163 Commits

Author	SHA1	Message	Date
lilleman	3491e6109f	Model the read/write split in the UI: read-only views, self-revoke and inherited-grant guards	2026-08-05 14:47:51 +02:00
lilleman	0011182f16	Permissions are a fixed list from plugin code; grant them on Users and Groups	2026-08-05 14:29:15 +02:00
lilleman	b6f4e5366a	Enforce the permission-name rule at discovery, for every plugin	2026-08-05 13:00:23 +02:00
lilleman	065d865d24	Permission names are <resource>:<action>, replacing the catch-all admin permission	2026-08-05 12:45:06 +02:00
lilleman	225569b08a	More todos	2026-08-05 12:08:09 +02:00
lilleman	32154fbbc0	Record the unpinned Playwright worker pool as an open decision	2026-08-05 11:21:57 +02:00
lilleman	690d67728b	Watch what a beforeAll logs, and record where each message came from	2026-08-05 11:15:37 +02:00
lilleman	e808f87fbd	Fail an E2E test on anything the browser logs, in all three engines	2026-08-05 11:00:25 +02:00
lilleman	81043edfc6	Count both paths of a rename in the docs-only CI skip	2026-08-05 10:15:09 +02:00
lilleman	b1b01f8bdc	More todos	2026-08-05 08:35:08 +02:00
lilleman	c54f5e2c51	New todos	2026-08-05 08:33:49 +02:00
lilleman	cfeee10fa8	Wrap each popover menu and give it a caller-named id	2026-08-05 01:58:11 +02:00
lilleman	5d9bdebf59	Close the popup menus on an outside click, via the popover API	2026-08-05 01:37:58 +02:00
lilleman	64d1387df2	Scope the profile-menu assertion to the menu itself	2026-08-05 01:08:09 +02:00
lilleman	3c64621515	Remove the dead Profile link from the sidebar profile menu	2026-08-05 01:01:14 +02:00
lilleman	2b09635ed5	Hold the one-verb rule in AGENTS.md instead of a unit test	2026-08-05 00:52:09 +02:00
lilleman	34b668d49f	Use one verb per action in the English UI: sign in, sign out, create account	2026-08-05 00:34:05 +02:00
lilleman	46548ae758	Narrow the settings-cog test assertions and record the icon-registry contract	2026-08-05 00:20:34 +02:00
lilleman	8f7ab55267	Remove the Settings cog and its Preferences menu from the sidebar footer	2026-08-05 00:08:35 +02:00
lilleman	7948596105	New todos	2026-08-04 23:48:26 +02:00
lilleman	89a234b841	Add a todo for guarding the double-clicked submit without client JS	2026-08-04 10:40:37 +02:00
lilleman	93139ea058	Stability round two: no language links on POST-rendered pages, scoped observers, Vary only where it varies	2026-08-04 00:10:31 +02:00
lilleman	245d1ad5b5	Add i18n support: per-locale catalogs, URL-driven locale, translated core and examples	2026-08-03 22:37:27 +02:00
lilleman	f38b5373bd	Say user throughout, noting Ory's identity naming in the docs	2026-08-03 17:41:40 +02:00
lilleman	9966b6bd46	Record the authorization vocabulary decision in AGENTS.md	2026-08-03 17:41:40 +02:00
lilleman	04fe5b1e06	Cut the security-model threat table down to what the code cannot show	2026-08-03 17:41:40 +02:00
lilleman	3486e0ad00	Rename the Keto User namespace to Identity, matching Kratos	2026-08-03 17:41:40 +02:00
lilleman	8f9f79ac30	Document the users, groups and roles model in README	2026-08-03 17:41:40 +02:00
lilleman	4b4ac178ab	Record the open CSRF token-binding decision as a todo item	2026-08-03 17:41:40 +02:00
lilleman	5a5803b265	Review fixes: denylist-conditional revoke, Ory secret wiring, exp guard test	2026-08-03 17:41:40 +02:00
lilleman	a2204782fa	Review fixes: re-mint path, real session lifetime, full secret checklist	2026-08-03 17:41:40 +02:00
lilleman	eb5aafdfaa	Document the auth security model in README	2026-08-03 17:41:40 +02:00
lilleman	f5f4455b81	Browser E2E for the admin OAuth2-clients screen	2026-08-02 16:03:30 +02:00
lilleman	ae1479f55b	Renovate: set GITHUB_COM_TOKEN for authenticated github.com lookups	2026-08-02 15:43:38 +02:00
lilleman	7c66599f35	Todo and agents updates	2026-08-02 14:11:33 +02:00
lilleman	145db5b4cd	CI: auto-release a version tag when Renovate merges a dependency update	2026-07-05 20:49:49 +02:00
lilleman	67d8a095a5	CI: Renovate for gated, self-hosted dependency updates	2026-07-04 21:51:04 +02:00
lilleman	476ef6fce2	README-dockerhub: clone-free quick start - self-contained compose, Ory config extracted from the image	2026-07-04 17:45:44 +02:00
lilleman	93fa751d6d	Add README-dockerhub.md - the hand-maintained Docker Hub repo description	2026-07-04 17:37:02 +02:00
lilleman	cc886936ed	CI: sync release images to Docker Hub on vX.Y.Z tag push	2026-07-04 17:08:31 +02:00
lilleman	058280934b	CI: re-tag the gated image as semver + latest on vX.Y.Z tag push	2026-07-04 08:35:48 +02:00
lilleman	50006dd1a7	CI: gate builds + pushes app image to Gitea registry tagged with the commit hash	2026-07-03 16:50:37 +02:00
lilleman	6e60df7008	CI: mirror main + tags to GitHub after every merge to main; note true home in README	2026-07-03 15:47:56 +02:00
lilleman	7a3161d3ff	README: document the merge gate on main (PR-only, required CI, fast-forward-only); check off todo	2026-07-03 14:50:54 +02:00
lilleman	94654a2adc	CI: Gitea Actions runs the full gate (ci.sh) on push to any branch except main; document runner setup	2026-07-02 14:24:19 +02:00
lilleman	535902e69b	Split handleRequest into pipeline + internal route table; auth/OAuth2 endpoints become named handlers in src/auth/routes.ts	2026-07-02 13:05:54 +02:00
lilleman	8621cf24b6	todo: note the missing e2e for the admin plugin's OAuth2-clients (Hydra) screen	2026-07-02 09:10:55 +02:00
lilleman	e8ea911b80	Move admin screens (users/groups/roles/oauth2-clients) into a drop-in example plugin; add the ctx.system capability surface	2026-07-02 08:01:15 +02:00
lilleman	2202bdbaa0	config/ becomes an empty drop-in mount; examples/ mirrors the mount dirs; plugins & config import the host via #plugin-api/#menu-config subpath imports	2026-07-01 23:19:48 +02:00
lilleman	fe97c3854a	Move reference plugin to examples/scheduling-plugin; plugins/ ships empty as a drop-in mount point, e2e bind-mounts the example	2026-06-27 00:02:26 +02:00