* feat(sftp): add option for absolute & parent symlink backups
Related issue: #1007
Recent SSHFS now contains absolute/parent-directory symlinks by default,
which is safer for browsing but prevents Restic from archiving the
original symlink metadata. This adds an opt-in `no_contain_symlinks`
switch for trusted SFTP sources that need exact symlink backup
* refactor(sftp): block unsafe symlink with skip host check combination
* fix(bacups): reschedule immediately warning backups
Backups that didn't end properly due to a container restart should be
re-scheduled immediately
* chore: pr feedback
* feat: add option to disable password login
Adds a global admin setting to hide the username/password form on the
login page, useful for deployments that rely solely on SSO/OIDC or
passkeys. The form defaults to enabled so existing deployments are
unaffected.
Changes:
- Add PASSWORD_LOGIN_ENABLED_KEY constant
- Add isPasswordLoginEnabled / setPasswordLoginEnabled to system service
(defaults to true when no DB record exists)
- Add GET/PUT /api/v1/system/password-login-status endpoints (GET
auth-gated for admin use; setting is exposed to the login page via
the existing getLoginOptions server function)
- Extend getLoginOptions to include passwordLoginEnabled
- Conditionally render the password login form in LoginPage
- Add "Enable password login" toggle in the admin System Settings tab,
next to "Enable new user registrations"
- Add corresponding entries to generated API client files
(types.gen.ts, sdk.gen.ts, @tanstack/react-query.gen.ts)
Closes#941
* fix(login): show errors even if password is disabled
* feat(cli): add command to re-enable password
---------
Co-authored-by: Nicolas Meienberger <github@thisprops.com>
* refactor(auth): mark desktop sessions with auth source
Makes it easier to filter out on session type in backend paths that
behave differently depending on the context
* chore: fix un-used import
* fix(auth): align desktop session guards
* refactor(auth): gate desktop sessions by runtime features
* feat(authentication): api key
Keeps selected UX pieces from b487b096.
Co-authored-by: Nguyen Quy Hy <nguyenquyhy@live.com.sg>
* refactor: pr feedbacks
* chore: bump @better-auth/api-key
* refactor: global limit of 50 api key instead of 10 per org
---------
Co-authored-by: Nguyen Quy Hy <nguyenquyhy@live.com.sg>
* fix(deps): update bun minor and patch dependencies
* fix: require SSO flow for SSO org invitations
Manual enforcement since better-auth made the rule wider
* chore: re-generate api-client
---------
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Nicolas Meienberger <github@thisprops.com>
* fix: block login for 2fa users with un-verified passkeys
* refactor(passkey): show proper login error
* refactor: show passkey generic error on all failures
