Anshuman Tripathi and GitHub
7c437fabf3
fix: corrected service reference ( #2559 )
2026-02-27 13:45:01 -05:00
Reynaldi Chernando and GitHub
613b0482e8
Add nano banana 2 ( #2562 )
2026-02-27 13:00:36 -05:00
Daniel Salazar and GitHub
784847b1b1
feat: enforce private app hosting access gate ( #2557 )
...
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
Add private app access gating in PuterSiteMiddleware with entitlement event checks, bootstrap/private cookie token flow, and camelCase helper/test updates.
2026-02-26 23:42:32 -08:00
Daniel Salazar and GitHub
23089901dd
perf:remove recents cache ( #2558 )
2026-02-26 16:38:58 -08:00
Daniel Salazar and GitHub
adce8c64db
feat: add private app access extension event contract ( #2556 )
...
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
* feat: add private app access extension event contract
Define app.private-access.check in extension API typings with mutable allow/redirect decision fields for entitlement handlers.
* refactor: camelCase private access event contract
Rename private access extension event and payload fields to camelCase for consistency with repo conventions.
2026-02-26 15:04:23 -08:00
Daniel Salazar and GitHub
15e7a3503b
feat: add private app asset token auth helpers ( #2555 )
...
* feat: add private app asset token auth helpers
Add mint/verify helpers and hardened cookie option helpers for app-private-asset tokens in AuthService.
Add focused tests for claims validation, mismatch denial, and cookie option defaults.
* fix: add prvate app config for new subdomain
2026-02-26 14:19:59 -08:00
Daniel Salazar and GitHub
f8560cf0f9
fix: delete redis keys in parallel, don't grant both read and write if just write needed ( #2552 )
2026-02-26 14:03:21 -08:00
Daniel Salazar and GitHub
1887352301
fix: don't await cache invalidation for grant app permission ( #2551 )
...
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
* fix: disable broadcast for cache invalidation
* fix: remove broadcast for redis events for now
* fix: don't await cache invalidation for grant app permission
2026-02-25 17:26:42 -08:00
Daniel Salazar and GitHub
2c1b21e197
feat: type extension cache update events ( #2548 )
...
* feat: type extension cache update events
Expose outer.cacheUpdate in extension API typings and consolidate extension service typing via ServicesMap.
* fix: batch broadcast events
* fix: bad import
* fix: import socket io
* fix: bad undefined call
* fix: simplify await for broadcast processing
2026-02-25 17:05:05 -08:00
Daniel Salazar and GitHub
aa04dfabb4
feat: add is_private to apps ( #2546 )
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
2026-02-25 13:26:16 -08:00
Eric Dubé and GitHub
c4346df24e
fix(gui): defer login event until listener registered ( #2547 )
...
Fixes an error introduced in 4b8c46e
2026-02-25 14:22:06 -05:00
Daniel Salazar and GitHub
7a1468d070
fix: app icons via subdomain on localhost ( #2544 )
2026-02-25 10:14:39 -08:00
jelveh
71f7698a46
Await update_auth_data to avoid races
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
2026-02-24 18:33:30 -08:00
jelveh
0515b65138
Await update_auth_data to avoid race conditions
2026-02-24 18:24:33 -08:00
Daniel Salazar and GitHub
66f1cd0bc3
fix: remove broadcast for cache updates ( #2542 )
...
* fix: disable broadcast for cache invalidation
* fix: remove broadcast for redis events for now
2026-02-24 16:45:32 -08:00
Eric Dubé and GitHub
6658a90b6a
fix(backend): invalidate app permission debounce ( #2541 )
...
* fix(backend): debounce app permission invalidation
* fix(backend): debounce app permission invalidation
2026-02-24 19:00:34 -05:00
Daniel Salazar and GitHub
4c863cc5bc
fix: make invalidations more robust ( #2529 )
2026-02-24 15:45:46 -08:00
Daniel Salazar and GitHub
6544e8c250
cleanup,:remove debugger calls in our code ( #2535 )
2026-02-24 15:42:39 -08:00
Eric Dubé and GitHub
ce3c9bff34
Fix OIDC in popups ( #2539 )
...
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
* fix(oidc): OIDC login with puter.js popup auth
Bring login through OpenID Connect to a working state in the puter.js
popup authentication flow. This allows OIDC login to work with
third-party websites and apps.
* fix(oidc): error handling, use const (initgui)
Remove a condition that can be handled by the control flow logic
already implied by a try...catch, which also allows a variable to become
const, and log errors in this catch block.
* doc(oidc): make this comment a little more helpful
* clean(oidc): remove out-of-scope puter.js change
Remove a change that gives explicit overrides of the `defaultGUIOrigin`
paramter precedence over other sources of this value. This was necessary
when testing but might not be the correct fix for this issue.
2026-02-24 17:17:18 -05:00
Neal Shah and GitHub
267713481c
fix desktop gui error handling for workers ( #2538 )
2026-02-24 16:32:14 -05:00
Neal Shah and GitHub
1e3193366a
dont forward data urls through cors proxy and fix core.validation ( #2537 )
...
* exempt data urls from using cors proxy
* disallow unlimited use
* make core.validation defined again
2026-02-24 16:11:00 -05:00
Daniel Salazar and GitHub
052e3f9dcb
cache: extend cache invalidation to emit events out too ( #2532 )
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
2026-02-23 22:24:57 -08:00
Neal Shah and GitHub
c14dd5ae78
WIP: use cors proxy for outbound requests ( #2533 )
2026-02-24 01:10:23 -05:00
jelveh
eaaeb4e6a4
Await update_auth_data before continuing
...
Await the window.update_auth_data call in initgui.js so subsequent logic (such as popup spinner hiding and timing) runs after authentication data has been updated. This prevents race conditions where later UI code executes before auth state is fully applied.
2026-02-23 18:19:35 -08:00
jelveh
8f4a38ae0b
Load user preferences with error handling
...
Read user preference keys (show_hidden_files, language, clock_visible) into local variables with try/catch and sensible defaults, instead of fetching/parsing them inline. This prevents exceptions from missing or malformed KV entries and centralizes parsing for show_hidden_files. Also remove an extra blank line in initgui.js's AJAX complete callback.
2026-02-23 16:52:56 -08:00
Eric Dubé and GitHub
4554331eff
dev(oidc): redirect to login/signup on error ( #2531 )
...
Redirect to the login or signup page when there is an error signing in
or creating an account using OIDC, instead of displaying the error on a
new page. Alter the flow in cases where the suggested action is not the
same as the initial action taken by the user (based on the error case).
2026-02-23 17:56:38 -05:00
Daniel Salazar and GitHub
eda9f117c7
fix: default timeout on user caches of 15 min ( #2530 )
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
2026-02-23 14:21:24 -08:00
Daniel Salazar and GitHub
e60f55f20e
fix: stricter invalidation for 2fa and confirm email codes ( #2528 )
2026-02-23 09:01:59 -08:00
P3il4 and GitHub
779321d334
fix nano banana pro pricing and resolutions ( #2501 )
...
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
* fix nano banana pro pricing and resolutions
* move gemini resolution map into models.ts
* require gemini 3 model for specific resolution and price logic
* fix usageamount for mp models
2026-02-23 03:39:48 -05:00
samarthmishra46 and GitHub
0ee2ebd7b4
added keyboard shortcut in the setting for better ui navigation ( #2484 )
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
2026-02-22 18:31:15 -08:00
Eric Dubé and GitHub
96be8707b8
Merge pull request #2526 from HeyPuter/eric/262L0_PUT-533
...
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
fix: bad copy with reference in UIItem
2026-02-21 20:19:59 -05:00
KernelDeimos
7ba40f8062
fix: bad copy with reference in UIItem
...
UIItem makes a recursive call when there are multiple matching elements
in the `options.appendTo` argument. When calling recursively, the
`appendTo` property of the `options` object is mutated to a specific
element before the call, which expects that each call to UIItem occurs
synchronously. UIItem was made asynchronous by
9d598f7965Resolves #2514
2026-02-21 20:14:08 -05:00
Neal Shah and GitHub
1ed765cb86
Clarify expiration time unit in getReadURL.md ( #2525 )
...
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
Updated the documentation to specify that the expiration time is in milliseconds instead of seconds.
2026-02-21 04:15:27 -05:00
Daniel Salazar and GitHub
9f87ccb460
fix: cleanup some app es and app service validation ( #2523 )
...
we saw some errors with icons not allowed when being objects, this likely user error, but this adds some validation to at least avoid nulls being flagged wrong
2026-02-21 00:10:55 -08:00
Daniel Salazar and GitHub
3a89deaf02
fix: wrong icon for workers ( #2524 )
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
2026-02-20 19:20:18 -08:00
Daniel Salazar and GitHub
3834571ab8
fix: don't call stat on each file in dir ( #2522 )
...
* fix: decrease metering service gloabl rate of change check
* fix: don't call stat on each file in dir
2026-02-20 19:07:16 -08:00
Daniel Salazar and GitHub
d418976ee4
perf: batching get_apps cache look ups ( #2521 )
...
should not be slow in any case, but this should help a bit more with speed in trade of more ram and cpu usage
2026-02-20 18:02:47 -08:00
Daniel Salazar and GitHub
22c1cd8be4
lint: fix eslint indentation for switch cases ( #2520 )
...
also trying to preserve call indentations, but afraid its not exactly the same, but fairly close
2026-02-20 17:22:00 -08:00
Daniel Salazar and GitHub
3b32b4a437
fix: don't await for cache writes ( #2519 )
...
* fix: allow healthcheck from other hosts
* fix: don't await for cache writes
we think some awaiting on redis writes was causing issues, we shouldn't need to await really, so removing now. will have optimistic caching for these
some style changes from a recently changed rule that seems to clash with prior one
2026-02-20 17:19:01 -08:00
Miika Kuisma and GitHub
808b78c234
Fixed: puter.chat button has weird gradient when browser is dark mode ( #2516 )
...
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
Fixed: The gradient and progress bar on the usage details page is not very pleasant and looks inverted
Fixed: The billing card on the billing tab is still light mode
2026-02-19 19:43:20 -08:00
Eric Dubé and GitHub
21185cdb3f
Merge pull request #2460 from HeyPuter/eric/262A0_PUT-453
...
Login/Signup with OIDC
Wellp... this is not a rebase, this is merge. My hands were tied this time.
2026-02-19 22:39:44 -05:00
KernelDeimos
ef0a665a5f
fix(oidc): add code lost due to editing a .js
...
This code was previously lost because I edited `outcomeutil.js` instead
of `outcomeutil.ts`. We're not building into a `dist/` directory and
`tsc` has a most peculiar lack of generating a comment at the top of
output files stating something like "// GENERATED - DO NOT EDIT" as I've
seen from every other code generator or transpiler I've worked with.
This caused the bug with duplicate confirmed emails and "account not
found" during testing on the staging server.
2026-02-19 21:25:24 -05:00
Daniel Salazar
b39bbe0a0a
Merge remote-tracking branch 'origin/main' into eric/262A0_PUT-453
2026-02-19 16:45:10 -08:00
Daniel Salazar and GitHub
2e7765004c
fix: redis cache deletions ( #2518 )
2026-02-19 16:43:56 -08:00
Daniel Salazar
0cca9d5535
fix : import
2026-02-19 16:08:48 -08:00
KernelDeimos
1be3eca335
fix: rate limits for oidc too extreme
2026-02-19 19:00:01 -05:00
Daniel Salazar
7493573c61
Merge remote-tracking branch 'origin/main' into eric/262A0_PUT-453
2026-02-19 15:28:14 -08:00
Daniel Salazar and GitHub
ec412eaff6
feat: cleanup cache invalidation and pull out keys to be easily used in other places that need the same cache ( #2515 )
...
fix: tests
2026-02-19 15:07:04 -08:00
KernelDeimos
0112f097db
style(oidc): if instead of return with ternary expression
2026-02-19 17:18:48 -05:00
KernelDeimos
4e01608e4a
dev: remove guarded debug log
2026-02-19 17:02:33 -05:00
