frontend: SPA UX polish — TargetSelector, audit fix, CSRF priming#833

Open

alvarofraguas wants to merge 38 commits into

jmpsec:mainfrom

alvarofraguas:pr/spa-ux-polish

Commits on May 19, 2026

pkg/auth: provider interface + state-as-JWT cookie helpers
alvarofraguas
committed
pkg/auth/oidc: provider implementation + legacy admin refactor
alvarofraguas
committed
pkg/auth/oidc: use Nonce (not EnvUUID) as OAuth2 state param
alvarofraguas
committed
oidc: pickUsername reads arbitrary claim names from raw token
alvarofraguas
committed
cmd/api: global OIDC federated login
alvarofraguas
committed
frontend: "Continue with SSO" button on the login page
alvarofraguas
committed
users: mark federated rows with auth_source and show OIDC badge
alvarofraguas
committed
auth: server-side logout + IdP end-session navigation
alvarofraguas
committed
auth: pass client_id to IdP end-session URL
alvarofraguas
committed
auth: persist id_token at callback + pass as id_token_hint on logout
alvarofraguas
committed
api: /logout hides IdP metadata from anonymous callers
alvarofraguas
committed
auth: split OAuth2 state and OIDC nonce into independent values
alvarofraguas
committed
saml: pkg/auth/saml protocol package + JIT auth-source plumbing
alvarofraguas
committed
saml: wire cmd/api handlers + routes + SPA login button
alvarofraguas
committed
saml: adopt OAuthState/Nonce split (sync with OIDC)
alvarofraguas
committed
saml: enforce InResponseTo correlation (close S7) + log private errors
alvarofraguas
committed
saml: fix SAML logout — gate IdP fields by auth_source + ForceAuthn
alvarofraguas
committed
saml: HTTPS-ready state cookie + Auth0 username attribute + per-session logout
alvarofraguas
committed
saml: sign AuthnRequests (close AuthnRequestsSigned=false finding)
alvarofraguas
committed
users: env dropdown + "apply to all envs" bulk grant
alvarofraguas
committed
users: SetEnvLevel upserts instead of erroring on missing row
alvarofraguas
committed
users: GET /permissions endpoint + prefill modal checkboxes
alvarofraguas
committed
users: permission-gated nav, /env list visible to non-admins, /me carries access map
alvarofraguas
committed
permissions: audit-trail scoped to user, palette+delete gated
alvarofraguas
committed
users: Add User + Delete User on the SPA /_app/users page
alvarofraguas
committed
api: delete user — clean permissions BEFORE the user row
alvarofraguas
committed
users: Reset password per-row + belt-and-braces delete confirmation
alvarofraguas
committed
users: drop window.confirm from delete flow — modal confirm is enough
alvarofraguas
committed
frontend: prime CSRF token from cookie on app boot
alvarofraguas
committed
TargetSelector: node combobox with hostname + UUID search
alvarofraguas
committed
queries/new: inline typeahead on UUID + Hostname inputs
alvarofraguas
committed
targets: collapse UUID + Hostname inputs into one Nodes picker
alvarofraguas
committed
TargetSelector: match queries' inline typeahead UX
alvarofraguas
committed
carves/new: two-column layout to match queries/new
alvarofraguas
committed
TargetingPanel: comma-friendly multi-pick
alvarofraguas
committed
nodes/detail: hide Archive button for non-env-admin operators
alvarofraguas
committed
nodes/detail: drop disabled Refresh placeholder
alvarofraguas
committed
audit: stop self-polluting on /audit-logs reads + memoize query key
alvarofraguas
committed