Paul Nothaft a607cea110 fix(auth): issuer-tag the oversize SSO logout marker (#798) (#1010) ...

Phase 3 validated a stored ID token hint against the currently configured issuer, but the oversize path never got that check: an ID token above the 3.9KB cookie limit was stored as the bare string 'sso', which collapsed to an undefined hint at logout and skipped validation entirely. Changing the issuer while such a session was live bounced the user to the new IdP on logout.

Stores sso.<base64url(issuer)> instead and moves all marker interpretation into buildEndSessionUrl: raw ID token -> iss/aud-validated hint, issuer-tagged marker -> round-trip without a hint, anything else -> no round-trip. Every branch fails closed.

Refs #798.

2026-08-10 09:14:56 +02:00

..

helpers

feat(auth): OIDC logout-to-IdP — phase 3 (#798) (#865)

2026-07-24 11:42:09 +02:00

adminBackupCoverage.test.js

fix(tests): raise jest timeouts to survive the growing migration chain (#860)

2026-07-22 21:27:12 +02:00

adminBackupIntegrity.test.js

fix(tests): raise jest timeouts to survive the growing migration chain (#860)

2026-07-22 21:27:12 +02:00

adminPhotos.reference.test.js

Fix admin reference mode regressions

2025-10-02 23:39:17 +02:00

backup-s3.test.js

fix(backup): incremental backups against S3 + jsonb stats parsing

2026-04-28 10:52:49 +02:00

backupSecretMasking.test.js

fix(security): close GHSA-g94x (cross-gallery photo read) + GHSA-pv6w (admin DB export) (#924)

2026-07-30 14:24:28 +02:00

backupService.businessDocs.test.js

fix(backup): include storage/business-docs/ in the in-app backup walker

2026-05-29 12:50:02 +02:00

backupService.configurableWalker.test.js

fix(backup): make backup settings actually apply (#871) (#874)

2026-07-27 09:06:38 +02:00

backupService.inlineDbDump.test.js

fix(tests): raise jest timeouts to survive the growing migration chain (#860)

2026-07-22 21:27:12 +02:00

backupService.perPathStats.test.js

fix(tests): raise jest timeouts to survive the growing migration chain (#860)

2026-07-22 21:27:12 +02:00

backupService.smoke.test.js

fix(tests): raise jest timeouts to survive the growing migration chain (#860)

2026-07-22 21:27:12 +02:00

bookingCutover.test.js

fix(tests): raise jest timeouts to survive the growing migration chain (#860)

2026-07-22 21:27:12 +02:00

categoryReorder.test.js

fix(tests): raise jest timeouts to survive the growing migration chain (#860)

2026-07-22 21:27:12 +02:00

crmMintPaths.test.js

test(crm): mint-path integration tests — quote send, invoice storno, contract countersign (#850)

2026-07-19 22:36:38 +02:00

crmSchema.test.js

test(crm): integration harness + schema-shape regression net

2026-05-26 19:50:57 +02:00

discountLineItems.test.js

fix(tests): raise jest timeouts to survive the growing migration chain (#860)

2026-07-22 21:27:12 +02:00

emailTemplateBoot.test.js

fix(crm): self-heal missing CRM email templates at boot + recover queue

2026-05-27 15:18:29 +02:00

eventTypeDefaults.test.js

fix(event-types): un-hardcode event type dependencies in v1 API and CRM (#800)

2026-07-15 22:31:28 +02:00

eventTypeRename.test.js

fix(tests): raise jest timeouts to survive the growing migration chain (#860)

2026-07-22 21:27:12 +02:00

eventTypeSetupWindow.test.js

refactor: move v1 API + CRM event-type un-hardcoding to a follow-up PR

2026-07-15 22:30:00 +02:00

galleryPasswordSanitize.test.js

fix(gallery): block password form in Instagram in-app browser and unmask login errors (#863)

2026-07-23 21:45:07 +02:00

galleryShortUrlRoute.test.js

fix(tests): raise jest timeouts to survive the growing migration chain (#860)

2026-07-22 21:27:12 +02:00

galleryShortUrls.test.js

fix(tests): raise jest timeouts to survive the growing migration chain (#860)

2026-07-22 21:27:12 +02:00

imageProcessor.storage.test.js

feat(lightbox): medium-resolution preview tier (#492)

2026-05-14 22:30:39 +02:00

incomingInvoiceRebill.test.js

fix(tests): raise jest timeouts to survive the growing migration chain (#860)

2026-07-22 21:27:12 +02:00

installFromBackupBoot.test.js

fix(tests): raise jest timeouts to survive the growing migration chain (#860)

2026-07-22 21:27:12 +02:00

invoiceDunning.test.js

fix(tests): raise jest timeouts to survive the growing migration chain (#860)

2026-07-22 21:27:12 +02:00

oidcLogout.test.js

fix(auth): issuer-tag the oversize SSO logout marker (#798) (#1010)

2026-08-10 09:14:56 +02:00

oidcRoleMappingPolicy.test.js

feat(auth): OIDC role mapping + login policy — phase 2 (#798) (#854)

2026-07-22 20:59:19 +02:00

oidcSso.test.js

fix(oidc): local-credential lockout, session hydration, split-origin gaps (codex round 3)

2026-07-16 10:07:59 +02:00

picpeakExport.test.js

fix(tests): raise migration-boot hook timeout pins to the 120s default (#900)

2026-07-29 12:38:26 +02:00

picpeakRestorePg.test.js

feat(security): harden .picpeak restore robustness — sessions, roles, sequences

2026-07-16 12:56:34 +02:00

picpeakRoundtrip.test.js

fix(tests): raise migration-boot hook timeout pins to the 120s default (#900)

2026-07-29 12:38:26 +02:00

rebillProofAndPanel.test.js

feat(accounting): re-bill proof attachment, CRM panel & hours↔re-bills cross-add (#979)

2026-08-03 22:03:31 +02:00

resetAdminMfaCli.test.js

fix(tests): raise migration-boot hook timeout pins to the 120s default (#900)

2026-07-29 12:38:26 +02:00

restoreService.pgBranch.test.js

fix(security): close 5 Trivy alerts — postcss/tar bumps + drop npm from the runtime image (#878)

2026-07-27 09:54:33 +02:00

revealMode.test.js

feat(gallery): admin preview skips the password on protected galleries (#981)

2026-08-04 16:48:07 +02:00

setupService.test.js

fix(tests): raise migration-boot hook timeout pins to the 120s default (#900)

2026-07-29 12:38:26 +02:00

sqliteEpochTimestamps.test.js

fix(dates): normalize SQLite epoch timestamps at remaining API surfaces (#485 follow-up) (#857)

2026-07-22 21:07:32 +02:00

storageBackend.test.js

feat: native S3 storage backend (#328) + presigned download follow-up

2026-04-28 10:06:36 +02:00

webhookDelivery.test.js

feat: outbound webhooks for event/photo lifecycle (#327)

2026-04-28 10:07:39 +02:00

workflowEngine.test.js

fix(tests): raise jest timeouts to survive the growing migration chain (#860)

2026-07-22 21:27:12 +02:00

workflowRoutes.test.js

fix(tests): raise jest timeouts to survive the growing migration chain (#860)

2026-07-22 21:27:12 +02:00