* feat(sftp): add option for absolute & parent symlink backups
Related issue: #1007
Recent SSHFS now contains absolute/parent-directory symlinks by default,
which is safer for browsing but prevents Restic from archiving the
original symlink metadata. This adds an opt-in `no_contain_symlinks`
switch for trusted SFTP sources that need exact symlink backup
* refactor(sftp): block unsafe symlink with skip host check combination
* feat: add option to disable password login
Adds a global admin setting to hide the username/password form on the
login page, useful for deployments that rely solely on SSO/OIDC or
passkeys. The form defaults to enabled so existing deployments are
unaffected.
Changes:
- Add PASSWORD_LOGIN_ENABLED_KEY constant
- Add isPasswordLoginEnabled / setPasswordLoginEnabled to system service
(defaults to true when no DB record exists)
- Add GET/PUT /api/v1/system/password-login-status endpoints (GET
auth-gated for admin use; setting is exposed to the login page via
the existing getLoginOptions server function)
- Extend getLoginOptions to include passwordLoginEnabled
- Conditionally render the password login form in LoginPage
- Add "Enable password login" toggle in the admin System Settings tab,
next to "Enable new user registrations"
- Add corresponding entries to generated API client files
(types.gen.ts, sdk.gen.ts, @tanstack/react-query.gen.ts)
Closes#941
* fix(login): show errors even if password is disabled
* feat(cli): add command to re-enable password
---------
Co-authored-by: Nicolas Meienberger <github@thisprops.com>
* refactor(auth): mark desktop sessions with auth source
Makes it easier to filter out on session type in backend paths that
behave differently depending on the context
* chore: fix un-used import
* fix(auth): align desktop session guards
* refactor(auth): gate desktop sessions by runtime features
* feat(authentication): api key
Keeps selected UX pieces from b487b096.
Co-authored-by: Nguyen Quy Hy <nguyenquyhy@live.com.sg>
* refactor: pr feedbacks
* chore: bump @better-auth/api-key
* refactor: global limit of 50 api key instead of 10 per org
---------
Co-authored-by: Nguyen Quy Hy <nguyenquyhy@live.com.sg>
* fix: block login for 2fa users with un-verified passkeys
* refactor(passkey): show proper login error
* refactor: show passkey generic error on all failures
* feat(auth): add passkey authentication support
* fix: implement AI review feedback
* fix: use non-unique index for passkey_credentialID_idx in migration
* refactor(passkeys): use TanStack mutations for passkey CRUD operations
* chore: restore lockfile from main and add @better-auth/passkey
* chore: fix conflicts
* refactor(passkey-login): simplify passkey autofill event
* refactor(settings-passkeys): ux improvements
---------
Co-authored-by: Nicolas Meienberger <github@thisprops.com>
* Add repository column sorting
* Make status title correctly centered o nsmaller screens
* Add volumes column sorting
* refactor: use tanstack table for filtering and sorting
* feat: make notifications sortable
* chore: pr feedbacks
---------
Co-authored-by: Antoine Jeanselme <67123340+ajeanselme@users.noreply.github.com>
Co-authored-by: Nicolas Meienberger <github@thisprops.com>
