* feat(server): add OIDC logout URL override option
- Added toggle and field consistent with existing mobile redirect URI override.
- Existing auto-discovery remains default.
- Update tests and docs for new feature.
* fix(server): changes from review for OIDC logout URL override
- Rename 'logoutUri' to 'endSessionEndpoint'
- Remove toggle, just use override if provided
- Moved field in settings UI
* feat(server): add configurable OAuth prompt parameter
Add a `prompt` field to the OAuth system config, allowing admins to
configure the OIDC `prompt` parameter (e.g. `select_account`, `login`,
`consent`). Defaults to empty string (no prompt sent), preserving
backward compatibility.
This is useful for providers like Google where users want to be prompted
to select an account when multiple accounts are signed in.
Discussed in #20762
* chore: regenerate OpenAPI spec and clients for OAuth prompt field
* Adding e2e test cases
* feat: web setting
* feat: docs
---------
Co-authored-by: Jason Rasmussen <jason@rasm.me>
* fix(oauth): normalize email claim to lowercase before account lookup and registration
* test(auth): add test for OAuth email case normalization
* chore: clean up
---------
Co-authored-by: Jason Rasmussen <jason@rasm.me>
* wip
* added user metadata key
* wip
* restructure onboarding system and add initial locale
* update language card and fix translation updating
* remove prints
* new card formattings
* fix cursed unmount effect
* add OAuth route onboarding
* remove required admin auth for onboarding
* delete the hotwire button
* update open-api files
* delete import
* fix failing oauth onboarding fields
* fix e2e test
* fix web e2e test
* add onboarding to user registration e2e test
* remove todo
this was a holdover during dev and didn't get deleted
* fix server small tests
* use onDestroy to save settings rather than a bind:this
* change to false for isOnboarded
* fix other auth small test
* provide type annotation in user factory metadata field
* remove onboardingCompelted from UserDto
* move translations to onboarding steps array and mark as derived so they update
* break language selector out into its own component as per @danieldietzler suggestion
* remove hello header on card
* fix flixkering on server privacy card
* label/id fixes
* openapi
---------
Co-authored-by: Alex Tran <alex.tran1502@gmail.com>
* fix: ensure oauth state param matches before finishing oauth flow
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
* chore: upgrade openid-client to v6
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
* feat: use PKCE for oauth2 on supported clients
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
* feat: use state and PKCE in mobile app
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
* fix: remove obsolete oauth repository init
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
* fix: rewrite callback url if mobile redirect url is enabled
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
* fix: propagate oidc client error cause when oauth callback fails
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
* fix: adapt auth service tests to required state and PKCE params
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
* fix: update sdk types
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
* fix: adapt oauth e2e test to work with PKCE
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
* fix: allow insecure (http) oauth clients
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
---------
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
Co-authored-by: Jason Rasmussen <jason@rasm.me>
* feat: sync pictureFile with oidc if it isn't set already
fix: move picture writer to get userId
fix: move await promise to the top of the setPicure function before checking its value and automatically create the user folder
chore: code cleanup
* fix: extension double dot
---------
Co-authored-by: Jason Rasmussen <jason@rasm.me>
* refactor: migrate shared-link repository to kysely
* fix duplicate individual shared link return in getAll when there are more than 1 asset in the shared link
* using correct order condition
* using eb.table
---------
Co-authored-by: Alex Tran <alex.tran1502@gmail.com>
bo0tzz