MythEclipse/9router
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,080 Commits 1 Branch 0 Tags
65197ad11c6ed96899e36c33ec28c0ddb9255a28
Commit Graph
6 Commits
Author SHA1 Message Date
Duc Nguyen 65197ad11c feat(auth): add native SAML 2.0 SSO integration 
Add SAML 2.0 as a second SSO protocol alongside OIDC under a unified
authMode/ssoType model. SP flows via @node-saml/node-saml: AuthnRequest
generation, ACS POST assertion handling, SP metadata export, and admin
config test endpoint. Replay-protected via saml_state cookie (httpOnly,
SameSite=Lax) matched against InResponseTo; wantAssertionsSigned enforced.

- src/lib/auth/saml.js: SAML instance builder, X.509 cert formatter, claim pickers
- 4 routes under src/app/api/auth/saml/: start, acs, metadata, test
- settingsRepo: ssoType + saml* defaults; login/status routes dispatch by type
- profile page: SSO protocol switcher, IdP metadata XML + cert uploaders
- login page: dynamic SAML sign-in button; Header: SAML user badge
 2026-08-13 17:56:34 +07:00
decoluaandCursor 0c7c9de00a fix(security): re-auth on DB export/import + SSRF guard on web fetch 
- /api/settings/database now requires current password (header for GET,
  body for POST) in addition to session; CLI-token requests exempt
- add verifyDashboardPassword helper reusing login bcrypt check
- profile UI prompts password via modal before export/import
- /v1/web/fetch rejects internal/private/metadata targets via assertPublicUrl

Refs GHSA-qvfm-67h2-2qfx, GHSA-qj3v-64wj-q825

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-13 11:40:35 +07:00
decoluaandCursor 7648c3412b fix(auth): real client IP rate-limiting + remote default-password guard 
- Add custom-server.js: inject unspoofable socket IP, strip client XFF
  (wired into Docker CMD + CLI spawn + build-cli copy)
- loginLimiter: key on trusted x-9r-real-ip, TRUST_PROXY opt-in, global fallback
- Force password change on first remote login while default is in use
- Add /api/auth/reset-password (local-only) so CLI reset writes live SQLite
- CLI settings: reset via API instead of stale db.json
- Fix OAuth modals opening duplicate browser tabs on add-connection
- Add cli:pack / cli:publish scripts

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-08 12:10:02 +07:00
decolua 026a7c9b85 Enhance security 2026-05-21 11:33:18 +07:00
decolua fe3ce25ae3 Update JWT_SECRET handling 2026-05-15 09:31:34 +07:00
Walter Cheng c3d91b019b Add OIDC dashboard auth (#1020) 2026-05-12 09:43:42 +07:00