mirror of
https://github.com/HeyPuter/puter.git
synced 2026-05-04 16:40:41 +00:00
KernelDeimos
4374281070
When users make sensitive changes to their account they are asked to re-enter their password. This prevents a hijacked session from causing futher damage. Users created with the new OIDC flow do not necessarily have a password set on their account, and they need to also be able to make these changes. While removal of the password entry requirement for these users would solve this problem, it would also make their accounts more vulnerable. To solve this problem while maintaining the same security standard for OIDC users, we need them to confirm via either 2FA or re-authentication via OIDC. Since users aren't required to have 2FA, the re-authentication via OIDC approach is also the minimum viable solution. This commit adds OIDC re-authentication support for all endpoints under UserProtectedEndpointsService, and makes updates to the UIWindowChangeUsername dialog for manual testing. Currently this implementation fails at the final submission to change the username because of a separate issue with the correct authentication token not being set; this is related to the separation of GUI tokens vs http-only tokens.
Extension System Development Guide
Where to find documentation
Here
Documentation for extensions is here.
Bundled extensions
- dev-console (
extensions/dev-console/) – Dev socket for running backend commands locally. Opt-in viaDEVCONSOLE=1(e.g.npm run dev). See Backend – dev socket.
Not Here
Outdated documentation for extensions is here. This documentation may include some topics that are missing from the current documentation. Eventually those topics should be updated and transferred to the current documentation so that this documentation may be removed.