mirror of
https://github.com/penpot/penpot.git
synced 2026-11-15 06:31:02 +00:00
036a2c0d22
Replace the OIDC-local build-public-uri helper with the canonical cf/get-public-uri so every backend link shares one builder, and drop the test that only covered the duplicate. Assert the OIDC token-exchange redirect_uri under a trusted origin by driving the callback with the HTTP client mocked instead of get-info; the test fails if the exchange hardcodes the canonical base. Document that removing an origin does not invalidate already-signed OIDC states (up to four hours) and that MCP OAuth follows the stamped origin the same way. Bring MCP OAuth into scope: wrap its routes with wrap-trusted-origin, stage the stamped origin in the Redis request record at authorize time, and re-apply it in decision so issuer, resource, the approval redirect and the code-exchange iss agree on one base. Unlisted origins and requests without Origin keep the canonical base. Add a tabulated trusted/untrusted end-to-end test over the real router. AI-assisted-by: muse-spark-1.3-contributor
Penpot Docs
Penpot documentation website.
Usage
To view this site locally, first set up the environment:
# only if necessary
nvm install
nvm use
pnpm install
And launch a development server:
pnpm start
You can then point a browser to http://localhost:8080.
Tooling
- Eleventy (11ty)
- Diagrams with plantuml. See also real-world-plantuml.
- Diagrams with svgbob and mermaid.
- arc42 template.
- c4model for software architecture, and an implementation in plantuml.