Skip to content

v0.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Sep 12:35
· 28 commits to main since this release
v0.3.0
46370b3

eCorpus v0.3.0

Authentication and authorization release: server-side sessions, an OAuth2 provider, scoped API tokens and the security hardening around them. Contains a breaking change.

Breaking changes

  • HTTP Basic authentication removed. Services and WebDAV clients must now authenticate with a personal access token (Authorization: Bearer …) instead of a username and password. A Basic header is ignored.

New Features

  • Server-side sessions — the cookie carries only an opaque session id, and identity is resolved from the database on every request, so revocations and level changes apply immediately. Sessions are inspectable and revocable, and a password change evicts all of a user's sessions.
  • OAuth2 provider — authorization-code flow with mandatory PKCE, admin-registered clients, a consent page with persisted grants and silent renewal while signed in, token revocation (RFC 7009) and discovery (RFC 8414). Comes with an admin client-registration page and a user "Authorized applications" view.
  • Personal access tokens — opaque, revocable tokens (ec_…, stored hashed and shown exactly once), created from a per-family scope picker on the user's token page.
  • Scoped authorization, deny-by-default — a token grants only what its scopes name, always capped by its owner's own rights (scenes:*, tasks:*, groups:*, users:*…). Account management and admin operations require an interactive session.
  • Search bar on the admin users page.
  • Voyager updated to v0.65.

Security

  • CSRF protection on every cookie-authenticated unsafe method, using Fetch Metadata with an Origin fallback; the login POST is covered as well.
  • Report-only CSP, frame denial on /auth to stop consent-page clickjacking, nosniff, and HSTS in production.
  • Noto Serif is now self-hosted instead of hot-linked from Google Fonts.
  • Scene ZIP exports are capped by the token's scene scope.

Bug Fixes

  • Sorting scenes by relevance with an empty search no longer returns a 500 — reachable by simply clearing the search box.
  • Malformed or unsatisfiable Range headers now answer 400/416 instead of 500.
  • oEmbed answers 400 on an unparseable url instead of 500.
  • Client disconnects during upload are no longer logged as server faults.
  • Clearer error labels for a range of recurring errors.

Full Changelog: v0.2.1...v0.3.0

Assets 3
Loading