214 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
lilleman	89a234b841	Add a todo for guarding the double-clicked submit without client JS	2026-08-04 10:40:37 +02:00
lilleman	e03c1d1a2f	Let an operator mount plugin catalogs; document the end-user personas	2026-08-04 10:31:08 +02:00
lilleman	bd76c981ee	Carry the language through sign-in; warn when switching leaves the page; product-review copy fixes	2026-08-04 09:59:00 +02:00
lilleman	37b88b2fe6	Show the language picker on every page, targeting the nearest page that answers GET	2026-08-04 09:37:03 +02:00
lilleman	7e4c6940c9	Escape the values interpolated into the one markup-carrying message	2026-08-04 00:42:54 +02:00
lilleman	18e1a8d29d	Keep the chrome lazy for error pages, guard the guard-error render, split the recovery link	2026-08-04 00:31:19 +02:00
lilleman	93139ea058	Stability round two: no language links on POST-rendered pages, scoped observers, Vary only where it varies	2026-08-04 00:10:31 +02:00
lilleman	be3bc2bdbb	Stability fixes: plugin-scoped contexts for owned pages, absent-href guard, checked locale mounts	2026-08-03 23:51:40 +02:00
lilleman	2b20497785	Pin the chrome's locale carrying in unit tests; keep one carrier list	2026-08-03 23:25:54 +02:00
lilleman	b3df7084c4	Reserve the locale param, carry it on breadcrumbs, translate the permissions detail view	2026-08-03 23:21:38 +02:00
lilleman	6440c543e5	Architecture review fixes: partials carry the locale, mountable locales/, shared core words	2026-08-03 23:12:18 +02:00
lilleman	245d1ad5b5	Add i18n support: per-locale catalogs, URL-driven locale, translated core and examples	2026-08-03 22:37:27 +02:00
lilleman	c30cd95ebd	Fix a stale ctx.identity reference in the file map	2026-08-03 17:41:40 +02:00
lilleman	f38b5373bd	Say user throughout, noting Ory's identity naming in the docs	2026-08-03 17:41:40 +02:00
lilleman	9966b6bd46	Record the authorization vocabulary decision in AGENTS.md	2026-08-03 17:41:40 +02:00
lilleman	096720904e	Rename the coarse gate from role to permission, matching RBAC	2026-08-03 17:41:40 +02:00
lilleman	04fe5b1e06	Cut the security-model threat table down to what the code cannot show	2026-08-03 17:41:40 +02:00
lilleman	3486e0ad00	Rename the Keto User namespace to Identity, matching Kratos	2026-08-03 17:41:40 +02:00
lilleman	8f9f79ac30	Document the users, groups and roles model in README	2026-08-03 17:41:40 +02:00
lilleman	b580f7d06e	Rename the plugin-API permission gate to role	2026-08-03 17:41:40 +02:00
lilleman	f0662cbd0f	Reflow the security-model prose to the file's wrap width	2026-08-03 17:41:40 +02:00
lilleman	4b4ac178ab	Record the open CSRF token-binding decision as a todo item	2026-08-03 17:41:40 +02:00
lilleman	73a78d4404	Add the seeded admin login to the production secrets checklist	2026-08-03 17:41:40 +02:00
lilleman	5a5803b265	Review fixes: denylist-conditional revoke, Ory secret wiring, exp guard test	2026-08-03 17:41:40 +02:00
lilleman	a2204782fa	Review fixes: re-mint path, real session lifetime, full secret checklist	2026-08-03 17:41:40 +02:00
lilleman	eb5aafdfaa	Document the auth security model in README	2026-08-03 17:41:40 +02:00
lilleman	5c3af63847	Merge branch 'main' into renovate/renovate-renovate-44.x	2026-08-03 12:10:24 +02:00
renovate-bot	21cd878447	Update renovate/renovate Docker tag to v44.7.2 ... Release-Bump: minor	2026-08-03 04:17:57 +00:00
renovate-bot	1abaa22a97	Update actions/checkout action to v4.4.0 ... Release-Bump: minor	2026-08-03 04:17:55 +00:00
lilleman	0919adf4ef	Review fixes: plain depends_on merge, positive secret assertion	2026-08-02 16:10:35 +02:00
lilleman	f5f4455b81	Browser E2E for the admin OAuth2-clients screen	2026-08-02 16:03:30 +02:00
lilleman	3f30f889c3	README: note GITHUB_ secret-name prefix is rejected too	2026-08-02 15:48:04 +02:00
lilleman	ae1479f55b	Renovate: set GITHUB_COM_TOKEN for authenticated github.com lookups	2026-08-02 15:43:38 +02:00
lilleman	bb6021adf7	Update lockfile for typescript 7.0.2	2026-08-02 15:29:13 +02:00
renovate-bot	c4e6212189	chore(deps): update dependency typescript to v7 ... Release-Bump: major	2026-08-02 15:29:03 +02:00
lilleman	6f6aafad39	Import ejs as default export — the v6 ESM build exports only default	2026-08-02 15:25:51 +02:00
lilleman	4aada6eed9	Update lockfile for ejs 6.0.1	2026-08-02 15:25:51 +02:00
renovate-bot	a574effb37	fix(deps): update dependency ejs to v6 ... Release-Bump: major	2026-08-02 15:25:51 +02:00
lilleman	c259497627	Update lockfile for @types/node 24.13.3	2026-08-02 15:22:25 +02:00
renovate-bot	8e74532a77	chore(deps): update node.js to v24.18.1 ... Release-Bump: minor	2026-08-02 15:22:25 +02:00
lilleman	62f95afe63	Merge branch 'main' into remove-stability-auto-review	2026-08-02 15:19:13 +02:00
lilleman	ffeec70f8f	Update lockfile and regenerate icons.ejs for lucide-static 1.28.0	2026-08-02 15:15:12 +02:00
renovate-bot	62d4c8b7cd	fix(deps): update dependency lucide-static to v1.28.0 ... Release-Bump: minor	2026-08-02 15:15:12 +02:00
lilleman	12cc2d54c2	Clarify todo.md reference and record manual review policy	2026-08-02 15:12:22 +02:00
lilleman	bb6adc40af	Remove stability reviewer auto-run from AGENTS.md	2026-08-02 15:06:48 +02:00
lilleman	c64156a9d5	Update e2e-tests lockfile for @playwright/test 1.62.1	2026-08-02 15:06:47 +02:00
renovate-bot	de2ad42f5a	chore(deps): update playwright to v1.62.1 ... Release-Bump: minor	2026-08-02 15:06:47 +02:00
lilleman	9213e5a0de	Make the CI web-image rebuild its own step; note the shared-workspace image-tag race	2026-08-02 15:06:21 +02:00
lilleman	45054db5e6	Build the web image in ci.sh so typecheck and tests run the branch's own deps	2026-08-02 15:06:21 +02:00
lilleman	23bafd247d	Fix typos in the AGENTS.md comment rules	2026-08-02 15:00:56 +02:00