19 Commits

Author	SHA1	Message	Date
Draco-Lunaris-Echo	26f87ebc20	chore: bump version to 1.1.8 (#60)	2026-06-09 12:02:50 -05:00
Draco-Lunaris-Echo	b2ea6b1f7a	chore: bump version to 1.1.7 (#58)	2026-06-09 09:27:34 -05:00
Draco-Lunaris-Echo	0c0f952f7f	chore: bump version to 1.1.6 (#56)	2026-06-09 08:21:20 -05:00
Draco-Lunaris-Echo	2a18276884	fix(postinst): correct argon2 -m parameter from raw KiB to log2 value (#55) ... * chore: bump version to 1.1.5 * fix(postinst): correct argon2 -m parameter from raw KiB to log2 value * trigger CI	2026-06-09 08:10:00 -05:00
Draco-Lunaris-Echo	836d409e3b	feat: add version display to sidebar and bump to v1.1.4 (#51)	2026-06-08 17:44:20 -05:00
Draco-Lunaris-Echo	0d151d36b9	chore: bump version to 1.1.2 (#48)	2026-06-07 22:08:55 -05:00
Draco-Lunaris-Echo	6d4ec8c9ac	chore: bump version to 1.1.1 (#45)	2026-06-07 20:14:45 -05:00
Draco-Lunaris-Echo	2d3be0955b	chore: bump version to 1.1.0 (#43)	2026-06-07 17:01:01 -05:00
Draco-Lunaris-Echo	209480dd43	Release v1.0.0 (#41) ... * chore: bump version to 1.0.0 * fix: BusyBox-compatible timing and set -e safety in shell scripts	2026-06-07 13:27:21 -05:00
Draco-Lunaris-Echo	f58d7a6f17	fix(security): stop embedding JWT tokens in SSO callback redirect URL (#4) (#14) ... Replaces URL-embedded JWT tokens with a single-use, 60-second handoff code that the SPA exchanges via server-to-server POST. The URL now contains only `?handoff=<code>` — no tokens are placed in the browser history, proxy access logs, or Referer header. Backend: new SsoHandoff store (DashMap, 60s TTL, atomic DashMap::remove for single-use), POST /api/v1/auth/sso/handoff endpoint, 7 new tests. Frontend: SsoCallbackPage rewritten to use useSearchParams + POST exchange, with history.replaceState to clear the handoff code from the address bar. Switched from window.location.search to useSearchParams() for test compatibility. New Vitest infrastructure (vitest, @testing-library/react, jsdom) and 6 new tests. CI fix in ccba9e3: cargo fmt --all and added searchParams to useEffect dep array to satisfy CI's Rust Format and Frontend Lint checks. Refs: closes #4	2026-06-03 06:28:08 -05:00
Echo	da3dffd81f	feat: add host self-enrollment workflow v0.1.7	2026-05-16 17:03:28 +00:00
Echo	69d2e88bbd	feat: OIDC SSO provider support (Keycloak, Azure AD, custom) ... - Refactored azure_sso.rs to sso.rs with generic OIDC provider support - Added OIDC discovery URL lookup with 1hr TTL caching - Added PKCE for all providers, client_secret optional for public clients - Added /api/v1/auth/sso/login and /api/v1/auth/sso/callback routes - Added /api/v1/auth/azure/* backward-compatible routes - Added POST /settings/sso/discover and POST /settings/sso/test endpoints - Frontend: Provider dropdown (Keycloak/Azure AD/Custom OIDC) - Frontend: Auto-fill discovery URL for Keycloak - Frontend: Discover Endpoints and Test Connection buttons - Frontend: Dynamic SSO button based on provider display name - Made migration 014 idempotent with DO blocks and IF NOT EXISTS - Fixed debian/install to use /usr/local/bin/ for binaries - Fixed frontend file path in .deb package - Reset admin password on dev server - Fixed database permissions for oidc_config table	2026-05-13 13:32:24 +00:00
Echo	c8b1feee19	fix: make version display dynamic from package.json instead of hardcoded	2026-05-12 23:49:14 +00:00
Echo	86a6c714d4	feat: Complete Azure SSO implementation (v0.1.3) ... - Add SSO session cleanup task (10-min expiry, 60s purge interval) - Change callback to redirect to frontend with tokens as query params - Add sso_callback_url to SecurityConfig with serde default - Add SsoCallbackPage.tsx for handling SSO callback redirects - Add /auth/sso/callback public route to App.tsx - Add Sign in with Microsoft Azure button to LoginPage - Replace insecure decode_jwt_payload with verify_id_token - Implement JWKS caching (1-hour TTL) and RSA signature verification - Validate iss, aud, exp claims on id_token - Add jsonwebtoken dependency to pm-web crate - Update config.example.toml with sso_callback_url setting - Add sso_callback_url to settings response (read-only from TOML)	2026-05-12 17:01:20 +00:00
Echo	cc1214a963	feat: Phase 4 - password validation, force password reset flow, account lockout, QR code for MFA	2026-05-07 17:53:16 +00:00
Echo	aa0cb9ab3c	feat: cert bundle download with CA root, re-issue endpoint, and enhanced cert UI	2026-05-05 23:06:48 +00:00
Echo	2fd3eb89b4	Fix all frontend ESLint errors ... - Add eslint-plugin-react-hooks to package.json and config - Fix duplicate imports in HostsPage.tsx - Remove non-null assertion in main.tsx - Fix != to !== in HostDetailPage.tsx and MaintenanceWindowsPage.tsx - Fix unused variable in ReportsPage.tsx - Change console.debug to console.warn in useJobWebSocket.ts	2026-04-27 21:20:25 +00:00
Echo	f49ec1ac51	ci: Add comprehensive CI quality gates ... - New ci.yml workflow: rust-format, clippy, rust-test, security-audit, frontend-lint - rustfmt.toml: strict formatting rules (edition 2021, max_width 100, grouped imports) - clippy.toml: lint configuration with complexity thresholds - eslint.config.js: ESLint 9 flat config for TypeScript/React - build.yml: now only triggers on v* tags (ci.yml handles master/PR) - package.json: updated lint script for ESLint 9 flat config Quality gates run on every push to master and every PR: 1. Rust Format Check (cargo fmt --check --all) 2. Clippy Lints (pedantic + deny warnings) 3. Rust Unit Tests (cargo test --workspace --all-features) 4. Security Audit (cargo audit) 5. Frontend Lint (ESLint + TypeScript type check)	2026-04-24 14:55:01 +00:00
Echo	da5a94d838	feat(M1): Project scaffolding, DB schema, core infrastructure ... - Initialize Rust workspace with 7 crates (pm-web, pm-worker, pm-core, pm-agent-client, pm-auth, pm-ca, pm-reports) - React + TypeScript + Vite + MUI frontend scaffold - Full PostgreSQL schema: all 17 tables with indexes and constraints - pm-core: config (TOML+env), db (SQLx pool + migrations), error (unified AppError + JSON envelope), request_id (ULID middleware), logging (tracing JSON/pretty) - pm-web: Axum skeleton, /status/health endpoint, static file serving - pm-worker: Tokio skeleton, heartbeat writer, schema version check - Embedded sqlx migrations with advisory lock (single-writer) - systemd unit files, setup.sh, build-frontend.sh - config.example.toml with all configuration keys - docs/runbooks/restore.md - cargo check passes with zero warnings Closes M1.	2026-04-23 15:55:53 +00:00