Document AllowPrivateNetworkAddresses and route the blocked-address failure to it [#1280]
The setting shipped fully wired - model, admin form, insecure-toggle audit,
config export/import, and the transport that honours it - and nothing outside
the source described it. An administrator whose identity provider lives on
their own network met "The outbound host resolves only to blocked addresses"
with no documented setting to reach for, which is the state that produces a
workaround instead of the opt-in.
Adds a section to the Options Reference stating what the toggle widens, that
it is per provider and off by default including across an upgrade, that
enabling it is recorded as a downgrade, and what it explicitly does not
relax. The Security Model's outbound-fetch section said every fetch is pinned
to public addresses, which stopped being the whole truth when the second
outbound tier landed; it now carries the exception, its bounds, and the link,
so the failure text routes to the setting.
Replace the typographic dashes on every page
612 dashes across 22 of the 30 pages. No page ends a line with a
space afterwards, and 566 dashes that would have started a Markdown list are
escaped so the list does not appear.
A wiki has no pull request and no gate, so the counts before and after are the
evidence: the run is recorded in iderex/operations#861.
Part of the fleet-wide pass in iderex/operations#860.
Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>
Replace the auto-redirect placeholder with what the live server does [#722]
The hide-password recipe promised an auto-redirect recipe "once it has been
verified against a live Jellyfin server". Verified now, on Jellyfin 10.11.11
with plugin 4.3.0.16 from manifest-beta: it cannot be written.
Jellyfin sanitises the branding disclaimer before it reaches the login page. A
script block, an onerror attribute and a meta refresh are each stripped; links
and formatting survive. That is exactly what makes the managed button block
safe to splice in, and it is the same reason no disclaimer snippet can navigate
on its own. The placeholder is replaced by that finding, with the remaining
out-of-plugin routes named and their lockout risk stated.
The CSS rule in step 2 is confirmed on the same server - served back by
GET /Branding/Css and applied to the login page - and it is noted that the
plugin manages only the disclaimer region, so an upgrade does not rewrite an
admin's own Custom CSS.
Deliberately kept to one home: the recipe stays where it already lived rather
than gaining a second section beside it.
Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>
Document the managed login-page buttons and the hide-password recipe
Add the #722 auto-managed 'Sign in with ...' buttons (ManageLoginPageButtons, per-provider HideLoginButton / LoginButtonText, HTML-encoded labels, start routes) and the hide-password-form recipe to the single options-reference home. The recipe is explicit that the CSS is cosmetic and DisablePasswordLogin is the enforced fail-closed control. The auto-redirect recipe and screenshots are left for live-server verification (#722).
Signed-off-by: iderex <30603423+iderex@users.noreply.github.com>
Document DisableAccountOnRoleDenied and OpenID back-channel logout in the options reference
Add the two config-only per-provider toggles from #831 (login-time deprovisioning) and #962 (inbound OIDC back-channel logout) to the single options-reference home: what each does, opt-in/off-by-default, the mass-lockout fail-safe (admins never disabled), the issuer binding, the no-self-heal operator note, the back-channel endpoint to register, the NAT reachability caveat, and the audit line. Self-contained; links to the existing single homes for issuer binding and single-logout design rather than duplicating. Closes #974, #976.
Signed-off-by: iderex <30603423+iderex@users.noreply.github.com>
Document permission-role mapping; scope the scalar policy fields (#827)
The full boolean PermissionKind surface has been claim-mappable since #164
(EnablePermissionRoles + PermissionRoleMappings) but was undocumented, so the
most-upvoted upstream ask (9p4#295 'User Policy from Claims', 9p4#95 'User
Options via Roles/Groups') read as unimplemented. Adds a Hardening & Options
Reference section covering the config shape, the deny-by-default/authoritative
semantics, the PermissionKind names, the dedicated-permission exclusions, and
save validation, plus a Provider-Setup pointer. Field names verified against
PluginConfiguration.cs + PermissionRolePolicy.cs on main. The remaining scalar
fields (max bitrate, max sessions) that are not PermissionKinds stay tracked in
#827.
Refresh the SAML setup wording for the full admin form (#856, #725)
The Hardening & Options Reference still described several SAML settings as
config-XML-only from before #725 shipped the full SAML provider form. Updated
the how-you-set-it wording only; the security guidance is unchanged:
- header note: both provider types have a full form, config-XML-only settings
are called out explicitly where they remain
- provision-new-users-pending-approval: a toggle on BOTH forms now
- Base URL Override: a form field on both forms (SAML under Compatibility &
overrides)
- metadata import: the form's URL/XML import fields pre-fill endpoint, SLO
endpoint and signing certificate; the admin endpoint stays documented as the
direct route
- SP signing keys: write-only form fields, blank-keeps-stored semantics stated
- inbound secondary IdP certificate: its own form field
- SP metadata: the form's read-only computed ACS URL and SP metadata URL with
copy buttons, derived from the canonical base URL
- Test Connection: the button exists on both forms
Consolidate the wiki: canonical Coding Standards, merged Architecture, split Provider Setup
Restructure the wiki into one coherent, audience-grouped set with a single home
for each fact.
- New Coding-Standards page: the one canonical statement of the architecture,
comment/documentation (#864), and object-oriented rules; the repo's CLAUDE.md
and CONTRIBUTING.md now point here instead of restating them.
- Merged the two stale, mutually-overlapping Architecture pages into one, re-based
on the current module-DAG reality (the old pages claimed the module split was
"not pursued" and that no IPluginServiceRegistrator existed — both were wrong
and contradicted docs/ARCHITECTURE.md). Cites modules and types, never
file:line, so it cannot drift on a move again.
- Split Provider-Setup (1172 lines, ~73% not provider-specific) into Provider
Setup (recipes) + a new Hardening & Options Reference; folded the security-
control narrative into the Security Model. Every moved section left a pointer.
- Merged Release-Policy + Release-QA-Checklist into Releasing (renamed the
per-release ladder to "release promotion ladder" to end the Beta-rung name
collision); merged OpenSSF-Best-Practices + Maturity-Map into Security &
Maturity Self-Assessment. Old slugs kept as redirect stubs.
- Rebuilt the sidebar into four audience groups (Getting started / How it works /
Security / Standards & process). Fixed the broken anchors, corrected the beta
publish-trigger to the daily scheduler (it is not "every merge"), de-referenced
the design records to module/type names, and trimmed Home's README duplication.