Balaji Vijayakumar f815e4a83f feat(auth): add OIDC SSO login ...

Adds an OpenID Connect relying-party login path (PKCE authorization-code
flow) against a single env-configured identity provider — additive to
password/passkey login by default, with an operator opt-in (OIDC_ONLY,
enforced server-side on every auth route) to disable them entirely.
First-time sign-in auto-provisions or links an account by verified email.

Closes an open redirect in the post-login `next` parameter (both the new
OIDC path and the pre-existing password/passkey flow shared the same
backslash-normalization bypass) by resolving the target through a real
URL parse and comparing origins instead of a prefix check.

2026-07-13 16:33:13 +05:30

..

__tests__

feat(auth): add OIDC SSO login

2026-07-13 16:33:13 +05:30

mfa

style: apply prettier 3.9.1 formatting

2026-06-28 19:26:16 +02:00

argon2-params.mjs

feat(insights): cycle ring replaces strain tile, tidy overview spacing, nav order, password-reset CLI

2026-06-06 21:31:12 +02:00

audit.ts

feat(admin): resolve the sign-in carrier online + give it its own column

2026-06-29 23:51:40 +02:00

bearer.ts

refactor(auth): extract Bearer-token validation into a reusable resolver

2026-06-27 13:25:43 +02:00

device-fingerprint.ts

feat(security): alert on a new-device sign-in

2026-06-27 20:34:31 +02:00

hibp.ts

feat(auth): warn on breached passwords at password set

2026-06-27 20:34:20 +02:00

hmac.ts

chore(ci): pin the supply chain and surface build provenance

2026-06-10 15:05:05 +02:00

invite-token.ts

Add invite universal-link landing for app deep-link

2026-06-14 19:32:19 +02:00

issue-token.ts

fix(mcp): close OAuth 2.1 resource-server gaps before the remote surface ships

2026-06-27 15:09:11 +02:00

login-alert.ts

fix(api): narrow swallowed database errors and redact the incident URL

2026-07-01 23:45:08 +02:00

login-response.ts

feat(auth): warn on a Secure-cookie / plain-HTTP transport mismatch at login

2026-07-08 23:36:48 +02:00

mfa-enrollment.ts

feat(security): let an operator require a second factor

2026-06-27 21:49:53 +02:00

native-client.ts

fix(auth): revoke bearer on logout, gate refresh-token issuance, widen device-mismatch revoke

2026-06-05 03:01:36 +02:00

oidc-cookie.ts

feat(auth): add OIDC SSO login

2026-07-13 16:33:13 +05:30

oidc.ts

feat(auth): add OIDC SSO login

2026-07-13 16:33:13 +05:30

passkey.ts

style: apply prettier 3.9.1 formatting

2026-06-28 19:26:16 +02:00

password.ts

feat(insights): cycle ring replaces strain tile, tidy overview spacing, nav order, password-reset CLI

2026-06-06 21:31:12 +02:00

profile-update.ts

feat(profile): persist and expose the date-format preference

2026-06-26 12:15:09 +02:00

refresh-token.ts

style: apply prettier 3.9.1 formatting

2026-06-28 19:26:16 +02:00

secure-cookie.ts

feat(auth): warn on a Secure-cookie / plain-HTTP transport mismatch at login

2026-07-08 23:36:48 +02:00

security-activity.ts

feat(security): list active sessions, sign out everywhere, and show security activity

2026-06-27 20:34:43 +02:00

session.ts

fix(i18n): survive Safari's 7-day cookie cap on the chosen locale

2026-07-05 21:01:50 +02:00

trusted-device.ts

feat(auth): allow trusting a device to skip the second factor

2026-06-27 21:49:39 +02:00

webauthn-rp.ts

feat(security): add a TOTP and security-key setup hub

2026-06-27 20:40:36 +02:00