miloschwartz
ddc4934ab8
make session revalidation private
2026-11-03 16:49:26 -05:00
miloschwartz
8538fff0ef
store metadata on session
2026-11-03 09:56:56 -05:00
Owen
095ca2204f
Resource session page
2026-11-02 15:00:09 -05:00
Owen
8c11260ede
Add resource session tracking page
2026-11-02 14:59:01 -05:00
Milo Schwartz and GitHub
9115808301
Merge pull request #4027 from S-NoF3aR/feature/idp-session-revalidation
...
Revalidate OIDC sessions with the IdP using refresh tokens
2026-10-30 14:44:23 -04:00
miloschwartz
440e874aa1
add toggle to idp settings
2026-10-30 14:07:04 -04:00
miloschwartz
476a41622d
restore in memory coalescing
2026-10-30 11:07:10 -04:00
miloschwartz
36f36d2ca1
address review feedback
2026-10-30 10:56:47 -04:00
Severin Enzler
7176fa4a40
Revalidate OIDC sessions with the IdP using refresh tokens
...
Pangolin consults the IdP only at login and keeps its own session
afterwards, so disabling a user or revoking their sessions in the IdP
does not end their Pangolin sessions.
Store the IdP refresh token at OIDC login as a grant and redeem it at
most every server.idp_session_revalidation_minutes (default 5). If the
IdP rejects it with invalid_grant, the grant is marked revoked and all
sessions backed by it and their resource sessions are deleted. Other
errors (IdP unreachable or slower than 10 seconds, invalid_client after
a secret change) keep the sessions valid and are retried after at most
a minute instead of on every request.
Only the instance holding a lease on the grant in the primary database
redeems its refresh token, and it writes the result only while it still
holds the lease, so instances never redeem the same token concurrently.
The per-request lookup reads from a replica through safeRead.
Device logins of the Pangolin clients share the grant of the browser
session that approved them, read from the primary database, so a rotated
refresh token is never redeemed twice by separate sessions.
The Entra ID provider type hardcodes its scopes, so it now requests
offline_access to get a refresh token.
2026-10-29 11:33:30 +01:00
Owen
cd39f2ecd6
Custom dns records
2026-10-28 11:01:29 -04:00
miloschwartz
89f6748a1b
Merge branch 'dev' into feat/redirect-tables
2026-10-15 11:47:55 -04:00
Owen
cccc2d1200
Merge branch 'mtls' into dev
2026-10-12 16:25:25 -04:00
Owen
bc2920af23
Support machine clients added to roles
2026-10-01 15:58:25 -04:00
Owen
37ed8997f2
Add fist pass of mtls support
2026-09-24 16:56:57 -04:00
Fred KISSIE
ae7315244f
🗃️ create DB models
2026-09-10 00:17:36 +02:00
Milo Schwartz and GitHub
bb824a7070
Merge pull request #3541 from fosrl/feat/test-alert-button
...
Feat: test alert rules
2026-08-19 10:33:16 -04:00
miloschwartz
e580c7db7c
use pangolin-key prefix for virtual api keys
2026-08-13 15:22:18 -04:00
miloschwartz
49020fa6ea
add virtual api key validation in verifySession
2026-08-12 10:38:26 -04:00
miloschwartz
1e3a9fb921
add virtual api key schema and crud endpoints
2026-08-10 17:20:06 -04:00
Owen
0050fad70d
add basic crud for ai budgets
2026-08-10 11:05:10 -04:00
Fred KISSIE
6689a8d93e
🚧 wip: test alert rule
2026-08-07 19:05:28 +02:00
Owen
f7689b7a5a
Endpoints to update models on the resource
2026-08-04 10:15:49 -04:00
miloschwartz and Owen
694fe98131
add crud for providers and models
2026-08-04 10:15:48 -04:00
miloschwartz
a8f3f71021
add reject endpoint
2026-07-12 17:48:48 -04:00
Owen
67a3d226f5
Add session creation
2026-07-08 21:17:40 -04:00
Owen Schwartz and GitHub
2a478eef6f
Merge pull request #3375 from fosrl/resource-launcher
...
Resource launcher
2026-07-01 21:19:19 -04:00
Owen
61fc2e5ea7
Fix restartSite import
2026-07-01 14:48:36 -04:00
miloschwartz
297fd2caf3
standardize permissions in api
2026-07-01 11:26:14 -04:00
miloschwartz
6fe4eee336
improve org policy error message responses
2026-06-24 16:32:58 -04:00
Owen
471ae98204
Pull roles from resource policies
...
Fixes #3256
2026-06-12 14:12:01 -07:00
Owen
b6d688f15e
Support pin,pass,whitelist correctly on login
2026-06-01 21:34:39 -07:00
Owen
f8a757c55f
Merge branch 'resource-policies' into dev
2026-05-28 15:30:16 -07:00
Owen
23ca3efbf4
Merge branch 'dev' into rdp-ssh
2026-05-19 20:12:05 -07:00
Owen
0938997548
Add crud for browser targets
2026-05-19 20:02:27 -07:00
Fred KISSIE
173562654b
✨ delete org label endpoint
2026-05-14 21:09:48 +02:00
Fred KISSIE
1831ca4e75
♻️ detach label from site/resoirce
2026-05-08 00:33:47 +02:00
Fred KISSIE
0d04cc365f
✨ attach label to item
2026-05-05 21:35:10 +02:00
Fred KISSIE
3253d60900
🚧 Add CRUD endpoints and tables for labels
2026-05-05 20:53:16 +02:00
Owen
5922bfb1a0
Fix API endpoint action issues
2026-05-04 16:01:40 -07:00
Owen
660197eef1
Merge branch 'feat/resource-policies' into resource-policies
2026-05-04 14:40:44 -07:00
Owen
93b09de425
Adjust cloud api endpoints
2026-04-29 21:04:11 -07:00
Owen
85334f082c
Only support alerts and newt sync on saas
2026-04-27 18:20:30 -07:00
Owen
1a0bde2ee9
Merge branch 'alerting-rules' into trial
2026-04-21 14:57:25 -07:00
Owen
6969671fc4
Log status inside of the trigger api calls
2026-04-21 14:04:38 -07:00
Owen
55989c2019
Add trial system
2026-04-18 13:40:50 -07:00
Owen
1397e61643
Create hcs freely
2026-04-15 20:32:02 -07:00
Owen
5e505224d0
Basic ui is working
2026-04-15 15:26:27 -07:00
Owen
87a554b6ef
Add crud
2026-04-15 14:33:55 -07:00
Owen
ca0dd09964
Add crud
2026-03-30 20:35:00 -07:00
Owen
9dc9b6a2c3
Merge branch 'logging-provision' into dev
2026-03-29 13:59:14 -07:00
miloschwartz
Owen
Severin Enzler
Fred KISSIE