Repository navigation

Security review fixes, signing-key revocation, auth_time, GHCR retention - #261

Merged

windischb merged 75 commits into

developfrom

fix/review-findings

Nov 5, 2026

Merged

Security review fixes, signing-key revocation, auth_time, GHCR retention#261
windischb merged 75 commits into
developfrom
fix/review-findings

Commits on Nov 3, 2026
- test: opt-in dedicated postgres-dev database for API tests
  
  windischb
  and
  claude
  committed
  b838b05
- fix(profile): keep account deletion usable below the portal MFA minimum
  
  windischb
  and
  claude
  committed
  54c58c9
- fix(service-accounts): keep the initial secret in the creator response only
  
  windischb
  and
  claude
  committed
  d98c2ff
- fix(gdpr): resume an erasure that failed part-way
  
  windischb
  and
  claude
  committed
  75539e1
- fix(resource-server): restore ended sessions after an SDK restart or cursor reset
  
  windischb
  and
  claude
  committed
  d713fd2
- fix(management): require the DPoP proof for DPoP-bound management tokens
  
  windischb
  and
  claude
  committed
  700ae8f
- fix(frontend): handle a refused reconnect reload instead of keeping a stale list
  
  windischb
  and
  claude
  committed
  97a7fdb
- build(deps): patch vulnerable NuGet packages
  
  windischb
  and
  claude
  committed
  0d87f1e
- fix(saml): validate the response signature before consuming the request
  
  windischb
  and
  claude
  committed
  31a3935
- test: opt-in failure correlation for test hosts and 500 diagnostics
  
  windischb
  and
  claude
  committed
  ca8b020
- fix(frontend): handle refused reloads in the standalone admin stores
  
  windischb
  and
  claude
  committed
  e8c3f10
- fix(authorization): add the invite-code permissions to the system app catalog
  
  windischb
  and
  claude
  committed
  5e19bca
- fix(observability): tag the realm on traces after realm resolution
  
  windischb
  and
  claude
  committed
  2fd47ed
- docs: safe local development preflight
  
  windischb
  and
  claude
  committed
  45ca0be
- fix(admin): one permission list for the sidebar, router and admin entry
  
  windischb
  and
  claude
  committed
  9c78a4a
- fix(login): keep the MFA continuation when a code is wrong
  
  windischb
  and
  claude
  committed
  07e13d4
- fix(oauth): refuse a refresh when the MFA setup grace has not started
  
  windischb
  and
  claude
  committed
  bfa57b5
- fix(account): confirm account changes with a passkey of an RP this host is under
  
  windischb
  and
  claude
  committed
  fc1cc5f
- test: opt-in live browser harness for the review fixes
  
  windischb
  and
  claude
  committed
  257eca4
- test: primary-domain switch and auth cookie selection
  
  windischb
  and
  claude
  committed
  feaaae9
- fix(passkeys): redeem an enrollment ceremony once and store a credential id once
  
  windischb
  and
  claude
  committed
  dc94e48
- fix(logging): keep link secrets and user names out of the request log
  
  windischb
  and
  claude
  committed
  e4123d8
- fix(oauth): accept the device approval only from the IdP's own origin
  
  windischb
  and
  claude
  committed
  77deb29
- fix(external-auth): require a recent account proof to link an external identity
  
  windischb
  and
  claude
  committed
  2366bf6
- fix(registration): never confer realm:admin through self-registration defaults
  
  windischb
  and
  claude
  committed
  629e198
- fix(oauth): redeem a magic link once through the native grant
  
  windischb
  and
  claude
  committed
  86abff7
- fix(rate-limit): reserve a login attempt before the password is checked
  
  windischb
  and
  claude
  committed
  2a595cb
- fix(drafts): check the draft version atomically and claim it while it is applied
  
  windischb
  and
  claude
  committed
  38e0d44
- test: opt-in dedicated postgres-dev database for the cold-start suite
  
  windischb
  and
  claude
  committed
  b90ba8e
- chore(dev): script to drop the modgud_review_* databases on postgres-dev
  
  windischb
  and
  claude
  committed
  e24f779
- fix(positions): keep one live grant per position and user
  
  windischb
  and
  claude
  committed
  d04c256
- fix(passkeys): fail closed on mistyped clientDataJSON
  
  windischb
  and
  claude
  committed
  9d86030
- fix(rate-limit): gate the web passkey login options
  
  windischb
  and
  claude
  committed
  4272c8c
- fix(passkeys): keep anonymous web login options usernameless
  
  windischb
  and
  claude
  committed
  b7ad8e1
- fix(oauth): rotate the concurrency token on bulk revoke
  
  windischb
  and
  claude
  committed
  7288b70
- fix(realtime): re-check stream permissions before every item
  
  windischb
  and
  claude
  committed
  5e71fd9
- fix(sessions): end relying-party sessions when validation finds an expiry
  
  windischb
  and
  claude
  committed
  be8fd04
- fix(logout): keep back-channel deliveries recoverable and due-checked
  
  windischb
  and
  claude
  committed
  a282df8
- fix(gdpr): cut off a self-deleting account on admin delete
  
  windischb
  and
  claude
  committed
  1c3df36
- fix(gdpr): record every permanent erasure in the Security log
  
  windischb
  and
  claude
  committed
  e0de41d
- fix(gdpr): export consents and mark what the data export limits
  
  windischb
  and
  claude
  committed
  e2b327c
- fix(oauth): revoke a client's grants when it is deleted or disabled
  
  windischb
  and
  claude
  committed
  497cab5
- fix(oauth): revalidate granted scopes on code, refresh and device exchange
  
  windischb
  and
  claude
  committed
  ebed399
- fix(external-auth): enforce Allow linking on the self-service link path
  
  windischb
  and
  claude
  committed
  12ff131
- fix(saml): enforce required assertion encryption and accept encrypted assertions
  
  windischb
  and
  claude
  committed
  5eb90ac
- fix(external-auth): let the JIT creator yield profile authority to a promoted provider
  
  windischb
  and
  claude
  committed
  46548ec
- fix(cimd): check the whole key set for private material
  
  windischb
  and
  claude
  committed
  5240c23
- fix(cimd): take token lifetimes from the current settings on a cache hit
  
  windischb
  and
  claude
  committed
  e4c8315
- fix(cimd): give the metadata and JWKS body read a deadline of its own
  
  windischb
  and
  claude
  committed
  0c28528
- fix(cimd): start the unknown-kid refetch cooldown when the refetch fails
  
  windischb
  and
  claude
  committed
  ab03048
- fix(discovery): advertise DCR and CIMD by the App's effective switch
  
  windischb
  and
  claude
  committed
  6648d67
- fix(oauth): let prompt=login complete after a fresh sign-in
  
  windischb
  and
  claude
  committed
  465120a
- fix(saml): bind a SAML login to the browser that started it
  
  windischb
  and
  claude
  committed
  07fcfaa
- fix(saml): send the AuthnRequest by form post to a POST-only IdP
  
  windischb
  and
  claude
  committed
  18f187a
- fix(saml): let concurrent first uses share one SP certificate
  
  windischb
  and
  claude
  committed
  9c5db81
- fix(saml): apply the configured IdP Entity ID override
  
  windischb
  and
  claude
  committed
  6a4ac42
- fix(saml): drop a metadata refresh whose provider changed meanwhile
  
  windischb
  and
  claude
  committed
  75a09b5
- fix(external-auth): keep an active provider's registration in step with its configuration
  
  windischb
  and
  claude
  committed
  68209c3
Commits on Nov 4, 2026
- fix(external-auth): let the database decide provider write conflicts
  
  windischb
  and
  claude
  committed
  288dbb7
- fix(external-auth): key runtime provider registrations by realm
  
  windischb
  and
  claude
  committed
  a9760c2
- fix(external-auth): enforce the login providers' raw-claims retention
  
  windischb
  and
  claude
  committed
  83e72a1
- fix(identity): write only what an identity update changed
  
  windischb
  and
  claude
  committed
  8a52edd
- test(security): count only the logins that reach the password check
  
  windischb
  and
  claude
  committed
  98ec23c
- fix(groups): only a realm admin may rebind a realm-admin group
  
  windischb
  and
  claude
  committed
  e2dc901
- fix(users): guard realm-admin group membership on the user routes
  
  windischb
  and
  claude
  committed
  3b3e9aa
- fix(deps): Cocoar.JsEval 5.0.1 — engines no longer share one Jint configuration
  
  windischb
  and
  claude
  committed
  8807ac2
- fix(keys): revoke a realm signing key at once on suspected compromise
  
  windischb
  and
  claude
  committed
  b23159d
- fix(observability): re-check observability:read while the live feeds run
  
  windischb
  and
  claude
  committed
  16c6e91
- fix(oidc): put auth_time into user ID tokens
  
  windischb
  and
  claude
  committed
  ba18a37
- docs(jobs): describe the staffing-sweep realm job
  
  windischb
  and
  claude
  committed
  5055629
Commits on Nov 5, 2026
- fix(ci): keep the platform images and signatures of retained GHCR images
  
  windischb
  and
  claude
  committed
  d9bd214
- build(deps): vite 8.3.6 and dompurify 3.4.17 for new advisories
  
  windischb
  and
  claude
  committed
  2ed02c1
- test: accept newer runtime patch assemblies and read spec files once
  
  windischb
  and
  claude
  committed
  1f9de87
- docs(saml): put the signature-placement comment back on its method
  
  windischb
  and
  claude
  committed
  4116507
- test(observability): wait for the request span before asserting
  
  windischb
  and
  claude
  committed
  0f01500

Commits

Commits on Nov 3, 2026

Commits on Nov 4, 2026

Commits on Nov 5, 2026