erabo/odysseus
1
0
Fork 0
mirror of https://github.com/pewdiepie-archdaemon/odysseus.git synced 2026-10-11 08:27:41 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
odysseus/core
History
holden093 f75e4bd68d fix(oidc): address review items — aud arrays, JWKS cache, alg pinning, redirect_uri, stateless state, first-user-admin 
1. aud validation: handle JSON array audiences per OIDC spec (check
   membership, validate azp for multi-audience tokens).
2. JWKS caching: cache keys after first fetch; refresh only on unknown
   kid — avoids live IdP round-trip on every login.
3. Algorithm pinning: restrict to RS256/ES256/etc from discovery doc,
   never allow HS256 or 'none'.
4. OIDC_REDIRECT_URI: support a fixed redirect URI (proxy-safe,
   doesn't trust Host header).
5. Stateless state: replace in-memory dict with Fernet-encrypted state
   tokens — works across multiple uvicorn workers/processes.
6. OIDC_FIRST_USER_IS_ADMIN: bootstrap first OIDC user as admin when
   no users exist and OIDC_ADMIN_GROUPS is unset — prevents zero-admin
   lockout.
2026-07-25 18:32:56 +02:00
..
__init__.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
atomic_io.py Reject non-string atomic text writes (#1819) 2026-06-29 14:36:21 +01:00
auth.py fix(oidc): address review items — aud arrays, JWKS cache, alg pinning, redirect_uri, stateless state, first-user-admin 2026-07-25 18:32:56 +02:00
constants.py refactor(constants): single source of truth for data dir (#3368) 2026-06-08 09:58:52 +02:00
database.py fix(db): restrict data/app.db to 0600 (#4420) 2026-07-11 21:15:49 +02:00
exceptions.py refactor(exceptions): dedupe src/exceptions via core re-export (#4785) 2026-06-24 16:50:07 +02:00
log_safety.py fix(security): redact credential-bearing URLs and PII from logs (#4750) 2026-06-22 23:12:39 +02:00
middleware.py Show thumbnails on past research cards 2026-06-30 08:00:01 +00:00
models.py fix: session context drifting — messages leaking between chats (#135) (#267) 2026-06-09 14:12:52 +01:00
oidc.py fix(oidc): address review items — aud arrays, JWKS cache, alg pinning, redirect_uri, stateless state, first-user-admin 2026-07-25 18:32:56 +02:00
platform_compat.py fix(platform): read proc version with utf-8 2026-06-11 21:58:22 +01:00
session_manager.py Merge verified Odysseus fixes 2026-07-23 14:49:02 +00:00