vinez/seerr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
3118 commits 1 branch 0 tags 56 MiB
Commit graph

3118 commits

This branch
This branch
All branches
Author SHA1 Message Date
Lauris
f389909a23 fix(auth): sign session cookie store with sessionSecret, not clientId 
cookie-parser was initialized with settings.clientId (the Plex client
UUID), but express-session signs connect.sid with settings.sessionSecret.
The secrets differ, so cookie-parser's signature check on connect.sid
fails, the cookie is dropped from req.cookies, and the OpenAPI validator
rejects every authenticated request with "cookie 'connect.sid' required"
even though the browser is sending it correctly.

This also matches the signing secret used by the OIDC code-verifier and
state cookies that are stored via res.cookie(..., {signed: true}), which
read back through req.signedCookies during the callback.
 2026-06-29 15:49:40 -04:00
Michael Thomas
baea24cd52 fix: strip query params when redirecting to provider 2026-06-29 15:49:40 -04:00
Michael Thomas
f7eab9d591 fix(oidcloginbutton): ensure router is initialized in callback hook 2026-06-29 15:49:40 -04:00
Michael Thomas
93b8a59a60 fix: explicitly set sameSite: strict for OIDC correlation cookies 2026-06-29 15:49:40 -04:00
Michael Thomas
66dbf7df0f fix: normalize email addresses from IDP before lookup / storage 2026-06-29 15:49:40 -04:00
Michael Thomas
3f0f7ec66e fix: only count active OIDC providers as a fallback sign-in method 2026-06-29 15:49:40 -04:00
Michael Thomas
173c813ab6 chore(api): clarify the 403 semantics on linked-account listing 
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
 2026-06-29 15:49:40 -04:00
Michael Thomas
f1b4cf782e fix: ensure that OIDC correlation cookies are present in callback 2026-06-29 15:49:40 -04:00
Michael Thomas
3d6acd721e fix(auth): always send state regardless of PKCE support 
This improves CSRF protection somewhat, and also improves compatibilty
with Authelia and Authentik, which both have strange handling of the
`state` parameter either beyond or non-compliant with the specification.
 2026-06-29 15:49:40 -04:00
Michael Thomas
6127da571f fix(user): filter linkedAccounts from user entity 2026-06-29 15:49:40 -04:00
Michael Thomas
5d3056bbf8 refactor: remove login-specific classes from ButtonWithLoader 2026-06-29 15:49:40 -04:00
Michael Thomas
f09d65a49d test: add cookie secret to express app for auth tests 2026-06-29 15:49:40 -04:00
Michael Thomas
5712d0f50a test: ensure test runner does not hang 2026-06-29 15:49:40 -04:00
Michael Thomas
b727361c0e fix: update unlink account endpoint guards to match client-side logic 2026-06-29 15:49:39 -04:00
Michael Thomas
7ec660b78a fix(seerr-api.yml): add additional return types to API schema 2026-06-29 15:49:39 -04:00
Michael Thomas
69e1c8cd3d docs: add OpenID Connect documentation 2026-06-29 15:49:39 -04:00
Michael Thomas
17d1b9f76d fix(Login): make error messages look a bit nicer 2026-06-29 15:49:39 -04:00
Michael Thomas
de03975e10 fix: handle errors in OIDC callback params 2026-06-29 15:49:39 -04:00
Michael Thomas
31ecc927ef style: error condition null check -> truthiness check 2026-06-29 15:49:39 -04:00
Michael Thomas
1e54f15abe refactor: for new user login, save user and linked account entities in single transaction 2026-06-29 15:49:39 -04:00
Michael Thomas
4ac63903cf refactor: store OIDC provider in sessionStorage 2026-06-29 15:49:39 -04:00
Michael Thomas
c10d5495a8 refactor: rename LoginButton -> ButtonWithLoader 2026-06-29 15:49:39 -04:00
Michael Thomas
0f2ec32c87 fix: use signed session cookie to persist state & code_verifier, clear after login 2026-06-29 15:49:39 -04:00
Michael Thomas
658a359824 fix(seerr-api.yml): uri -> uri-reference 2026-06-29 15:49:39 -04:00
Michael Thomas
8a1bd4d5f5 fix: add indexes and constraints for linked accounts 2026-06-29 15:49:39 -04:00
Michael Thomas
6fc33b1963 feat(client): support login & account linking with OpenID Connect 2026-06-29 15:49:39 -04:00
Michael Thomas
f3b3e207ef test(auth): add tests for OpenID Connect endpoints 2026-06-29 15:49:39 -04:00
Michael Thomas
e56ff623fa feat: support login with OpenID Connect 2026-06-29 15:49:39 -04:00
Michael Thomas
61ee8dd00f feat: support linking OpenID Connect accounts to users 2026-06-29 15:49:39 -04:00
Michael Thomas
ff4867c98c feat: add OpenID Connect provider settings 2026-06-29 15:49:39 -04:00
A. Schueler
ebac489c8a
docs: update truenas migration section to include chown (#3143) 2026-06-26 12:32:12 +02:00
fallenbagel
8ad191f42b
fix(proxy): proxy clients built before proxy init (#3196) 2026-06-25 01:49:58 +02:00
fallenbagel
ef9edc832f
fix(i18n): fallback to server locale for "Default" user lang in notifs (#3190) 2026-06-23 17:07:34 +08:00
John Fletcher
0a1f7035d0
fix: close manage movie sidebar without back reopening (#2590) 
Co-authored-by: John Fletcher <johnfletcherdev@gmail.com>
Co-authored-by: gauthier-th <mail@gauthierth.fr>
 2026-06-19 09:02:23 +02:00
Weblate
8d351bce65 chore(i18n): update translations from Weblate 
Co-authored-by: Kisnov <gabrielmarfil0@gmail.com>
Co-authored-by: Weblate <noreply@weblate.org>
 2026-06-18 17:39:02 +02:00
0xsysr3ll
72536da50e
feat(requests): allow admins to bypass user quota limits (#2026) 2026-06-18 12:37:07 +02:00
Ludovic Ortega
d2ffe4f75c
chore(dev): add devenv setup (#3138) 
Signed-off-by: Ludovic Ortega <ludovic.ortega@adminafk.fr>
 2026-06-17 18:46:13 +02:00
Weblate
3f3384265e chore(i18n): update translations from Weblate 
Co-authored-by: Kisnov <gabrielmarfil0@gmail.com>
Co-authored-by: Weblate <noreply@weblate.org>
Co-authored-by: dtalens <dtalens@users.noreply.translate.seerr.dev>
 2026-06-16 16:02:25 +02:00
Weblate
6c8527fea3 chore(i18n): update translations from Weblate 
Co-authored-by: Anatoly Tarasenko <fm.ksbw@gmail.com>
Co-authored-by: Weblate <noreply@weblate.org>
 2026-06-14 14:58:55 +02:00
Weblate
ab26f068f2 chore(i18n): update translations from Weblate 
Co-authored-by: Daniel G <daniel.guerra.997@gmail.com>
Co-authored-by: Weblate <noreply@weblate.org>
 2026-06-14 01:54:04 +08:00
fallenbagel
784faa9f84
fix: availability sync demotion and orphan season rollup edge cases (#3148) 2026-06-12 00:04:36 +02:00
renovate[bot]
0438710761
ci(actions): update github actions (#3041) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-11 12:15:04 +02:00
Gauthier
a8f1780bee
fix(notifications): make the Discord IDs available even when the notification is disabled on Seerr (#3139) 
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
 2026-06-09 19:44:12 +02:00
Austin
6e9ba06e88
feat(notifications): add Discord thread ID support (#3065) 2026-06-09 10:11:11 +02:00
0xsysr3ll
5f2722da30
feat(api): support userId when creating issues (#3100) 2026-06-08 23:34:00 +02:00
Adam Toy
7379c73703
chore(helm): bump seerr to 3.3.0 (#3131) 2026-06-07 21:30:36 +02:00
ud
6829850bbc
fix(webpush): guard subscriptions request until user loads (#3113) 2026-06-07 17:09:02 +02:00
Weblate
0a305f6e18 chore(i18n): update translations from Weblate 
Co-authored-by: Bas <910100490+weblate@proton.me>
Co-authored-by: Weblate <noreply@weblate.org>
 2026-06-05 11:22:24 +02:00
Gauthier
4e7a227bff
docs(blog): fix "monitorNewItems" feature description and previous post author (#3103) 2026-06-05 10:55:17 +02:00
Weblate
32249f26fe chore(i18n): update translations from Weblate 
Co-authored-by: Bas Trebus <bas.trebus@maastrichtuniversity.nl>
Co-authored-by: Gallyam <gallyamb@gmail.com>
Co-authored-by: Gökhan GÜRBÜZ <gkhn.gurbuz@hotmail.com>
Co-authored-by: Marek <mara.pavelka@gmail.com>
Co-authored-by: Mateusz Lesiak <mateusz.lesiak01@gmail.com>
Co-authored-by: Nils Karlsson Pyssling <nisse@users.noreply.translate.seerr.dev>
Co-authored-by: RobertRvB <Robert_RB@live.nl>
Co-authored-by: SulliL <susu.leduc@gmail.com>
Co-authored-by: Thadah D. Denyse <thadahdenyse@protonmail.com>
Co-authored-by: Ulrik J <ulrikj@users.noreply.translate.seerr.dev>
Co-authored-by: Weblate <noreply@weblate.org>
Co-authored-by: markspoiss007-web <markspoiss007@gmail.com>
Co-authored-by: tkymmm <lempicka@sluice.xyz>
Co-authored-by: ugyes <ferenc.bodi@live.com>
 2026-06-04 19:27:17 +02:00