peaklabs-dev
3842bc2442
fix(auth): rate limit by proxy-aware client ip instead of REMOTE_ADDR
2026-08-26 17:12:01 +02:00
Andras Bacsai
7bbd91175f
Revert "Merge branch 'next' into main"
...
This reverts commit 2598f3e4c883f1a2e503
2026-08-21 12:12:56 +02:00
github-actions[bot]
7759c9b910
Merge remote-tracking branch 'origin/main' into next
2026-08-20 07:34:23 +00:00
Andras Bacsai and GitHub
de1d234ea5
fix(auth): require confirmation before accepting magic links ( #11413 )
2026-08-20 09:34:05 +02:00
Andras Bacsai
81227670e6
Reapply "Merge origin/next into main"
...
This reverts commit 15359833d3
2026-08-19 12:39:55 +02:00
Andras Bacsai
15359833d3
Revert "Merge origin/next into main"
...
This reverts commit 541d743907bb1d3f13f2
2026-08-19 12:33:16 +02:00
Andras Bacsai
bdc7e53fac
Merge remote-tracking branch 'origin/next' into openid-auth-support
2026-07-14 13:55:35 +02:00
Andras Bacsai
b0f0f7d8d0
feat: harden auth flows and server mobile navigation
...
Add normalized email identity rate limiting for registration and forgot-password requests, and refresh Sentinel status from restart broadcasts.
Rework server sidebars and navbar for mobile menus and active status visibility.
2026-07-08 09:42:52 +02:00
Andras Bacsai
e354840e5a
feat(auth): add OIDC SSO and registration controls
...
Add OIDC discovery, JWKS validation, Socialite integration, OAuth identity linking, and configurable registration policy for password and SSO signups. Update related settings/profile UI and tests.
2026-06-04 13:59:08 +02:00
Andras Bacsai
65e5b2ecdb
fix: correct login rate limiter key format to include IP address
2025-10-28 10:32:19 +01:00
Andras Bacsai and Claude
f300ba0118
fix: prevent login rate limit bypass via spoofed headers
...
The login and forgot-password rate limiters were vulnerable to bypass
by manipulating the X-Forwarded-For header. Attackers could rotate
this header value to circumvent the 5 attempts per minute limit.
Changed both rate limiters to use server('REMOTE_ADDR') instead of
ip() to prevent header spoofing. REMOTE_ADDR gives the actual
connecting IP before proxy headers are processed.
Also added comprehensive unit tests to verify the fix.
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-Authored-By: Claude <noreply@anthropic.com >
2025-10-28 09:47:13 +01:00
Andras Bacsai
a1eaa046c9
feat(auth): enhance user login flow to handle team invitations, attaching users to invited teams upon first login and maintaining personal team logic for regular logins
2025-09-15 12:12:14 +02:00
peaklabs-dev
c27e2e328f
chore: remove waitlist redirect
2024-12-09 16:37:36 +01:00
peaklabs-dev
1c5ddab30d
use one constants file
2024-11-12 15:18:48 +01:00
Andras Bacsai
b8a35be095
fix: always authenticate with lowercase emails
2024-11-03 16:14:25 +01:00
Andras Bacsai
83549965ca
Refactor instanceSettings() function for improved code readability
2024-10-01 10:37:40 +02:00
Andras Bacsai
0ce41d2c1c
chore: Update registration view to display a notice for first user that it will be an admin
2024-08-06 11:34:51 +02:00
Andras Bacsai
0f55e83591
revert: instancesettings
2024-07-12 15:45:36 +02:00
Andras Bacsai
88f33be5b6
refactor: only get instanceSettings once from db
2024-07-12 12:51:55 +02:00
Thijmen and github-actions[bot]
d86274cc37
Fix styling
2024-06-10 20:43:34 +00:00
1f37318f79
Add oauth support
...
- Support azure, bitbucket, github, gitlab, google providers
- Add authentication page to settings
Co-authored-by: Suraj Kumar <srjkmr1024@gmail.com >
Co-authored-by: Michael Castanieto <mcastanieto@gmail.com >
Co-authored-by: Mike Kim <m.kim4247@gmail.com >
2024-03-11 17:29:57 -04:00
Andras Bacsai
2ffc3f497b
fix: should note delete personal teams
2024-03-05 09:19:15 +01:00
Andras Bacsai
4c3907c296
refactor routes
2024-01-07 16:23:41 +01:00
Andras Bacsai
f03aa57758
fix: routing, switch back to old one
2023-12-27 16:45:01 +01:00
Andras Bacsai
3fabff93f6
fix a few things
2023-09-01 09:34:25 +02:00
Andras Bacsai
5a3457c180
on login, update updated_at
2023-08-17 15:18:03 +02:00
Andras Bacsai
9940aa68e7
fix error
2023-08-15 16:45:44 +02:00
Andras Bacsai
f8d7c5209e
rate limit things
2023-08-15 14:27:45 +02:00
Andras Bacsai
88b3005589
feat: force password reset + waitlist
2023-08-15 14:11:38 +02:00
Andras Bacsai
82a01b4483
format muhahaha
2023-08-11 20:48:52 +02:00
Andras Bacsai
f2228cec7b
testing php storm code cleanup and styling
2023-08-08 11:51:36 +02:00
Andras Bacsai
fed35d9c13
fix: registration/login button
...
fix: init user registrations
2023-06-29 17:16:50 +02:00
Andras Bacsai
0aa816b4f2
a lot hehe
2023-06-01 12:15:33 +02:00
Andras Bacsai
cd625ba1e1
init forgot password
2023-06-01 08:19:33 +02:00
Andras Bacsai
4156ba8908
fix instanceSettings
2023-05-16 17:09:50 +02:00
Andras Bacsai
30f597c563
production modifications
2023-04-27 11:29:02 +02:00
Andras Bacsai
50316c9cf6
settings view
2023-04-25 10:06:45 +02:00
Andras Bacsai
e47d493776
Add users, teams, authentication, profile/login/register/navbar views
2023-03-24 14:54:17 +01:00
peaklabs-dev
Andras Bacsai
github-actions[bot]
Andras Bacsai
Thijmenandgithub-actions[bot]
