70 Commits

Author SHA1 Message Date
aliworksx08
81061013b1
Add openid-attr support and dot notation for OIDC attribute (#8946)
*  Add openid-attr support and dot notation for OIDC attribute paths

* ♻️ Simplify OIDC: add dot-notation for attr paths and retain sub claim

* ♻️ Fix OIDC: fix

* 🐛 Fix OIDC nested attr lookup for dot notation

* ♻️ Remove unused OIDC openid-attr support

---------

Signed-off-by: Andrey Antukh <niwi@niwi.nz>
Co-authored-by: Andrey Antukh <niwi@niwi.nz>
2026-04-16 11:12:37 +02:00
Andrey Antukh
c8675c5b7e
♻️ Normalize newsletter-updates checbox on different register flows (#8839)
*  Add newsletter opt-in checkbox to registration validation form

Add accept-newsletter-updates support through the full registration
token flow. The newsletter checkbox is now available on the
registration validation form, allowing users to opt-in during the
email verification step.

Backend changes:
- Refactor prepare-register to consolidate UTM params and newsletter
  preference into props at token creation time
- Add accept-newsletter-updates to prepare-register-profile and
  register-profile schemas
- Handle newsletter-updates in register-profile by updating token
  claims props on second step

Frontend changes:
- Add newsletter-options component to register-validate-form
- Add accept-newsletter-updates to validation schema
- Fix subscription finalize/error handling in register form

Signed-off-by: Andrey Antukh <niwi@niwi.nz>

* ♻️ Refactor auth register components to modern style

Migrate all components in app.main.ui.auth.register and
app.main.ui.auth.login/demo-warning to use the modern * suffix
convention, removing deprecated ::mf/props :obj metadata and
updating all invocations from [:& name] to [:> name*] syntax.

Components updated:
- terms-and-privacy -> terms-and-privacy*
- register-form -> register-form*
- register-methods -> register-methods*
- register-page -> register-page*
- register-success-page -> register-success-page*
- terms-register -> terms-register*
- register-validate-form -> register-validate-form*
- register-validate-page -> register-validate-page*
- demo-warning -> demo-warning*

Also remove unused old context-notification import in login.cljs.

Signed-off-by: Andrey Antukh <niwi@niwi.nz>

* 🔥 Remove unused onboarding-newsletter component

The newsletter opt-in is now handled directly in the registration
form via the newsletter-options* component, making the standalone
onboarding-newsletter modal obsolete.

Signed-off-by: Andrey Antukh <niwi@niwi.nz>

* 🐛 Fix register test for UTM params to use prepare-register step

UTM params are now extracted and stored in token props during the
prepare-register step, not at register-profile time. Move utm_campaign
and mtm_campaign from the register-profile call to the
prepare-register-profile call in the test.

Signed-off-by: Andrey Antukh <niwi@niwi.nz>

---------

Signed-off-by: Andrey Antukh <niwi@niwi.nz>
2026-04-08 17:00:52 +02:00
Alejandro Alonso
86f7d6b26b
Sanitizing error values (#8020) 2026-01-07 11:23:19 +01:00
Andrey Antukh
363b4e3778
♻️ Make the SSO code more modular (#7575)
* 📎 Disable by default social auth on devenv

* 🎉 Add the ability to import profile picture from SSO provider

* 📎 Add srepl helper for insert custom sso config

* 🎉 Add custom SSO auth flow
2025-11-12 12:49:10 +01:00
Andrey Antukh
28cf67e7ff
🎉 Add management RPC API (#7700)
* 🎉 Add management RPC API

And refactor internal http auth flow

* 📎 Adjust final url namings

* 📚 Update changelog
2025-11-10 17:10:59 +01:00
Andrey Antukh
61d9b57bc7 ♻️ Refactor internal tokens API
Mainly make it receive the whol cfg/system instead only props. This
makes the api more flexible for a future extending without the need
to change the api again.
2025-10-07 12:08:00 +02:00
Andrey Antukh
283eb0419c ♻️ Refactor time related namespaces
Mainly removes the custom app.util.time namespace
from frontend and backend and normalize all to use
the app.common.time namespace
2025-08-01 11:20:01 +02:00
Andrey Antukh
88fb5e7ab5 ♻️ Update integrant to latest version
This upgrade also includes complete elimination of use spec
from the backend codebase, completing the long running migration
to fully use malli for validation and decoding.
2024-11-13 19:09:19 +01:00
Andrey Antukh
51ecbf15a9 ⬆️ Update yetti and http server dependency 2024-10-22 20:23:38 +02:00
Andrey Antukh
452aabdec6 🐛 Don't send user props on auth token after oidc login 2024-09-10 12:39:54 +02:00
Alejandro Alonso
9344fb958a Merge remote-tracking branch 'origin/staging' into develop 2024-08-08 07:43:10 +02:00
Andrey Antukh
ea7ad2aaa0 Add flag oidc-registration for switch on/off registration with oidc 2024-08-06 11:51:26 +02:00
Andrey Antukh
025034cb71 Merge remote-tracking branch 'origin/staging' into develop 2024-07-25 11:23:42 +02:00
Andrey Antukh
69b432eb0e 📎 Fix audit event type naming on oidc 2024-07-24 21:25:55 +02:00
Andrey Antukh
343f3feed3 Improve ip-addr parsing 2024-07-24 21:07:11 +02:00
Andrey Antukh
a100d1d11a Merge remote-tracking branch 'origin/staging' into develop 2024-07-24 08:20:36 +02:00
Andrey Antukh
8dfc97d875 Add jwks loading on gitlab oidc provider 2024-07-12 14:03:48 +02:00
Andrey Antukh
3b48be808c 💄 Add minor naming change on calling logging on oidc ns 2024-07-12 13:39:32 +02:00
Andrey Antukh
f4b59cc5a0 Normalize external-session-id parsing from request 2024-07-12 13:38:46 +02:00
Andrey Antukh
d52f2b18a5 Add context to OIDC errors 2024-07-12 13:38:46 +02:00
Alejandro
73fb95976c
Merge pull request #4863 from penpot/niwinz-refactor-backend-config
♻️ Refactor configuration validation
2024-07-11 12:27:59 +02:00
Andrey Antukh
9174bb140b ♻️ Refactor configuration validation
Replace spec with schema
2024-07-10 15:16:28 +02:00
Andrey Antukh
0ae8cb4979 🐛 Do not report explicit user reject as error on oidc auth process 2024-07-09 13:57:48 +02:00
Andrey Antukh
6a253871b0 Improve internal handling of external-session-id 2024-06-19 16:15:48 +02:00
Andrey Antukh
5aa62ef1dd Add email blacklist mechanism 2024-06-04 10:45:55 +02:00
AzazelN28
47804429c0 Merge branch 'staging' into develop 2024-04-25 11:32:28 +02:00
AzazelN28
17fb5283cc 📎 Add provider to validate uri 2024-04-22 13:13:42 +02:00
Andrey Antukh
81b52d7170 Disable oidc registration when registration flag is disabled 2024-04-18 09:52:24 +02:00
Andrey Antukh
a969550aa4 Trust oidc providers which provides email_verified claim 2024-04-18 09:52:24 +02:00
Andrey Antukh
ce790d83fd Improve internal registration flow 2024-04-18 09:52:24 +02:00
Andrey Antukh
ef632bcae7 Trigger email verification on OIDC register process
This will happen only if:
- the oidc provider properly reports that user has a non-verified email
- the oidc does not provides any way to know the email verification
  status
2024-04-18 09:52:24 +02:00
Andrey Antukh
91118bec70 Improve internal naming of setup/props
This reverts commit a6f70c77cbe72875875ab83587d5dcd9cfc61e34.
2024-03-14 10:48:23 +01:00
alonso.torres
a6f70c77cb Revert " Improve internal naming of setup/props"
This reverts commit f525c6df5e9785df9b534b6de1b5308084627699.
2024-03-13 16:21:12 +01:00
Andrey Antukh
eabec6be20 🔥 Remove not needed events 2024-03-13 11:40:16 +01:00
Andrey Antukh
f525c6df5e Improve internal naming of setup/props 2024-03-13 11:39:53 +01:00
Andrey Antukh
d2626ead0b Add better email cleaning mechanism
This commit separates the email cleaning mechanism to a separated
function, and enables a proper cleaning of `mailto:` prefix, usually
found on invitations because users just copy and paste from external
source.
2024-02-07 09:14:07 +01:00
Andrey Antukh
87615ce221 💄 Fix format issues on backend module 2023-11-29 12:55:58 +01:00
Andrey Antukh
bb5a4c0fa5 Update yetti and adapt for ring-2.0 2023-11-27 14:25:12 +01:00
Andrey Antukh
da62a6809c Stop report oidc failed operations as exceptions 2023-08-14 12:13:31 +02:00
Andrey Antukh
c39702fbf7 Improve get-user-info implementation (oidc) 2023-08-07 15:55:54 +02:00
Andrey Antukh
8cda8924df Add the ability to select user info source
using the PENPOT_OIDC_USER_INFO_SOURCE environment variable
with two possible values: token and userinfo
2023-07-03 10:46:29 +02:00
Andrey Antukh
dda67af5cc Update oidc impl with latest buddy-sign improvements 2023-07-03 10:46:25 +02:00
Andrey Antukh
6339b07fba Add the ability to parse OIDC JWT token
If jwks-uri is provided or properly discovered, they will be used
for unsign JWT token and get use info data from that token instead
of making an additional call to the userinfo endpoint
2023-06-28 00:25:48 +02:00
Andrey Antukh
f166fe1926 🐛 Add proper validation of registration domain whitelist on oidc
Fixes #3348
2023-06-26 18:14:56 +02:00
Andrey Antukh
5026bfa6c1 📎 Fix linter issues introduced in previous merge 2023-04-25 13:35:26 +02:00
Andrey Antukh
b37a92aaf7 Merge remote-tracking branch 'origin/staging' into develop 2023-04-25 13:34:28 +02:00
Andrey Antukh
c0ccc4a5c5 Improve OICD attrs lookup mechanism 2023-04-25 12:18:06 +02:00
Andrey Antukh
6af783ea91 Merge remote-tracking branch 'origin/staging' into develop 2023-04-24 16:55:18 +02:00
Andrey Antukh
c31eb2df42 🐛 Fix OICD auth provider roles checking mechanism 2023-04-24 15:13:24 +02:00
Andrey Antukh
aafbf6bc15 ♻️ Refactor cocurrency model on backend
Mainly the followin changes:

- Pass majority of code to the old and plain synchronous style
  and start using virtual threads for the RPC (and partially some
  HTTP server middlewares).
- Make some improvements on how CLIMIT is handled, simplifying code
- Improve considerably performance reducing the reflection and
  unnecesary funcion calls on the whole stack-trace of an RPC call.
- Improve efficiency reducing considerably the total threads number.
2023-03-14 12:30:27 +01:00