Commit Graph

5269 Commits

Author SHA1 Message Date
Eric Dubé 0fa0340ca2 clean(apps): merge fns only called by get_app_icon_url (#2617)
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
Each of these methods is only being called by get_app_icon_url. By
changing that ternary operator into an `if` block with an early return
we can move the bodies of these functions here. If one of the former
functions ever needs to be used in more than one place, it's easy to
extract it out of here agian - for now though let's not pay the cost of
jumping to another function definition while trying to understand this
code if we're not gaining anything from it.
2026-03-06 20:07:14 -05:00
Eric Dubé 2a027ed410 fix(puterfs): await queue items for fsentry action (#2616)
* style(puterfs): update adherence to linter rules

* fix(puterfs): await queue items for fsentry actions

This will ensure some operations always function as expected in a
sequence, although it may incur some performance costs.
2026-03-06 20:04:18 -05:00
ProgrammerIn-wonderland a0fc1bca30 add gpt 5.3 codex and gpt 5.4 (#2618)
* add gpt 5.3 codex and gpt 5.4

* add gemini 3.1 pro preview
2026-03-06 16:59:39 -08:00
Daniel Salazar a861c3e27a chore: typeFixes (#2615)
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
2026-03-06 00:04:39 -08:00
Miika Kuisma 8e794faf06 Merge pull request #2595 from HeyPuter/miika/put-611
Fix border colors in Settings panel
2026-03-06 10:03:25 +02:00
Eric Dubé f167da9a0a clean: remove a log (#2610)
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
2026-03-04 22:02:36 -05:00
Daniel Salazar 4aab06611e feat: redirect away cookie (#2609) 2026-03-04 17:54:58 -08:00
ProgrammerIn-wonderland 9a6178e66f Make credentialless false by default 2026-03-04 20:54:04 -05:00
Daniel Salazar 237973f227 fix: fetching user from session token (#2607)
old bug was causing issues trying to use sessions as auth checks for tighter security for private apps. missed it without more detailed logs
2026-03-04 17:29:52 -08:00
Daniel Salazar 3f0b0bfd1d feat: more robust error logs (#2605) 2026-03-04 16:47:01 -08:00
Daniel Salazar d28cc46e02 fix: add logs to debug on prod (#2604) 2026-03-04 16:20:52 -08:00
Eric Dubé 0864b9ece1 dev(apps): add configuration to not use app icon subdomain (#2603)
* dev(apps): add configuration to not use app icon subdomain

For some local configurations of Puter, such as using ngrok or a hosting
service that has limited subdomains or limited subdomain depth, the
static hosting subdomain for app icons is difficult to configure and may
not be viable. Since this is only done so an external geo-replicated
cache can be used, and it's always possible for Puter's backend to
generate an app icon, it should be possible to configure Puter's backend
to use icons from a URL hosted on the default subdomain.

Add a configuration parameter to the service "app-icon" called
"no_subdomain" which prevents Puter's backend from sending puter-icons
subdomain URLs or redirecting to them.

Also perform some small cleanup changes to make the existing code easier
to understand, including:
- rename `buildAppIconUrl` to `buildAppIconSubdomainUrl` to make it
  clear which of the two types of icon URLs are being generated.
- replace `withAppIconUrl` with `get_app_icon_url` so it is possible to
  get an icon URL without mutating an app object.
- make the `get_taskbar_items` helper use the same code for getting app
  icons as the `get_apps` helper.

* fix(apps): test initializes a service with no config
2026-03-04 19:10:32 -05:00
jelveh d802d12a05 Add UI notify API and notification handling 2026-03-04 15:29:50 -08:00
Daniel Salazar 9721943040 fix: prioritize new token thant anything outdated stored in localstorage (#2600) 2026-03-04 14:49:05 -08:00
KernelDeimos fc29e57730 fix(oidc): request object reference in oidc signup
The request object was not being passed to OIDC signup because it is
called by createUserFromOIDC which doesn't take a request object as a
parameter. It was decided to have `create_user` take the request object
from context if it's not specified rather than change the signature of
createUserFromOIDC.
2026-03-04 14:33:36 -05:00
Daniel Salazar 1720c97851 fix: origin canonization (#2597) 2026-03-04 11:09:25 -08:00
Daniel Salazar 8a14871dde fix: bad token generation for private apps (#2596)
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
2026-03-04 10:09:16 -08:00
Miika Kuisma f887c56e61 Restored previously used border colors 2026-03-04 10:32:39 +02:00
jelveh 6248a89a59 Add autoplay to iframe allow list
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
2026-03-03 22:20:31 -08:00
Daniel Salazar 6b6f9b4743 fix: puter site middleware host (#2594) 2026-03-03 22:18:47 -08:00
Daniel Salazar 8380b28d8a fix: reset subdomain if empty (#2593) 2026-03-03 21:07:55 -08:00
Daniel Salazar adf034b120 feat: add subdomain to private asset tokens (#2591) 2026-03-03 20:37:17 -08:00
KernelDeimos 468558f8dc dev(oidc): hide unnecessary div
I decided not to remove it because I really don't want to introduce a
bug right now while everything is finally working smoothly... I'm making
a note to properly clean this up later when it can be more easily tested
in isolation from everything else.
2026-03-03 23:08:05 -05:00
Daniel Salazar dbdead9ad1 fix: remove redis cache scan in favour of direct key invalidation (#2589) 2026-03-03 19:55:41 -08:00
jelveh 80cabca7ad Add Google SVG icon to sign-in button 2026-03-03 19:31:39 -08:00
Baptiste Lyet f0d0e1d8ca docs : udpdate current year (#2585) 2026-03-04 10:30:42 +07:00
Daniel Salazar 911c163fc8 feat: private app config to use app urls + app routing (#2587)
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
* feat: private app config to use app urls

* fix: launch app

* fix: cookie origin
2026-03-03 18:34:33 -08:00
KernelDeimos 3cd5268379 fix(oidc): login flow with puter.ui.authenticateWithPuter
It turns out there are nuances between `puter.ui.authenticateWithPuter`
vs `puter.auth.signIn` - these don't do the same thing. The primary
difference is that `puter.ui.authenticateWithPuter` will display an
override if it's not triggered by a user action, whereas
`puter.auth.signIn` will not. This definitely suggests
`puter.ui.authenticateWithPuter` should be a caller of
`puter.auth.signIn` instead of implementing its own logic for handling
the popup - that makes this part of the code more fagile - but that
refactor is out-of-scope for this bug fix.
2026-03-03 21:20:46 -05:00
Daniel Salazar 1f975b9d19 fix: private app config to use app urls (#2586) 2026-03-03 15:49:33 -08:00
Daniel Salazar 4f5fec5ee4 feat: resolve private app hosts by index_url fallback (#2583)
* feat: resolve private app hosts by index_url fallback

Adds a private-app lookup fallback for hosted subdomains without associated_app_id by matching owner-scoped index_url candidates built from request host and configured protocol.

* fix: redirect path

* fix: add new domains too

* fix, bootstrap url

* fix: bootstrap url

* fix: auto sign in puter pirvate app
2026-03-03 13:52:12 -08:00
KernelDeimos 930cbfb770 fix(ai): additional auth guard (corrected 676b6c3)
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
2026-03-02 19:55:07 -05:00
KernelDeimos 91b9aa014a Reapply "fix(auth): add explicit check for access token suspension (#2576)" (#2579)
This reverts commit 8349b0d692.
2026-03-02 19:45:11 -05:00
KernelDeimos 9fd1d0a2e2 Revert "fix(ai): additional auth guard (#2577)"
This reverts commit 676b6c31e1.
2026-03-02 19:37:18 -05:00
Eric Dubé 8349b0d692 Revert "fix(auth): add explicit check for access token suspension (#2576)" (#2579)
This reverts commit f6b9c69ce6.
2026-03-02 19:24:15 -05:00
Eric Dubé 8073f73032 Eric/26323 revert 26322 (#2578)
* fix(ai): additional auth guard

* Revert "fix(ai): additional auth guard"

This reverts commit 03d4e66e3b.
2026-03-02 19:12:41 -05:00
Eric Dubé 676b6c31e1 fix(ai): additional auth guard (#2577) 2026-03-02 18:45:33 -05:00
Eric Dubé f6b9c69ce6 fix(auth): add explicit check for access token suspension (#2576) 2026-03-02 17:10:42 -05:00
Miika Kuisma c0583a9095 Fix: When a maximized window gets resized, Puter apps should be resized as well (#2498)
* Fix: When a maximized window gets resized, Puter apps should be resized as well

* Fix maximixed selector to match any window with data-is_maximized (not just apps)
2026-03-02 10:48:47 -08:00
jelveh 43b313972c Revert "Permission modal now displays application's icon and title. Read and write access requests have their own text strings. (#2499)"
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
This reverts commit 0f33e49335.
2026-03-01 21:59:10 -08:00
Miika Kuisma 0f33e49335 Permission modal now displays application's icon and title. Read and write access requests have their own text strings. (#2499) 2026-03-01 20:02:20 -08:00
Eric Dubé f2926c948e fix(oidc): bring "Add Existing User" to working state (#2572)
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
2026-02-28 16:39:20 -05:00
Daniel Salazar 314c671778 fix: redis startup (#2571)
add event logging and handling to deal with redis startup
2026-02-28 13:25:42 -08:00
Daniel Salazar bb02fc6e6b fix: hardcode default perm (#2570) 2026-02-28 13:13:05 -08:00
Daniel Salazar 537f3957ed feat: add private app direct-login bootstrap page (#2566)
* feat: add private app direct-login bootstrap page

Serves a lightweight puter.js sign-in interstitial when private app identity is missing, then retries with a bootstrap token query param while preserving entitlement redirect behavior for authenticated denies.

* fix: allow private app subdomain
2026-02-28 13:04:14 -08:00
Daniel Salazar 2eb16ceab6 chore: switch private hosting domain to puter.dev (#2565)
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
Updates private app hosting defaults and middleware/test expectations from puter.app to puter.dev for current rollout needs.
2026-02-27 16:24:54 -08:00
Eric Dubé 2cc8cb22f8 [OIDC] allow user deletion for accounts without a password (#2567)
* fix: user deletion for OIDC accounts

* clean(backend): update copied license header

* clean(backend): replace previously removed comments

* fix: double-encoding
2026-02-27 18:55:12 -05:00
Eric Dubé 9d4e990b92 dev(oidc): switch login/signup flows where applicable (#2550)
For convenience, switch flow if the user's action doesn't match the
system state when signing up or logging in with Google:
- If the user chooses "signup" but they already have an account, log
  them into that account.
- If the user chooses "login" but they do not have an account yet,
  create an account where their authenticated email address.
2026-02-27 18:30:17 -05:00
Daniel Salazar 7e07c3d937 feat: add private access rollout gate and auditing (#2560)
Adds a config flag to disable private app gate enforcement, structured middleware audit logs for private access decisions, and regression coverage for the disabled-gate path.
2026-02-27 13:55:15 -08:00
Eric Dubé 866825767b fix(backend): default rate-limit scope instead of error (#2564)
When a rate-limit scope is not configured, use a default configuration
instead of throwing an error. Display a warning about the unconfigured
rate-limit scope when the default is used.
2026-02-27 15:58:36 -05:00
Anshuman Tripathi 7c437fabf3 fix: corrected service reference (#2559) 2026-02-27 13:45:01 -05:00