Johan Lundberg
1054feb534
fix: reorder imports and use ty-compatible type suppression
2026-02-19 14:29:01 +01:00
Johan Lundberg
f648422227
test: update all tests to include CSRF tokens
2026-02-19 14:19:47 +01:00
Johan Lundberg
9e5773f52f
feat: add CSRF tokens to templates and JS fetch calls
2026-02-19 14:03:34 +01:00
Johan Lundberg
d1f2b39cb6
feat: wire CSRF middleware and harden session cookie
2026-02-19 13:45:58 +01:00
Johan Lundberg
b5ea9950a2
fix: use frozenset for SAFE_METHODS and extract SESSION_KEY constant
2026-02-19 13:42:18 +01:00
Johan Lundberg
f93290d43e
feat: add CSRF middleware with synchronizer token pattern
2026-02-19 13:26:33 +01:00
Johan Lundberg
b1291c801e
docs: add CSRF protection implementation plan
2026-02-19 11:32:51 +01:00
Johan Lundberg
94c14af8cc
docs: add CSRF protection design document
2026-02-19 11:29:19 +01:00
Johan Lundberg
be35c17fa5
Merge branch 'feature/consent-screen'
2026-02-19 11:16:51 +01:00
Johan Lundberg
3b1c145e31
fix: add type annotation to approved_scopes for type checker
2026-02-19 11:16:01 +01:00
Johan Lundberg
b8464284c2
test: update existing tests to handle consent step
2026-02-19 11:13:11 +01:00
Johan Lundberg
078892a413
fix: validate consent action and add error check after re-parse
2026-02-19 11:09:14 +01:00
Johan Lundberg
5c4269fd6e
feat: add consent page template
2026-02-19 09:52:45 +01:00
Johan Lundberg
1d8fd91f68
feat: add consent check to authorization flow
2026-02-19 09:47:59 +01:00
Johan Lundberg
9ccc6c885f
feat: add Consent model, migration, and repository
2026-02-18 15:01:35 +01:00
Johan Lundberg
b22dabbbb0
Merge branch 'feature/profile-page'
2026-02-18 14:38:53 +01:00
Johan Lundberg
8a610a0cd6
feat: add self-service profile page with manage navigation
...
Add /manage/profile page where authenticated users can view and edit
their OIDC profile fields (given_name, family_name, preferred_username,
email, phone_number, picture, locale).
- Create manage/base.html with tab-style nav for Profile/Credentials
- Update credentials.html to extend manage/base.html
- Add GET/POST routes with server-side validation
- Add input styling for tel and url input types
- Add profile test user with pre-filled data in setup_db.py
- Add 19 E2E tests covering structure, navigation, updates, validation
- All 76 E2E tests and 172 Python tests pass
2026-02-18 14:35:17 +01:00
Johan Lundberg
16f3e039d9
docs: add consent screen design
2026-02-18 13:50:56 +01:00
Johan Lundberg
404fcac4dd
Merge branch 'feature/config-file'
2026-02-18 13:09:58 +01:00
Johan Lundberg
64f8c1936b
refactor: fix lint warnings and remove stale type: ignore comments
2026-02-18 13:08:03 +01:00
Johan Lundberg
8c91edf137
docs: add example config file and update README
2026-02-18 12:54:43 +01:00
Johan Lundberg
eeb09321e2
feat: register OIDC clients from config file
2026-02-18 12:48:23 +01:00
Johan Lundberg
fa614e9321
Merge branch 'feature/playwright-webauthn-e2e'
2026-02-18 12:48:03 +01:00
Johan Lundberg
70c97233c5
fix(e2e): fix WebAuthn and integration test failures
...
- Use localhost instead of 127.0.0.1 as TARGET_URL so the WebAuthn RP ID
is a valid domain (the spec forbids IP addresses)
- Replace request.post('/logout') with page.context().clearCookies() since
Playwright's request fixture has a separate cookie jar from the page
- Add registerPasskey() helper that waits for 'load' event to reliably
detect the page reload after successful registration
- Track credential count with getCredentialCount() since credentials
accumulate across serial tests sharing the same database
- Fix login.spec.js selector from #webauthn-login-form to #webauthn-login-btn
to match the actual template
All 57 E2E tests now pass (50 migrated + 7 WebAuthn).
2026-02-18 12:45:03 +01:00
Johan Lundberg
61ca3063ca
feat: add TOML config file support with client registrations
2026-02-18 12:44:00 +01:00
Johan Lundberg
94f777fc8f
docs: add config file implementation plan
2026-02-18 12:12:49 +01:00
Johan Lundberg
edeb036086
docs: add TOML config file design
2026-02-18 12:09:43 +01:00
Johan Lundberg
71ddf5d8ff
feat(e2e): add WebAuthn E2E tests with CDP virtual authenticator
2026-02-18 11:52:47 +01:00
Johan Lundberg
c96ebe1b64
feat(e2e): add WebAuthn test user to fixture seeding
2026-02-18 11:47:11 +01:00
Johan Lundberg
c726ae18d3
chore: remove completed implementation plan docs
2026-02-18 11:46:37 +01:00
Johan Lundberg
dee1b1e3bc
docs: update README with CLI commands and fix stale module name
2026-02-18 11:43:56 +01:00
Johan Lundberg
ef8bf10555
refactor(e2e): remove old custom test runner
2026-02-18 11:43:17 +01:00
Johan Lundberg
7900f264ba
refactor(e2e): migrate all tests to Playwright Test
2026-02-18 11:37:23 +01:00
Johan Lundberg
80960d5a1f
Merge branch 'feature/cli-module'
2026-02-18 11:35:15 +01:00
Johan Lundberg
e43720cd62
refactor: fix lint and type check issues in CLI module
2026-02-18 11:34:00 +01:00
Johan Lundberg
4e83c3807e
feat: add initial-admin CLI command
2026-02-18 11:29:13 +01:00
Johan Lundberg
bcddf5d1c8
feat: add create-invite CLI command
2026-02-18 11:27:36 +01:00
Johan Lundberg
174c6c001e
feat: migrate e2e test infrastructure to @playwright/test
...
Replace direct playwright dependency with @playwright/test and add
playwright.config.js for centralized test configuration. Update run.sh
to invoke 'npx playwright test' instead of running test files with node.
2026-02-18 11:10:23 +01:00
Johan Lundberg
0c3157ea3a
feat: handle pre-existing users in register_magic_link route
2026-02-18 10:29:44 +01:00
Johan Lundberg
a817fdb0f6
docs: add CLI module design and implementation plan
2026-02-17 14:09:14 +01:00
Johan Lundberg
1c21d6d199
test: add failing test for registering pre-existing users
...
Part of CLI module work (fastapi-oidc-op-9lb.1). The test verifies that
/register/{token} handles users already created by initial-admin.
2026-02-17 14:09:00 +01:00
Johan Lundberg
cd9469342b
refactor: fix lint warnings in webauthn login tests
2026-02-17 13:46:02 +01:00
Johan Lundberg
ebe5497879
feat: update login UI and JS for usernameless WebAuthn authentication
2026-02-17 13:42:35 +01:00
Johan Lundberg
32567b5484
feat: rewrite WebAuthn login routes for usernameless discoverable credential flow
2026-02-17 13:38:17 +01:00
Johan Lundberg
2ffe968342
feat: require discoverable credentials and prefer user verification in WebAuthnService
2026-02-17 13:18:46 +01:00
Johan Lundberg
8aebd04d2a
chore: add .worktrees/ to .gitignore
2026-02-17 12:58:25 +01:00
Johan Lundberg
51d03bc780
refactor: extract open_db() context manager from lifespan
2026-02-16 15:41:15 +01:00
Johan Lundberg
3462e38131
update Dockerfile: fastapi_oidc_op → porchlight
2026-02-16 15:35:21 +01:00
Johan Lundberg
7cb1adbd06
update all imports in test files: fastapi_oidc_op → porchlight
2026-02-16 15:34:53 +01:00
Johan Lundberg
14037117e7
update all imports in source files: fastapi_oidc_op → porchlight
2026-02-16 15:32:30 +01:00
