v20260918a

Changelog

• 39dc003: Merge pull request #4 from riipandi/overhaul-stack (@riipandi)
• 0ef13a9: build: adopt taskfile and improve dev tooling (@riipandi)
• 8fe98fb: build: revamp go plugin and fix version output (@riipandi)
• a5e06b6: cchore: reorganize Yaak request folders into nested subfolders (@riipandi)
• 43d6740: chore: add /rpc to Vite proxy list (@riipandi)
• 72625b0: chore: add AGENTS.md (@riipandi)
• a01d36d: chore: add ConnectRPC migration plan (@riipandi)
• b32e492: chore: add ConnectRPC toolchain (@riipandi)
• e90d0c9: chore: add api client sdk placholder (@riipandi)
• ab78997: chore: add database stub (@riipandi)
• 9aa5923: chore: add plan to create API client (@riipandi)
• 96746e2: chore: add plan to port Pocket ID (@riipandi)
• 6fd1ae5: chore: add plan to port Pocket ID gap (@riipandi)
• 6fa49c8: chore: add porting remediation plan (@riipandi)
• a4b8789: chore: add refined porting plan (@riipandi)
• 5d99497: chore: add task for test api client (@riipandi)
• 26d0b61: chore: archived old plans (@riipandi)
• cebc9eb: chore: change testcontainer docker images (@riipandi)
• bd30b3b: chore: change user-agent name on resty http client (@riipandi)
• acfdeb4: chore: clean excluded ldap artifacts (@riipandi)
• 66285d6: chore: cleanup and refine comments (@riipandi)
• 66b2c58: chore: cleanup and refine comments (@riipandi)
• 808e87b: chore: cleanup comments (@riipandi)
• 443e2ac: chore: cleanup comments (@riipandi)
• 934852f: chore: dev tooling and local TLS setup (@riipandi)
• 1b2ca0b: chore: exclude tmpl from oxfmt (@riipandi)
• b0697c7: chore: frontend tooling, yaak spec sync, and storage doc alignment (@riipandi)
• 456eb15: chore: glauth LDAP dev server with postgres backend (@riipandi)
• 1faef05: chore: gofmt formatting fixes (@riipandi)
• e9f51d0: chore: improved docker compose stack (@riipandi)
• ae412a9: chore: load env file for task run (@riipandi)
• d4f20ce: chore: oxlint type-aware rules and pocketid compose service (@riipandi)
• 4465fd9: chore: refined plan and add porting PRD (@riipandi)
• 2e74458: chore: refined plan and add porting PRD (@riipandi)
• 80171c9: chore: remove excluded application image requests (@riipandi)
• ad7b8b3: chore: remove excluded database residue and verify the fresh schema (@riipandi)
• beacc8c: chore: remove obsolete module scaffolding (@riipandi)
• 44ef1f2: chore: remove stray verification binary (@riipandi)
• 8fde2ac: chore: rename HealthzHandler to HealthCheckHandler (@riipandi)
• 289e4be: chore: rename request id prefix (@riipandi)
• c14182c: chore: reorganize Yaak API requests (@riipandi)
• 8cfb7bd: chore: reorganize Yaak API requests (@riipandi)
• 10e0c4b: chore: reorganize Yaak API requests (@riipandi)
• b21d1b0: chore: reorganize Yaak API requests (@riipandi)
• 8acb65b: chore: reorganize Yaak folders into nested subfolders (@riipandi)
• e5c28ee: chore: set default arg task test go (@riipandi)
• 7bd0003: chore: set explicit version for Pocket ID docker compose (@riipandi)
• d289b83: chore: update AGENTS.md (@riipandi)
• 18369f7: chore: update AGENTS.md (@riipandi)
• cacaa63: chore: update AGENTS.md (@riipandi)
• 9f35e01: chore: update AGENTS.md (@riipandi)
• 1709ed0: chore: update ConnectRPC refactor plan (@riipandi)
• d2a7e11: chore: update README.md (@riipandi)
• 5e191ae: chore: update Yaak API requests parameter (@riipandi)
• 8e3aaf2: chore: update Yaak requests (@riipandi)
• 0fd91d8: chore: update dependencies (@riipandi)
• 004b2fd: chore: update dependencies (@riipandi)
• f220919: chore: update docs (@riipandi)
• cfd5c5d: chore: update plan instruction to use Comlink WebWorkers" (@riipandi)
• 443d369: chore: update refactor plan auth section (@riipandi)
• 42e3d35: chore: use compact CLI output (@riipandi)
• 0dd651b: ci: cache homebrew cellar and skip auto-update on macOS runners (@riipandi)
• a13188c: ci: cache homebrew cellar and skip auto-update on macOS runners (@riipandi)
• 7bbb9c0: ci: fix gh actions release workflow (@riipandi)
• fac7eb7: ci: optimize actions caching for node_modules, homebrew, and testcontainers images (@riipandi)
• 02fc975: ci: optimize go cache (@riipandi)
• 4f25426: ci: remove CI test from tag trigger (@riipandi)
• cb99d53: ci: update actions/cache to v6 (@riipandi)
• 11988eb: db: consolidate application schemas to internal (@riipandi)
• 6440b1f: db: fold remediation migrations into initial schema (@riipandi)
• b52886c: db: remove obsolete client columns (@riipandi)
• e17a7e0: db: remove unused oidc refresh token table (@riipandi)
• 3fe648b: docs(llms): add architecture improvement plan (6 phases) (@riipandi)
• f540ba2: docs(llms): gotchas + upstream endpoint gap register (@riipandi)
• ac86597: docs(llms): mandate request validation with ozzo-validation (@riipandi)
• 5d19147: docs(llms): status column on the endpoint reference (@riipandi)
• 6f9fc00: docs(llms): upstream endpoint reference grouped by spec tag (@riipandi)
• 5a961ae: feat(antree): add postgres-backed task queue ported from backlite (@riipandi)
• e27dec3: feat(api): standard response envelope with typed TypeIDs (@riipandi)
• dcad7a8: feat(auth): session-cookie sign-in, guards, account self-service (@riipandi)
• c8a70e6: feat(core): wire postgres-backed stores with go-sqlbuilder and request-id middleware (@riipandi)
• 812e8e6: feat(db): migration session lock, backup perms, schema check (@riipandi)
• 77fcb74: feat(email): compile templates in vite email plugin (@riipandi)
• e554403: feat(email): plugin-style logs and fail on error (@riipandi)
• a4d1b40: feat(federation): JWKS lifecycle and well-known endpoints (@riipandi)
• 635ba4f: feat(federation): OIDC provider — authorize PKCE, token, userinfo (@riipandi)
• eeb424f: feat(identity): admin surface — groups, claims, audit API, user CRUD (@riipandi)
• 3dfea87: feat(queue): wire antree into the registry lifecycle (@riipandi)
• 63c8f4e: feat: add CIMD-lite metadata clients with refresh endpoint (phase 9D) (@riipandi)
• 25f0f12: feat: add OIDC device flow and pushed authorization requests (@riipandi)
• 132c6d4: feat: add Postgres TOTP MFA storage (@riipandi)
• 0ae66e9: feat: add React Email (@riipandi)
• e0d80b6: feat: add TOTP verification service (@riipandi)
• 6814645: feat: add advance health check (@riipandi)
• 27c8a97: feat: add application configuration CRUD (phase 9B) (@riipandi)
• 43f3ddb: feat: add async logger via loglayer (@riipandi)
• 23efb26: feat: add canonical encrypted value prefix (@riipandi)
• 22a7347: feat: add configurable application data directory (@riipandi)
• acd2371: feat: add cryptography module (@riipandi)
• 4616c35: feat: add final postgres schema cleanup (@riipandi)
• b841366: feat: add flush to antree (@riipandi)
• 1c17046: feat: add jwtutils module (@riipandi)
• 8382cf9: feat: add mailer with template caching (@riipandi)
• 74e1de4: feat: add missing Yaak API requests (@riipandi)
• 3361d7b: feat: add password auth subdomain structure (@riipandi)
• 8b83f28: feat: add password recovery flow (@riipandi)
• 5d342a1: feat: add password sign-in flow (@riipandi)
• 0cf6b58: feat: add profile picture and client logo surfaces (phase 9C) (@riipandi)
• bfd317e: feat: add shared resty fetcher (@riipandi)
• fdb64b1: feat: add shared resty fetcher (@riipandi)
• 0f0e619: feat: add transactional audit boundary (@riipandi)
• 8ce0665: feat: adopt Go 1.26 and 1.27 stdlib features (@riipandi)
• 5c8b875: feat: close sdk coverage gaps for internal surfaces (@riipandi)
• 23e33ed: feat: complete api client namespaces and machine auth (@riipandi)
• 764a92b: feat: complete password credential service (@riipandi)
• f6a8052: feat: complete phase 1-4 endpoint surface + auditlog split (@riipandi)
• 7ed8ad6: feat: enforce MFA during authentication (@riipandi)
• fd741d6: feat: goose migrate subcommands (@riipandi)
• a72e34a: feat: harden config validation and key sync (@riipandi)
• ebf6c82: feat: implement phase 9A OIDC client context endpoints (@riipandi)
• 1784105: feat: initial schema migration with goose (@riipandi)
• f54fc74: feat: move LDAP/SMTP settings into appconfig (phase 9 stretch) (@riipandi)
• 0147490: feat: nest db backup under migrate command (@riipandi)
• 148da84: feat: phase 5 passkeys and alternative sign-in (@riipandi)
• ff99ae4: feat: phase 6 api keys, resource APIs, and rate limiter (@riipandi)
• dc1cc12: feat: phase 7 async jobs and webhooks (@riipandi)
• 4deba9b: feat: phase 8 directory sync and storage (@riipandi)
• 235b636: feat: phase 8 supporting wiring and docs (@riipandi)
• 665a926: feat: port migrator.sh to go commands (@riipandi)
• cba3f63: feat: postgres datastore with tx and pooling (@riipandi)
• 20501db: feat: real readiness health checks (@riipandi)
• bc66f0d: feat: replace prepare.sh with secrets cobra command (@riipandi)
• b561355: feat: scaffold datastore and storage (@riipandi)
• b878e45: feat: scaffold identity provider modules (@riipandi)
• 734da80: feat: supabase-style API client SDK over ofetch (@riipandi)
• 5d9f6c1: feat: wire application logger (@riipandi)
• 114f80a: fix(database): pass PGPASSWORD to client tools (@riipandi)
• add47aa: fix: Yaak request parameters (@riipandi)
• 490e65c: fix: Yaak request parameters (@riipandi)
• 1cfb7e0: fix: Yaak request parameters (@riipandi)
• afb066d: fix: align API access contracts (@riipandi)
• 31fd5f8: fix: align OIDC protocol contracts (@riipandi)
• dc90a03: fix: align SCIM and configuration contracts (@riipandi)
• c196442: fix: align claims and audit contracts (@riipandi)
• f1d0e04: fix: align health and discovery contracts (@riipandi)
• 16a1a40: fix: align passkey and device-login contracts (@riipandi)
• 2314842: fix: align transport response and header contracts (@riipandi)
• 2ee57d7: fix: align user and signup contracts (@riipandi)
• 1acff5d: fix: change default password algorithm to scrypt (@riipandi)
• e98646b: fix: complete password-reset email data and fail fast on broken templates (@riipandi)
• 9328408: fix: gh actions workflow (@riipandi)
• 2a4ccfa: fix: gh actions workflow (@riipandi)
• 38a07d2: fix: gh actions workflow (@riipandi)
• 88cc906: fix: gh actions workflow (@riipandi)
• 58a1bdb: fix: gh actions workflow (@riipandi)
• 59bf394: fix: gh actions workflow (@riipandi)
• b13cd1a: fix: gosec issues on cmd/launcher (@riipandi)
• fbf71f3: fix: harden auditlog listing boundaries (@riipandi)
• f89e8aa: fix: harden graceful shutdown (@riipandi)
• 830ef95: fix: harden webhook delivery (@riipandi)
• 424ec46: fix: let admins clear sensitive app settings (@riipandi)
• a432e8b: fix: modernize Go code (@riipandi)
• 890d573: fix: pass the bundled logo URL into email templates (@riipandi)
• f1f1b4f: fix: preload font using crossorigin (@riipandi)
• d6a9993: fix: prevent internal error disclosure (@riipandi)
• 778a100: fix: refine and hardening antree module (@riipandi)
• 9a12f0d: fix: refine and hardening jwtutils (@riipandi)
• e042a90: fix: resolve audit findings (@riipandi)
• 748f637: fix: retire spent authorize-code sessions and purge protocol state (@riipandi)
• 8cf0bf2: fix: smtp test deadlock and shared mailpit (@riipandi)
• 6d0223b: refactor(antree): harden dispatcher and modernize encoding (@riipandi)
• 9184368: refactor(antree): tidy comments and align READMEs with the implementation (@riipandi)
• bfcd966: refactor(datastore): centralize pgx helpers and error mapping; move antree to internal (@riipandi)
• a17295a: refactor(identity): consolidate auth_tokens stores into shared token package (@riipandi)
• 64344ad: refactor(kernel): refine auth contract (@riipandi)
• 43ab27a: refactor(oidc): split store per bounded context (file-level, no subpackages) (@riipandi)
• 4df8307: refactor(queue): merge antree into built-in internal/queue with datastore integration (@riipandi)
• 39e9fd5: refactor(registry): move settings mapping and SCIM snapshot SQL into owning modules (@riipandi)
• 4618fc7: refactor(responder): centralize error-to-HTTP mapping with statused sentinels (@riipandi)
• 8025ecf: refactor: add explicit application runtime (@riipandi)
• cb5b224: refactor: add shared deps struct and module lifecycle (@riipandi)
• c4ba48a: refactor: cleanup ConnectRPC and React SPA (@riipandi)
• e1757b8: refactor: consolidate application modules under modules/admin (@riipandi)
• cd085ef: refactor: finalize oidc client secret storage (@riipandi)
• fabe513: refactor: isolate domain errors from the transport layer (@riipandi)
• 5ffe9c2: refactor: isolate federation protocol handlers (@riipandi)
• eb4f043: refactor: migrate remaining encoding/json usages to encoding/json/v2 (@riipandi)
• 5ea3555: refactor: modernize Go 1.27 (@riipandi)
• 22d5105: refactor: modernize Go 1.27 (@riipandi)
• baec303: refactor: move apiRoot to transport layer (@riipandi)
• 3a9793e: refactor: move guards and paging out of services (@riipandi)
• 2249b3d: refactor: move module contracts to schema.go files (@riipandi)
• 2c4e487: refactor: narrow infrastructure boundaries (@riipandi)
• 88f3650: refactor: normalize request validation (@riipandi)
• 1f0eee5: refactor: overhaul database migration (@riipandi)
• 84b3ed5: refactor: overhaul database migration (@riipandi)
• bc4252e: refactor: place typed ids and table names in owning packages (@riipandi)
• 1a29e6c: refactor: promote the Queue to a Built-In Subsystem (@riipandi)
• 8c16f6c: refactor: rate limit only sensitive endpoints (@riipandi)
• 6283f7b: refactor: remove appimage module (@riipandi)
• 2fff937: refactor: remove excluded LDAP and application-images features (@riipandi)
• 5716f4f: refactor: remove feature plugin wiring (@riipandi)
• 6af1c5c: refactor: remove internal/scheduler (@riipandi)
• ac36ca2: refactor: remove late-bound dependencies (@riipandi)
• 8dca460: refactor: rename job package to scheduler (@riipandi)
• 0190174: refactor: reorganize code structure (@riipandi)
• cdd9798: refactor: reorganize code structure (@riipandi)
• 80c9d5b: refactor: reorganize code structure (@riipandi)
• ce187a2: refactor: reorganize code structure (@riipandi)
• 4cf06bb: refactor: reorganize code structure (@riipandi)
• 2eebd01: refactor: reorganize code structure (@riipandi)
• c6ea41f: refactor: reorganize identity subdomains (@riipandi)
• f6c6cb8: refactor: replace cobra with kong (@riipandi)
• 0e854be: refactor: replace viper with koanf (@riipandi)
• 19c2fc1: refactor: restructure cli into db command group (@riipandi)
• afda84e: refactor: restructure into modular monolith architecture (@riipandi)
• 5132259: refactor: separate recovery transport from service (@riipandi)
• c93de4c: refactor: separated identity module and identity provider module (@riipandi)
• 652be6c: refactor: simplify config defaults and env mapping (@riipandi)
• 59773c1: refactor: simplify healthz to liveness probe (@riipandi)
• fd85e82: refactor: simplify webhook boundaries (@riipandi)
• 21aa334: schema: consolidate migrations to final-shape creates (@riipandi)
• af26a00: schema: rename migration files (@riipandi)
• c99bcba: streamdown frontend dependencies (@riipandi)