graham/towerops
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
2589 commits 1 branch 0 tags 50 MiB
Commit graph

10 commits

Author SHA1 Message Date
Graham McIntire
6fa0b791f2 fix: M3, M6, M7, M12 — open redirect, overfetch, missing constraint, admin defense-in-depth 
- M3: Replace blacklist-based valid_return_path? with whitelist of known app
  route prefixes, plus URI decoding to prevent %2f encoding bypasses
- M6: Replace full-org device/link load in get_node_detail with targeted
  join query filtering by discovered node fields
- M7: Add partial unique index on (organization_id, email) for pending
  invitations (WHERE accepted_at IS NULL)
- M12: Add on_mount superuser verification to all 7 admin LiveViews for
  defense-in-depth
 2026-05-12 12:46:16 -05:00
Graham McIntire
3276a1cd8c
fix user session controller test 
Update email input ID assertion to match actual template implementation
 2026-02-03 13:42:24 -06:00
Graham McIntire
dff9c26905
fix TOTP enrollment with recovery codes 2026-01-31 14:54:44 -06:00
Graham McIntire
2a36917738 mfa enforced on login 2026-01-29 14:31:13 -06:00
Graham McIntire
d29fb8cfd7 totp fixes 2026-01-28 16:16:59 -06:00
Graham McIntire
3abd70e133
use password for user regi 2026-01-21 09:13:08 -06:00
Graham McIntire
3eb95b5f90
Streamline login flow and fix test failures 
Login flow improvements:
- Remove "Welcome back!" flash message on successful login
- Auto-login users clicking magic links without confirmation prompt
- Always use "remember me" for magic link logins
- Fix Accounts.login_user_by_magic_link/1 to handle invalid token format

Test fixes:
- Add @tag :integration to Ping tests (require actual system ping)
- Add halt() calls to UserAuth.start_impersonation error paths

Users now go directly to their intended destination after clicking a
magic link, with no interruption for "log in and stay logged in" choice.
 2026-01-13 13:08:24 -06:00
Graham McIntire
11bc5dec4a
no post login page 2026-01-13 12:27:17 -06:00
Graham McIntire
93e0b869be
more features 2026-01-02 14:06:44 -06:00
Graham McIntire
c52f313e2d
1. User Authentication 
- Full auth system with email/password (using phx.gen.auth)
  - Login, registration, password reset
  - Session management with remember-me functionality
  - Magic link login support

  2. Organization Management
  - Multi-tenant organization system
  - Organizations schema with unique slugs
  - Automatic organization creation when users register
  - Organization switcher UI at /orgs

  3. Membership System
  - Users can belong to multiple organizations
  - 4 permission levels: Owner, Admin, Member, Viewer
  - Complete permission matrix implemented
  - Join/leave organizations

  4. Invitation System
  - Email-based invitations with secure tokens
  - 7-day expiration on invites
  - Track who invited and who accepted

  5. Authorization
  - Full policy system (Organizations.Policy)
  - can?(membership, :action, :resource) helper
  - Enforced via plugs in router

  6. LiveView Pages
  - /orgs - List all your organizations
  - /orgs/new - Create new organization
  - /orgs/:slug - Organization dashboard (placeholder)

  7. Database Schema
  - users table
  - organizations table
  - organization_memberships table
  - organization_invitations table
  - All migrations run successfully
 2025-12-21 13:31:59 -06:00