Skip to content

Opifer 1.1.0 — authenticated mode

Choose a tag to compare

View all tags
@mikegazzaruso mikegazzaruso released this 20 Sep 21:31
· 23 commits to main since this release
v1.1.0
d6e2129

Install

npm install -g @opifer/cli
o4r init --company "My company" && o4r up            # your machine
o4r init --company "My company" --auth --email you@example.com   # a server: sign-in required

Opifer can now run on a server or a VPS: o4r init --auth --email you@example.com (or o4r auth enable) and every call to the interface and the API needs a signed-in person or an API key.

Added

  • People with email and password (scrypt), session cookie (HttpOnly, SameSite=Lax, Secure behind HTTPS, 30 days sliding), ten failed sign-ins a minute per address.
  • API keys (opk_…) for the CLI and integrations, shown once, stored hashed, revocable.
  • Roles, server-wide: observer reads, operator does the daily work, admin configures, owner manages people, keys, the emergency stop and export/import. The last owner cannot be removed.
  • CLI: o4r auth enable|disable|status, o4r user add|list|remove|password|role, o4r apikey create|list|revoke; o4r init --auth --email --password; the CLI signs its own calls with a key in <home>/credentials/cli.key.
  • Interface: sign-in screen, the signed-in person in the sidebar, sign-out in Settings; preferences per person.
  • The interface works under a path (https://example.com/opifer/): relative assets, API, events socket and service worker.
  • Docker: OPIFER_AUTH_EMAIL and OPIFER_AUTH_PASSWORD turn authenticated mode on at first start.
  • Migration 0010_auth: users.password_hash|role|status|last_login_at, user_sessions, api_keys.

Changed

  • o4r doctor reports the authentication mode instead of warning about exposure when sign-in is on.
  • The guide has a section "On a server" with the nginx snippet; the security review describes both modes.

Full changelog: https://github.com/NextEpochs/opifer/blob/main/CHANGELOG.md · Website: https://opifer.dev

Assets 2
Loading