* fix(deps): update bun minor and patch dependencies
* chore(deps): pin drizzle version
---------
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Nicolas Meienberger <github@thisprops.com>
* feat(sftp): add option for absolute & parent symlink backups
Related issue: #1007
Recent SSHFS now contains absolute/parent-directory symlinks by default,
which is safer for browsing but prevents Restic from archiving the
original symlink metadata. This adds an opt-in `no_contain_symlinks`
switch for trusted SFTP sources that need exact symlink backup
* refactor(sftp): block unsafe symlink with skip host check combination
Volume browser paths are API paths, not native filesystem paths. They
need stable slash-separated encoding so paths containing spaces,
backslashes, or percent-encoded characters can round-trip between the
browser and the agent without escaping the mounted volume root.
This adds a small codec at the volume-host boundary, verifies
symlink/root containment on the resolved native path, and keeps the
local file browser from normalizing user-facing request.
* fix(bacups): reschedule immediately warning backups
Backups that didn't end properly due to a container restart should be
re-scheduled immediately
* chore: pr feedback
* feat: add option to disable password login
Adds a global admin setting to hide the username/password form on the
login page, useful for deployments that rely solely on SSO/OIDC or
passkeys. The form defaults to enabled so existing deployments are
unaffected.
Changes:
- Add PASSWORD_LOGIN_ENABLED_KEY constant
- Add isPasswordLoginEnabled / setPasswordLoginEnabled to system service
(defaults to true when no DB record exists)
- Add GET/PUT /api/v1/system/password-login-status endpoints (GET
auth-gated for admin use; setting is exposed to the login page via
the existing getLoginOptions server function)
- Extend getLoginOptions to include passwordLoginEnabled
- Conditionally render the password login form in LoginPage
- Add "Enable password login" toggle in the admin System Settings tab,
next to "Enable new user registrations"
- Add corresponding entries to generated API client files
(types.gen.ts, sdk.gen.ts, @tanstack/react-query.gen.ts)
Closes#941
* fix(login): show errors even if password is disabled
* feat(cli): add command to re-enable password
---------
Co-authored-by: Nicolas Meienberger <github@thisprops.com>
* refactor(auth): mark desktop sessions with auth source
Makes it easier to filter out on session type in backend paths that
behave differently depending on the context
* chore: fix un-used import
* fix(auth): align desktop session guards
* refactor(auth): gate desktop sessions by runtime features
