Add account authentication support to web app #41
No reviewers
Labels
No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Blocks
Depends on
#26 Add authentication support
luca0N/lanbassador
#62 Add account support to the server
luca0N/lanbassador
Reference
luca0N/lanbassador!41
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "dev_client_auth"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Add account authentication support to the web app. This pull request does not include account support in the backend server.
ServerCommunicationclass for clarity#41 (comment) ↩︎
Account authentication is optional. Instance administrators can either require it, or leave it disabled. The web app should check whether the server it's configured to use requires authentication before redirecting the user to the relevant page. ↩︎
Note that support for accounts is not yet implemented in the server. This will be worked on in another pull request. I am still deciding how authentication will be implemented (either a simple session token with cookies/bearer authorization, or JWT).
I must decide which DBMS to use. Seems like there is a Go library that provides an interface to multiple RDBMSes, but I haven't dug too deep into it yet. If such library were to exist, using it would make the project much more flexible, and administrators could pick and choose their DBMS of choice. One downside is that it would likely make testing more complex, as the need for testing multiple DBMSes would surge.
2026-03-05 update: see #62 (comment)
11293068efto974d32400dI had to rebase this branch with
dev, as it was missing the required@angular/localizepackage.Doing so resulted in the commit I made losing its GPG signature (as expected), but the new commit was not signed by this Forgejo instance.
I will force-push to this branch with a signed commit ASAP (I still have the original signed one).
974d32400dto112f06f035Latest force-push rebased the branch with the
devbranch, resigning the single commit in this pull request.I had to introduce CORS headers to non-preflight requests in order to make it so Firefox would accept the
fetchrequest from a different origin (77ec56f838).As stated in the message of commit
c5e0ec41f6, I have created a new class for dynamic instance configuration retrieval. I will make use of this in (hopefully) the next commit, which will be used by the login page to send authentication requests.With the introduction of the
ServerCommssource file (and class) ina078d49086, theServerCommunicationclass should be renamed so that it's clear to everyone which one is meant for the WebSocket API.Some minor notes that need attention.
@ -0,0 +18,4 @@import { ConfigManager } from "./ConfigManager";export class ServerComms {This class should probably use the
@Injectableannotation.@ -0,0 +23,4 @@})export class AccountSession {/*** Saves the given session token to the browser storage.The
@paramcomment here was erroneously removed.@ -0,0 +42,4 @@public loadSessionToken(): string | undefined {const cookies = document.cookie.split(";");for (const cookie of cookies) {// const kv = cookie.trim().split("=");This is a leftover comment which should be removed.
8faee90b56tobcb937f7d0Latest force-push some of the previous comments 1 2.
#41 (comment) ↩︎
#41 (comment) ↩︎
At this time, the server does not have any endpoints for recovering lost passwords. Even if it had one, SMTP support would have to be implemented, which is something that is not on the roadmap, at this time. As such, all references to password recovery from the UI will be removed.
Therefore, administrators must have the ability to change the passwords of user accounts. For security reasons, users should be prompted to change their passwords immediately after logging in for the first time (after an administrator has changed their account password).
ce66450012tocba4e05309Latest force-push removes the unused Forgot password? control from the login page.
WIP: Add account authentication support to web appto Add account authentication support to web appThere are a few minor things missing, and i18n changes are yet to be committed.
@ -0,0 +41,4 @@onLoaded(ConfigManager.instanceConfig);});}Missing documentation here.
@ -0,0 +43,4 @@private getEndpointUrl(endpoint: string): string {if (this.serverHost == undefined || this.serverPort == undefined)throw new Error("The instance settings have not yet been loaded.");Unreachable code: the instance configuration is loaded during app startup, so it will always be available.
This whole file is missing the
i18nattribute.@ -0,0 +94,4 @@const dialogRef = this.dialog.open(DialogError, {data: {title: "Accounts support is disabled",message: "This Lanbassador instance does not have account support enabled. Contact the instance administrator to solve this problem if this is unexpected.",Missing i18n.
Add account authentication support to web appto WIP: Add account authentication support to web appWIP: Add account authentication support to web appto Add account authentication support to web app