lilleman
453d6dc065
Deleting a group revokes the permissions it granted
CI / full-gate (push) Successful in 2m39s
2026-08-05 15:26:25 +02:00
lilleman
151117680a
Extend the read-only treatment to OAuth2 clients and write-intent GETs
CI / full-gate (push) Successful in 2m42s
2026-08-05 15:08:31 +02:00
lilleman
3491e6109f
Model the read/write split in the UI: read-only views, self-revoke and inherited-grant guards
CI / full-gate (push) Successful in 2m39s
2026-08-05 14:47:51 +02:00
lilleman
0011182f16
Permissions are a fixed list from plugin code; grant them on Users and Groups
CI / full-gate (push) Successful in 2m38s
2026-08-05 14:29:15 +02:00
lilleman
b6f4e5366a
Enforce the permission-name rule at discovery, for every plugin
CI / full-gate (push) Failing after 1m53s
2026-08-05 13:00:23 +02:00
lilleman
065d865d24
Permission names are <resource>:<action>, replacing the catch-all admin permission
CI / full-gate (push) Successful in 2m43s
2026-08-05 12:45:06 +02:00
lilleman
690d67728b
Watch what a beforeAll logs, and record where each message came from
CI / full-gate (push) Successful in 2m48s
2026-08-05 11:15:37 +02:00
lilleman
e808f87fbd
Fail an E2E test on anything the browser logs, in all three engines
CI / full-gate (push) Successful in 2m51s
2026-08-05 11:00:25 +02:00
lilleman
e5bdc15262
Prune deleted tags on the GitHub mirror so it stops advertising dropped versions
CI / full-gate (push) Successful in 2m40s
Mirror / github-mirror (push) Successful in 7s
2026-08-05 10:42:39 +02:00
lilleman
2fb5e695e1
Record the docs-skip and no-release decisions, and blind the guard to comments
CI / full-gate (push) Successful in 2m42s
2026-08-05 10:34:46 +02:00
lilleman
81043edfc6
Count both paths of a rename in the docs-only CI skip
2026-08-05 10:15:09 +02:00
lilleman
9cf6c05325
Name the chrome's language menu and guard anchor positioning in the fallback
CI / full-gate (push) Successful in 2m44s
2026-08-05 02:23:50 +02:00
lilleman
cfeee10fa8
Wrap each popover menu and give it a caller-named id
CI / full-gate (push) Successful in 2m43s
2026-08-05 01:58:11 +02:00
lilleman
5d9bdebf59
Close the popup menus on an outside click, via the popover API
CI / full-gate (push) Successful in 2m40s
2026-08-05 01:37:58 +02:00
lilleman
64d1387df2
Scope the profile-menu assertion to the menu itself
CI / full-gate (push) Successful in 2m38s
Mirror / github-mirror (push) Successful in 7s
2026-08-05 01:08:09 +02:00
lilleman
3c64621515
Remove the dead Profile link from the sidebar profile menu
CI / full-gate (push) Successful in 2m39s
2026-08-05 01:01:14 +02:00
lilleman
2b09635ed5
Hold the one-verb rule in AGENTS.md instead of a unit test
CI / full-gate (push) Successful in 2m38s
Mirror / github-mirror (push) Successful in 6s
2026-08-05 00:52:09 +02:00
lilleman
9a9c63e625
Widen the one-verb guard to inflections and drop the last competing English string
CI / full-gate (push) Successful in 2m38s
2026-08-05 00:43:05 +02:00
lilleman
34b668d49f
Use one verb per action in the English UI: sign in, sign out, create account
CI / full-gate (push) Successful in 2m39s
2026-08-05 00:34:05 +02:00
lilleman
46548ae758
Narrow the settings-cog test assertions and record the icon-registry contract
CI / full-gate (push) Successful in 2m37s
Mirror / github-mirror (push) Successful in 6s
2026-08-05 00:20:34 +02:00
lilleman
8f7ab55267
Remove the Settings cog and its Preferences menu from the sidebar footer
CI / full-gate (push) Successful in 2m37s
2026-08-05 00:08:35 +02:00
lilleman
e03c1d1a2f
Let an operator mount plugin catalogs; document the end-user personas
CI / full-gate (push) Successful in 2m37s
2026-08-04 10:31:08 +02:00
lilleman
bd76c981ee
Carry the language through sign-in; warn when switching leaves the page; product-review copy fixes
CI / full-gate (push) Successful in 2m40s
2026-08-04 09:59:00 +02:00
lilleman
37b88b2fe6
Show the language picker on every page, targeting the nearest page that answers GET
CI / full-gate (push) Successful in 2m39s
2026-08-04 09:37:03 +02:00
lilleman
7e4c6940c9
Escape the values interpolated into the one markup-carrying message
CI / full-gate (push) Successful in 2m37s
2026-08-04 00:42:54 +02:00
lilleman
18e1a8d29d
Keep the chrome lazy for error pages, guard the guard-error render, split the recovery link
CI / full-gate (push) Successful in 2m38s
2026-08-04 00:31:19 +02:00
lilleman
93139ea058
Stability round two: no language links on POST-rendered pages, scoped observers, Vary only where it varies
CI / full-gate (push) Successful in 2m37s
2026-08-04 00:10:31 +02:00
lilleman
be3bc2bdbb
Stability fixes: plugin-scoped contexts for owned pages, absent-href guard, checked locale mounts
CI / full-gate (push) Successful in 2m37s
2026-08-03 23:51:40 +02:00
lilleman
2b20497785
Pin the chrome's locale carrying in unit tests; keep one carrier list
CI / full-gate (push) Successful in 2m36s
2026-08-03 23:25:54 +02:00
lilleman
b3df7084c4
Reserve the locale param, carry it on breadcrumbs, translate the permissions detail view
CI / full-gate (push) Successful in 2m38s
2026-08-03 23:21:38 +02:00
lilleman
6440c543e5
Architecture review fixes: partials carry the locale, mountable locales/, shared core words
CI / full-gate (push) Successful in 2m36s
2026-08-03 23:12:18 +02:00
lilleman
245d1ad5b5
Add i18n support: per-locale catalogs, URL-driven locale, translated core and examples
CI / full-gate (push) Successful in 2m37s
2026-08-03 22:37:27 +02:00
lilleman
f38b5373bd
Say user throughout, noting Ory's identity naming in the docs
2026-08-03 17:41:40 +02:00
lilleman
096720904e
Rename the coarse gate from role to permission, matching RBAC
2026-08-03 17:41:40 +02:00
lilleman
3486e0ad00
Rename the Keto User namespace to Identity, matching Kratos
2026-08-03 17:41:40 +02:00
lilleman
8f9f79ac30
Document the users, groups and roles model in README
2026-08-03 17:41:40 +02:00
lilleman
b580f7d06e
Rename the plugin-API permission gate to role
2026-08-03 17:41:40 +02:00
lilleman
5a5803b265
Review fixes: denylist-conditional revoke, Ory secret wiring, exp guard test
2026-08-03 17:41:40 +02:00
lilleman
6f6aafad39
Import ejs as default export — the v6 ESM build exports only default
CI / full-gate (push) Successful in 2m52s
Mirror / github-mirror (push) Successful in 6s
2026-08-02 15:25:51 +02:00
lilleman
175717f04d
Move the docs-only decision into ci.sh so it runs locally
CI / full-gate (push) Successful in 2m33s
2026-08-02 13:38:32 +02:00
lilleman
6c850b8923
Skip the test gate on docs-only branches
CI / full-gate (push) Successful in 2m41s
2026-08-02 13:31:07 +02:00
lilleman
535902e69b
Split handleRequest into pipeline + internal route table; auth/OAuth2 endpoints become named handlers in src/auth/routes.ts
2026-07-02 13:05:54 +02:00
lilleman
e8ea911b80
Move admin screens (users/groups/roles/oauth2-clients) into a drop-in example plugin; add the ctx.system capability surface
2026-07-02 08:01:15 +02:00
lilleman
d8cf257940
Move plugin-contract.md into README's Building plugins section; remove docs/, repoint all references
2026-06-26 23:12:40 +02:00
lilleman
de22f51c12
Organize src/ into concern folders (http, auth, admin, plugin-host, ui); co-locate tests, move plugin-api barrel into plugin-host, sync docs + AGENTS layout
2026-06-24 00:23:55 +02:00
lilleman
913bd6813a
Consolidate E2E into e2e-tests/ (Dockerfile + compose.{visual,auth,oauth,full,devstack}.yml, WORKDIR /e2e-tests); move ci.sh to repo root
2026-06-23 23:48:05 +02:00
lilleman
a9f25a7692
Remove completed todo.md + html-css-foundation mockups; strip dead §N phase refs from comments/docs (simplify visual E2E to drop the mockup-comparison oracle)
2026-06-23 22:49:28 +02:00
lilleman
e22d24aa8a
§10 - one menu everywhere (buildPluginChrome) + shell on every page; instructional starter dashboard; Kratos-native email docs
...
Collapse the three nav builders into buildPluginChrome: chrome.bestHref does longest-prefix matching so deep admin routes mark their leaf. Delete adminNav; buildConfirmModel and the admin model builders take the resolved nav. The same role-filtered sidebar now renders signed in or out, collapsing to a burger on narrow screens.
shell.ejs gains menu (default true; menu:false -> single-column .app-bare), docTitle (separate <title> from the topbar, so the body keeps the single <h1>), and hideSignIn (suppress the footer Sign-in on auth pages to avoid a login loop). auth/home/landing now render inside the shell.
Dashboard is a replaceable instructional starter (definePlugin snippet, no mock data). Email stays delegated to Kratos: documented its built-in courier.template_override_path instead of adding web-side SMTP.
2026-06-23 21:26:00 +02:00
lilleman
af097a8885
Verification/recovery: guard the OTP code field against a pasted space (numeric inputmode + digits-only pattern + one-time-code autofill); Kratos doesn't trim, so a space-padded code was rejected as 'invalid or already used'
2026-06-21 23:26:23 +02:00
lilleman
c8b4c3c23b
Fix 500 on /login when a Kratos session exists but no app JWT (session_already_available)
...
Repro: register a new account, then click back from the password/verification step to /login →
500. Registration's `session` hook signs the user in at Kratos but routes to the verification UI,
not /auth/complete, so they hold a Kratos session with NO app JWT — ctx.user is null, the "already
signed in -> /dashboard" short-circuit can't fire, and initialising a login flow makes Kratos return
400 `session_already_available`. The flow-init catch only handled 403/404/410 and 5xx, so the 400
fell through to `throw` -> catch-all 500.
Recover instead: on `session_already_available` (already authenticated at Kratos), 303 to
/auth/complete to mint the JWT from the live session, preserving return_to. A genuinely unexpected
Kratos 400 still surfaces as 500. Verified live: /login (Kratos session, no JWT) now 303s to
/auth/complete, which mints plainpages_jwt and lands on /dashboard.
Also default LOG_LEVEL to debug in the dev override (compose.override.yml) for verbose local logs.
Tests-first: app.test asserts the session-race recovers to /auth/complete (return_to carried) while
an unrelated 400 stays a 500. typecheck + 361 units green.
2026-06-21 22:04:55 +02:00
lilleman