64ae230d23
fix(rules): decode percent-encoded PATH rule patterns before matching
...
isPathAllowed decodes the incoming request path (and Badger already sends
Go's decoded req.URL.Path), but compared it against the rule pattern as raw
text. isValidUrlGlobPattern rejects raw spaces and non-ASCII and only accepts
them percent-encoded, so a PATH rule such as `/my%20docs/*` or `/caf%C3%A9`
was stored as `my%20docs` / `caf%C3%A9` and compared against `my docs` /
`café`, and could therefore never match any request.
Run the pattern through the same decodeAndResolvePath normalisation as the
request path so both sides are compared in decoded form.
Claude-Session: https://claude.ai/code/session_0134ujLF81GyXsCByibLcYsz
2026-09-13 19:00:59 -07:00
0a8b5e46ca
Bind share link sessions to the token's own resource
2026-08-17 14:24:21 -04:00
125091d719
Send email whitelist user downstream headers
...
Fix #1226
2026-08-14 10:51:59 -04:00
c33fa8782b
Merge branch 'aig' of https://github.com/fosrl/pangolin into aig
2026-08-12 12:35:30 -04:00
93cba1d098
support sending capability specific error codes
2026-08-12 12:34:25 -04:00
d3a1f9798d
Merge branch 'aig' of github.com:fosrl/pangolin into aig
2026-08-12 11:45:28 -04:00
115c3cbf07
show sso page in browser for gateway resource
2026-08-12 11:32:22 -04:00
bed5817da3
send, process, store, display virtual api key ai information in usage and sessions
2026-08-12 11:20:25 -04:00
83035753af
support bypass auth rules on gateway
2026-08-12 11:18:16 -04:00
379b53bcca
redirect to api key page when access gateway in browser
2026-08-12 11:15:50 -04:00
49020fa6ea
add virtual api key validation in verifySession
2026-08-12 10:38:26 -04:00
1a644b131d
Pull the session cookie properly
2026-08-04 10:15:49 -04:00
f079714caf
Dont redirect when the browser agent is not real
2026-08-04 10:07:52 -04:00
9561d23f1e
Resovle endcoding issue
2026-07-19 14:41:07 -04:00
9e2ec72ced
Fix missing resource id in cache
2026-07-18 16:15:30 -04:00
bb9b94a983
add persistent session and users to access tokens
2026-07-17 13:39:09 -04:00
6d129c0738
Fix #3099
2026-07-08 21:44:20 -04:00
1bd6f240cc
♻️ add Country is not rule to verifySession
2026-06-26 23:18:46 +02:00
b136bd2246
Escape regex metacharacters in PATH rule wildcard matching
...
isValidUrlGlobPattern accepts characters like ( ) [ ] { } | . + ^ $ in PATH rule values, but isPathAllowed converted wildcard segments to regex without escaping them. A rule value such as /(api* produced an invalid regex and threw on every request to the resource, surfacing as a 500 from verifySession. Literal characters like . and + also changed matching semantics. isPathAllowed is extracted to server/lib/pathMatch.ts as a pure module, metacharacters are escaped before wildcard substitution, compiled segment regexes are cached, and the test suite now imports the real implementation instead of a stale copy, with added coverage for special characters.
2026-06-12 11:21:21 +03:00
9d88683fc5
Reset resource info when on inline policy
2026-06-09 21:28:25 -07:00
5a575c916b
Handle backward compatability
2026-06-08 21:11:57 -07:00
bc6fd0b399
Get user resources from the right table
2026-06-03 16:53:39 -07:00
d00b737412
Pull the sso from the policies as well
2026-06-03 16:16:42 -07:00
cc5bec1d83
Pull the rules and the policy information
2026-06-03 15:33:15 -07:00
8e9071a336
Converting to use both inline and shared policy
2026-06-03 14:41:43 -07:00
12cbd40596
Fix types
2026-06-02 16:56:58 -07:00
0943cf5d4c
Dont strip session
2026-05-30 12:10:06 -07:00
76cd716caa
Add user id
2026-05-29 10:57:16 -07:00
f81f78f294
Merge branch 'dev' into resource-policies
2026-05-04 17:41:49 -07:00
b2c8311b26
Merge branch 'fosrl:dev' into dev
2026-05-03 18:53:48 +02:00
d08f276794
Use the provided host in the cookie
2026-04-24 11:55:09 -07:00
6a96f743aa
Update exchange session to support wildcards
2026-04-23 21:38:12 -07:00
789b991c56
Logging and http working
2026-04-12 15:08:17 -07:00
0cf385b718
CRUD and newt mode http mostly working
2026-04-12 12:15:29 -07:00
8e1905a695
Exclude local/private/CGNAT IPs from COUNTRY=ALL and ASN=ALL/AS0 geo-blocking rules
2026-04-12 20:19:32 +02:00
be3e066843
Merge branch 'dev' into feature/region-rules
2026-03-30 14:36:50 -07:00
757bb39622
Support overriding badger for testing
2026-03-28 21:24:13 -07:00
00ef6d617f
Handle the roles better in the verify session
2026-03-28 21:24:13 -07:00
0fecbe704b
Merge branch 'dev' into multi-role
2026-03-24 22:01:13 -07:00
0c4d9ea164
Extend santize into hybrid
2026-03-20 14:31:12 -07:00
222dd6bba3
Santize inserts
2026-03-20 10:27:18 -07:00
75f34ff127
Stub cache
2026-02-25 16:17:06 -08:00
63e208f4ec
Use local cache in verify session
2026-02-24 19:56:16 -08:00
f50d1549b0
Update cache to use redis
2026-02-24 19:50:42 -08:00
20e547a0f6
first pass
2026-02-24 17:58:11 -08:00
b622aca221
Try to route logs requests to a different database
2026-02-20 17:20:01 -08:00
be89e5ca55
Fix issue with auto provisioning being overriden
2026-02-13 14:56:56 -08:00
47743a5fa8
Fix private import -> dynamic
2026-02-11 10:26:50 -08:00
0850a28d20
Add more tier matrix checks
2026-02-11 10:06:55 -08:00
be60d66ce3
Switch to the new tier system and clean up checks
2026-02-11 10:06:03 -08:00
breken
miloschwartz
Owen
Fred KISSIE
kshitijshresth
Mustafa