Anshuman Tripathi
7c437fabf3
fix: corrected service reference ( #2559 )
2026-02-27 13:45:01 -05:00
Reynaldi Chernando
613b0482e8
Add nano banana 2 ( #2562 )
2026-02-27 13:00:36 -05:00
Daniel Salazar
784847b1b1
feat: enforce private app hosting access gate ( #2557 )
...
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
Add private app access gating in PuterSiteMiddleware with entitlement event checks, bootstrap/private cookie token flow, and camelCase helper/test updates.
2026-02-26 23:42:32 -08:00
Daniel Salazar
23089901dd
perf:remove recents cache ( #2558 )
2026-02-26 16:38:58 -08:00
Daniel Salazar
15e7a3503b
feat: add private app asset token auth helpers ( #2555 )
...
* feat: add private app asset token auth helpers
Add mint/verify helpers and hardened cookie option helpers for app-private-asset tokens in AuthService.
Add focused tests for claims validation, mismatch denial, and cookie option defaults.
* fix: add prvate app config for new subdomain
2026-02-26 14:19:59 -08:00
Daniel Salazar
f8560cf0f9
fix: delete redis keys in parallel, don't grant both read and write if just write needed ( #2552 )
2026-02-26 14:03:21 -08:00
Daniel Salazar
1887352301
fix: don't await cache invalidation for grant app permission ( #2551 )
...
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
* fix: disable broadcast for cache invalidation
* fix: remove broadcast for redis events for now
* fix: don't await cache invalidation for grant app permission
2026-02-25 17:26:42 -08:00
Daniel Salazar
2c1b21e197
feat: type extension cache update events ( #2548 )
...
* feat: type extension cache update events
Expose outer.cacheUpdate in extension API typings and consolidate extension service typing via ServicesMap.
* fix: batch broadcast events
* fix: bad import
* fix: import socket io
* fix: bad undefined call
* fix: simplify await for broadcast processing
2026-02-25 17:05:05 -08:00
Daniel Salazar
aa04dfabb4
feat: add is_private to apps ( #2546 )
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
2026-02-25 13:26:16 -08:00
Daniel Salazar
7a1468d070
fix: app icons via subdomain on localhost ( #2544 )
2026-02-25 10:14:39 -08:00
Daniel Salazar
66f1cd0bc3
fix: remove broadcast for cache updates ( #2542 )
...
* fix: disable broadcast for cache invalidation
* fix: remove broadcast for redis events for now
2026-02-24 16:45:32 -08:00
Eric Dubé
6658a90b6a
fix(backend): invalidate app permission debounce ( #2541 )
...
* fix(backend): debounce app permission invalidation
* fix(backend): debounce app permission invalidation
2026-02-24 19:00:34 -05:00
Daniel Salazar
4c863cc5bc
fix: make invalidations more robust ( #2529 )
2026-02-24 15:45:46 -08:00
Daniel Salazar
6544e8c250
cleanup,:remove debugger calls in our code ( #2535 )
2026-02-24 15:42:39 -08:00
Eric Dubé
ce3c9bff34
Fix OIDC in popups ( #2539 )
...
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
* fix(oidc): OIDC login with puter.js popup auth
Bring login through OpenID Connect to a working state in the puter.js
popup authentication flow. This allows OIDC login to work with
third-party websites and apps.
* fix(oidc): error handling, use const (initgui)
Remove a condition that can be handled by the control flow logic
already implied by a try...catch, which also allows a variable to become
const, and log errors in this catch block.
* doc(oidc): make this comment a little more helpful
* clean(oidc): remove out-of-scope puter.js change
Remove a change that gives explicit overrides of the `defaultGUIOrigin`
paramter precedence over other sources of this value. This was necessary
when testing but might not be the correct fix for this issue.
2026-02-24 17:17:18 -05:00
Neal Shah
1e3193366a
dont forward data urls through cors proxy and fix core.validation ( #2537 )
...
* exempt data urls from using cors proxy
* disallow unlimited use
* make core.validation defined again
2026-02-24 16:11:00 -05:00
Daniel Salazar
052e3f9dcb
cache: extend cache invalidation to emit events out too ( #2532 )
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
2026-02-23 22:24:57 -08:00
Neal Shah
c14dd5ae78
WIP: use cors proxy for outbound requests ( #2533 )
2026-02-24 01:10:23 -05:00
Eric Dubé
4554331eff
dev(oidc): redirect to login/signup on error ( #2531 )
...
Redirect to the login or signup page when there is an error signing in
or creating an account using OIDC, instead of displaying the error on a
new page. Alter the flow in cases where the suggested action is not the
same as the initial action taken by the user (based on the error case).
2026-02-23 17:56:38 -05:00
Daniel Salazar
eda9f117c7
fix: default timeout on user caches of 15 min ( #2530 )
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
2026-02-23 14:21:24 -08:00
Daniel Salazar
e60f55f20e
fix: stricter invalidation for 2fa and confirm email codes ( #2528 )
2026-02-23 09:01:59 -08:00
P3il4
779321d334
fix nano banana pro pricing and resolutions ( #2501 )
...
Docker Image CI / build-and-push-image (push) Has been cancelled
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
release-please / release-please (push) Has been cancelled
test / test-backend (24.x) (push) Has been cancelled
test / API tests (node env, api-test) (24.x) (push) Has been cancelled
test / puterjs (node env, vitest) (24.x) (push) Has been cancelled
* fix nano banana pro pricing and resolutions
* move gemini resolution map into models.ts
* require gemini 3 model for specific resolution and price logic
* fix usageamount for mp models
2026-02-23 03:39:48 -05:00
Daniel Salazar
9f87ccb460
fix: cleanup some app es and app service validation ( #2523 )
...
we saw some errors with icons not allowed when being objects, this likely user error, but this adds some validation to at least avoid nulls being flagged wrong
2026-02-21 00:10:55 -08:00
Daniel Salazar
3834571ab8
fix: don't call stat on each file in dir ( #2522 )
...
* fix: decrease metering service gloabl rate of change check
* fix: don't call stat on each file in dir
2026-02-20 19:07:16 -08:00
Daniel Salazar
d418976ee4
perf: batching get_apps cache look ups ( #2521 )
...
should not be slow in any case, but this should help a bit more with speed in trade of more ram and cpu usage
2026-02-20 18:02:47 -08:00
Daniel Salazar
3b32b4a437
fix: don't await for cache writes ( #2519 )
...
* fix: allow healthcheck from other hosts
* fix: don't await for cache writes
we think some awaiting on redis writes was causing issues, we shouldn't need to await really, so removing now. will have optimistic caching for these
some style changes from a recently changed rule that seems to clash with prior one
2026-02-20 17:19:01 -08:00
KernelDeimos
ef0a665a5f
fix(oidc): add code lost due to editing a .js
...
This code was previously lost because I edited `outcomeutil.js` instead
of `outcomeutil.ts`. We're not building into a `dist/` directory and
`tsc` has a most peculiar lack of generating a comment at the top of
output files stating something like "// GENERATED - DO NOT EDIT" as I've
seen from every other code generator or transpiler I've worked with.
This caused the bug with duplicate confirmed emails and "account not
found" during testing on the staging server.
2026-02-19 21:25:24 -05:00
Daniel Salazar
b39bbe0a0a
Merge remote-tracking branch 'origin/main' into eric/262A0_PUT-453
2026-02-19 16:45:10 -08:00
Daniel Salazar
2e7765004c
fix: redis cache deletions ( #2518 )
2026-02-19 16:43:56 -08:00
Daniel Salazar
0cca9d5535
fix : import
2026-02-19 16:08:48 -08:00
KernelDeimos
1be3eca335
fix: rate limits for oidc too extreme
2026-02-19 19:00:01 -05:00
Daniel Salazar
7493573c61
Merge remote-tracking branch 'origin/main' into eric/262A0_PUT-453
2026-02-19 15:28:14 -08:00
Daniel Salazar
ec412eaff6
feat: cleanup cache invalidation and pull out keys to be easily used in other places that need the same cache ( #2515 )
...
fix: tests
2026-02-19 15:07:04 -08:00
KernelDeimos
4e01608e4a
dev: remove guarded debug log
2026-02-19 17:02:33 -05:00
KernelDeimos
b3b32980db
clean(oidc): remove jwt remap in ESM code
2026-02-19 16:32:41 -05:00
KernelDeimos
f3bf40a3c0
style(oidc): rename httpPowers to hasHttpOnlyCookie
2026-02-19 16:29:19 -05:00
KernelDeimos
4de6d38604
style(oidc): make this a private method
2026-02-19 16:23:40 -05:00
KernelDeimos
4c518830ea
clean(oidc): remove "ghost files"
2026-02-19 16:23:40 -05:00
KernelDeimos
b5d719e110
lint: [+] no-useless-computed-key:error
2026-02-19 16:23:38 -05:00
KernelDeimos
c97a499bc9
style(oidc): private members in OIDCService
2026-02-19 16:21:43 -05:00
KernelDeimos
16f2f5bf5f
style(oidc): address PR rev on oidcCallbackPreamble_
2026-02-19 16:21:42 -05:00
KernelDeimos
720277c9bd
style(oidc): migrate cjs to esm
2026-02-19 16:21:42 -05:00
KernelDeimos
ccecf0a86e
fix(oidc): remove generated source file
...
I forgot that our transpile tooling requires manually gitignoring
individual javascript files because we don't actually create a full
generated build of backend.
2026-02-19 16:21:42 -05:00
KernelDeimos
8d18ee527c
refactor(oidc): address review comment
...
https://github.com/HeyPuter/puter/pull/2460/changes#r2819861213
2026-02-19 16:21:42 -05:00
KernelDeimos
7858f5ba3e
fix(oidc): add error log for QR login flow
2026-02-19 16:21:42 -05:00
KernelDeimos
a2b9193287
clean(oidc): remove temporary debugging logs
...
These logs were temporary. I have a pre-merge TODO list item that says
to remove these. They were caught in review so I'm removing them early.
2026-02-19 16:21:42 -05:00
KernelDeimos
d0c2e9b7fc
fix(oidc): rate-limit identity for username
2026-02-19 16:21:41 -05:00
KernelDeimos
42d3f9e816
fix(oidc): http-only cookie sync for switch user
2026-02-19 16:21:41 -05:00
KernelDeimos
298f1cdb42
fix: incorrect accessor reference in OIDCService
...
During development a property named `success` was inverted to a property
named `failed` which resulted in an incorrect accessor reference with a
referring piece of code that wasn't updated. This is type error.
2026-02-19 16:21:41 -05:00
KernelDeimos
8ecd6cd13e
dev(oidc): confirm email by default for OIDC
2026-02-19 16:13:45 -05:00
Anshuman Tripathi