publisher/internal/config/ at main · geofox.org/publisher · Tangled

geofox.org / publisher

0

A small go app to cross-post/publish to various social platforms.

0

publisher / internal / config /

at main 2 files

Geoffrey Richard feat(api): async streamed video upload with polled job progress 2mo ago

feat(api): async streamed video upload with polled job progress

2 months ago

feat: OIDC authentication (Relying Party) + API tokens (#9) * build: add go-oidc and x/oauth2 deps * feat(store): add users, sessions, api_tokens tables * feat(store): users upsert/lookup * feat(store): server-side sessions with hashed ids + sweep * feat(store): api_tokens create/lookup/list/revoke * refactor(store): RevokeAPIToken reports ErrNoRows; drop dead scan var * feat(auth): OIDC RP authenticator + allowlist * feat(config): OIDC RP settings with group validation * feat(api): OIDC login/callback/logout handlers + cookies * feat(api): requireSession (page/XHR) + requireAPIToken middleware * feat(api): token management + /api/me handlers * feat(api): path-based session/token gating behind OIDC feature flag * test(api): OIDC callback happy-path integration * harden(api): path.Clean gate matching, session cookie MaxAge, gate-on test * feat(cmd): wire OIDC authenticator + session sweep when enabled * feat(web): access-token management view + user chip/sign-out * docs: document OIDC auth, API tokens, and new env vars * fix(web): invalid string literals broke tokens.js module parse; harden cookie-clear flags - tokens.js: escaped inner quotes on lines 54/150 — the juxtaposed string literals were a SyntaxError that broke SPA module boot when OIDC is enabled (plain `node --check <path>` misses ESM syntax errors; use --input-type=module). - auth.go: login-state and session cookie deletions now carry HttpOnly/Secure/ SameSite, matching the set path (CodeQL alerts 3-6).

2 months ago