kodev-org
/
vikunja
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
vikunja/pkg/migration
History
kolaente 970f3c3733 fix(auth): build OIDC end-session URL with id_token_hint and post_logout_redirect_uri 
On OIDC logout Vikunja redirected to the configured `logouturl` with no query
parameters, so it never sent `id_token_hint` or `post_logout_redirect_uri`.
RP-Initiated-Logout-compliant providers (e.g. PocketID) then ignored the
post-logout redirect and left the user on the IdP's own login page.

This builds the end-session URL server-side from the OpenID Connect
RP-Initiated Logout 1.0 spec:

- id_token_hint (§2, RECOMMENDED): the ID token previously issued to the
  session. It lets the OP skip the logout-confirmation prompt and is what makes
  the OP honor post_logout_redirect_uri (the OP MAY require it, §3).
- post_logout_redirect_uri (§2, OPTIONAL): where the OP redirects after logout.
  MUST be pre-registered with the OP. Defaults to service.publicurl so the user
  lands back on Vikunja.
- client_id (§2, OPTIONAL): the RP client id; the OP verifies it matches the
  id_token_hint.

The end_session_endpoint is discovered from the provider's discovery document
(§2.1, REQUIRED metadata) and falls back to the static `logouturl` config when
the provider does not publish one.

To replay id_token_hint, the raw ID token (and the provider key) are persisted
on the session at the OIDC callback (new migration adds oidc_id_token /
oidc_provider_key columns to the sessions table). At logout the server reads
them, builds the URL, deletes the session, and returns the URL in the logout
response so the frontend redirects to it.

Security note: the raw ID token is stored at rest in the sessions table
(json:"-", never exposed over the API) and removed when the session is deleted
on logout.

Spec: OpenID Connect RP-Initiated Logout 1.0
https://openid.net/specs/openid-connect-rpinitiated-1_0.html

Fixes #2820
 		2026-06-19 16:06:26 +02:00
..
20190324205606.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20190328074430.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20190430111111.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20190511202210.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20190514192749.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20190524205441.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20190718200716.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20190818210133.go feat!: rename right to permission (#1277) 2025-08-13 11:05:05 +02:00
20190920185205.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20190922205826.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20191008194238.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20191010131430.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20191207204427.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20191207220736.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200120201756.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200219183248.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200308205855.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200308210130.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200322214440.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200322214624.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200417175201.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200418230432.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200418230605.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200420215928.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200425182634.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200509103709.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200515172220.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200515195546.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200516123847.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200524221534.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200524224611.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200614113230.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200621214452.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200801183357.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200904101559.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200905151040.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200905232458.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20200906184746.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20201025195822.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20201121181647.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20201218152741.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20201218220204.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20201219145028.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210207192805.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210209204715.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210220222121.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210221111953.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210321185225.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210328191017.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210403145503.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210403220653.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210407170753.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210411113105.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210411161337.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210413131057.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210527105701.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210603174608.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210709191101.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210709211508.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210711173657.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210713213622.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210725153703.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210727204942.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210727211037.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210729142940.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210802081716.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20210829194722.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20211212151642.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20211212210054.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20220112211537.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20220616145228.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20220815200851.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20221002120521.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20221113170740.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20221228112131.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20230104152903.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20230307171848.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20230611170341.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20230824132533.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20230828125443.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20230831155832.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20230903143017.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20230913202615.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20231022144641.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20231108231513.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20231121191822.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20240114224713.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20240304153738.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20240309111148.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20240311173251.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20240313230538.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20240314214802.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20240315093418.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20240315104205.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20240315110428.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20240329170952.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20240406125227.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20240603172746.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20240919130957.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20241028131622.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20241118123644.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20241119115012.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20250317174522.go fix: preserve teams external_id type when renaming on mysql 2026-02-24 14:29:49 +01:00
20250323212553.go fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
20250402173109.go feat(auth): allow passing custom settings links to user account via openid claims 2025-08-03 13:25:32 +02:00
20250624092830.go fix: add migration for non-unique task buckets 2025-06-25 11:12:24 +02:00
20250813093602.go feat!: rename right to permission (#1277) 2025-08-13 11:05:05 +02:00
20251001113831.go fix: handle mixed-format bucket configurations in migration (#2033) 2026-01-05 22:30:10 +01:00
20251108154913.go fix: handle MySQL 8 CREATE INDEX without IF NOT EXISTS support (#1903) 2025-11-28 15:57:54 +00:00
20251118125156.go feat: task unread tracking (#1857) 2025-11-27 15:14:42 +01:00
20260123000717.go fix: replace tx.Sync() with explicit ALTER TABLE in webhooks migration 2026-02-24 14:29:49 +01:00
20260224113347.go feat: add sessions table migration 2026-02-25 10:30:25 +01:00
20260224122023.go fix: cast bucket_configuration to text in postgres catchup query 2026-02-24 14:29:49 +01:00
20260224122023_test.go fix: cast bucket_configuration to text in postgres catchup query 2026-02-24 14:29:49 +01:00
20260224215050.go fix: use MySQL-compatible CREATE INDEX in migration 20260224215050 2026-03-23 16:45:50 +00:00
20260225114726.go refactor: remove typesense support 2026-02-25 12:15:28 +01:00
20260226172819.go feat: add OAuth 2.0 authorization code model and migration 2026-03-27 23:05:04 +00:00
20260324120000.go feat(db): add license_status table migration 2026-04-15 10:32:37 +00:00
20260405194817.go feat(migration): add bot_owner_id column to users 2026-05-01 14:44:10 +00:00
20260411013328.go feat(tasks): enforce unique (project_id, index) via migration 2026-04-11 20:44:28 +00:00
20260415143536.go feat(db): add is_admin column to users 2026-04-20 18:55:06 +00:00
20260519120000.go feat(projects): always store identifiers as uppercase (#2775) 2026-05-19 10:35:43 +02:00
20260607132257.go feat(time-tracking): add the time_entries table migration 2026-06-08 13:54:09 +00:00
20260617153629.go fix(migration): fail loudly if a deduplicated position pair has no row 2026-06-17 21:16:41 +00:00
20260619155410.go fix(auth): build OIDC end-session URL with id_token_hint and post_logout_redirect_uri 2026-06-19 16:06:26 +02:00
migration.go feat: add license comments for agents and humans 2026-04-15 10:32:37 +00:00