Paul Nothaft a607cea110 fix(auth): issuer-tag the oversize SSO logout marker (#798) (#1010) ...

Phase 3 validated a stored ID token hint against the currently configured issuer, but the oversize path never got that check: an ID token above the 3.9KB cookie limit was stored as the bare string 'sso', which collapsed to an undefined hint at logout and skipped validation entirely. Changing the issuer while such a session was live bounced the user to the new IdP on logout.

Stores sso.<base64url(issuer)> instead and moves all marker interpretation into buildEndSessionUrl: raw ID token -> iss/aud-validated hint, issuer-tagged marker -> round-trip without a hint, anything else -> no round-trip. Every branch fails closed.

Refs #798.

2026-08-10 09:14:56 +02:00

..

__tests__

fix(auth): issuer-tag the oversize SSO logout marker (#798) (#1010)

2026-08-10 09:14:56 +02:00

assets/fonts

feat(events): gallery QR code + printable table-card/poster PDFs (#847)

2026-07-19 22:35:44 +02:00

docs

…

migrations

feat(transfers): add PicTransfer — cross-event file transfers (#998)

2026-08-09 13:40:03 +02:00

scripts

feat(auth): admin TOTP MFA — enrollment, login challenge, recovery, CLI reset

2026-07-03 11:33:38 +02:00

src

fix(auth): issuer-tag the oversize SSO logout marker (#798) (#1010)

2026-08-10 09:14:56 +02:00

.dockerignore

chore(backend): ignore runtime storage in git/docker, remove dead getSafeFilename

2026-07-19 00:40:53 +02:00

.env.example

fix(file-watcher): bound concurrent photo processing (#846)

2026-07-19 22:00:46 +02:00

.eslintrc.js

…

audit-backend.json

…

dependencies-backend.json

Upgrade nodemailer to 7.0.7 (GHSA-mm7p-fcc7-pg87)

2025-10-13 21:11:38 +02:00

Dockerfile

fix(security): close 5 Trivy alerts — postcss/tar bumps + drop npm from the runtime image (#878)

2026-07-27 09:54:33 +02:00

Dockerfile.dev

fix(uploads): RAW derivative key collision, watermark skip, dev exiftool (codex review of #833 round 2)

2026-07-17 22:50:24 +02:00

ecosystem.config.js

…

jest.config.js

fix(tests): raise jest timeouts to survive the growing migration chain (#860)

2026-07-22 21:27:12 +02:00

jest.setup.js

feat: overhaul public landing page and backup tooling

2025-09-19 16:39:18 +02:00

knexfile.js

Fix PicPeak regressions and close #22 #24 #25 #26 #27 #28

2025-09-21 22:03:07 +02:00

package-lock.json

fix(deps): bump ip-address, brace-expansion and postcss for open CVEs (#987)

2026-08-04 14:35:57 +02:00

package.json

chore(main): release 3.101.2-beta.0 (#1009)

2026-08-10 06:30:01 +00:00

server.js

feat(transfers): add PicTransfer — cross-event file transfers (#998)

2026-08-09 13:40:03 +02:00

test-filter.js

docs: fix deployment/admin routing and CORS guidance; add AGENTS.md; ignore AGENTS.md (refs #18)

2025-09-05 15:01:16 +02:00

wait-for-db.sh

fix(security): close 5 Trivy alerts — postcss/tar bumps + drop npm from the runtime image (#878)

2026-07-27 09:54:33 +02:00