout in seconds." yaml:"loginTimeout,omitempty"`
|
LoginTimeout int `description:"Login timeout in seconds." yaml:"loginTimeout,omitempty"`
|
||||||
LoginMaxRetries int `description:"Maximum login retries." yaml:"loginMaxRetries,omitempty"`
|
LoginMaxRetries int `description:"Maximum login retries." yaml:"loginMaxRetries,omitempty"`
|
||||||
|
LockdownEnabled bool `description:"Enable lockdown mode after maximum login retries. Lockdown mode limit is calculated automatically." yaml:"lockdownEnabled,omitempty"`
|
||||||
TrustedProxies []string `description:"Comma-separated list of trusted proxy addresses." yaml:"trustedProxies,omitempty"`
|
TrustedProxies []string `description:"Comma-separated list of trusted proxy addresses." yaml:"trustedProxies,omitempty"`
|
||||||
ACLs ACLsConfig `description:"ACLs configuration." yaml:"acls,omitempty"`
|
ACLs ACLsConfig `description:"ACLs configuration." yaml:"acls,omitempty"`
|
||||||
}
|
}
|
||||||
@@ -238,7 +239,7 @@ type LogStreamConfig struct {
|
|||||||
Level string `description:"Log level for this stream. Use global if empty." yaml:"level,omitempty"`
|
Level string `description:"Log level for this stream. Use global if empty." yaml:"level,omitempty"`
|
||||||
}
|
}
|
||||||
|
|
||||||
//type ExperimentalConfig struct{}
|
type ExperimentalConfig struct{}
|
||||||
|
|
||||||
type TailscaleConfig struct {
|
type TailscaleConfig struct {
|
||||||
Enabled bool `description:"Enable Tailscale integration." yaml:"enabled,omitempty"`
|
Enabled bool `description:"Enable Tailscale integration." yaml:"enabled,omitempty"`
|
||||||
|
|||||||
+11
-12
@@ -1,18 +1,17 @@
|
|||||||
package model
|
package model
|
||||||
|
|
||||||
type RuntimeConfig struct {
|
type RuntimeConfig struct {
|
||||||
AppURL string
|
AppURL string
|
||||||
UUID string
|
UUID string
|
||||||
CookieDomain string
|
CookieDomain string
|
||||||
SessionCookieName string
|
SessionCookieName string
|
||||||
CSRFCookieName string
|
CSRFCookieName string
|
||||||
RedirectCookieName string
|
RedirectCookieName string
|
||||||
OAuthSessionCookieName string
|
OAuthSessionCookieName string
|
||||||
LocalUsers []LocalUser
|
LocalUsers []LocalUser
|
||||||
OAuthProviders map[string]OAuthServiceConfig
|
OAuthProviders map[string]OAuthServiceConfig
|
||||||
OAuthWhitelist []string
|
OAuthWhitelist []string
|
||||||
ConfiguredProviders []Provider
|
ConfiguredProviders []Provider
|
||||||
TrustedProxiesConfigured bool
|
|
||||||
}
|
}
|
||||||
|
|
||||||
type Provider struct {
|
type Provider struct {
|
||||||
|
|||||||
@@ -7,16 +7,6 @@ const (
|
|||||||
UserLDAP
|
UserLDAP
|
||||||
)
|
)
|
||||||
|
|
||||||
func (t UserSearchType) String() string {
|
|
||||||
switch t {
|
|
||||||
case UserLocal:
|
|
||||||
return "local"
|
|
||||||
case UserLDAP:
|
|
||||||
return "ldap"
|
|
||||||
}
|
|
||||||
return "unknown"
|
|
||||||
}
|
|
||||||
|
|
||||||
type LDAPUser struct {
|
type LDAPUser struct {
|
||||||
DN string
|
DN string
|
||||||
Groups []string
|
Groups []string
|
||||||
|
|||||||
@@ -1,7 +1,6 @@
|
|||||||
package service
|
package service
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"errors"
|
|
||||||
"regexp"
|
"regexp"
|
||||||
"strings"
|
"strings"
|
||||||
|
|
||||||
@@ -44,10 +43,6 @@ func (rule *UserAllowedRule) Evaluate(ctx *ACLContext) Effect {
|
|||||||
rule.Log.App.Debug().Msg("User is an OAuth user, checking OAuth whitelist")
|
rule.Log.App.Debug().Msg("User is an OAuth user, checking OAuth whitelist")
|
||||||
match, err := utils.CheckFilter(ctx.ACLs.OAuth.Whitelist, ctx.UserContext.OAuth.Email)
|
match, err := utils.CheckFilter(ctx.ACLs.OAuth.Whitelist, ctx.UserContext.OAuth.Email)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
if errors.Is(err, utils.ErrFilterEmpty) {
|
|
||||||
rule.Log.App.Debug().Msg("OAuth whitelist is empty, abstaining")
|
|
||||||
return EffectAbstain
|
|
||||||
}
|
|
||||||
rule.Log.App.Warn().Err(err).Str("item", ctx.UserContext.OAuth.Email).Msg("Invalid entry in OAuth whitelist")
|
rule.Log.App.Warn().Err(err).Str("item", ctx.UserContext.OAuth.Email).Msg("Invalid entry in OAuth whitelist")
|
||||||
return EffectDeny
|
return EffectDeny
|
||||||
}
|
}
|
||||||
@@ -77,7 +72,7 @@ func (rule *UserAllowedRule) Evaluate(ctx *ACLContext) Effect {
|
|||||||
match, err := utils.CheckFilter(ctx.ACLs.Users.Allow, ctx.UserContext.GetUsername())
|
match, err := utils.CheckFilter(ctx.ACLs.Users.Allow, ctx.UserContext.GetUsername())
|
||||||
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
if errors.Is(err, utils.ErrFilterEmpty) {
|
if err == utils.ErrFilterEmpty {
|
||||||
return EffectAbstain
|
return EffectAbstain
|
||||||
}
|
}
|
||||||
rule.Log.App.Warn().Err(err).Str("item", ctx.UserContext.GetUsername()).Msg("Invalid entry in users allow list")
|
rule.Log.App.Warn().Err(err).Str("item", ctx.UserContext.GetUsername()).Msg("Invalid entry in users allow list")
|
||||||
@@ -220,10 +215,6 @@ type IPAllowedRule struct {
|
|||||||
}
|
}
|
||||||
|
|
||||||
func (rule *IPAllowedRule) Evaluate(ctx *ACLContext) Effect {
|
func (rule *IPAllowedRule) Evaluate(ctx *ACLContext) Effect {
|
||||||
if !ctx.TrustedProxiesConfigured {
|
|
||||||
return EffectAllow // We can't block the proxy
|
|
||||||
}
|
|
||||||
|
|
||||||
// merge global and per-app block/allow lists
|
// merge global and per-app block/allow lists
|
||||||
blockedIps := append([]string{}, rule.Config.Auth.IP.Block...)
|
blockedIps := append([]string{}, rule.Config.Auth.IP.Block...)
|
||||||
allowedIPs := append([]string{}, rule.Config.Auth.IP.Allow...)
|
allowedIPs := append([]string{}, rule.Config.Auth.IP.Allow...)
|
||||||
@@ -272,10 +263,6 @@ type IPBypassedRule struct {
|
|||||||
}
|
}
|
||||||
|
|
||||||
func (rule *IPBypassedRule) Evaluate(ctx *ACLContext) Effect {
|
func (rule *IPBypassedRule) Evaluate(ctx *ACLContext) Effect {
|
||||||
if !ctx.TrustedProxiesConfigured {
|
|
||||||
return EffectDeny
|
|
||||||
}
|
|
||||||
|
|
||||||
// merge global and per-app bypass lists
|
// merge global and per-app bypass lists
|
||||||
bypassList := append([]string{}, rule.Config.Auth.IP.Bypass...)
|
bypassList := append([]string{}, rule.Config.Auth.IP.Bypass...)
|
||||||
if ctx.ACLs != nil {
|
if ctx.ACLs != nil {
|
||||||
|
|||||||
@@ -44,21 +44,6 @@ func TestUserAllowedRule(t *testing.T) {
|
|||||||
},
|
},
|
||||||
expected: EffectAbstain,
|
expected: EffectAbstain,
|
||||||
},
|
},
|
||||||
{
|
|
||||||
name: "abstains when filter is empty",
|
|
||||||
ctx: &ACLContext{
|
|
||||||
ACLs: &model.App{
|
|
||||||
OAuth: model.AppOAuth{Whitelist: ""},
|
|
||||||
},
|
|
||||||
UserContext: &model.UserContext{
|
|
||||||
Provider: model.ProviderOAuth,
|
|
||||||
OAuth: &model.OAuthContext{
|
|
||||||
BaseContext: model.BaseContext{Username: "alice"},
|
|
||||||
},
|
|
||||||
},
|
|
||||||
},
|
|
||||||
expected: EffectAbstain,
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
name: "allows OAuth user when email matches whitelist",
|
name: "allows OAuth user when email matches whitelist",
|
||||||
ctx: &ACLContext{
|
ctx: &ACLContext{
|
||||||
@@ -626,20 +611,11 @@ func TestIPAllowedRule(t *testing.T) {
|
|||||||
ctx *ACLContext
|
ctx *ACLContext
|
||||||
expected Effect
|
expected Effect
|
||||||
}{
|
}{
|
||||||
{
|
|
||||||
name: "when trusted proxies are not configured, IP is allowed",
|
|
||||||
ctx: &ACLContext{
|
|
||||||
ACLs: &model.App{},
|
|
||||||
IP: net.ParseIP("10.0.0.1"),
|
|
||||||
},
|
|
||||||
expected: EffectAllow,
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
name: "allows when ACLs are nil and no global lists configured",
|
name: "allows when ACLs are nil and no global lists configured",
|
||||||
ctx: &ACLContext{
|
ctx: &ACLContext{
|
||||||
ACLs: nil,
|
ACLs: nil,
|
||||||
IP: net.ParseIP("10.0.0.1"),
|
IP: net.ParseIP("10.0.0.1"),
|
||||||
TrustedProxiesConfigured: true,
|
|
||||||
},
|
},
|
||||||
expected: EffectAllow,
|
expected: EffectAllow,
|
||||||
},
|
},
|
||||||
@@ -649,8 +625,7 @@ func TestIPAllowedRule(t *testing.T) {
|
|||||||
ACLs: &model.App{
|
ACLs: &model.App{
|
||||||
IP: model.AppIP{Block: []string{"10.0.0.1"}},
|
IP: model.AppIP{Block: []string{"10.0.0.1"}},
|
||||||
},
|
},
|
||||||
IP: net.ParseIP("10.0.0.1"),
|
IP: net.ParseIP("10.0.0.1"),
|
||||||
TrustedProxiesConfigured: true,
|
|
||||||
},
|
},
|
||||||
expected: EffectDeny,
|
expected: EffectDeny,
|
||||||
},
|
},
|
||||||
@@ -662,9 +637,8 @@ func TestIPAllowedRule(t *testing.T) {
|
|||||||
},
|
},
|
||||||
},
|
},
|
||||||
ctx: &ACLContext{
|
ctx: &ACLContext{
|
||||||
ACLs: &model.App{},
|
ACLs: &model.App{},
|
||||||
IP: net.ParseIP("10.0.0.5"),
|
IP: net.ParseIP("10.0.0.5"),
|
||||||
TrustedProxiesConfigured: true,
|
|
||||||
},
|
},
|
||||||
expected: EffectDeny,
|
expected: EffectDeny,
|
||||||
},
|
},
|
||||||
@@ -674,8 +648,7 @@ func TestIPAllowedRule(t *testing.T) {
|
|||||||
ACLs: &model.App{
|
ACLs: &model.App{
|
||||||
IP: model.AppIP{Allow: []string{"192.168.1.0/24"}},
|
IP: model.AppIP{Allow: []string{"192.168.1.0/24"}},
|
||||||
},
|
},
|
||||||
IP: net.ParseIP("192.168.1.10"),
|
IP: net.ParseIP("192.168.1.10"),
|
||||||
TrustedProxiesConfigured: true,
|
|
||||||
},
|
},
|
||||||
expected: EffectAllow,
|
expected: EffectAllow,
|
||||||
},
|
},
|
||||||
@@ -687,9 +660,8 @@ func TestIPAllowedRule(t *testing.T) {
|
|||||||
},
|
},
|
||||||
},
|
},
|
||||||
ctx: &ACLContext{
|
ctx: &ACLContext{
|
||||||
ACLs: &model.App{},
|
ACLs: &model.App{},
|
||||||
IP: net.ParseIP("192.168.1.10"),
|
IP: net.ParseIP("192.168.1.10"),
|
||||||
TrustedProxiesConfigured: true,
|
|
||||||
},
|
},
|
||||||
expected: EffectAllow,
|
expected: EffectAllow,
|
||||||
},
|
},
|
||||||
@@ -699,17 +671,15 @@ func TestIPAllowedRule(t *testing.T) {
|
|||||||
ACLs: &model.App{
|
ACLs: &model.App{
|
||||||
IP: model.AppIP{Allow: []string{"192.168.1.0/24"}},
|
IP: model.AppIP{Allow: []string{"192.168.1.0/24"}},
|
||||||
},
|
},
|
||||||
IP: net.ParseIP("10.0.0.1"),
|
IP: net.ParseIP("10.0.0.1"),
|
||||||
TrustedProxiesConfigured: true,
|
|
||||||
},
|
},
|
||||||
expected: EffectDeny,
|
expected: EffectDeny,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
name: "allows when no block or allow lists are configured",
|
name: "allows when no block or allow lists are configured",
|
||||||
ctx: &ACLContext{
|
ctx: &ACLContext{
|
||||||
ACLs: &model.App{},
|
ACLs: &model.App{},
|
||||||
IP: net.ParseIP("10.0.0.1"),
|
IP: net.ParseIP("10.0.0.1"),
|
||||||
TrustedProxiesConfigured: true,
|
|
||||||
},
|
},
|
||||||
expected: EffectAllow,
|
expected: EffectAllow,
|
||||||
},
|
},
|
||||||
@@ -722,8 +692,7 @@ func TestIPAllowedRule(t *testing.T) {
|
|||||||
Allow: []string{"10.0.0.1"},
|
Allow: []string{"10.0.0.1"},
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
IP: net.ParseIP("10.0.0.1"),
|
IP: net.ParseIP("10.0.0.1"),
|
||||||
TrustedProxiesConfigured: true,
|
|
||||||
},
|
},
|
||||||
expected: EffectDeny,
|
expected: EffectDeny,
|
||||||
},
|
},
|
||||||
@@ -736,8 +705,7 @@ func TestIPAllowedRule(t *testing.T) {
|
|||||||
Allow: []string{"10.0.0.1"},
|
Allow: []string{"10.0.0.1"},
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
IP: net.ParseIP("10.0.0.1"),
|
IP: net.ParseIP("10.0.0.1"),
|
||||||
TrustedProxiesConfigured: true,
|
|
||||||
},
|
},
|
||||||
expected: EffectAllow,
|
expected: EffectAllow,
|
||||||
},
|
},
|
||||||
@@ -767,23 +735,12 @@ func TestIPBypassedRule(t *testing.T) {
|
|||||||
ctx *ACLContext
|
ctx *ACLContext
|
||||||
expected Effect
|
expected Effect
|
||||||
}{
|
}{
|
||||||
{
|
|
||||||
name: "when trusted proxies are not configured, IP is not bypassed",
|
|
||||||
rule: defaultIPBR,
|
|
||||||
ctx: &ACLContext{
|
|
||||||
ACLs: &model.App{},
|
|
||||||
IP: net.ParseIP("10.0.0.1"),
|
|
||||||
TrustedProxiesConfigured: false,
|
|
||||||
},
|
|
||||||
expected: EffectDeny,
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
name: "deny when ACLs are nil and no global bypass",
|
name: "deny when ACLs are nil and no global bypass",
|
||||||
rule: defaultIPBR,
|
rule: defaultIPBR,
|
||||||
ctx: &ACLContext{
|
ctx: &ACLContext{
|
||||||
ACLs: nil,
|
ACLs: nil,
|
||||||
IP: net.ParseIP("10.0.0.1"),
|
IP: net.ParseIP("10.0.0.1"),
|
||||||
TrustedProxiesConfigured: true,
|
|
||||||
},
|
},
|
||||||
expected: EffectDeny,
|
expected: EffectDeny,
|
||||||
},
|
},
|
||||||
@@ -791,9 +748,8 @@ func TestIPBypassedRule(t *testing.T) {
|
|||||||
name: "allows when ACLs are nil but IP matches global bypass",
|
name: "allows when ACLs are nil but IP matches global bypass",
|
||||||
rule: globBypassIPBR,
|
rule: globBypassIPBR,
|
||||||
ctx: &ACLContext{
|
ctx: &ACLContext{
|
||||||
ACLs: nil,
|
ACLs: nil,
|
||||||
IP: net.ParseIP("10.0.0.5"),
|
IP: net.ParseIP("10.0.0.5"),
|
||||||
TrustedProxiesConfigured: true,
|
|
||||||
},
|
},
|
||||||
expected: EffectAllow,
|
expected: EffectAllow,
|
||||||
},
|
},
|
||||||
@@ -801,9 +757,8 @@ func TestIPBypassedRule(t *testing.T) {
|
|||||||
name: "denies when ACLs are nil and IP does not match global bypass",
|
name: "denies when ACLs are nil and IP does not match global bypass",
|
||||||
rule: globBypassIPBR,
|
rule: globBypassIPBR,
|
||||||
ctx: &ACLContext{
|
ctx: &ACLContext{
|
||||||
ACLs: nil,
|
ACLs: nil,
|
||||||
IP: net.ParseIP("192.168.1.1"),
|
IP: net.ParseIP("192.168.1.1"),
|
||||||
TrustedProxiesConfigured: true,
|
|
||||||
},
|
},
|
||||||
expected: EffectDeny,
|
expected: EffectDeny,
|
||||||
},
|
},
|
||||||
@@ -814,8 +769,7 @@ func TestIPBypassedRule(t *testing.T) {
|
|||||||
ACLs: &model.App{
|
ACLs: &model.App{
|
||||||
IP: model.AppIP{Bypass: []string{"10.0.0.0/24"}},
|
IP: model.AppIP{Bypass: []string{"10.0.0.0/24"}},
|
||||||
},
|
},
|
||||||
IP: net.ParseIP("10.0.0.5"),
|
IP: net.ParseIP("10.0.0.5"),
|
||||||
TrustedProxiesConfigured: true,
|
|
||||||
},
|
},
|
||||||
expected: EffectAllow,
|
expected: EffectAllow,
|
||||||
},
|
},
|
||||||
@@ -826,8 +780,7 @@ func TestIPBypassedRule(t *testing.T) {
|
|||||||
ACLs: &model.App{
|
ACLs: &model.App{
|
||||||
IP: model.AppIP{Bypass: []string{"172.16.0.0/24"}},
|
IP: model.AppIP{Bypass: []string{"172.16.0.0/24"}},
|
||||||
},
|
},
|
||||||
IP: net.ParseIP("10.0.0.5"),
|
IP: net.ParseIP("10.0.0.5"),
|
||||||
TrustedProxiesConfigured: true,
|
|
||||||
},
|
},
|
||||||
expected: EffectAllow,
|
expected: EffectAllow,
|
||||||
},
|
},
|
||||||
@@ -838,8 +791,7 @@ func TestIPBypassedRule(t *testing.T) {
|
|||||||
ACLs: &model.App{
|
ACLs: &model.App{
|
||||||
IP: model.AppIP{Bypass: []string{"10.0.0.0/24"}},
|
IP: model.AppIP{Bypass: []string{"10.0.0.0/24"}},
|
||||||
},
|
},
|
||||||
IP: net.ParseIP("10.0.0.5"),
|
IP: net.ParseIP("10.0.0.5"),
|
||||||
TrustedProxiesConfigured: true,
|
|
||||||
},
|
},
|
||||||
expected: EffectAllow,
|
expected: EffectAllow,
|
||||||
},
|
},
|
||||||
@@ -850,8 +802,7 @@ func TestIPBypassedRule(t *testing.T) {
|
|||||||
ACLs: &model.App{
|
ACLs: &model.App{
|
||||||
IP: model.AppIP{Bypass: []string{"10.0.0.0/24"}},
|
IP: model.AppIP{Bypass: []string{"10.0.0.0/24"}},
|
||||||
},
|
},
|
||||||
IP: net.ParseIP("192.168.1.1"),
|
IP: net.ParseIP("192.168.1.1"),
|
||||||
TrustedProxiesConfigured: true,
|
|
||||||
},
|
},
|
||||||
expected: EffectDeny,
|
expected: EffectDeny,
|
||||||
},
|
},
|
||||||
@@ -859,9 +810,8 @@ func TestIPBypassedRule(t *testing.T) {
|
|||||||
name: "denies when bypass list is empty",
|
name: "denies when bypass list is empty",
|
||||||
rule: defaultIPBR,
|
rule: defaultIPBR,
|
||||||
ctx: &ACLContext{
|
ctx: &ACLContext{
|
||||||
ACLs: &model.App{},
|
ACLs: &model.App{},
|
||||||
IP: net.ParseIP("10.0.0.1"),
|
IP: net.ParseIP("10.0.0.1"),
|
||||||
TrustedProxiesConfigured: true,
|
|
||||||
},
|
},
|
||||||
expected: EffectDeny,
|
expected: EffectDeny,
|
||||||
},
|
},
|
||||||
@@ -872,8 +822,7 @@ func TestIPBypassedRule(t *testing.T) {
|
|||||||
ACLs: &model.App{
|
ACLs: &model.App{
|
||||||
IP: model.AppIP{Bypass: []string{"not-an-ip", "10.0.0.1"}},
|
IP: model.AppIP{Bypass: []string{"not-an-ip", "10.0.0.1"}},
|
||||||
},
|
},
|
||||||
IP: net.ParseIP("10.0.0.1"),
|
IP: net.ParseIP("10.0.0.1"),
|
||||||
TrustedProxiesConfigured: true,
|
|
||||||
},
|
},
|
||||||
expected: EffectAllow,
|
expected: EffectAllow,
|
||||||
},
|
},
|
||||||
|
|||||||
@@ -44,15 +44,13 @@ func (service *AccessControlsService) lookupStaticACLs(domain string) *model.App
|
|||||||
|
|
||||||
// First try to find a matching app by domain, then fallback to matching by app name (subdomain)
|
// First try to find a matching app by domain, then fallback to matching by app name (subdomain)
|
||||||
for app, config := range service.config.Apps {
|
for app, config := range service.config.Apps {
|
||||||
if config.Config.Domain != "" {
|
err := v.Validate(config.Config.Domain, domain)
|
||||||
err := v.Validate(config.Config.Domain, domain)
|
if err == nil {
|
||||||
if err == nil {
|
service.log.App.Debug().Str("name", app).Msg("Found matching container by domain")
|
||||||
service.log.App.Debug().Str("name", app).Msg("Found matching container by domain")
|
return &config
|
||||||
return &config
|
}
|
||||||
}
|
if !errors.Is(err, validators.ErrHostnameMismatch) {
|
||||||
if !errors.Is(err, validators.ErrHostnameMismatch) {
|
service.log.App.Debug().Str("name", app).Err(err).Msg("Domain validation failed")
|
||||||
service.log.App.Debug().Str("name", app).Err(err).Msg("Domain validation failed")
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
if strings.HasPrefix(strings.ToLower(domain), strings.ToLower(app+".")) {
|
if strings.HasPrefix(strings.ToLower(domain), strings.ToLower(app+".")) {
|
||||||
service.log.App.Debug().Str("name", app).Msg("Found matching container by app name")
|
service.log.App.Debug().Str("name", app).Msg("Found matching container by app name")
|
||||||
|
|||||||
@@ -8,6 +8,7 @@ import (
|
|||||||
"math/big"
|
"math/big"
|
||||||
"net/http"
|
"net/http"
|
||||||
"strings"
|
"strings"
|
||||||
|
"sync"
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
"github.com/steveiliop56/ding"
|
"github.com/steveiliop56/ding"
|
||||||
@@ -15,7 +16,6 @@ import (
|
|||||||
"github.com/tinyauthapp/tinyauth/internal/repository"
|
"github.com/tinyauthapp/tinyauth/internal/repository"
|
||||||
"github.com/tinyauthapp/tinyauth/internal/utils"
|
"github.com/tinyauthapp/tinyauth/internal/utils"
|
||||||
"github.com/tinyauthapp/tinyauth/internal/utils/logger"
|
"github.com/tinyauthapp/tinyauth/internal/utils/logger"
|
||||||
"github.com/tinyauthapp/tinyauth/pkg/cache"
|
|
||||||
"go.uber.org/dig"
|
"go.uber.org/dig"
|
||||||
|
|
||||||
"github.com/google/uuid"
|
"github.com/google/uuid"
|
||||||
@@ -69,13 +69,21 @@ type AuthService struct {
|
|||||||
tailscale *TailscaleService
|
tailscale *TailscaleService
|
||||||
policyEngine *PolicyEngine
|
policyEngine *PolicyEngine
|
||||||
|
|
||||||
dummyHash string
|
lockdown struct {
|
||||||
|
active bool
|
||||||
|
until time.Time
|
||||||
|
ctx context.Context
|
||||||
|
cancelFunc context.CancelFunc
|
||||||
|
mu sync.RWMutex
|
||||||
|
}
|
||||||
|
|
||||||
caches struct {
|
caches struct {
|
||||||
login *cache.CacheStore[LoginAttempt]
|
login *CacheStore[LoginAttempt]
|
||||||
oauth *cache.CacheStore[OAuthPendingSession]
|
oauth *CacheStore[OAuthPendingSession]
|
||||||
ldap *cache.CacheStore[[]string]
|
ldap *CacheStore[[]string]
|
||||||
}
|
}
|
||||||
|
|
||||||
|
maxLoginLimits int
|
||||||
}
|
}
|
||||||
|
|
||||||
type AuthServiceInput struct {
|
type AuthServiceInput struct {
|
||||||
@@ -93,7 +101,7 @@ type AuthServiceInput struct {
|
|||||||
PolicyEngine *PolicyEngine
|
PolicyEngine *PolicyEngine
|
||||||
}
|
}
|
||||||
|
|
||||||
func NewAuthService(i AuthServiceInput) (*AuthService, error) {
|
func NewAuthService(i AuthServiceInput) *AuthService {
|
||||||
service := &AuthService{
|
service := &AuthService{
|
||||||
log: i.Log,
|
log: i.Log,
|
||||||
runtime: i.Runtime,
|
runtime: i.Runtime,
|
||||||
@@ -106,19 +114,19 @@ func NewAuthService(i AuthServiceInput) (*AuthService, error) {
|
|||||||
policyEngine: i.PolicyEngine,
|
policyEngine: i.PolicyEngine,
|
||||||
}
|
}
|
||||||
|
|
||||||
// dummy hash
|
// get the max login limits based on the number of users and the configured max retries
|
||||||
dummyHash, err := bcrypt.GenerateFromPassword([]byte(utils.GenerateString(8)), bcrypt.DefaultCost)
|
service.maxLoginLimits = service.calculateLockdownLimit()
|
||||||
|
|
||||||
if err != nil {
|
loginCacheSize := 0
|
||||||
return nil, fmt.Errorf("failed to generate dummy hash: %w", err)
|
|
||||||
|
if !service.config.Auth.LockdownEnabled {
|
||||||
|
loginCacheSize = service.maxLoginLimits
|
||||||
}
|
}
|
||||||
|
|
||||||
service.dummyHash = string(dummyHash)
|
|
||||||
|
|
||||||
// caches setup
|
// caches setup
|
||||||
oauthCache := cache.NewCacheStore[OAuthPendingSession](256)
|
oauthCache := NewCacheStore[OAuthPendingSession](256)
|
||||||
loginCache := cache.NewCacheStore[LoginAttempt](service.calculateLockdownLimit())
|
loginCache := NewCacheStore[LoginAttempt](loginCacheSize)
|
||||||
ldapCache := cache.NewCacheStore[[]string](1024)
|
ldapCache := NewCacheStore[[]string](1024)
|
||||||
|
|
||||||
service.caches.oauth = oauthCache
|
service.caches.oauth = oauthCache
|
||||||
service.caches.login = loginCache
|
service.caches.login = loginCache
|
||||||
@@ -140,28 +148,7 @@ func NewAuthService(i AuthServiceInput) (*AuthService, error) {
|
|||||||
}
|
}
|
||||||
}, ding.RingMinor)
|
}, ding.RingMinor)
|
||||||
|
|
||||||
i.Ding.Go(func(ctx context.Context) {
|
return service
|
||||||
ticker := time.NewTicker(15 * time.Minute)
|
|
||||||
defer ticker.Stop()
|
|
||||||
|
|
||||||
for {
|
|
||||||
select {
|
|
||||||
case <-ticker.C:
|
|
||||||
service.log.App.Debug().Msg("Updating login cache limits")
|
|
||||||
service.caches.login.SetMaxSize(service.calculateLockdownLimit())
|
|
||||||
service.log.App.Debug().Msg("Login cache limits updated")
|
|
||||||
case <-ctx.Done():
|
|
||||||
return
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
}, ding.RingMinor)
|
|
||||||
|
|
||||||
return service, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
func (auth *AuthService) DummyPasswordCheck(password string) {
|
|
||||||
bcrypt.CompareHashAndPassword([]byte(auth.dummyHash), []byte(password))
|
|
||||||
}
|
}
|
||||||
|
|
||||||
func (auth *AuthService) SearchUser(username string) (*model.UserSearch, error) {
|
func (auth *AuthService) SearchUser(username string) (*model.UserSearch, error) {
|
||||||
@@ -258,6 +245,10 @@ func (auth *AuthService) GetLDAPUser(userDN string) (*model.LDAPUser, error) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
func (auth *AuthService) IsAccountLocked(identifier string) (bool, int) {
|
func (auth *AuthService) IsAccountLocked(identifier string) (bool, int) {
|
||||||
|
if locked, remaining := auth.IsInLockdown(); locked {
|
||||||
|
return true, remaining
|
||||||
|
}
|
||||||
|
|
||||||
if auth.config.Auth.LoginMaxRetries <= 0 || auth.config.Auth.LoginTimeout <= 0 {
|
if auth.config.Auth.LoginMaxRetries <= 0 || auth.config.Auth.LoginTimeout <= 0 {
|
||||||
return false, 0
|
return false, 0
|
||||||
}
|
}
|
||||||
@@ -280,7 +271,15 @@ func (auth *AuthService) RecordLoginAttempt(identifier string, success bool) {
|
|||||||
return
|
return
|
||||||
}
|
}
|
||||||
|
|
||||||
auth.caches.login.WithLock(func(actions cache.CacheStoreActions[LoginAttempt]) {
|
if !success && auth.config.Auth.LockdownEnabled && auth.caches.login.Size() >= auth.maxLoginLimits {
|
||||||
|
if locked, _ := auth.IsInLockdown(); locked {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
go auth.lockdownMode()
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
auth.caches.login.WithLock(func(actions CacheStoreActions[LoginAttempt]) {
|
||||||
entry, ok := actions.Get(identifier)
|
entry, ok := actions.Get(identifier)
|
||||||
|
|
||||||
if !ok {
|
if !ok {
|
||||||
@@ -345,7 +344,7 @@ func (auth *AuthService) CreateSession(ctx context.Context, data repository.Sess
|
|||||||
return nil, fmt.Errorf("tailscale service not configured, cannot create session for tailscale user")
|
return nil, fmt.Errorf("tailscale service not configured, cannot create session for tailscale user")
|
||||||
}
|
}
|
||||||
|
|
||||||
u, err := uuid.NewRandom()
|
uuid, err := uuid.NewRandom()
|
||||||
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, fmt.Errorf("failed to generate session uuid: %w", err)
|
return nil, fmt.Errorf("failed to generate session uuid: %w", err)
|
||||||
@@ -362,7 +361,7 @@ func (auth *AuthService) CreateSession(ctx context.Context, data repository.Sess
|
|||||||
expiresAt := time.Now().Add(time.Duration(expiry) * time.Second)
|
expiresAt := time.Now().Add(time.Duration(expiry) * time.Second)
|
||||||
|
|
||||||
session := repository.CreateSessionParams{
|
session := repository.CreateSessionParams{
|
||||||
UUID: u.String(),
|
UUID: uuid.String(),
|
||||||
Username: data.Username,
|
Username: data.Username,
|
||||||
Email: data.Email,
|
Email: data.Email,
|
||||||
Name: data.Name,
|
Name: data.Name,
|
||||||
@@ -617,7 +616,62 @@ func (auth *AuthService) GetOAuthPendingSession(sessionId string) (*OAuthPending
|
|||||||
return &session, nil
|
return &session, nil
|
||||||
}
|
}
|
||||||
|
|
||||||
// ClearLoginAttempts is a testing function, not useful for anything else
|
func (auth *AuthService) lockdownMode() {
|
||||||
|
auth.lockdown.mu.Lock()
|
||||||
|
|
||||||
|
if auth.lockdown.active {
|
||||||
|
auth.lockdown.mu.Unlock()
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
ctx, cancel := context.WithCancel(auth.ctx)
|
||||||
|
|
||||||
|
auth.log.App.Warn().Msg("Too many failed login attempts, entering lockdown mode")
|
||||||
|
|
||||||
|
auth.lockdown.active = true
|
||||||
|
auth.lockdown.ctx = ctx
|
||||||
|
auth.lockdown.cancelFunc = cancel
|
||||||
|
|
||||||
|
d := time.Duration(auth.config.Auth.LoginTimeout) * time.Second
|
||||||
|
auth.lockdown.until = time.Now().Add(d)
|
||||||
|
timer := time.NewTimer(d)
|
||||||
|
|
||||||
|
auth.lockdown.mu.Unlock()
|
||||||
|
|
||||||
|
defer cancel()
|
||||||
|
defer timer.Stop()
|
||||||
|
|
||||||
|
select {
|
||||||
|
case <-timer.C:
|
||||||
|
// Timer expired, end lockdown
|
||||||
|
case <-ctx.Done():
|
||||||
|
// Context cancelled, end lockdown
|
||||||
|
}
|
||||||
|
|
||||||
|
auth.lockdown.mu.Lock()
|
||||||
|
|
||||||
|
auth.log.App.Info().Msg("Exiting lockdown mode")
|
||||||
|
|
||||||
|
auth.caches.login.Clear()
|
||||||
|
auth.lockdown.active = false
|
||||||
|
auth.lockdown.until = time.Time{}
|
||||||
|
auth.lockdown.ctx = nil
|
||||||
|
auth.lockdown.cancelFunc = nil
|
||||||
|
|
||||||
|
auth.lockdown.mu.Unlock()
|
||||||
|
}
|
||||||
|
|
||||||
|
func (auth *AuthService) IsInLockdown() (bool, int) {
|
||||||
|
auth.lockdown.mu.RLock()
|
||||||
|
defer auth.lockdown.mu.RUnlock()
|
||||||
|
if auth.lockdown.active {
|
||||||
|
remaining := int(time.Until(auth.lockdown.until).Seconds())
|
||||||
|
return true, remaining
|
||||||
|
}
|
||||||
|
return false, 0
|
||||||
|
}
|
||||||
|
|
||||||
|
// mostly a testing function, not useful for anything else
|
||||||
func (auth *AuthService) ClearLoginAttempts() {
|
func (auth *AuthService) ClearLoginAttempts() {
|
||||||
auth.caches.login.Clear()
|
auth.caches.login.Clear()
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
package cache
|
package service
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"slices"
|
"slices"
|
||||||
@@ -33,8 +33,8 @@ func NewCacheStore[T any](maxSize int) *CacheStore[T] {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// WithLock allows performing multiple operations on a single lock.
|
// With lock allows performing multiple operations on the cache store atomically.
|
||||||
// The provided mutate function receives a set of actions (Set, Get, Delete, Update) that
|
// The provided mutate function receives a set of actions (Set, Get, Delete) that
|
||||||
// can be used to manipulate the cache store within the locked context.
|
// can be used to manipulate the cache store within the locked context.
|
||||||
func (cs *CacheStore[T]) WithLock(mutate func(actions CacheStoreActions[T])) {
|
func (cs *CacheStore[T]) WithLock(mutate func(actions CacheStoreActions[T])) {
|
||||||
cs.mu.Lock()
|
cs.mu.Lock()
|
||||||
@@ -195,19 +195,3 @@ func (cs *CacheStore[T]) Clear() {
|
|||||||
cs.cache = make(map[string]cacheEntry[T])
|
cs.cache = make(map[string]cacheEntry[T])
|
||||||
cs.order = make([]string, 0)
|
cs.order = make([]string, 0)
|
||||||
}
|
}
|
||||||
|
|
||||||
func (cs *CacheStore[T]) SetMaxSize(maxSize int) {
|
|
||||||
cs.mu.Lock()
|
|
||||||
defer cs.mu.Unlock()
|
|
||||||
cs.maxSize = maxSize
|
|
||||||
for len(cs.cache) > maxSize {
|
|
||||||
if !cs.evictOne() {
|
|
||||||
break
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
func (cs *CacheStore[T]) GetMaxSize() int {
|
|
||||||
cs.mu.Lock()
|
|
||||||
defer cs.mu.Unlock()
|
|
||||||
return cs.maxSize
|
|
||||||
}
|
|
||||||
@@ -1,4 +1,4 @@
|
|||||||
package cache
|
package service
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"strconv"
|
"strconv"
|
||||||
@@ -316,21 +316,6 @@ func TestCacheStoreSizeAndClear(t *testing.T) {
|
|||||||
assert.False(t, ok)
|
assert.False(t, ok)
|
||||||
}
|
}
|
||||||
|
|
||||||
func TestCacheStoreWithMaxSize(t *testing.T) {
|
|
||||||
cs := NewCacheStore[string](0)
|
|
||||||
assert.Equal(t, 0, cs.Size())
|
|
||||||
|
|
||||||
for i := 0; i < 100; i++ {
|
|
||||||
cs.Set(strconv.Itoa(i), strconv.Itoa(i), 0)
|
|
||||||
}
|
|
||||||
|
|
||||||
assert.Equal(t, 100, cs.Size())
|
|
||||||
|
|
||||||
cs.SetMaxSize(10)
|
|
||||||
|
|
||||||
assert.Equal(t, 10, cs.Size())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCacheStoreWithLock(t *testing.T) {
|
func TestCacheStoreWithLock(t *testing.T) {
|
||||||
cs := NewCacheStore[int](0)
|
cs := NewCacheStore[int](0)
|
||||||
cs.Set("counter", 1, 0)
|
cs.Set("counter", 1, 0)
|
||||||
@@ -27,7 +27,6 @@ import (
|
|||||||
"github.com/tinyauthapp/tinyauth/internal/repository"
|
"github.com/tinyauthapp/tinyauth/internal/repository"
|
||||||
"github.com/tinyauthapp/tinyauth/internal/utils"
|
"github.com/tinyauthapp/tinyauth/internal/utils"
|
||||||
"github.com/tinyauthapp/tinyauth/internal/utils/logger"
|
"github.com/tinyauthapp/tinyauth/internal/utils/logger"
|
||||||
"github.com/tinyauthapp/tinyauth/pkg/cache"
|
|
||||||
"go.uber.org/dig"
|
"go.uber.org/dig"
|
||||||
)
|
)
|
||||||
|
|
||||||
@@ -159,9 +158,9 @@ type OIDCService struct {
|
|||||||
issuer string
|
issuer string
|
||||||
|
|
||||||
caches struct {
|
caches struct {
|
||||||
code *cache.CacheStore[AuthorizeCodeEntry]
|
code *CacheStore[AuthorizeCodeEntry]
|
||||||
usedCode *cache.CacheStore[UsedCodeEntry]
|
usedCode *CacheStore[UsedCodeEntry]
|
||||||
authorize *cache.CacheStore[AuthorizeRequest]
|
authorize *CacheStore[AuthorizeRequest]
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -340,11 +339,11 @@ func NewOIDCService(i OIDCServiceInput) (*OIDCService, error) {
|
|||||||
i.Ding.Go(service.cleanupRoutine, ding.RingMinor)
|
i.Ding.Go(service.cleanupRoutine, ding.RingMinor)
|
||||||
|
|
||||||
// Create caches
|
// Create caches
|
||||||
codeCache := cache.NewCacheStore[AuthorizeCodeEntry](256)
|
codeCash := NewCacheStore[AuthorizeCodeEntry](256)
|
||||||
usedCode := cache.NewCacheStore[UsedCodeEntry](256)
|
usedCode := NewCacheStore[UsedCodeEntry](256)
|
||||||
authorize := cache.NewCacheStore[AuthorizeRequest](256)
|
authorize := NewCacheStore[AuthorizeRequest](256)
|
||||||
|
|
||||||
service.caches.code = codeCache
|
service.caches.code = codeCash
|
||||||
service.caches.usedCode = usedCode
|
service.caches.usedCode = usedCode
|
||||||
service.caches.authorize = authorize
|
service.caches.authorize = authorize
|
||||||
|
|
||||||
@@ -504,7 +503,7 @@ func (service *OIDCService) GetCodeEntry(codeHash string, clientId string) (*Aut
|
|||||||
var entry AuthorizeCodeEntry
|
var entry AuthorizeCodeEntry
|
||||||
var ok bool
|
var ok bool
|
||||||
|
|
||||||
service.caches.code.WithLock(func(actions cache.CacheStoreActions[AuthorizeCodeEntry]) {
|
service.caches.code.WithLock(func(actions CacheStoreActions[AuthorizeCodeEntry]) {
|
||||||
entry, ok = actions.Get(codeHash)
|
entry, ok = actions.Get(codeHash)
|
||||||
|
|
||||||
if !ok {
|
if !ok {
|
||||||
|
|||||||
@@ -29,11 +29,10 @@ type Rule interface {
|
|||||||
}
|
}
|
||||||
|
|
||||||
type ACLContext struct {
|
type ACLContext struct {
|
||||||
ACLs *model.App
|
ACLs *model.App
|
||||||
UserContext *model.UserContext
|
UserContext *model.UserContext
|
||||||
IP net.IP
|
IP net.IP
|
||||||
Path string
|
Path string
|
||||||
TrustedProxiesConfigured bool
|
|
||||||
}
|
}
|
||||||
|
|
||||||
type PolicyEngine struct {
|
type PolicyEngine struct {
|
||||||
|
|||||||
@@ -10,7 +10,6 @@ import (
|
|||||||
"github.com/tinyauthapp/tinyauth/internal/model"
|
"github.com/tinyauthapp/tinyauth/internal/model"
|
||||||
"github.com/tinyauthapp/tinyauth/internal/utils"
|
"github.com/tinyauthapp/tinyauth/internal/utils"
|
||||||
"github.com/tinyauthapp/tinyauth/internal/utils/logger"
|
"github.com/tinyauthapp/tinyauth/internal/utils/logger"
|
||||||
"github.com/tinyauthapp/tinyauth/pkg/cache"
|
|
||||||
"go.uber.org/dig"
|
"go.uber.org/dig"
|
||||||
)
|
)
|
||||||
|
|
||||||
@@ -60,8 +59,8 @@ type TailscaleService struct {
|
|||||||
apiToken string
|
apiToken string
|
||||||
|
|
||||||
caches struct {
|
caches struct {
|
||||||
devices *cache.CacheStore[tailscaleAPIDevices]
|
devices *CacheStore[tailscaleAPIDevices]
|
||||||
users *cache.CacheStore[tailscaleAPIUsers]
|
users *CacheStore[tailscaleAPIUsers]
|
||||||
}
|
}
|
||||||
|
|
||||||
urls struct {
|
urls struct {
|
||||||
@@ -101,8 +100,8 @@ func NewTailscaleService(i TailscaleServiceInput) (*TailscaleService, error) {
|
|||||||
apiToken: apiToken,
|
apiToken: apiToken,
|
||||||
}
|
}
|
||||||
|
|
||||||
devicesCache := cache.NewCacheStore[tailscaleAPIDevices](0)
|
devicesCache := NewCacheStore[tailscaleAPIDevices](0)
|
||||||
usersCache := cache.NewCacheStore[tailscaleAPIUsers](0)
|
usersCache := NewCacheStore[tailscaleAPIUsers](0)
|
||||||
|
|
||||||
s.caches.devices = devicesCache
|
s.caches.devices = devicesCache
|
||||||
s.caches.users = usersCache
|
s.caches.users = usersCache
|
||||||
|
|||||||
@@ -163,10 +163,9 @@ func CreateTestConfigs(t *testing.T) (model.Config, model.RuntimeConfig) {
|
|||||||
},
|
},
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
CookieDomain: "example.com",
|
CookieDomain: "example.com",
|
||||||
AppURL: "https://tinyauth.example.com",
|
AppURL: "https://tinyauth.example.com",
|
||||||
SessionCookieName: "tinyauth-session",
|
SessionCookieName: "tinyauth-session",
|
||||||
TrustedProxiesConfigured: true,
|
|
||||||
}
|
}
|
||||||
|
|
||||||
return config, runtime
|
return config, runtime
|
||||||
|
|||||||
@@ -7,55 +7,10 @@ import (
|
|||||||
"strings"
|
"strings"
|
||||||
|
|
||||||
"github.com/weppos/publicsuffix-go/publicsuffix"
|
"github.com/weppos/publicsuffix-go/publicsuffix"
|
||||||
"golang.org/x/net/idna"
|
|
||||||
)
|
)
|
||||||
|
|
||||||
var (
|
// GetCookieDomain parses the app url and returns the domain value to use for cookies.
|
||||||
ErrEmptyURL = fmt.Errorf("invalid url")
|
|
||||||
)
|
|
||||||
|
|
||||||
func SafeParseAppURL(str string) (string, error) {
|
|
||||||
if strings.TrimSpace(str) == "" {
|
|
||||||
return "", ErrEmptyURL
|
|
||||||
}
|
|
||||||
|
|
||||||
u, err := url.Parse(str)
|
|
||||||
|
|
||||||
if err != nil {
|
|
||||||
return "", fmt.Errorf("invalid url: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
if u.Host == "" ||
|
|
||||||
(u.Scheme != "http" &&
|
|
||||||
u.Scheme != "https") {
|
|
||||||
return "", fmt.Errorf("invalid url, must be in format https(s)://host")
|
|
||||||
}
|
|
||||||
|
|
||||||
hostname := strings.ToLower(u.Hostname())
|
|
||||||
hostname = strings.TrimSuffix(hostname, ".")
|
|
||||||
|
|
||||||
if netIP := net.ParseIP(hostname); netIP != nil {
|
|
||||||
return "", fmt.Errorf("ip addresses not allowed")
|
|
||||||
}
|
|
||||||
|
|
||||||
hostname, err = idna.Lookup.ToASCII(hostname)
|
|
||||||
|
|
||||||
if err != nil {
|
|
||||||
return "", fmt.Errorf("failed to convert hostname to ascii: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
appURL := fmt.Sprintf("%s://%s", u.Scheme, hostname)
|
|
||||||
|
|
||||||
if u.Port() != "" {
|
|
||||||
appURL += ":" + u.Port()
|
|
||||||
}
|
|
||||||
|
|
||||||
return appURL, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetCookieDomain parses the app URL and returns the domain value to use for cookies.
|
|
||||||
// When auth for subdomains is enabled, it strips the leftmost label
|
// When auth for subdomains is enabled, it strips the leftmost label
|
||||||
// GetCookieDomain assumes the app URL is first parsed with SafeParseAppURL
|
|
||||||
// (e.g. sub1.sub2.domain.com -> sub2.domain.com), otherwise it returns the full hostname.
|
// (e.g. sub1.sub2.domain.com -> sub2.domain.com), otherwise it returns the full hostname.
|
||||||
func GetCookieDomain(appUrl string, subdomainsEnabled bool) (string, error) {
|
func GetCookieDomain(appUrl string, subdomainsEnabled bool) (string, error) {
|
||||||
u, err := url.Parse(appUrl)
|
u, err := url.Parse(appUrl)
|
||||||
@@ -66,6 +21,10 @@ func GetCookieDomain(appUrl string, subdomainsEnabled bool) (string, error) {
|
|||||||
|
|
||||||
hostname := strings.ToLower(u.Hostname())
|
hostname := strings.ToLower(u.Hostname())
|
||||||
|
|
||||||
|
if netIP := net.ParseIP(hostname); netIP != nil {
|
||||||
|
return "", fmt.Errorf("ip addresses not allowed")
|
||||||
|
}
|
||||||
|
|
||||||
parts := strings.Split(hostname, ".")
|
parts := strings.Split(hostname, ".")
|
||||||
|
|
||||||
if len(parts) < 2 {
|
if len(parts) < 2 {
|
||||||
|
|||||||
@@ -7,86 +7,7 @@ import (
|
|||||||
"github.com/tinyauthapp/tinyauth/internal/utils"
|
"github.com/tinyauthapp/tinyauth/internal/utils"
|
||||||
)
|
)
|
||||||
|
|
||||||
func TestSafeParseAPPURL(t *testing.T) {
|
func TestGetRootDomain(t *testing.T) {
|
||||||
// Normal app url
|
|
||||||
appURL := "http://sub.tinyauth.app"
|
|
||||||
expected := "http://sub.tinyauth.app"
|
|
||||||
result, err := utils.SafeParseAppURL(appURL)
|
|
||||||
assert.NoError(t, err)
|
|
||||||
assert.Equal(t, expected, result)
|
|
||||||
|
|
||||||
// Strip path
|
|
||||||
appURL = "http://sub.tinyauth.app/path"
|
|
||||||
expected = "http://sub.tinyauth.app"
|
|
||||||
result, err = utils.SafeParseAppURL(appURL)
|
|
||||||
assert.NoError(t, err)
|
|
||||||
assert.Equal(t, expected, result)
|
|
||||||
|
|
||||||
// Preserve port
|
|
||||||
appURL = "http://sub.tinyauth.app:8080"
|
|
||||||
expected = "http://sub.tinyauth.app:8080"
|
|
||||||
result, err = utils.SafeParseAppURL(appURL)
|
|
||||||
assert.NoError(t, err)
|
|
||||||
assert.Equal(t, expected, result)
|
|
||||||
|
|
||||||
// Remove trailing dot
|
|
||||||
appURL = "http://sub.tinyauth.app."
|
|
||||||
expected = "http://sub.tinyauth.app"
|
|
||||||
result, err = utils.SafeParseAppURL(appURL)
|
|
||||||
assert.NoError(t, err)
|
|
||||||
assert.Equal(t, expected, result)
|
|
||||||
|
|
||||||
// Convert to ascii
|
|
||||||
appURL = "http://bücher.example.com"
|
|
||||||
expected = "http://xn--bcher-kva.example.com"
|
|
||||||
result, err = utils.SafeParseAppURL(appURL)
|
|
||||||
assert.NoError(t, err)
|
|
||||||
assert.Equal(t, expected, result)
|
|
||||||
|
|
||||||
// Lowercase
|
|
||||||
appURL = "HTTP://SUb.tinyAUth.aPP"
|
|
||||||
expected = "http://sub.tinyauth.app"
|
|
||||||
result, err = utils.SafeParseAppURL(appURL)
|
|
||||||
assert.NoError(t, err)
|
|
||||||
assert.Equal(t, expected, result)
|
|
||||||
|
|
||||||
// Empty string
|
|
||||||
appURL = ""
|
|
||||||
_, err = utils.SafeParseAppURL(appURL)
|
|
||||||
assert.ErrorIs(t, err, utils.ErrEmptyURL)
|
|
||||||
|
|
||||||
// Invalid URL
|
|
||||||
appURL = "invalidurl"
|
|
||||||
_, err = utils.SafeParseAppURL(appURL)
|
|
||||||
assert.ErrorContains(t, err, "invalid url")
|
|
||||||
|
|
||||||
// Non http or https URL
|
|
||||||
appURL = "ftp://sub.tinyauth.app"
|
|
||||||
_, err = utils.SafeParseAppURL(appURL)
|
|
||||||
assert.ErrorContains(t, err, "invalid url")
|
|
||||||
|
|
||||||
// Invalid punycode
|
|
||||||
appURL = "http://ab--cd.example.com"
|
|
||||||
_, err = utils.SafeParseAppURL(appURL)
|
|
||||||
assert.ErrorContains(t, err, "failed to convert hostname to ascii")
|
|
||||||
|
|
||||||
// IP address
|
|
||||||
appURL = "http://10.10.10.10"
|
|
||||||
_, err = utils.SafeParseAppURL(appURL)
|
|
||||||
assert.ErrorContains(t, err, "ip addresses not allowed")
|
|
||||||
|
|
||||||
// IPv6 address
|
|
||||||
appURL = "http://[::1]:8080"
|
|
||||||
_, err = utils.SafeParseAppURL(appURL)
|
|
||||||
assert.ErrorContains(t, err, "ip addresses not allowed")
|
|
||||||
|
|
||||||
// Invalid URL
|
|
||||||
appURL = "://"
|
|
||||||
_, err = utils.SafeParseAppURL(appURL)
|
|
||||||
assert.ErrorContains(t, err, "invalid url")
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestGetCookieDomain(t *testing.T) {
|
|
||||||
// Normal case
|
// Normal case
|
||||||
domain := "http://sub.tinyauth.app"
|
domain := "http://sub.tinyauth.app"
|
||||||
expected := "tinyauth.app"
|
expected := "tinyauth.app"
|
||||||
@@ -106,6 +27,11 @@ func TestGetCookieDomain(t *testing.T) {
|
|||||||
_, err = utils.GetCookieDomain(domain, true)
|
_, err = utils.GetCookieDomain(domain, true)
|
||||||
assert.EqualError(t, err, "invalid app url, must be in format subdomain.domain.tld or domain.tld")
|
assert.EqualError(t, err, "invalid app url, must be in format subdomain.domain.tld or domain.tld")
|
||||||
|
|
||||||
|
// IP address
|
||||||
|
domain = "http://10.10.10.10"
|
||||||
|
_, err = utils.GetCookieDomain(domain, true)
|
||||||
|
assert.ErrorContains(t, err, "ip addresses not allowed")
|
||||||
|
|
||||||
// Invalid URL
|
// Invalid URL
|
||||||
domain = "http://[::1]:namedport"
|
domain = "http://[::1]:namedport"
|
||||||
_, err = utils.GetCookieDomain(domain, true)
|
_, err = utils.GetCookieDomain(domain, true)
|
||||||
@@ -130,11 +56,6 @@ func TestGetCookieDomain(t *testing.T) {
|
|||||||
_, err = utils.GetCookieDomain(domain, true)
|
_, err = utils.GetCookieDomain(domain, true)
|
||||||
assert.ErrorContains(t, err, "domain in public suffix list, cannot set cookies")
|
assert.ErrorContains(t, err, "domain in public suffix list, cannot set cookies")
|
||||||
|
|
||||||
// Domain managed by ICANN without subdomain
|
|
||||||
domain = "http://co.uk"
|
|
||||||
_, err = utils.GetCookieDomain(domain, true)
|
|
||||||
assert.ErrorContains(t, err, "domain in public suffix list, cannot set cookies")
|
|
||||||
|
|
||||||
// Domain without subdomain
|
// Domain without subdomain
|
||||||
domain = "http://tinyauth.app"
|
domain = "http://tinyauth.app"
|
||||||
expected = "tinyauth.app"
|
expected = "tinyauth.app"
|
||||||
|
|||||||
@@ -1,10 +0,0 @@
|
|||||||
# Public packages
|
|
||||||
|
|
||||||
This directory contains packages that can be used by
|
|
||||||
other projects.
|
|
||||||
|
|
||||||
While we try to maintain a consistent API, no promises
|
|
||||||
can be made for non-breaking changes throughout updates
|
|
||||||
as we constantly need to make changes to comply with the
|
|
||||||
needs of Tinyauth. We advise pinning the version of the
|
|
||||||
package you wish to use.
|
|
||||||
@@ -10,13 +10,14 @@ import (
|
|||||||
"fmt"
|
"fmt"
|
||||||
"net"
|
"net"
|
||||||
"net/url"
|
"net/url"
|
||||||
|
"slices"
|
||||||
"strings"
|
"strings"
|
||||||
|
|
||||||
"golang.org/x/net/idna"
|
"golang.org/x/net/idna"
|
||||||
)
|
)
|
||||||
|
|
||||||
// Errors
|
|
||||||
var (
|
var (
|
||||||
|
ErrInvalidURL = fmt.Errorf("invalid url")
|
||||||
ErrSchemeMismatch = fmt.Errorf("scheme mismatch")
|
ErrSchemeMismatch = fmt.Errorf("scheme mismatch")
|
||||||
ErrPortMismatch = fmt.Errorf("port mismatch")
|
ErrPortMismatch = fmt.Errorf("port mismatch")
|
||||||
ErrHostnameMismatch = fmt.Errorf("hostname mismatch")
|
ErrHostnameMismatch = fmt.Errorf("hostname mismatch")
|
||||||
@@ -28,7 +29,8 @@ type DomainValidatorOptions struct {
|
|||||||
WithScheme bool
|
WithScheme bool
|
||||||
// Ensure domains have the same port.
|
// Ensure domains have the same port.
|
||||||
WithPort bool
|
WithPort bool
|
||||||
// Specify a list of allowed schemes if WithScheme is set to true.
|
// Specify a list of allowed schemes IF WithScheme is set to true.
|
||||||
|
// Leave empty to allow any scheme.
|
||||||
AllowedSchemes []string
|
AllowedSchemes []string
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -46,74 +48,53 @@ func NewDomainValidator(opts DomainValidatorOptions) *DomainValidator {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
func (v *DomainValidator) checkScheme(rawURL string) error {
|
|
||||||
if !v.opts.WithScheme {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
if len(v.opts.AllowedSchemes) == 0 {
|
|
||||||
return fmt.Errorf("allowed schemes must be specified")
|
|
||||||
}
|
|
||||||
|
|
||||||
for _, scheme := range v.opts.AllowedSchemes {
|
|
||||||
if strings.HasPrefix(strings.ToLower(rawURL), strings.ToLower(scheme)+"://") {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return fmt.Errorf("invalid scheme")
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
func (v *DomainValidator) getURL(i string) (*url.URL, error) {
|
func (v *DomainValidator) getURL(i string) (*url.URL, error) {
|
||||||
if i == "" {
|
u, err := url.Parse(i)
|
||||||
return nil, fmt.Errorf("url cannot be empty")
|
|
||||||
|
if !v.opts.WithScheme && (err != nil || u.Host == "") {
|
||||||
|
u, err = url.Parse("tinyauth://" + i)
|
||||||
}
|
}
|
||||||
|
|
||||||
if v.opts.WithScheme {
|
|
||||||
err := v.checkScheme(i)
|
|
||||||
|
|
||||||
if err != nil {
|
|
||||||
return nil, fmt.Errorf("invalid scheme: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
u, err := url.Parse(i)
|
|
||||||
|
|
||||||
if err != nil {
|
|
||||||
return nil, fmt.Errorf("failed to parse input url: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
if u.Host == "" || u.Scheme == "" {
|
|
||||||
return nil, fmt.Errorf("missing host or scheme in url: %s", i)
|
|
||||||
}
|
|
||||||
|
|
||||||
return u, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
rawURL := i
|
|
||||||
|
|
||||||
if !strings.Contains(i, "://") {
|
|
||||||
// From godoc: [scheme:][//[userinfo@]host][/]path[?query][#fragment]
|
|
||||||
// So, we can omit the colon and tell the Go URL lib that we want
|
|
||||||
// to parse the URL without the scheme. If we don't do this,
|
|
||||||
// the URL lib will parse our entire domain as the path.
|
|
||||||
rawURL = "//" + i
|
|
||||||
}
|
|
||||||
|
|
||||||
u, err := url.Parse(rawURL)
|
|
||||||
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, fmt.Errorf("failed to parse host: %w", err)
|
return nil, fmt.Errorf("failed to parse input url: %w", err)
|
||||||
}
|
}
|
||||||
|
|
||||||
if u.Host == "" {
|
if u.Host == "" {
|
||||||
return nil, fmt.Errorf("missing host in url: %s", i)
|
return nil, ErrInvalidURL
|
||||||
|
}
|
||||||
|
|
||||||
|
if v.opts.WithPort && !v.opts.WithScheme && u.Port() == "" {
|
||||||
|
return nil, fmt.Errorf("port validation is enabled but port is missing in input url and schemes are not enabled")
|
||||||
|
}
|
||||||
|
|
||||||
|
if v.opts.WithScheme {
|
||||||
|
// Empty scheme means that we parsed the url with the tinyauth:// placeholder
|
||||||
|
if u.Scheme == "tinyauth" {
|
||||||
|
return nil, fmt.Errorf("input url is missing scheme")
|
||||||
|
}
|
||||||
|
if len(v.opts.AllowedSchemes) > 0 && !slices.Contains(v.opts.AllowedSchemes, u.Scheme) {
|
||||||
|
return nil, fmt.Errorf("scheme %s not allowed", u.Scheme)
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
return u, nil
|
return u, nil
|
||||||
}
|
}
|
||||||
|
|
||||||
func (v *DomainValidator) getHostname(hostname string) (string, error) {
|
func (v *DomainValidator) getEffectivePort(u *url.URL) (string, bool) {
|
||||||
|
if u.Port() != "" {
|
||||||
|
return u.Port(), true
|
||||||
|
}
|
||||||
|
switch u.Scheme {
|
||||||
|
case "http":
|
||||||
|
return "80", true
|
||||||
|
case "https":
|
||||||
|
return "443", true
|
||||||
|
default:
|
||||||
|
return "", false
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (v *DomainValidator) formatHostname(hostname string) (string, error) {
|
||||||
hostname = strings.ToLower(hostname)
|
hostname = strings.ToLower(hostname)
|
||||||
hostname = strings.TrimSuffix(hostname, ".")
|
hostname = strings.TrimSuffix(hostname, ".")
|
||||||
if net.ParseIP(hostname) != nil {
|
if net.ParseIP(hostname) != nil {
|
||||||
@@ -152,18 +133,26 @@ func (v *DomainValidator) Validate(expected, actual string) error {
|
|||||||
}
|
}
|
||||||
|
|
||||||
if v.opts.WithPort {
|
if v.opts.WithPort {
|
||||||
if eu.Port() != au.Port() {
|
eup, ok := v.getEffectivePort(eu)
|
||||||
|
if !ok {
|
||||||
|
return fmt.Errorf("failed to get effective port for url: %s", eu.String())
|
||||||
|
}
|
||||||
|
aup, ok := v.getEffectivePort(au)
|
||||||
|
if !ok {
|
||||||
|
return fmt.Errorf("failed to get effective port for url: %s", au.String())
|
||||||
|
}
|
||||||
|
if eup != aup {
|
||||||
return ErrPortMismatch
|
return ErrPortMismatch
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
euf, err := v.getHostname(eu.Hostname())
|
euf, err := v.formatHostname(eu.Hostname())
|
||||||
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
|
||||||
auf, err := v.getHostname(au.Hostname())
|
auf, err := v.formatHostname(au.Hostname())
|
||||||
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return err
|
return err
|
||||||
@@ -176,7 +165,7 @@ func (v *DomainValidator) Validate(expected, actual string) error {
|
|||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|
||||||
// SafeHostname uses the internal validation for domains that the validator uses
|
// SafeHostname uses the internal validation for domains that Validator uses
|
||||||
// to parse a hostname. It ensures the input URL is a valid URL, that a host
|
// to parse a hostname. It ensures the input URL is a valid URL, that a host
|
||||||
// is present and that the hostname is lowercased and without a trailing dot.
|
// is present and that the hostname is lowercased and without a trailing dot.
|
||||||
func (v *DomainValidator) SafeHostname(input string) (string, error) {
|
func (v *DomainValidator) SafeHostname(input string) (string, error) {
|
||||||
@@ -186,5 +175,5 @@ func (v *DomainValidator) SafeHostname(input string) (string, error) {
|
|||||||
return "", err
|
return "", err
|
||||||
}
|
}
|
||||||
|
|
||||||
return v.getHostname(u.Hostname())
|
return v.formatHostname(u.Hostname())
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -20,36 +20,16 @@ func TestDomainValidator_SafeHostname(t *testing.T) {
|
|||||||
{
|
{
|
||||||
description: "Empty url fails",
|
description: "Empty url fails",
|
||||||
errorFunc: func(t *testing.T, e error) {
|
errorFunc: func(t *testing.T, e error) {
|
||||||
assert.ErrorContains(t, e, "url cannot be empty")
|
assert.ErrorIs(t, e, ErrInvalidURL)
|
||||||
},
|
|
||||||
},
|
|
||||||
{
|
|
||||||
description: "URL without host fails",
|
|
||||||
input: "/foo",
|
|
||||||
errorFunc: func(t *testing.T, e error) {
|
|
||||||
assert.ErrorContains(t, e, "missing host in url")
|
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
description: "Invalid url fails",
|
description: "Invalid url fails",
|
||||||
input: "foo:foo",
|
input: "foo:foo",
|
||||||
errorFunc: func(t *testing.T, e error) {
|
|
||||||
assert.ErrorContains(t, e, "failed to parse host")
|
|
||||||
},
|
|
||||||
},
|
|
||||||
{
|
|
||||||
description: "With scheme and invalid url should fail",
|
|
||||||
options: DomainValidatorOptions{WithScheme: true, AllowedSchemes: []string{"https"}},
|
|
||||||
input: "https://foo:foo",
|
|
||||||
errorFunc: func(t *testing.T, e error) {
|
errorFunc: func(t *testing.T, e error) {
|
||||||
assert.ErrorContains(t, e, "failed to parse input url")
|
assert.ErrorContains(t, e, "failed to parse input url")
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
{
|
|
||||||
description: "Scheme disabled with scheme should pass",
|
|
||||||
input: "https://example.com",
|
|
||||||
expected: "example.com",
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
description: "Domain without scheme should parse if scheme is disabled",
|
description: "Domain without scheme should parse if scheme is disabled",
|
||||||
input: "example.com",
|
input: "example.com",
|
||||||
@@ -60,7 +40,7 @@ func TestDomainValidator_SafeHostname(t *testing.T) {
|
|||||||
options: DomainValidatorOptions{WithScheme: true},
|
options: DomainValidatorOptions{WithScheme: true},
|
||||||
input: "example.com",
|
input: "example.com",
|
||||||
errorFunc: func(t *testing.T, e error) {
|
errorFunc: func(t *testing.T, e error) {
|
||||||
assert.ErrorContains(t, e, "invalid scheme")
|
assert.ErrorIs(t, e, ErrInvalidURL)
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
@@ -68,7 +48,7 @@ func TestDomainValidator_SafeHostname(t *testing.T) {
|
|||||||
options: DomainValidatorOptions{WithScheme: true, AllowedSchemes: []string{"https"}},
|
options: DomainValidatorOptions{WithScheme: true, AllowedSchemes: []string{"https"}},
|
||||||
input: "foo://example.com",
|
input: "foo://example.com",
|
||||||
errorFunc: func(t *testing.T, e error) {
|
errorFunc: func(t *testing.T, e error) {
|
||||||
assert.ErrorContains(t, e, "invalid scheme")
|
assert.ErrorContains(t, e, "foo not allowed")
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
@@ -114,10 +94,15 @@ func TestDomainValidator_SafeHostname(t *testing.T) {
|
|||||||
},
|
},
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
description: "With port enabled without any port should work",
|
// Placeholder should not be used by users and is reserved for the validator.
|
||||||
options: DomainValidatorOptions{WithPort: true},
|
// Using it is like not using any scheme for the validator, and thus it will fail
|
||||||
input: "example.com",
|
// with schemes enabled.
|
||||||
expected: "example.com",
|
description: "Placeholder scheme supplied directly should fail",
|
||||||
|
options: DomainValidatorOptions{WithScheme: true, AllowedSchemes: []string{"https"}},
|
||||||
|
input: "tinyauth://example.com",
|
||||||
|
errorFunc: func(t *testing.T, e error) {
|
||||||
|
assert.ErrorContains(t, e, "input url is missing scheme")
|
||||||
|
},
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -150,7 +135,7 @@ func TestDomainValidator_Validate(t *testing.T) {
|
|||||||
expected: "foo:foo",
|
expected: "foo:foo",
|
||||||
actual: "bar.com",
|
actual: "bar.com",
|
||||||
errorFunc: func(t *testing.T, e error) {
|
errorFunc: func(t *testing.T, e error) {
|
||||||
assert.ErrorContains(t, e, "failed to parse host:")
|
assert.ErrorContains(t, e, "failed to parse input url:")
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
@@ -158,7 +143,7 @@ func TestDomainValidator_Validate(t *testing.T) {
|
|||||||
expected: "example.com",
|
expected: "example.com",
|
||||||
actual: "foo:foo",
|
actual: "foo:foo",
|
||||||
errorFunc: func(t *testing.T, e error) {
|
errorFunc: func(t *testing.T, e error) {
|
||||||
assert.ErrorContains(t, e, "failed to parse host:")
|
assert.ErrorContains(t, e, "failed to parse input url:")
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
@@ -177,22 +162,58 @@ func TestDomainValidator_Validate(t *testing.T) {
|
|||||||
actual: "https://example.com",
|
actual: "https://example.com",
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
description: "Port validation with ports enabled and empty ports should work",
|
description: "Port validation without ports and schemes disabled should fail",
|
||||||
options: DomainValidatorOptions{WithPort: true},
|
options: DomainValidatorOptions{WithPort: true},
|
||||||
expected: "example.com",
|
expected: "example.com",
|
||||||
actual: "example.com",
|
actual: "example.com",
|
||||||
|
errorFunc: func(t *testing.T, e error) {
|
||||||
|
assert.ErrorContains(t, e, "port validation is enabled but port is missing in input url and schemes are not enabled")
|
||||||
|
},
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
description: "Port validation should pass with same port",
|
description: "Port validation with no port and http should pass",
|
||||||
|
options: DomainValidatorOptions{WithPort: true, WithScheme: true, AllowedSchemes: []string{"http"}},
|
||||||
|
expected: "http://example.com",
|
||||||
|
actual: "http://example.com",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
description: "Port validation with no port and https should pass",
|
||||||
|
options: DomainValidatorOptions{WithPort: true, WithScheme: true, AllowedSchemes: []string{"https"}},
|
||||||
|
expected: "https://example.com",
|
||||||
|
actual: "https://example.com",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
description: "Port validation with port and no scheme should pass with same port",
|
||||||
options: DomainValidatorOptions{WithPort: true},
|
options: DomainValidatorOptions{WithPort: true},
|
||||||
expected: "example.com:8080",
|
expected: "example.com:8080",
|
||||||
actual: "example.com:8080",
|
actual: "example.com:8080",
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
description: "Port enabled with scheme and matching port should pass",
|
description: "Domains with unknown scheme and port enabled but no port should fail",
|
||||||
|
options: DomainValidatorOptions{WithPort: true, WithScheme: true},
|
||||||
|
expected: "ssh://example.com:22",
|
||||||
|
actual: "ssh://example.com",
|
||||||
|
errorFunc: func(t *testing.T, e error) {
|
||||||
|
assert.ErrorContains(t, e, "failed to get effective port for url")
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
description: "Domains with unknown scheme and port enabled but no port should fail, reverse",
|
||||||
|
options: DomainValidatorOptions{WithPort: true, WithScheme: true},
|
||||||
|
expected: "ssh://example.com",
|
||||||
|
actual: "ssh://example.com:22",
|
||||||
|
errorFunc: func(t *testing.T, e error) {
|
||||||
|
assert.ErrorContains(t, e, "failed to get effective port for url")
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
description: "Port validation with port and no scheme should fail with different port",
|
||||||
options: DomainValidatorOptions{WithPort: true},
|
options: DomainValidatorOptions{WithPort: true},
|
||||||
expected: "https://example.com:443",
|
expected: "example.com:8080",
|
||||||
actual: "https://example.com:443",
|
actual: "example.com:8081",
|
||||||
|
errorFunc: func(t *testing.T, e error) {
|
||||||
|
assert.ErrorIs(t, e, ErrPortMismatch)
|
||||||
|
},
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
description: "Failure to format expected domain should fail",
|
description: "Failure to format expected domain should fail",
|
||||||
@@ -223,13 +244,10 @@ func TestDomainValidator_Validate(t *testing.T) {
|
|||||||
actual: "https://example.com",
|
actual: "https://example.com",
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
description: "Valid domains with non matching ports should fail",
|
description: "Valid domains with matching ports should pass",
|
||||||
options: DomainValidatorOptions{WithPort: true},
|
options: DomainValidatorOptions{WithPort: true},
|
||||||
expected: "example.com:8080",
|
expected: "example.com:8080",
|
||||||
actual: "example.com:8085",
|
actual: "example.com:8080",
|
||||||
errorFunc: func(t *testing.T, e error) {
|
|
||||||
assert.ErrorIs(t, e, ErrPortMismatch)
|
|
||||||
},
|
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
description: "Valid domains without ports or schemes should pass",
|
description: "Valid domains without ports or schemes should pass",
|
||||||
|
|||||||
Reference in New Issue
Block a user