Chris CoutinhoandClaude Opus 4.7 af25c281bf fix(auth): use Settings for OIDC env vars in token revocation helper ...

After merging master, _should_use_secure_cookies was refactored to read
from Settings instead of os.getenv, which dropped `import os` from
browser_oauth_routes.py — leaving _revoke_refresh_token_at_idp's four
remaining os.getenv() calls undefined (CI ruff F821).

Migrate the helper to the same Settings-based pattern:
  - oidc_discovery_url     → settings.oidc_discovery_url
  - OIDC_CLIENT_ID         → settings.oidc_client_id
  - OIDC_CLIENT_SECRET     → settings.oidc_client_secret
  - NEXTCLOUD_HOST         → settings.nextcloud_host

Drive-by: the previous fallback read OIDC_CLIENT_ID, but the canonical
env var per env.sample / docker-compose is NEXTCLOUD_OIDC_CLIENT_ID.
The Settings layer handles this mapping via dynaconf, so the corrected
name is now used automatically.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-02 18:32:19 +02:00

..

static

feat: add Tailscale Funnel config for Claude AI connector testing

2026-03-29 21:00:00 +02:00

templates

fix(auth): address PR #758 review — XSS, CSRF, open redirect, JWKS cache

2026-05-02 18:26:39 +02:00

__init__.py

feat: Implement ADR-005 unified token verifier to eliminate token passthrough vulnerability

2025-11-05 18:53:14 +01:00

astrolabe_client.py

feat: add self-signed SSL certificate support for Nextcloud connections

2026-02-16 09:21:21 +01:00

bearer_auth.py

feat(server): Experimental support for OAuth2/OIDC authentication

2025-10-14 01:22:15 +02:00

browser_oauth_routes.py

fix(auth): use Settings for OIDC env vars in token revocation helper

2026-05-02 18:32:19 +02:00

client_registration.py

fix: address review feedback — security, caching, CI 429 retry

2026-03-02 17:22:23 +01:00

client_registry.py

feat(auth): drop test-client defaults, add ALLOWED_MGMT_CLIENT allowlist

2026-04-30 01:20:21 +02:00

context_helper.py

refactor: remove RFC 8693 token exchange and Keycloak OAuth implementation

2026-04-03 00:22:20 +02:00

elicitation.py

fix(auth): address PR #757 round-3 review feedback

2026-05-02 17:24:50 +02:00

login_flow.py

fix: address PR review — XSS escape, asyncio→anyio, URL rewrite dedup

2026-03-30 08:51:41 +02:00

oauth_routes.py

Merge remote-tracking branch 'origin/master' into security/oauth-session-hardening-626

2026-05-02 18:29:53 +02:00

permissions.py

feat: add webhook management UI and BeforeNodeDeletedEvent support

2025-11-11 20:35:08 +01:00

provision_routes.py

fix(auth): invalidate scope cache on web/REST provisioning paths

2026-05-02 16:59:53 +02:00

provisioning_decorator.py

fix(auth): harden OAuth/session for hosted multi-tenant deployment (#626)

2026-05-02 17:03:57 +02:00

scope_authorization.py

fix(auth): address PR #757 round-3 review feedback

2026-05-02 17:24:50 +02:00

session_backend.py

fix(auth): harden OAuth/session for hosted multi-tenant deployment (#626)

2026-05-02 17:03:57 +02:00

storage.py

fix(auth): address PR #758 review — XSS, CSRF, open redirect, JWKS cache

2026-05-02 18:26:39 +02:00

token_broker.py

fix(auth): harden OAuth/session for hosted multi-tenant deployment (#626)

2026-05-02 17:03:57 +02:00

token_utils.py

fix(auth): address PR #758 review — XSS, CSRF, open redirect, JWKS cache

2026-05-02 18:26:39 +02:00

unified_verifier.py

feat(auth): drop test-client defaults, add ALLOWED_MGMT_CLIENT allowlist

2026-04-30 01:20:21 +02:00

userinfo_routes.py

refactor(config): consolidate NEXTCLOUD_PUBLIC_ISSUER_URL through Settings

2026-05-02 16:16:19 +02:00

viz_routes.py

fix(api): use stored app password for chunk-context and pdf-preview

2026-04-22 19:50:13 +02:00

webhook_routes.py

fix(webhooks): escape webhook_uri, lazy logging, document 401 header omission

2026-04-30 14:37:34 +02:00