Alex Ababii
e95ca276d2
feat(guestlinks): handling of SpaceShare unshared and expired events
2026-10-23 09:17:16 +02:00
Alex Ababii
2425b7e2ff
feat(guestauth): consume space shared event
2026-10-19 12:43:52 +02:00
André Duffeck
564e1c0ec7
Rate limit guest link renewals with a valid session separately
...
Each session renewal issues a PIN with fresh attempts, so without a limit a stolen session could keep guessing. The quota is separate from the one for renewals without a session, so neither can use up the other's.
2026-10-16 13:05:38 +02:00
Alex Ababii
ddf388a058
feat(authguest): nonce and pin ttl are now using the same value
2026-10-16 10:07:22 +02:00
Alex Ababii
d8ab8dc7ee
feat(authguest): extracted restrict access logic into separate package, backoff and quota limiters
2026-10-16 10:01:55 +02:00
Alex Ababii
985c39de1f
feat(authguest): basica data structs and config for rate limiting
2026-10-16 09:32:46 +02:00
Alex Ababii
a51f79505d
feat(authguest): renewal logic and publishing event
2026-10-13 09:30:52 +02:00
André Duffeck
10b93edded
Derive the guest session key from OC_JWT_SECRET
...
Replace AUTH_GUEST_SESSION_JWT_SECRET with a key derived via
HMAC-SHA256 from the reva JWT secret. Guest session tokens and reva
access tokens remain unforgeable across each other without a second
secret to configure.
2026-10-07 08:46:53 +02:00
André Duffeck
adc8a51657
Don't use the same secret for signing sessions and reva tokens
2026-10-06 09:52:02 +02:00
Ralf Haferkamp
246d49ee18
guestlinks: Setup guestlinks authprovider
...
This starts the guestlinks authprovider as part of the auth-guest
service and wires it into the authregistry.
2026-10-06 09:47:00 +02:00
Alex Ababii
cbf3ee8c0b
feat(guestauth): guestauth service rename to auth-guest
2026-10-06 08:07:44 +02:00
Alex Ababii