Andrey Antukh a146fe2a73 ♻️ Address review findings on trusted alternate origins ...

Verify the OIDC state token once per callback and reuse the parsed
claims, removing the duplicate verification while preserving the
invalid-state error redirect.

Test that the trusted-origin middleware is registered in the root
router chain and ordered before auth and errors, and cover the OIDC
logout post-logout redirect with and without a trusted origin.

Warn at startup about malformed PENPOT_TRUSTED_ORIGINS entries, unify
the request stamp keyword spelling, and clean up the test helpers.

Closes #11625

AI-assisted-by: deepseek-v4.1-flash

2026-10-08 13:02:36 +02:00

..

test_files

Merge remote-tracking branch 'origin/main' into staging

2026-09-29 23:07:26 +02:00

auth_ldap_test.clj

Merge remote-tracking branch 'origin/staging' into develop

2026-09-10 20:29:44 +02:00

auth_login_lockout_test.clj

✨ Add account lockout after failed login attempts (#11402)

2026-09-23 12:31:50 +02:00

auth_oidc_test.clj

♻️ Address review findings on trusted alternate origins

2026-10-08 13:02:36 +02:00

binfile_svg_test.clj

Merge remote-tracking branch 'origin/main' into staging

2026-10-06 15:56:55 +02:00

binfile_test.clj

Merge remote-tracking branch 'origin/main' into staging

2026-10-06 15:56:55 +02:00

bounce_handling_test.clj

📎 Update copyright name on file header (#11346)

2026-08-25 11:55:10 +02:00

config_test.clj

♻️ Address review findings on trusted alternate origins

2026-10-08 13:02:36 +02:00

db_test.clj

✨ Add Prometheus metrics for storage operations (#11700)

2026-09-23 15:25:21 +02:00

demo_test.clj

📎 Update copyright headers

2026-09-09 17:58:09 +02:00

email_blacklist_test.clj

📎 Update copyright name on file header (#11346)

2026-08-25 11:55:10 +02:00

email_sending_test.clj

🐛 Fix renewal-email greeting falling back to the wrong name (#11848)

2026-09-24 16:33:18 +02:00

graph_binder_gate_test.clj

📎 Update copyright headers

2026-09-09 17:58:09 +02:00

graph_sync_parity_test.clj

⬆️ Update deps (#11960)

2026-09-29 09:07:34 +02:00

helpers_test.clj

🐛 Fix RPC test helper dropping injected request metadata

2026-09-24 11:42:14 +02:00

helpers.clj

♻️ Address review findings on trusted alternate origins

2026-10-08 13:02:36 +02:00

http_assets_test.clj

✨ Normalize storage metadata with a closed schema (#11987)

2026-10-01 07:19:21 +02:00

http_client_test.clj

Merge remote-tracking branch 'origin/staging' into develop

2026-09-10 20:29:44 +02:00

http_errors_test.clj

🐛 Restore rate-limit headers and add Retry-After on 429 (#11895)

2026-09-24 12:19:29 +02:00

http_link_preview_test.clj

📎 Fix copyright owner on several files

2026-09-15 19:22:56 +02:00

http_management_test.clj

Merge remote-tracking branch 'origin/staging' into develop

2026-09-14 14:50:32 +02:00

http_metrics_test.clj

✨ Add observability improvements (#11854)

2026-09-23 18:03:03 +02:00

http_middleware_security.clj

📎 Update copyright name on file header (#11346)

2026-08-25 11:55:10 +02:00

http_middleware_test.clj

♻️ Address review findings on trusted alternate origins

2026-10-08 13:02:36 +02:00

http_websocket_test.clj

♻️ Scope organization notifications to specific WebSocket topics (#11460)

2026-10-01 13:16:12 +02:00

loggers_error_reporters_test.clj

✨ Audit-log docs, error-reporting flag and frontend initiator (#11997)

2026-10-02 11:08:13 +02:00

loggers_webhooks_test.clj

📎 Update copyright name on file header (#11346)

2026-08-25 11:55:10 +02:00

logical_deletion_test.clj

📎 Update copyright name on file header (#11346)

2026-08-25 11:55:10 +02:00

media_remote_test.clj

Merge remote-tracking branch 'origin/staging' into develop

2026-09-10 20:29:44 +02:00

media_sanitize_test.clj

📎 Update copyright name on file header (#11346)

2026-08-25 11:55:10 +02:00

media_test.clj

Merge remote-tracking branch 'origin/main' into staging

2026-10-06 15:56:55 +02:00

metrics_test.clj

✨ Add observability improvements (#11854)

2026-09-23 18:03:03 +02:00

passwords_test.clj

📎 Update copyright headers

2026-09-09 17:58:09 +02:00

rpc_access_tokens_test.clj

📎 Update copyright name on file header (#11346)

2026-08-25 11:55:10 +02:00

rpc_audit_test.clj

✨ Audit-log docs, error-reporting flag and frontend initiator (#11997)

2026-10-02 11:08:13 +02:00

rpc_auth_override_test.clj

✨ Enable closed schemas for RPC methods (#11136)

2026-09-22 14:03:02 +02:00

rpc_auth_test.clj

♻️ Address review findings on trusted alternate origins

2026-10-08 13:02:36 +02:00

rpc_binfile_test.clj

✨ Enable closed schemas for RPC methods (#11136)

2026-09-22 14:03:02 +02:00

rpc_commands_error_reports_test.clj

Merge remote-tracking branch 'origin/main' into staging

2026-09-29 23:07:26 +02:00

rpc_comment_test.clj

Merge remote-tracking branch 'origin/staging' into develop

2026-09-01 12:45:17 +02:00

rpc_cond_middleware_test.clj

📎 Update copyright name on file header (#11346)

2026-08-25 11:55:10 +02:00

rpc_demo_test.clj

✨ Add renderer option on create-demo-profile command (#11894)

2026-09-28 18:21:07 +02:00

rpc_doc_test.clj

📎 Update copyright name on file header (#11346)

2026-08-25 11:55:10 +02:00

rpc_feedback_test.clj

📎 Update copyright name on file header (#11346)

2026-08-25 11:55:10 +02:00

rpc_file_snapshot_test.clj

📎 Update copyright name on file header (#11346)

2026-08-25 11:55:10 +02:00

rpc_file_test.clj

🐛 Fix shared library deletion with storage-backed file data

2026-09-24 18:17:07 +02:00

rpc_file_thumbnails_test.clj

📎 Update copyright name on file header (#11346)

2026-08-25 11:55:10 +02:00

rpc_font_test.clj

✨ Add indirection for upload-chunks storage via new table (#11651)

2026-09-15 17:26:43 +02:00

rpc_management_nitrate_test.clj

♻️ Scope organization notifications to specific WebSocket topics (#11460)

2026-10-01 13:16:12 +02:00

rpc_management_test.clj

✨ Normalize storage metadata with a closed schema (#11987)

2026-10-01 07:19:21 +02:00

rpc_media_test.clj

💥 Remove client-provided id from creation RPC commands (#11784)

2026-09-22 15:51:50 +02:00

rpc_nitrate_test.clj

✨ Honor trusted alternate origins for backend links and OIDC

2026-10-08 12:50:20 +02:00

rpc_organization_owner_permissions_test.clj

📎 Update copyright name on file header (#11346)

2026-08-25 11:55:10 +02:00

rpc_plugins_test.clj

✨ Add size limits to profile props and plugin registry (#11596)

2026-10-01 14:31:30 +02:00

rpc_profile_test.clj

✨ Add size limits to profile props and plugin registry (#11596)

2026-10-01 14:31:30 +02:00

rpc_project_test.clj

💥 Remove client-provided id from creation RPC commands (#11784)

2026-09-22 15:51:50 +02:00

rpc_quotes_test.clj

Merge remote-tracking branch 'origin/staging' into develop

2026-08-26 20:14:51 +02:00

rpc_rlimit_test.clj

🐛 Restore rate-limit headers and add Retry-After on 429 (#11895)

2026-09-24 12:19:29 +02:00

rpc_team_test.clj

♻️ Address review findings on trusted alternate origins

2026-10-08 13:02:36 +02:00

rpc_test.clj

✨ Enable closed schemas for RPC methods (#11136)

2026-09-22 14:03:02 +02:00

rpc_viewer_test.clj

🐛 Trim linked-library data in view-only bundle for share links (#11627)

2026-09-22 14:43:04 +02:00

rpc_webhooks_test.clj

📎 Update copyright name on file header (#11346)

2026-08-25 11:55:10 +02:00

shell_test.clj

📎 Update copyright name on file header (#11346)

2026-08-25 11:55:10 +02:00

srepl_main_test.clj

✨ Add observability improvements (#11854)

2026-09-23 18:03:03 +02:00

storage_metadata_test.clj

✨ Normalize storage metadata with a closed schema (#11987)

2026-10-01 07:19:21 +02:00

storage_metrics_test.clj

✨ Add Prometheus metrics for storage operations (#11700)

2026-09-23 15:25:21 +02:00

storage_s3_metrics_test.clj

✨ Add Prometheus metrics for storage operations (#11700)

2026-09-23 15:25:21 +02:00

storage_test.clj

✨ Normalize storage metadata with a closed schema (#11987)

2026-10-01 07:19:21 +02:00

storage_tmp_test.clj

🐛 Reserve S3 download path without creating the file

2026-10-05 17:16:47 +02:00

tasks_telemetry_test.clj

✨ Audit-log docs, error-reporting flag and frontend initiator (#11997)

2026-10-02 11:08:13 +02:00

util_blob_test.clj

📎 Update copyright name on file header (#11346)

2026-08-25 11:55:10 +02:00

util_objects_map_test.clj

📎 Update copyright name on file header (#11346)

2026-08-25 11:55:10 +02:00

util_pointer_map_test.clj

📎 Update copyright name on file header (#11346)

2026-08-25 11:55:10 +02:00

util_ssrf_test.clj

Merge remote-tracking branch 'origin/staging' into develop

2026-09-01 12:45:17 +02:00