45 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
lyra	cb378e20bc	chore: add php-cs-fixer with PSR-12 config and CI check ... - Add friendsofphp/php-cs-fixer to require-dev - Create .php-cs-fixer.dist.php configured for @PSR12 ruleset - Add php-cs-fixer dry-run step to CI pipeline - Auto-fix existing PSR-12 violations - Document code style tooling in readme.md	2026-08-11 08:30:05 -04:00
lyra	6b5a711fa9	Fix docs, add .dockerignore, fix base64url padding, fix typo ... - Add .dockerignore to exclude .git, vendor, var, tests, docs, .env and other non-build files from Docker context - Fix broken base64url padding in src/Data/Payload.php: str_pad was a no-op because the length argument was always < string length. Replaced with correct str_repeat approach - Fix typo in bin/franken.sh: digtialadapt → digitaladapt - Add comment to bin/franken.sh noting it's a dev utility - Remove config/reference.php from git tracking (auto-generated file) and add to .gitignore - Fix readme.md: env.example → example.env (matches actual filename)	2026-08-10 18:55:19 -04:00
andrew	95ab77db2a	added roadmap for where we are aiming to take this project	2026-08-07 09:25:56 -04:00
andrew	d6bcbf661e	Merge pull request 'Add PHPUnit test suite — 222 tests, 100% code coverage' (#1) from Lyra into main ... First AI contribution to main branch, a full suite of tests, thank you GLM-5.2. 0.9.0	2026-08-07 09:13:16 -04:00
lyra	de2a382cbf	Add Gitea workflow to run test suite on push and PR	2026-08-07 09:06:32 -04:00
lyra	12ba6cde7b	Add unit tests for untested edge cases and code paths ... PayloadTest: - decode() with invalid JSON, JSON array, null, boolean, number - load() with all fields present but empty strings - create() with invalid scope string (falls back to cookie) - create() with missing json property (defaults to true) DomainManagerTest: - TLD table coverage: com.au, co.jp, com.br, co.nz, com.mx, co.in, br.com - Single-label host matching behavior - Empty string host - validReturn with URL containing port, without path, different domain with port MakeNonceTraitTest: - Retry-then-succeed path (first attempt collides, second succeeds) - Zero retries throws immediately on collision StringTraitTest: - Only invalid characters collapses to single underscore - Exactly 128 characters boundary - Multibyte characters (é, ö) replaced with underscore - Emoji replaced with underscore GetTotpTraitTest: - HOTP URI triggers HttpException(500) via instanceof check LoginManagerTest: - ULID collision throws HttpException(500) - Central auth cookie sets domain on matching host (uses auth cookie name) - Central auth cookie uses null domain on non-matching host - Empty return parameter falls back to request path BackupCodeManagerTest: - Empty string code returns false - Code with value false (consumed) verified via cache state - Generated codes are unique (50 codes) - Code length equals TOTP digits + 2 MonitorCacheKeysTest: - saveDeferred on __key_list and __chg_list throws OutOfBoundsException - getKeys returns empty when key list is lost - deleteItem/deleteItems return true assertions PersistCacheTest: - Mixed updates and removals in same persist cycle - Multiple boot-modify-persist cycles with interleaved modifications	2026-08-06 06:10:31 -04:00
lyra	6c5a7c98e8	Fix failing functional tests and add test infrastructure ... - Add TestKernel that removes the kernel.reset tag from nonceCache, rateLimitCache, sessionCache and sessionStorage pools so in-memory state survives across requests within a single test (mirroring APCu persistence in production) - Add config/packages/test/ with array cache adapters and test session config - Set fixed TOTP secret (JBSWY3DPEHPK3PXP) and high rate limits in phpunit.dist.xml and .env.test so functional tests can compute valid codes and are not rate-limited - Make Kernel non-final so TestKernel can extend it - Fix testFailedLoginWithSpentNonceIsRejected and testConsumedBackupCodeCannotBeReused: clear the CookieJar between sub-requests so a session cookie set by a prior successful login does not auto-authenticate the next request via AcceptListener before the nonce/backup-code path is exercised	2026-08-06 06:07:14 -04:00
lyra	4d314bcb28	Add unit tests for all listeners, the backup-codes command, and test support helpers ... - Add ListenerTestHelper providing a real Twig Environment pointed at the project templates and configurable RateLimiterFactoryInterface doubles (fixed-remaining and counting variants) - Add AcceptListenerTest: valid cookie session (host & auth-subdomain cookie names), missing/empty cookie, no session - Add AllowListenerTest: valid IP session, missing session, IP access disabled - Add RejectListenerTest: blocked -> teapot / too-many-requests, unblocked, error template content - Add InterceptListenerTest: central-auth redirect, login page rendering, post form on auth subdomain, invalid-cookie pruning (host & auth cookies) - Add LoginListenerTest: no-login early return, successful login via header and via POST to auth subdomain, failed login (json/html), rate-limited (teapot/too-many), invalid payload handling - Add GenerateBackupCodesCommandTest: default/specific count, default argument is 10, boot+persist invocation, zero codes, name & description configuration - Fix MakeNonceTraitTest nonce cache lookups to use makeCacheKey() (was flaky when random nonce contained '-')	2026-08-05 16:55:28 -04:00
lyra	890cc225ef	Add PHPUnit test suite and supporting infrastructure ... - Add phpunit/phpunit ^13.2, symfony/browser-kit and symfony/css-selector to require-dev, plus the autoload-dev mapping for App\Tests- Add phpunit.dist.xml (strict deprecation/notice/warning failures, APP_ENV=test forced) and .env.test / bin/phpunit / tests/bootstrap.php from the PHPUnit recipe - Add tests/Support/TotpTestHelper providing a deterministic TOTP fixture, frozen clock and ConfigBag/cache-pool helpers - Add 121 unit tests covering Clock, ConfigBag, Data/Payload, Enum/Scope, MonitorCacheKeys, PersistCache, Utilities, all five Traits and the three Service managers (BackupCode, Domain, Login) - Fix LoginManagerTest nonce lookups to use makeCacheKey() so the cache key matches the one the manager actually reads/writes - Gitignore bin/.phpunit.result.cache	2026-08-05 16:52:44 -04:00
andrew	3c1253ee45	Merge branch 'develop' 0.8.1	2026-06-17 13:27:48 -04:00
andrew	70bf811b1d	gitea action cleanup	2026-06-17 10:55:26 -04:00
andrew	3269151e9b	new workflow to build and push to docker hub	2026-06-14 18:27:32 -04:00
andrew	1da2188bdf	Gitea action to sync to GitHub	2026-06-13 21:28:59 -04:00
andrew	7cf7e04d17	extracted interfaces for services, to aid in creating tests	2026-06-05 15:15:21 -04:00
andrew	0813323ac2	renamed form fields to work better with password managers; fixed bug where an invalid login requests were not being counted as login attempts; preserve username when using central auth 0.8.0	2026-06-01 16:28:57 -04:00
andrew	9114cfd96f	update to php 8.5, backup codes, etc. ... modified: Dockerfile modified: composer.json modified: composer.lock modified: config/packages/twig.yaml modified: config/services.yaml modified: docs/Caddyfile modified: docs/compose.yaml renamed: docs/env.example -> docs/example.env modified: public/index.php modified: readme.md modified: src/Command/GenerateBackupCodesCommand.php modified: src/ConfigBag.php modified: src/Data/Payload.php modified: src/Enum/Scope.php modified: src/Listener/AcceptListener.php modified: src/Listener/AllowListener.php modified: src/Listener/InterceptListener.php modified: src/Listener/LoginListener.php modified: src/MonitorCacheKeys.php modified: src/PersistCache.php modified: src/Service/BackupCodeManager.php modified: src/Service/DomainManager.php new file: src/Service/LoginManager.php modified: src/Trait/CookieNameTrait.php modified: src/Trait/GetTotpTrait.php modified: src/Trait/MakeNonceTrait.php modified: src/Trait/StringTrait.php modified: src/Utilities.php modified: templates/_script.html.twig modified: templates/_style.html.twig modified: templates/base.html.twig modified: templates/login.html.twig	2026-05-29 21:56:42 -04:00
andrew	43e9b7136e	auth subdomain tentatively complete. ... All domain logic moved into service.	2026-05-22 12:43:02 -04:00
andrew	38124ef66c	First draft of backup codes. only created when the command is called. no command yet to expire/review codes. ... Also added a few safeguards against excessively long user input. Started on ability to redirect to auth subdomain (incomplete).	2026-05-21 12:15:35 -04:00
andrew	6ed1ab26f1	cache persistence improvement, only update keys which have changed. More efficient, and less likely to cause race conditions. 0.7.0	2026-03-12 17:15:49 -04:00
andrew	a0dc1a6049	rate-limiting update, now using a compound sliding-window. Continuing to move over to using traits more, and other code cleanup.	2026-03-11 08:27:27 -04:00
andrew	3d28485921	Removal of static-secret and totp-lookup. ... Intending to build support for single-use backup codes. Started refactoring to move trait dependencies internally, so that classes only have to specify their own direct dependencies.	2026-03-09 16:22:32 -04:00
andrew	27394ae555	v0.6.0 optional lookup for totp by static password v0.6.0	2026-02-10 13:31:09 -05:00
andrew	c235aad941	single column if narrow enough v0.5.0	2026-01-17 14:02:23 -05:00
andrew	b61400085a	frontend support for password	2026-01-17 10:57:57 -05:00
andrew	4a543f45ca	minor nonce related cleanup	2026-01-16 12:17:18 -05:00
andrew	4cec5a5963	added project history	2025-12-28 11:14:59 -05:00
andrew	c3fbb12842	updating readme	2025-12-28 10:38:46 -05:00
andrew	ac817649ab	fixed bug which can occur if you delete cache files. ... fixed warnings due to volume locations. v0.4.1	2025-12-26 21:17:36 -05:00
andrew	1c4c289d81	massive rewrite to switch to using listeners instead of controller, header for login payload instead of get request, removed icon system, asset system, was able to remove all the domain processing, enhanced cookie security, and more. v0.4.0	2025-12-23 11:24:47 -05:00
andrew	b36aabb8a3	WIP: nearly done switching to using header instead of url parameters	2025-12-18 19:20:50 -05:00
andrew	f486ab7481	already accepted/rejected are now listeners to start cleaning up the massive controller of doom	2025-12-17 15:25:07 -05:00
andrew	a73d039e10	removed maker-bundle, switching to apcu	2025-12-16 22:34:57 -05:00
andrew	102b9f3e78	Full code refactor to Symfony7.4 with FrankenPHP ... Includes significant breaking changes. Default port and transportation changed to http via port 80 Names of environment variables have changed. v0.3.0	2025-12-15 12:30:14 -05:00
andrew	f5a5d63eb7	finished adding rate limiting v0.2.0	2025-12-03 11:05:32 -05:00
andrew	f60a81e259	tentatively added rate limiting, block by IP if too many failed login attempts	2025-12-02 22:16:56 -05:00
andrew	3bb2d9cecd	new page for client error (too many requests).. work in progress	2025-12-01 22:47:36 -05:00
andrew	5ebfad604f	method in snippet is required	2025-12-01 11:51:08 -05:00
andrew	e34645eeaa	fixed a typo	2025-11-20 11:21:53 -05:00
andrew	1f5e4847ca	fix typo	2025-11-19 10:43:10 -05:00
andrew	91bb67da51	example docker compose	2025-11-19 10:42:13 -05:00
andrew	9d4dae4a93	added MIT license v0.1.0	2025-11-14 15:31:23 -05:00
andrew	b8ebbd95e6	Added a readme	2025-11-14 15:25:29 -05:00
andrew	40a98c0e72	bugfix, only use url reutrn-to parameter if not empty	2025-11-12 16:30:26 -05:00
andrew	e27d393165	PREAUTH_SEND_TO environment variable, to set a default redirection after authenticating	2025-11-12 16:17:04 -05:00
andrew	25186c3aa9	initial commit	2025-11-12 15:15:30 -05:00