Chris
|
405000ded5
|
feat(role): add role_code across schema and APIs
|
2026-04-03 15:49:22 +08:00 |
|
Chris
|
94cec746cb
|
chore(env): split dev/prod env files and clarify keycloak settings
|
2026-04-03 14:43:13 +08:00 |
|
Chris
|
c032020f59
|
chore: update backend env example
|
2026-04-03 06:03:04 +08:00 |
|
Chris
|
60b34a0817
|
chore: update backend env example
|
2026-04-03 05:57:02 +08:00 |
|
Chris
|
d2b6957013
|
dev: prefer .env.development in start script
|
2026-04-03 04:59:14 +08:00 |
|
Chris
|
7b9915e81c
|
update
|
2026-04-03 04:57:22 +08:00 |
|
Chris
|
dc51af8c39
|
update
|
2026-04-03 04:52:17 +08:00 |
|
Chris
|
60608fe199
|
Remove redundant backend production env template
|
2026-04-03 04:33:47 +08:00 |
|
Chris
|
7c4364b52f
|
Use single .env for local startup
|
2026-04-03 04:31:58 +08:00 |
|
Chris
|
065f1d52f0
|
Stop tracking local env files
|
2026-04-03 04:25:36 +08:00 |
|
Chris
|
4ae7e75a96
|
Ignore .venv and local build artifacts
|
2026-04-03 04:00:58 +08:00 |
|
Chris
|
d430b69888
|
Ignore .venv and Python cache files
|
2026-04-03 03:57:53 +08:00 |
|
Chris
|
ed7a0344e0
|
Remove legacy migration file and alias API routes
|
2026-04-03 03:54:48 +08:00 |
|
Chris
|
ade60bdbaa
|
Switch backend Docker image to Alpine multi-stage
|
2026-04-03 03:12:19 +08:00 |
|
Chris
|
75cf22f7e5
|
Add production Dockerfile for backend deployment
|
2026-04-03 03:11:28 +08:00 |
|
Chris
|
a187acf58c
|
Switch access control from groups to realm roles
|
2026-04-03 03:03:43 +08:00 |
|
Chris
|
6d6f5aa2a6
|
Remove duplicate internal permissions snapshot API
|
2026-04-03 02:46:55 +08:00 |
|
Chris
|
73ed4ff0ff
|
Add Redis-backed cache backend with env switch
|
2026-04-03 02:38:54 +08:00 |
|
Chris
|
55e640f2fb
|
Add in-memory read cache with CUD-based invalidation
|
2026-04-03 02:32:38 +08:00 |
|
Chris
|
e912d1498e
|
Speed up auth verification with JWKS/admin token caching
|
2026-04-03 02:20:54 +08:00 |
|
Chris
|
c431fe180b
|
Sync site-role assignments to Keycloak group role mappings
|
2026-04-03 02:14:01 +08:00 |
|
Chris
|
da08bc01ec
|
feat: allow assigning sites directly from role page
|
2026-04-03 01:56:22 +08:00 |
|
Chris
|
d5418d47e7
|
chore: silence introspection fallback warning noise
|
2026-04-03 01:53:35 +08:00 |
|
Chris
|
64246984ba
|
refactor: simplify schema names and remove provider id columns
|
2026-04-03 01:49:36 +08:00 |
|
Chris
|
e91639d6d9
|
perf: disable read-time sync and keep provider sync manual
|
2026-04-03 01:23:42 +08:00 |
|
Chris
|
49949498e0
|
fix: sync role CRUD with provider client roles
|
2026-04-03 01:17:13 +08:00 |
|
Chris
|
224f3d67bd
|
fix: add provider column migration script for existing db
|
2026-04-03 01:10:13 +08:00 |
|
Chris
|
388a3f461c
|
refactor: rename idp fields to provider naming
|
2026-04-03 01:05:01 +08:00 |
|
Chris
|
ce181ebf67
|
refactor(idp-groups): use display name as keycloak group name
|
2026-04-03 00:53:31 +08:00 |
|
Chris
|
573a75b9e3
|
feat(sync): keycloak as source-of-truth with auto catalog sync and token refresh
|
2026-04-03 00:46:46 +08:00 |
|
Chris
|
81085e1844
|
fix(auth): resolve admin groups via keycloak admin API when token lacks groups
|
2026-04-03 00:28:32 +08:00 |
|
Chris
|
fd55d90a44
|
fix(auth): accept keycloak group path variants for admin guard
|
2026-04-03 00:24:32 +08:00 |
|
Chris
|
0db04f9afc
|
fix(backend): postpone annotations to avoid list() type shadowing crash
|
2026-04-03 00:22:00 +08:00 |
|
Chris
|
2f92b94f59
|
refactor: rebuild backend around role-site authorization model
|
2026-04-02 23:58:13 +08:00 |
|
Chris
|
0bc667847d
|
refactor(keycloak): remove authentik naming and switch to keycloak-only paths
|
2026-04-01 02:01:41 +08:00 |
|
Chris
|
34fc865b30
|
fix(auth): relax keycloak audience check and auto-redirect logged-in user
|
2026-04-01 01:48:06 +08:00 |
|
Chris
|
d16722ebf8
|
fix(oidc): add PKCE support for keycloak login flow
|
2026-04-01 01:43:53 +08:00 |
|
Chris
|
94ae0e5a7a
|
chore(env): use member-frontend oidc client and keep member-backend admin client
|
2026-04-01 01:30:44 +08:00 |
|
Chris
|
f582ef3850
|
chore(env): configure keycloak master client for local backend
|
2026-04-01 01:20:46 +08:00 |
|
Chris
|
c7ed517ed2
|
feat(idp): add keycloak-first support with authentik fallback
|
2026-04-01 00:41:38 +08:00 |
|
Chris
|
f6105f079d
|
fix(login): switch frontend account login to oidc flow
|
2026-03-31 23:43:57 +08:00 |
|
Chris
|
4060ebff70
|
refactor(identity): rename authentik_sub to user_sub and authentik_user_id to idp_user_id
|
2026-03-31 22:32:48 +08:00 |
|
Chris
|
ed5679948b
|
docs(api): add internal API contract and expose response schemas in swagger
|
2026-03-31 22:20:24 +08:00 |
|
Chris
|
ce8f9342de
|
fix(internal): return correct system_key in modules list
|
2026-03-31 22:02:56 +08:00 |
|
Chris
|
85e67ae0cd
|
refactor(internal): switch auth to api-client headers
|
2026-03-31 21:09:18 +08:00 |
|
Chris
|
cf02d9ec41
|
fix(member): delete authentik user when removing member
|
2026-03-31 21:01:15 +08:00 |
|
Chris
|
2b29a1a274
|
feat(admin): add delete APIs and UI actions for all admin resources
|
2026-03-31 20:58:20 +08:00 |
|
Chris
|
556fc8d5cb
|
fix(api-clients): fallback api-key hashing without argon2; show site/module parent display names
|
2026-03-31 20:35:04 +08:00 |
|
Chris
|
3fe5ce4ce7
|
feat(admin): add api client management UI and backend CRUD/rotate endpoints
|
2026-03-30 23:28:27 +08:00 |
|
Chris
|
75f9f28588
|
feat(members): split username/display_name, sync updates to authentik, add password reset API and refresh docs
|
2026-03-30 22:15:41 +08:00 |
|