Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: add security feature #1026

Merged
merged 1 commit into from
Aug 20, 2024
Merged

feat: add security feature #1026

merged 1 commit into from
Aug 20, 2024

Conversation

sattvikc
Copy link
Collaborator

Summary of change

(A few sentences about this PR)

Related issues

  • Link to issue1 here
  • Link to issue1 here

Test Plan

(Write your test plan here. If you changed any code, please provide us with clear instructions on how you verified your
changes work. Bonus points for screenshots and videos!)

Documentation changes

(If relevant, please create a PR in our docs repo, or create a checklist here
highlighting the necessary changes)

Checklist for important updates

  • Changelog has been updated
    • If there are any db schema changes, mention those changes clearly
  • coreDriverInterfaceSupported.json file has been updated (if needed)
  • pluginInterfaceSupported.json file has been updated (if needed)
  • Changes to the version if needed
    • In build.gradle
  • If added a new paid feature, edit the getPaidFeatureStats function in FeatureFlag.java file
  • Had installed and ran the pre-commit hook
  • If there are new dependencies that have been added in build.gradle, please make sure to add them
    in implementationDependencies.json.
  • Update function getValidFields in io/supertokens/config/CoreConfig.java if new aliases were added for any core
    config (similar to the access_token_signing_key_update_interval config alias).
  • Issue this PR against the latest non released version branch.
    • To know which one it is, run find the latest released tag (git tag) in the format vX.Y.Z, and then find the
      latest branch (git branch --all) whose X.Y is greater than the latest released tag.
    • If no such branch exists, then create one from the latest released branch.
  • If added a foreign key constraint on app_id_to_user_id table, make sure to delete from this table when deleting
    the user as well if deleteUserIdMappingToo is false.

Remaining TODOs for this PR

  • Item1
  • Item2

@sattvikc sattvikc self-assigned this Aug 20, 2024
@sattvikc sattvikc merged commit b63ed0d into 9.2 Aug 20, 2024
2 of 3 checks passed
@sattvikc sattvikc deleted the security-feature branch August 20, 2024 04:08
sattvikc added a commit that referenced this pull request Aug 20, 2024
@sattvikc @rishabhpoddar
fix: merge with latest (#1028)
611e4e7 
* fix: pathrouter for tenant id stop words (#1022)

* fix: pathrouter for tenant id stop words

* fix: pathrouter for tenant id stop words

* fix: changelog

* adding dev-v9.1.2 tag to this commit to ensure building

* fix: 500 error to return actual message (#1023)

* adding dev-v9.1.2 tag to this commit to ensure building

* fix: tests (#1024)

* adding dev-v9.1.2 tag to this commit to ensure building

* fix: cicd tests (#1025)

* adding dev-v9.1.2 tag to this commit to ensure building

* Update release.md

* feat: add security feature (#1026)

* adding dev-v9.2.0 tag to this commit to ensure building

* fix: feature test fix (#1027)

* adding dev-v9.2.0 tag to this commit to ensure building

---------

Co-authored-by: Rishabh Poddar <[email protected]>
sattvikc added a commit that referenced this pull request Oct 4, 2024
@rishabhpoddar @sattvikc
@tamassoltesz @porcellus
feat: OAuth provider support (#1010)
e83c9b4 
* fix: tenant config

* fix: api permissions and telemetry update

* fix: totp length validation

* fix: accept api key via authorization header

* fix: cache control header for jwks endpoint

* fix: tests

* fix: for dashboard

* fix: remove unused import

* fix: remove unused import

* fix: providers non null

* fix: tests

* fix: pr comments

* fix: pr comments

* fix: pr comments

* fix: pr comments

* fix: improve core config normalisation

* fix: more tests

* fix: more tests

* fix: clean up core config

* fix: pr comments

* fix: more test

* adds config in config.yaml

* reformates code

* reformats code

* modifies changelog

* small changes

* adds one more config for admin vs public service

* starts working on authorization endpoint

* removes unnecesssary files

* Oauth - WIP (#1018)

* fix/change annotations for configs

* feat: oauth2 auth API - WIP

* fix: hidefromdashboard to oauth_provider service url configs

* feat: OAuthAPI input parsing, basic flow

* feat: first test in progress

* fix: review fixes

* feat: tables for oauth in sqlite

* fix: remove unnecessary tables

* fix: store only the necessary data in the client table

* feat: oauth client - app exists check in db, a few tests

* fix: review fixes

* fix: review fixes

* feat: new configs for handling errors from hydra

* feat: using the new configs for oauth provider

* fix: CHANGELOG

* fix: tests for the new Util method

* fix: changelog changes

* fix: changelog migration section fix

* fix: fixing repeated header handling in HttpRequest#sendGETRequestWithResponseHeaders

* fix: more tests for oauth auth

* fix: review fix - more checks for the oauth config validity

* fix: review fix - throwing expection if there is no location header in response from hydra

* fix: review fix - renamed exception

* feat: oauth2 register client API

* feat: oauth2 get clients API

* feat: OAuth2 DELETE clients API

* fix: following the already existing response pattern with the oauth2 apis

* fix: renaming exception to be more expressive

* fix: review fixes

* fix: using BadRequestException instead of custom format for hydra invalid input errors

* Feature: oauth update client api (#1020)

* fix/change annotations for configs

* feat: oauth2 auth API - WIP

* fix: hidefromdashboard to oauth_provider service url configs

* feat: OAuthAPI input parsing, basic flow

* feat: first test in progress

* fix: review fixes

* feat: tables for oauth in sqlite

* fix: remove unnecessary tables

* fix: store only the necessary data in the client table

* feat: oauth client - app exists check in db, a few tests

* fix: review fixes

* fix: review fixes

* feat: new configs for handling errors from hydra

* feat: using the new configs for oauth provider

* fix: CHANGELOG

* fix: tests for the new Util method

* fix: changelog changes

* fix: changelog migration section fix

* fix: fixing repeated header handling in HttpRequest#sendGETRequestWithResponseHeaders

* fix: more tests for oauth auth

* fix: review fix - more checks for the oauth config validity

* fix: review fix - throwing expection if there is no location header in response from hydra

* fix: review fix - renamed exception

* feat: oauth2 register client API

* feat: oauth2 get clients API

* feat: OAuth2 DELETE clients API

* fix: following the already existing response pattern with the oauth2 apis

* fix: renaming exception to be more expressive

* fix: review fixes

* feat: oauth2 client update support

* fix: using BadRequestException instead of custom format for hydra invalid input errors

* fix: renaming method

* fix: remove unused constant

* fix: returning 500 when oauth update client goes wrong

* fix: fixing test after changing error response

* chore: removing TODO from code

* fix: merge with latest (#1028)

* fix: pathrouter for tenant id stop words (#1022)

* fix: pathrouter for tenant id stop words

* fix: pathrouter for tenant id stop words

* fix: changelog

* adding dev-v9.1.2 tag to this commit to ensure building

* fix: 500 error to return actual message (#1023)

* adding dev-v9.1.2 tag to this commit to ensure building

* fix: tests (#1024)

* adding dev-v9.1.2 tag to this commit to ensure building

* fix: cicd tests (#1025)

* adding dev-v9.1.2 tag to this commit to ensure building

* Update release.md

* feat: add security feature (#1026)

* adding dev-v9.2.0 tag to this commit to ensure building

* fix: feature test fix (#1027)

* adding dev-v9.2.0 tag to this commit to ensure building

---------

Co-authored-by: Rishabh Poddar <[email protected]>

* feat: hydra integration for auth, token and few more endpoints (#1032)

* fix: auth and token api

* fix: cookie and code transformations

* fix: token re-signing

* fix: token endpoint

* fix: license check and jwks caching

* fix: exceptions

* fix: refactor

* fix: refactor

* fix: refactor and client crud APIs

* fix: token type enum

* fix: process ext only on access token

* fix: refactor

* fix: bugs and refactor

* fix: oauth clients list api

* fix: consent get accept and reject

* fix: login request

* fix: query param transformation

* fix: logout request

* fix: refactor

* fix: remove error debug and hint

* fix: introspect api

* fix: pr comments

* fix: pr comments

* fix: pr comment

* fix: pr comment

* fix: pr comments and refactor

* fix: pr comments

* fix: pr comments

* fix: revert original http request

* fix: pr comment refactor

* fix: pr comment

* fix: pr comment

* fix: pr comment

* fix: pr comments

* fix: owner and pagination

* fix: pr comment

* fix: client id check

* fix: ext related

* fix: pr comment

* fix: revoke APIs (#1041)

* fix: revoke consent sessions

* fix: revoke token

* fix: revoke impl

* fix: revoke session

* fix: introspect impl after revoke

* fix: revoke by client_id

* fix: refresh token check in token exchange

* fix: at hash

* fix: sqlite impl

* fix: client props whitelist

* fix: status and query null check

* fix: plugin interface update

* fix: logout api

* fix: ext

* fix: accept consent

* fix: accept consent

* fix: introspect in token api

* fix: keep fragment while updating query params

* fix: count creds and pr comment

* fix: oauth stats

* fix: oauth cleanup cron task

* fix: gid in refresh token

* fix: inememory impl

* feat: add initial payload fields to accept consent

* fix: revoke cleanup

* fix: stats

* fix: client credentials basic

* fix: authorization header

* fix: authorizaion header in revoke

* fix: missing table

---------

Co-authored-by: Mihaly Lengyel <[email protected]>

---------

Co-authored-by: Mihaly Lengyel <[email protected]>

* fix: logout apis (#1047)

* fix: logout apis

* fix: session revoke in logout

* fix: tests

* feat: update logout logic to make BE integration easier

* refactor: minor fixes for consistency

---------

Co-authored-by: Mihaly Lengyel <[email protected]>

* fix: tests (#1051)

* fix: logout apis

* fix: session revoke in logout

* fix: tests

* fix: tests

* fix: tests

* fix: tests

* fix: versioning and cleanup

* fix: http revert

* fix: http revert

* fix: rename / refactor

* revert

* revert

* fix: test, cleanup and changelog

* revert

* fix: constraints

* fix: constraints

* fix: constraints

* fix: constraints

---------

Co-authored-by: Sattvik Chakravarthy <[email protected]>
Co-authored-by: Tamas Soltesz <[email protected]>
Co-authored-by: Sattvik Chakravarthy <[email protected]>
Co-authored-by: Mihaly Lengyel <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@sattvikc sattvikc

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@sattvikc