Commit Graph

196 Commits

Author SHA1 Message Date
BilalG1
61d0adb7a5
Send email route and notification settings page (#717) 2025-07-01 19:17:53 -07:00
Zai Shi
dfae043457
Fix redirect uri error message (#682)
<!--

Make sure you've read the CONTRIBUTING.md guidelines:
https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md

-->

<!-- ELLIPSIS_HIDDEN -->


----

> [!IMPORTANT]
> Update error message for invalid redirect URIs in OAuth callback
handler and adjust tests accordingly.
> 
>   - **Behavior**:
> - In `route.tsx`, change error handling for invalid redirect URIs to
throw `StatusError` with message: "Invalid redirect URI. You might have
set the wrong redirect URI in the OAuth provider settings. (Please copy
the redirect URI from the Stack Auth dashboard and paste it into the
OAuth provider's dashboard)".
>   - **Tests**:
> - Update `callback.test.ts` to expect new error message for untrusted
redirect URL case.
> 
> <sup>This description was created by </sup>[<img alt="Ellipsis"
src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup>
for 00c68bc708. You can
[customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this
summary. It will automatically update as commits are pushed.</sup>


<!-- ELLIPSIS_HIDDEN -->

---------

Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>
2025-07-02 01:12:10 +00:00
Zai Shi
9f79485410
Fix redirect url (#703)
Some checks failed
all-good: Did all the other checks pass? / all-good (push) Has been cancelled
Ensure Prisma migrations are in sync with the schema / check_prisma_migrations (22.x) (push) Has been cancelled
Docker Emulator Test / docker (push) Has been cancelled
Docker Server Build and Push / Docker Build and Push Server (push) Has been cancelled
Docker Server Test / docker (push) Has been cancelled
Runs E2E API Tests / build (22.x) (push) Has been cancelled
Lint & build / lint_and_build (latest) (push) Has been cancelled
Dev Environment Test / restart-dev-and-test (push) Has been cancelled
Run setup tests / setup-tests (push) Has been cancelled
TOC Generator / TOC Generator (push) Has been cancelled
<!--

Make sure you've read the CONTRIBUTING.md guidelines:
https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md

-->

<!-- ELLIPSIS_HIDDEN -->


----

> [!IMPORTANT]
> Adds redirect URL validation in sign-up process and updates test URL
to localhost.
> 
>   - **Behavior**:
> - Adds `validateRedirectUrl` check in `POST` handler in `route.tsx` to
ensure `verificationCallbackUrl` is whitelisted.
>     - Throws `RedirectUrlNotWhitelisted` error if URL is not valid.
>   - **Tests**:
> - Updates `verificationCallbackUrl` in `scaffoldProject` in
`js-helpers.ts` to `http://localhost:3000`.
> 
> <sup>This description was created by </sup>[<img alt="Ellipsis"
src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup>
for f25e26b9d3. You can
[customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this
summary. It will automatically update as commits are pushed.</sup>


<!-- ELLIPSIS_HIDDEN -->

---------

Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>
2025-06-27 04:00:12 +02:00
Zai Shi
8139ee926b
Added error logs for team member update (#706)
<!--

Make sure you've read the CONTRIBUTING.md guidelines:
https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md

-->

<!-- ELLIPSIS_HIDDEN -->

----

> [!IMPORTANT]
> Added error handling for team member updates and contact channel
verification, with corresponding tests.
> 
>   - **Error Handling**:
> - In `verification-code-handler.tsx`, added `StatusError` for missing
contact channels during email verification.
> - In `crud.tsx`, wrapped `teamMember.update` in a try-catch to log
errors with `StackAssertionError` if update fails.
>   - **Testing**:
> - Updated `users.test.ts` to test team selection updates, ensuring
correct team ID is set or unset.
> 
> <sup>This description was created by </sup>[<img alt="Ellipsis"
src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup>
for b024f7ba3e. You can
[customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this
summary. It will automatically update as commits are pushed.</sup>

<!-- ELLIPSIS_HIDDEN -->

---------

Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
2025-06-27 02:20:08 +02:00
BilalG1
71c35fd672
added cron job to for daily failed email digest (#714)
Some checks failed
all-good: Did all the other checks pass? / all-good (push) Has been cancelled
Ensure Prisma migrations are in sync with the schema / check_prisma_migrations (22.x) (push) Has been cancelled
Docker Emulator Test / docker (push) Has been cancelled
Docker Server Build and Push / Docker Build and Push Server (push) Has been cancelled
Docker Server Test / docker (push) Has been cancelled
Runs E2E API Tests / build (22.x) (push) Has been cancelled
Lint & build / lint_and_build (latest) (push) Has been cancelled
Preview Docs / run (push) Has been cancelled
Dev Environment Test / restart-dev-and-test (push) Has been cancelled
Run setup tests / setup-tests (push) Has been cancelled
TOC Generator / TOC Generator (push) Has been cancelled
Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>
2025-06-17 15:38:09 -07:00
Madison
2d42f44483
Now allows user to update primary_email_auth_enabled to false via API (#697)
Some checks failed
all-good: Did all the other checks pass? / all-good (push) Has been cancelled
Ensure Prisma migrations are in sync with the schema / check_prisma_migrations (22.x) (push) Has been cancelled
Docker Emulator Test / docker (push) Has been cancelled
Docker Server Build and Push / Docker Build and Push Server (push) Has been cancelled
Docker Server Test / docker (push) Has been cancelled
Runs E2E API Tests / build (22.x) (push) Has been cancelled
Lint & build / lint_and_build (latest) (push) Has been cancelled
Preview Docs / run (push) Has been cancelled
Dev Environment Test / restart-dev-and-test (push) Has been cancelled
Run setup tests / setup-tests (push) Has been cancelled
TOC Generator / TOC Generator (push) Has been cancelled
<!--

Make sure you've read the CONTRIBUTING.md guidelines:
https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md

-->

<!-- ELLIPSIS_HIDDEN -->


----

> [!IMPORTANT]
> Allows `primary_email_auth_enabled` to be set to `false` via API,
fixing previous issue, with tests verifying behavior.
> 
>   - **Behavior**:
> - Allows `primary_email_auth_enabled` to be set to `false` in
`crud.tsx` by using nullish coalescing operator.
> - Updates `usedForAuth` field in `contactChannel` when
`primary_email_auth_enabled` changes without email change.
>   - **Tests**:
> - Adds tests in `users.test.ts` to verify disabling and re-enabling
`primary_email_auth_enabled`.
> - Tests cover both specific user updates and current user updates via
`/me` endpoint.
> 
> <sup>This description was created by </sup>[<img alt="Ellipsis"
src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup>
for b4b5354bcd. You can
[customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this
summary. It will automatically update as commits are pushed.</sup>


<!-- ELLIPSIS_HIDDEN -->

---------

Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>
2025-06-02 14:50:14 -05:00
Zai Shi
d100033e79 rename back
Some checks failed
all-good: Did all the other checks pass? / all-good (push) Has been cancelled
Ensure Prisma migrations are in sync with the schema / check_prisma_migrations (22.x) (push) Has been cancelled
Docker Emulator Test / docker (push) Has been cancelled
Docker Server Build and Push / Docker Build and Push Server (push) Has been cancelled
Docker Server Test / docker (push) Has been cancelled
Runs E2E API Tests / build (22.x) (push) Has been cancelled
Lint & build / lint_and_build (latest) (push) Has been cancelled
Preview Docs / run (push) Has been cancelled
Dev Environment Test / restart-dev-and-test (push) Has been cancelled
Run setup tests / setup-tests (push) Has been cancelled
TOC Generator / TOC Generator (push) Has been cancelled
Update pull request branches / Update pull request branches (push) Has been cancelled
2025-05-26 14:08:50 -07:00
Zai Shi
a16589e469 Refactor project integration identifiers from externalProjectId to clientId across the backend, including environment configuration, database schema, and API endpoints. Update test cases to reflect these changes for both custom and Neon integrations. 2025-05-26 13:03:30 -07:00
Zai Shi
16e14240bf
General project provisioning (#694)
<!--

Make sure you've read the CONTRIBUTING.md guidelines:
https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md

-->

<!-- ELLIPSIS_HIDDEN -->


----

> [!IMPORTANT]
> This pull request adds support for custom integrations alongside Neon,
including environment updates, database schema changes, new API
endpoints, and comprehensive tests.
> 
>   - **Environment**:
> - Renamed `STACK_NEON_INTEGRATION_CLIENTS_CONFIG` to
`STACK_INTEGRATION_CLIENTS_CONFIG` in `.env.development`.
> - Added `custom-local` client configuration to
`STACK_INTEGRATION_CLIENTS_CONFIG`.
>   - **Database**:
> - Renamed `NeonProvisionedProject` table to `ProvisionedProject` and
updated related constraints and columns in `migration.sql`.
>     - Updated `schema.prisma` to reflect table and column renames.
>   - **API Endpoints**:
>     - Added CRUD operations for custom domains in `domains/`.
> - Implemented OAuth authorization and token exchange for custom
integrations in `oauth/`.
> - Added project provisioning and transfer endpoints for custom
integrations in `projects/`.
>   - **IDP**:
> - Updated `createOidcProvider` to handle both Neon and custom
integrations in `idp.ts`.
>   - **Tests**:
> - Added e2e tests for custom domain, OAuth, project provisioning, and
transfer in `e2e/tests/backend/endpoints/api/v1/integrations/custom/`.
> - Updated snapshot serializer to handle custom integration paths in
`snapshot-serializer.ts`.
> 
> <sup>This description was created by </sup>[<img alt="Ellipsis"
src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup>
for 7da89c38eb. You can
[customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this
summary. It will automatically update as commits are pushed.</sup>


<!-- ELLIPSIS_HIDDEN -->

---------

Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>
2025-05-23 23:23:14 +02:00
Zai Shi
b15fea3ac9
Domain should be always defined in neon domain crud endpoint (#683)
<!--

Make sure you've read the CONTRIBUTING.md guidelines:
https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md

-->

<!-- ELLIPSIS_HIDDEN -->


----

> [!IMPORTANT]
> Ensure `domain` is always defined in neon domain CRUD operations and
add test for missing domain case.
> 
>   - **Schema Changes**:
> - Update `domainReadSchema` and `domainCreateSchema` in `crud.tsx` to
ensure `domain` is always defined.
>   - **Tests**:
> - Add test case in `domain.test.ts` to verify failure when `domain` is
not specified in the request body.
> 
> <sup>This description was created by </sup>[<img alt="Ellipsis"
src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup>
for defea9d0dd. You can
[customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this
summary. It will automatically update as commits are pushed.</sup>


<!-- ELLIPSIS_HIDDEN -->

---------

Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>
2025-05-23 18:41:33 +02:00
Will
ec3875d1b7
Change JWT issuer (#656)
This PR address #651 

The `iss` domain [should
be](https://mojoauth.com/glossary/jwt-issuer/#:~:text=The%20authorization%20server%20can%20then%20use%20the%20%22iss%22%20claim%20to%20verify%20the%20validity%20of%20the%20JWT%2C%20and%20to%20determine%20which%20client%20is%20requesting%20access%20to%20the%20protected%20resources.)
a publicly accessible domain that can be used to verify the validity of
the JWT.

I believe this domain should be `api.stack-auth.com` as your `jwks.json`
file is located at this domain
(`https://api.stack-auth.com/api/v1/projects/<your-project-id>/.well-known/jwks.json`)

Alternatively, you could make `jwks.json` available at your
`https://access-token.jwt-signature.stack-auth.com` domain. Currently a
DNS lookup fails:

```
$> nslookup access-token.jwt-signature.stack-auth.com
Server:  one.one.one.one
Address:  1.1.1.1

*** one.one.one.one can't find access-token.jwt-signature.stack-auth.com: Non-existent domain
```

One example of why this is a problem is Convex, which allows auth
integration with any service following the OpenID Connect/JWKs standard.
Upon receiving a JWT, Convex will match the `iss` claim to the [custom
auth
config](https://docs.convex.dev/auth/advanced/custom-auth#server-side-integration)
it should use. It then attempts to connect to `iss` in order to validate
the JWT. If I switch the `iss` (in Convex config) to
`api.stack-auth.com`, then the `iss` claim doesn't match and auth fails.
If I leave it at `https://access-token.jwt-signature.stack-auth.com`,
then Convex tries to connect to
`https://access-token.jwt-signature.stack-auth.com` and gets a DNS
lookup fail and can't verify the token.

This may have implications for currently issued JWTs - so porting this
change may have to be done with care.

<!-- ELLIPSIS_HIDDEN -->

----

> [!IMPORTANT]
> Change JWT issuer to `https://api.stack-auth.com` for public
accessibility and validation.
> 
>   - **Behavior**:
> - Change JWT `iss` from
`https://access-token.jwt-signature.stack-auth.com` to
`https://api.stack-auth.com` in `decodeAccessToken()` and
`generateAccessToken()` in `tokens.tsx`.
> - Update test expectation for `iss` in `ensureParsableAccessToken()`
in `backend-helpers.ts`.
>   - **Rationale**:
> - Ensures `iss` is a publicly accessible domain for JWT validation.
>     - Addresses issue #651.
> 
> <sup>This description was created by </sup>[<img alt="Ellipsis"
src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup>
for 00393b87ad. You can
[customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this
summary. It will automatically update as commits are pushed.</sup>

<!-- ELLIPSIS_HIDDEN -->

---------

Co-authored-by: Zai Shi <zaishi00@outlook.com>
2025-05-13 22:06:01 +02:00
Zai Shi
5dc13defac
Fix Apple OAuth (#669)
<!--

Make sure you've read the CONTRIBUTING.md guidelines:
https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md

-->

<!-- ELLIPSIS_HIDDEN -->


----

> [!IMPORTANT]
> Fix Apple OAuth by updating response status codes and adding ngrok
compatibility.
> 
>   - **Behavior**:
> - Update `statusCode` in `route.tsx` to accept 303 in addition to 307
for OAuth responses.
> - Modify `oauthResponseToSmartResponse()` in `oauth-helpers.tsx` to
map 302 to 303.
> - Add `ngrok-skip-browser-warning` header in `middleware.tsx` and
`clientInterface.ts` for ngrok compatibility.
>   - **Tests**:
> - Update expected status to 303 in `backend-helpers.ts` for OAuth
tests.
> 
> <sup>This description was created by </sup>[<img alt="Ellipsis"
src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup>
for ae3ec66e96. You can
[customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this
summary. It will automatically update as commits are pushed.</sup>


<!-- ELLIPSIS_HIDDEN -->

---------

Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>
2025-05-13 18:38:09 +02:00
Konsti Wohlwend
bae04178cc
Endpoints branching (#659)
Some checks failed
all-good: Did all the other checks pass? / all-good (push) Has been cancelled
Ensure Prisma migrations are in sync with the schema / check_prisma_migrations (22.x) (push) Has been cancelled
Docker Emulator Test / docker (push) Has been cancelled
Docker Server Build and Push / Docker Build and Push Server (push) Has been cancelled
Docker Server Test / docker (push) Has been cancelled
Runs E2E API Tests / build (22.x) (push) Has been cancelled
Lint & build / lint_and_build (latest) (push) Has been cancelled
Preview Docs / run (push) Has been cancelled
Dev Environment Test / restart-dev-and-test (push) Has been cancelled
Run setup tests / setup-tests (push) Has been cancelled
TOC Generator / TOC Generator (push) Has been cancelled
Co-authored-by: Zai Shi <zaishi00@outlook.com>
Co-authored-by: moritz <moritsch@student.ethz.ch>
2025-04-30 15:39:47 -07:00
Konsti Wohlwend
f3f2adcee7
Remove SmartRequest.auth.project.config (#658)
Co-authored-by: Zai Shi <zaishi00@outlook.com>
Co-authored-by: moritz <moritsch@student.ethz.ch>
2025-04-30 15:31:15 -07:00
Zai Shi
d9e2dae4c6
Config DB migration step 2 (#629)
Some checks failed
all-good: Did all the other checks pass? / all-good (push) Has been cancelled
Ensure Prisma migrations are in sync with the schema / check_prisma_migrations (22.x) (push) Has been cancelled
Docker Emulator Test / docker (push) Has been cancelled
Docker Server Build and Push / Docker Build and Push Server (push) Has been cancelled
Docker Server Test / docker (push) Has been cancelled
Runs E2E API Tests / build (22.x) (push) Has been cancelled
Lint & build / lint_and_build (latest) (push) Has been cancelled
Preview Docs / run (push) Has been cancelled
Dev Environment Test / restart-dev-and-test (push) Has been cancelled
Run setup tests / setup-tests (push) Has been cancelled
TOC Generator / TOC Generator (push) Has been cancelled
Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>
Co-authored-by: moritz <moritsch@student.ethz.ch>
2025-04-29 14:52:45 -07:00
Konstantin Wohlwend
5c9325ebb4 Fix flakey tests 2025-04-22 22:20:28 -07:00
Konstantin Wohlwend
512e0113fc Fix flakey tests 2025-04-22 18:03:53 -07:00
Moritz Schneider
d242292ab6
Implement api key revocation endpoint (#614)
<!--

Make sure you've read the CONTRIBUTING.md guidelines:
https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md

-->

<!-- ELLIPSIS_HIDDEN -->


----

> [!IMPORTANT]
> Add API endpoint to revoke API keys found through credential scanning,
with email notifications and error handling.
> 
>   - **Behavior**:
> - Adds `POST` endpoint in `route.tsx` to revoke API keys found through
credential scanning.
> - Handles errors for non-existent, public, expired, and already
revoked API keys.
>     - Sends email notifications to affected users or team members.
>   - **Email**:
> - Adds `getSharedEmailConfig()` in `emails.tsx` for shared email
configuration.
>   - **Testing**:
> - Adds tests in `revoke.test.ts` for user and team API key revocation,
including email notifications and error handling for non-existent and
already revoked keys.
>   - **Errors**:
>     - Adds `PublicApiKeyCannotBeRevoked` error in `known-errors.tsx`.
> 
> <sup>This description was created by </sup>[<img alt="Ellipsis"
src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup>
for a67021bf47. It will automatically
update as commits are pushed.</sup>


<!-- ELLIPSIS_HIDDEN -->

---------

Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>
2025-04-12 01:08:31 +00:00
Zai Shi
61bc0de8f4
Config DB (#568)
- Added new config json schema and helper functions
- Separated the internal project and client project so we can later
change the internal project APIs without breaking backward compatibility
- Added database to config json and config json to project type so we
can test and compare the result in production

Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>
2025-04-10 19:38:25 +02:00
Zai Shi
6a2c3f99a9
add role to access token generation (#603) 2025-04-09 05:06:40 +02:00
Moritz Schneider
592d259dde
Api Keys (#590)
<!--

Make sure you've read the CONTRIBUTING.md guidelines:
https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md

-->

<img width="1510" alt="image"
src="https://github.com/user-attachments/assets/99619123-6be5-4788-aebe-5fc2a9a36245"
/>

<img width="1510" alt="image"
src="https://github.com/user-attachments/assets/660677bf-f19a-4673-94c8-59ac50eb6ae5"
/>

<img width="1510" alt="image"
src="https://github.com/user-attachments/assets/11ae63c4-5813-4fd8-aa01-fa580d2103be"
/>


<!-- ELLIPSIS_HIDDEN -->


----

> [!IMPORTANT]
> Introduces API key management for users and teams, integrating with
existing project configurations and permissions, and adds comprehensive
tests and examples.
> 
>   - **API Key Management**:
> - Introduces `ProjectApiKey` model in `schema.prisma` for managing API
keys.
> - Adds `createApiKeyHandlers` in `handlers.tsx` to handle API key CRUD
operations.
>     - Implements API key creation, revocation, and validation logic.
>   - **Permissions and Configurations**:
> - Adds `allowUserApiKeys` and `allowTeamApiKeys` to `ProjectConfig` in
`schema.prisma`.
> - Updates `TeamSystemPermission` enum to include `MANAGE_API_KEYS`.
> - Ensures API key operations respect project configurations and
user/team permissions.
>   - **Testing and Examples**:
> - Adds extensive tests in `api-keys.test.ts` to cover various API key
scenarios.
>     - Updates example projects to demonstrate API key usage.
>   - **Miscellaneous**:
>     - Refactors existing code to integrate API key functionalities.
> - Updates documentation and type definitions to reflect new API key
features.
> 
> <sup>This description was created by </sup>[<img alt="Ellipsis"
src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup>
for 96f60c57f0. It will automatically
update as commits are pushed.</sup>


<!-- ELLIPSIS_HIDDEN -->

---------

Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>
2025-04-04 13:03:10 -07:00
Zai Shi
c2cb2aac76
Add basic client lib tests (#601) 2025-04-03 20:05:44 +02:00
CactusBlue
306f4e4c67
Permission Robustness (#591)
<!-- ELLIPSIS_HIDDEN -->


> [!IMPORTANT]
> Enhance permission management by adding unique constraints, handling
duplicate ID errors, and updating frontend and backend logic with
comprehensive tests.
> 
>   - **Database**:
> - Add unique constraint on `Permission` table for `[tenancyId,
queryableId]` in `migration.sql`.
>     - Update `schema.prisma` to reflect new unique constraints.
>   - **Backend**:
> - Update `crud.tsx` files to handle `PERMISSION_ID_ALREADY_EXISTS`
error using `isErrorForNonUniquePermission()`.
> - Add `isPrismaUniqueConstraintViolation()` in `prisma-client.tsx` to
identify unique constraint violations.
>     - Add `PermissionIdAlreadyExists` error in `known-errors.tsx`.
>   - **Frontend**:
> - Update `page-client.tsx` and `permission-table.tsx` to check for
duplicate permission IDs before creation.
>   - **Tests**:
> - Add tests in `project-permission-definitions.test.ts` and
`team-permission-definitions.test.ts` to verify duplicate ID handling.
> - Ensure permissions cannot be created with duplicate IDs across
project and team contexts.
> 
> <sup>This description was created by </sup>[<img alt="Ellipsis"
src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup>
for b3ccd15bca. It will automatically
update as commits are pushed.</sup>


<!-- ELLIPSIS_HIDDEN -->

---------

Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>
Co-authored-by: Zai Shi <zaishi00@outlook.com>
2025-04-02 01:12:13 +02:00
CactusBlue
793272c8c5
Rename USER to PROJECT in permissions (#576)
<!-- ELLIPSIS_HIDDEN -->


> [!IMPORTANT]
> Renamed user-related permissions to project-related permissions across
the codebase, affecting enums, schemas, APIs, models, and tests.
> 
>   - **Behavior**:
> - Renamed `USER` to `PROJECT` in `PermissionScope` enum in
`schema.prisma` and `migration.sql`.
> - Updated `isDefaultUserPermission` to `isDefaultProjectPermission` in
`schema.prisma` and `migration.sql`.
>     - Removed `jwks.json/route.ts` file.
>   - **API Changes**:
> - Renamed `user-permission-definitions` and `user-permissions`
endpoints to `project-permission-definitions` and `project-permissions`
in `route.tsx` files.
>     - Updated CRUD handlers in `crud.tsx` files to reflect new naming.
>   - **Models**:
> - Updated models in `permissions.tsx` to use `ProjectPermission` and
`AdminProjectPermission`.
>     - Updated `KnownErrors` to use `ProjectPermissionRequired`.
>   - **Tests**:
> - Renamed test files and updated test cases in
`e2e/tests/backend/endpoints/api/v1` to reflect new naming.
>   - **Misc**:
> - Updated `admin-app-impl.ts`, `client-app-impl.ts`, and
`server-app-impl.ts` to use new project permission naming.
>     - Updated `schema-fields.ts` to reflect new permission ID schema.
> 
> <sup>This description was created by </sup>[<img alt="Ellipsis"
src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup>
for 08924f5241. It will automatically
update as commits are pushed.</sup>


<!-- ELLIPSIS_HIDDEN -->

---------

Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>
2025-03-27 09:39:48 -07:00
Zai Shi
392a3f9790
Upgrade oslo to oslojs (#564) 2025-03-26 02:02:03 +01:00
CactusBlue
1ffd1e3e5b
User permissions (#573)
<!-- ELLIPSIS_HIDDEN -->


> [!IMPORTANT]
> Adds user permissions management, including models, API endpoints, and
tests, alongside existing team permissions.
> 
>   - **Behavior**:
> - Adds user permissions alongside team permissions, allowing for
user-specific permission management.
> - Introduces `ProjectUserDirectPermission` model in `schema.prisma`
for direct user permissions.
>     - Updates `PermissionScope` enum from `GLOBAL` to `USER`.
>   - **API**:
> - Adds CRUD endpoints for user permissions in `user-permissions` and
`user-permission-definitions`.
> - Updates existing team permission endpoints to support user
permissions.
>   - **Tests**:
> - Adds e2e tests for user permissions in `user-permissions.test.ts`
and `user-permission-definitions.test.ts`.
> - Updates existing tests to include user permissions where applicable.
>   - **Misc**:
> - Updates `adminInterface.ts` and `server-app-impl.ts` to handle user
permissions.
> - Modifies `known-errors.tsx` to include `UserPermissionRequired`
error.
> - Adjusts `project-configs` and `projects` to include user default
permissions.
> 
> <sup>This description was created by </sup>[<img alt="Ellipsis"
src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup>
for 8b73e668e2. It will automatically
update as commits are pushed.</sup>


<!-- ELLIPSIS_HIDDEN -->
2025-03-25 02:20:53 +01:00
Konsti Wohlwend
a99b04ac6c
Anonymous users (#566) 2025-03-20 18:24:19 -07:00
Konstantin Wohlwend
b53b0c8232 Rename UserEmailAlreadyExists to UserWithEmailAlreadyExists 2025-03-20 09:56:08 -07:00
Konstantin Wohlwend
61919e362f Fix CI flakeyness 2025-03-20 09:28:33 -07:00
Konstantin Wohlwend
e7104dcb52 Wait longer in test 2025-03-18 10:25:28 -07:00
CactusBlue
62aaa6d45a
Email send dashboard fix (#541)
<!-- ELLIPSIS_HIDDEN -->


> [!IMPORTANT]
> Enhance email configuration handling, add email listing endpoint and
tests, and update schemas for improved security and functionality.
> 
>   - **Email Configuration**:
> - Refactor `prismaModelToCrud` in `crud.tsx` to expand `sender_config`
into detailed fields.
> - Use `emailConfigWithoutPasswordSchema` in `emails.ts` for
`sender_config`.
>   - **API Changes**:
> - Update `internalEmailsCrudHandlers` in `crud.tsx` to use
`auth.tenancy.id` for filtering emails and limit results to 100.
>     - Add `route.tsx` to export `GET` handler for listing emails.
>   - **Testing**:
> - Add `email.test.ts` to test email listing, project isolation, and
admin access restrictions.
> - Add `resetContext` function in `backend-helpers.ts` to reset test
context.
>   - **Miscellaneous**:
> - Implement `emailConfigWithoutPasswordSchema` in `projects.ts` to
exclude password from email config.
>     - Update `snapshot-serializer.ts` to strip `sent_at_millis` field.
> 
> <sup>This description was created by </sup>[<img alt="Ellipsis"
src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup>
for 6721f4e13a. It will automatically
update as commits are pushed.</sup>


<!-- ELLIPSIS_HIDDEN -->
2025-03-13 19:49:37 +01:00
devin-ai-integration[bot]
0e3f63d2ac
Add CLI authentication endpoints (#503)
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Konstantin Wohlwend <n2d4xc@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: TheCactusBlue <thecactusblue@gmail.com>
2025-03-12 18:44:33 -07:00
Zai Shi
0f7727b6ba
add permission webhooks (#533)
<!--

Make sure you've read the CONTRIBUTING.md guidelines:
https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md

-->

<!-- ELLIPSIS_HIDDEN -->

----

> [!IMPORTANT]
> Add webhooks for team permission creation and deletion, updating CRUD
operations and tests to support this functionality.
> 
>   - **Webhooks**:
> - Add `sendTeamPermissionCreatedWebhook` and
`sendTeamPermissionDeletedWebhook` in `webhooks.tsx`.
> - Trigger `sendTeamPermissionCreatedWebhook` on permission creation in
`team-memberships/crud.tsx` and `team-permissions/crud.tsx`.
> - Trigger `sendTeamPermissionDeletedWebhook` on permission deletion in
`team-permissions/crud.tsx`.
>   - **CRUD Operations**:
> - Modify `addUserToTeam` in `team-memberships/crud.tsx` to return
permission IDs.
> - Update `onCreate` and `onDelete` handlers in
`team-permissions/crud.tsx` to handle webhooks.
>   - **Tests**:
> - Add tests in `team-memberships.test.ts` and
`team-permissions.test.ts` to verify webhook triggers for permission
creation and deletion.
> 
> <sup>This description was created by </sup>[<img alt="Ellipsis"
src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup>
for 5067753761. It will automatically
update as commits are pushed.</sup>

<!-- ELLIPSIS_HIDDEN -->

---------

Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>
2025-03-13 02:43:48 +01:00
Moritz Schneider
6776af30fd
Active Sessions Page (#528)
<img width="1443" alt="image"
src="https://github.com/user-attachments/assets/611ede72-4d46-41dc-adea-9546c04b199a"
/>

Adds new active sessions page to settings

<!-- ELLIPSIS_HIDDEN -->


----

> [!IMPORTANT]
> Adds an active sessions page to settings, enabling users to view and
manage their sessions, with backend support for session listing and
deletion.
> 
>   - **Active Sessions Page**:
> - Adds `ActiveSessionsPage` component in `account-settings.tsx` to
display active sessions.
> - Allows revoking individual sessions or all sessions except the
current one.
>   - **Backend Changes**:
> - Adds `sessionsCrudHandlers` in `crud.tsx` for session management
(list, delete).
> - Updates `ProjectUserRefreshToken` model in `schema.prisma` to
include `id` and `isImpersonation` fields.
> - Implements session listing and deletion in `serverInterface.ts` and
`client-app-impl.ts`.
>   - **Error Handling**:
> - Introduces `CannotDeleteCurrentSession` error in `known-errors.tsx`.
>   - **Testing**:
> - Adds tests for session management in
`endpoints/api/v1/auth/sessions` tests.
> 
> <sup>This description was created by </sup>[<img alt="Ellipsis"
src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup>
for ba78df0928. It will automatically
update as commits are pushed.</sup>


<!-- ELLIPSIS_HIDDEN -->

---------

Co-authored-by: TheCactusBlue <thecactusblue@gmail.com>
Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
2025-03-12 22:35:32 +01:00
CactusBlue
ef6248dd87
Option for merging/blocking account creations with same email but different oauth provider (#502)
* Add SettingSelect component and sign-up mode configuration

* update schema

* update schema

* add merge oauth schema fields

* update test snapshots

* reformat the file

* add mergeOauthMethods in the UI

* Improve documentation with minor enhancements and fixes (#466)

* Improve PATCH /users/me performance

* Neon domain (#488)

* React setup docs (#491)

* chore: update package versions

* Update branding from Stack to Stack Auth in documentation (#504)

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: zai@stack-auth.com <zai@stack-auth.com>

* Improve inner OAuth cookie error description

* Fix tests

* Add several spans

* Fix Next.js navigation

* chore: update package versions

* add handler config

* Fix conditional hooks in account settings page

* Add `pnpm run claude-code`

* Fixed docs image ratio (#507)

* Documentation Updates (#508)

* add links

* moar

* fix broken links

* fixed images

* updated readme

* Add Python SDK tab to docs

* Fix broken links

* Prefix `pnpm pre` before `pnpm dev`

* Automatically update pull request branches (#509)

* Give PR updater more permissions

* Ignore PR merge conflicts in GH Actions

* [DEVIN: Konsti] Add userCount property to Project table with automatic update trigger (#506)

Co-authored-by: Konstantin Wohlwend <n2d4xc@gmail.com>

* chore: update package versions

* rewrite as toMatchobject

* fix test

* test again

* fix

* update claude

* fix migrations

* fix migration

* fix types

* Update CLAUDE.md

Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>

* more instructions

* fix

* what was i on

* wew

* factor things

* correct the flow

* Update apps/backend/src/app/api/latest/auth/oauth/callback/[provider_id]/route.tsx

Very good catch

Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>

* rename everything

* fix more

* fix typeerror

* update all the tests

* modify migration for legacy projects

* add loading state

* enable email verification for tests

* update test

* get a failing test

* the test works now

* remove debug console log

* change error

* no lowercase

* use typedToUpper/Lowercase

* capture err

* fix types

* modify error throw

* fixed

* add working tests

* documentation update

* Update apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/merge-strategy.test.ts

Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>

* remove eslint rule

* fix json args

* documentation update

---------

Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Konstantin Wohlwend <n2d4xc@gmail.com>
Co-authored-by: Zai Shi <zaishi00@outlook.com>
Co-authored-by: zai@stack-auth.com <zai@stack-auth.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
2025-03-10 21:25:12 +00:00
Konstantin Wohlwend
234a3e5a51 Reduce metrics test flakeyness 2025-03-10 10:55:18 -07:00
Konsti Wohlwend
b41681d1e4
Reduce test flakeyness (#517)
Some checks failed
All good? / all-good (push) Has been cancelled
Update pull request branches / Update pull request branches (push) Has been cancelled
Ensure Prisma migrations are in sync with the schema / check_prisma_migrations (22.x) (push) Has been cancelled
Docker Build and Push / Docker Build and Push Server (push) Has been cancelled
Docker Test / docker (push) Has been cancelled
Runs E2E API Tests / build (20.x) (push) Has been cancelled
Runs E2E API Tests / build (22.x) (push) Has been cancelled
Runs E2E API Tests / build (latest) (push) Has been cancelled
Lint & build / lint_and_build (20.x) (push) Has been cancelled
Lint & build / lint_and_build (22.x) (push) Has been cancelled
Mirror main branch to main-mirror-for-wdb / lint_and_build (push) Has been cancelled
Publish Docs / run (push) Has been cancelled
Dev Environment Test / test (push) Has been cancelled
Run setup tests / test (push) Has been cancelled
TOC Generator / TOC Generator (push) Has been cancelled
2025-03-07 13:34:50 -08:00
Zai Shi
6a8fd6a265 fixed tests
Some checks failed
Update pull request branches / Update pull request branches (push) Has been cancelled
Ensure Prisma migrations are in sync with the schema / check_prisma_migrations (22.x) (push) Has been cancelled
Docker Build and Push / Docker Build and Push Server (push) Has been cancelled
Docker Test / docker (push) Has been cancelled
Runs E2E API Tests / build (20.x) (push) Has been cancelled
Runs E2E API Tests / build (22.x) (push) Has been cancelled
Runs E2E API Tests / build (latest) (push) Has been cancelled
Lint & build / lint_and_build (20.x) (push) Has been cancelled
Lint & build / lint_and_build (22.x) (push) Has been cancelled
Dev Environment Test / test (push) Has been cancelled
Run setup tests / test (push) Has been cancelled
TOC Generator / TOC Generator (push) Has been cancelled
2025-03-05 18:05:18 -08:00
devin-ai-integration[bot]
271ea9b175
[DEVIN: Konsti] Add userCount property to Project table with automatic update trigger (#506)
Co-authored-by: Konstantin Wohlwend <n2d4xc@gmail.com>
2025-03-05 09:27:40 -08:00
Konstantin Wohlwend
bb8e28a275 Add Python SDK tab to docs 2025-03-04 18:24:32 -08:00
Konstantin Wohlwend
d6cc73a278 Fix tests 2025-03-03 19:16:50 -08:00
Zai Shi
d89a4e3442
Neon domain (#488) 2025-03-04 02:48:38 +01:00
CactusBlue
6353baa486
Disallow template updates without custom SMTP server (#447)
* add some rudimentary checks

* add some checks on email providers as well

* add warning

* Update apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/emails/page-client.tsx

Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>

* added writeFileSyncIfChanged to all the codegen

* JS lib docs (#444)

* fix creator id (#449)

* Added magic link, OTP, and OAuth examples to JS docs (#448)

* fixed syntax error

* Update page-client.tsx (#451)

Co-authored-by: CactusBlue <thecactusblue@gmail.com>

* Add custom pages/contact channel docs (#438)

* add some description about contact channels

* add some examples of password reset

* update the doc

* rename things

* split examples

* remove custom for now

* fix error message

---------

Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>
Co-authored-by: Zai Shi <zaishi00@outlook.com>

* add warning

* move the check

* add warning popup

* a

* fix more

* remove dead function

* start adding some tests

* add a test case

* moar tests

* fix tests

---------

Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
Co-authored-by: Zai Shi <zaishi00@outlook.com>
Co-authored-by: Zayd Krunz <70227235+ShrootBuck@users.noreply.github.com>
Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>
2025-02-27 19:05:27 -08:00
devin-ai-integration[bot]
9a76d10c2a
[DEVIN: Konsti] Add in-source unit tests to stack-shared utilities (#485)
* Add in-source unit tests to stack-shared utilities

Co-Authored-By: Konstantin Wohlwend <n2d4xc@gmail.com>

* Fix type checking and linting issues

Co-Authored-By: Konstantin Wohlwend <n2d4xc@gmail.com>

* Fix lint errors in results.tsx

Co-Authored-By: Konstantin Wohlwend <n2d4xc@gmail.com>

* Fix remaining lint errors in results.tsx

Co-Authored-By: Konstantin Wohlwend <n2d4xc@gmail.com>

* Fix lint warnings in results.tsx

Co-Authored-By: Konstantin Wohlwend <n2d4xc@gmail.com>

* Fix wait function mocking in results.tsx

Co-Authored-By: Konstantin Wohlwend <n2d4xc@gmail.com>

* Fix retry function test in results.tsx

Co-Authored-By: Konstantin Wohlwend <n2d4xc@gmail.com>

* Fix React.forwardRef mock in react.tsx test

Co-Authored-By: Konstantin Wohlwend <n2d4xc@gmail.com>

* Fix trailing spaces in react.tsx and results.tsx

Co-Authored-By: Konstantin Wohlwend <n2d4xc@gmail.com>

* Revert to DependenciesMap and wrap rejected promise in ignoreUnhandledRejection

Co-Authored-By: Konstantin Wohlwend <n2d4xc@gmail.com>

* Fix

* Revert changes to known-errors.tsx constructor

Co-Authored-By: Konstantin Wohlwend <n2d4xc@gmail.com>

* Make rotateRight call rotateLeft per review feedback

Co-Authored-By: Konstantin Wohlwend <n2d4xc@gmail.com>

* Remove redundant @ts-expect-error directive in known-errors.tsx

Co-Authored-By: Konstantin Wohlwend <n2d4xc@gmail.com>

* Fix import order in promises.tsx

Co-Authored-By: Konstantin Wohlwend <n2d4xc@gmail.com>

* Fix

* Fix CI failures: add back @ts-expect-error in known-errors.tsx and revert mapResult implementation in results.tsx

Co-Authored-By: Konstantin Wohlwend <n2d4xc@gmail.com>

* Remove unused @ts-expect-error directive in known-errors.tsx

Co-Authored-By: Konstantin Wohlwend <n2d4xc@gmail.com>

* Add back @ts-expect-error directive with explanation in known-errors.tsx

Co-Authored-By: Konstantin Wohlwend <n2d4xc@gmail.com>

* Change @ts-expect-error to @ts-ignore in known-errors.tsx

Co-Authored-By: Konstantin Wohlwend <n2d4xc@gmail.com>

* be honest

* vocabulary

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Konstantin Wohlwend <n2d4xc@gmail.com>
2025-02-28 01:47:37 +00:00
CactusBlue
8b88c7a258
Add E2E tests for the JS library (#487)
* Add dependency on @stackframe/js to e2e tests

* add more

* add some additional logic for issuing api key

* more

* fix window dependency

* roll it back

* chore: update package versions

* Make Project description field non-nullable (#483)

Co-Authored-By: Konstantin Wohlwend <n2d4xc@gmail.com>

* Run E2E API tests on Node v22 too

* Run E2E tests on latest Node.js version

* Codegen + macros for SDK docs (#456)

* add extra body

* Add link to Docker image to docs

* Permit signUpWithCredential in non-browser environments

* get the tests running

* remove

* fix

* update the interface

* Update apps/e2e/tests/js/js-helpers.ts

Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>

---------

Co-authored-by: Konstantin Wohlwend <n2d4xc@gmail.com>
Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Zai Shi <zaishi00@outlook.com>
2025-02-27 16:32:41 -08:00
CactusBlue
180b455d4f
Remove global legacy JWT (#450)
* remove all legacy jwt references

* fix creator id (#449)

* update snapshots

* Added magic link, OTP, and OAuth examples to JS docs (#448)

* fixed syntax error

* re-add legacy jwt on prisma schema

---------

Co-authored-by: Zai Shi <zaishi00@outlook.com>
Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>
2025-02-21 10:10:56 -08:00
Zai Shi
dbf061fb8e
Fix webhook tests (#458) 2025-02-21 18:55:39 +01:00
Konstantin Wohlwend
c3d0fe952f Less flakey webhook tests 2025-02-20 15:44:14 -08:00
Konsti Wohlwend
157f722417
Vanilla JS init script (#454) 2025-02-20 15:11:06 -08:00
Zai Shi
f81d1c0e04 fix creator id (#449)
Some checks failed
Ensure Prisma migrations are in sync with the schema / check_prisma_migrations (22.x) (push) Has been cancelled
Docker Build and Push / Docker Build and Push Server (push) Has been cancelled
Docker Test / docker (push) Has been cancelled
Runs E2E API Tests / build (20.x) (push) Has been cancelled
Lint & build / lint_and_build (20.x) (push) Has been cancelled
Lint & build / lint_and_build (22.x) (push) Has been cancelled
Run setup tests / test (push) Has been cancelled
TOC Generator / TOC Generator (push) Has been cancelled
2025-02-19 19:16:30 -08:00