Evan Jarrett and Claude Fable 5
37bab324d7
fix OAuth refresh-token burn on client cancellation causing sign-outs
...
When a Docker client canceled a slow /auth/token request mid-refresh, the
token-refresh POST was aborted client-side but completed on the PDS, which
rotated the refresh token. The rotated token was never received or persisted,
so the next refresh replayed the consumed token, got invalid_grant, and the
session (OAuth + UI) was deleted, signing the user out everywhere.
- Detach refresh POSTs from the inbound request context via a per-session
RoundTripper (WithoutCancel + 30s cap); once a refresh starts it completes
- Persist session updates (rotated tokens, DPoP nonces) on a detached context
- Gate session deletion on IsSessionInvalidError: cancellation, timeouts, and
transport errors no longer delete sessions; genuine invalid_grant still does
- Add phase timing to /auth/token and per-DID lock wait warnings to attribute
the ~14s pre-refresh stalls that push requests past Docker's deadline
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-08-02 13:38:45 -05:00
Evan Jarrett
902fba4553
convert alert to modal. go fix the codebase
2026-05-16 11:59:47 -05:00
Evan Jarrett
6b6ce093d3
new signup flow
2026-04-21 22:29:23 -05:00
Evan Jarrett
7c064ba8b0
fix error code checking to not just check the raw string response in the case that '401' shows up in the sha256
2026-02-27 19:51:39 -06:00
Evan Jarrett
6b87539ef8
update scanner, fix tests, fix dockerfile, move keys to db instead of flat files for appview
2026-02-16 21:04:40 -06:00
Evan Jarrett
8048921f5e
show attestation details
2026-02-13 19:40:05 -06:00
Evan Jarrett
ca56a7c309
allow domain name and short name to be replaced by config
2026-01-22 14:52:30 -06:00
Evan Jarrett
4c0f20a32e
begin large refactor of UI to use tailwind and daisy
2026-01-14 14:42:04 -06:00
Evan Jarrett
f35bf2bcde
fix oauth scope mismatch
2026-01-05 20:26:41 -06:00
Evan Jarrett
efef46b15a
various linting fixes
2026-01-04 22:02:01 -06:00
Evan Jarrett
fbcaf56fce
fixup unused functions/vars
2026-01-04 21:16:02 -06:00
Evan Jarrett
aa4b32bbd6
basic implementation of quotas
2026-01-04 20:09:41 -06:00
Evan Jarrett
347db5c391
begin support for helm-charts
2026-01-02 13:09:04 -06:00
Evan Jarrett
8956568ed2
remove unused filestore. replace it with memstore for tests
2025-12-29 16:51:08 -06:00
Evan Jarrett
c1f2ae0f7a
fix scope mismatch?
2025-12-26 17:41:38 -06:00
Evan Jarrett
012a14c4ee
try fix permission scope again
2025-12-26 17:13:19 -06:00
Evan Jarrett
4cda163099
add back individual scopes
2025-12-26 17:05:51 -06:00
Evan Jarrett
41bcee4a59
try new permission sets
2025-12-26 16:51:49 -06:00
Evan Jarrett
d11356cd18
more improvements on repo page rendering. allow for repo avatar image uploads (requires new scopes)
2025-12-21 21:51:44 -06:00
Evan Jarrett
79d1126726
better handling for io.atcr.repo.page
2025-12-20 21:50:09 -06:00
Evan Jarrett
4063544cdf
cleanup view around attestations. credential helper self upgrades. better oauth support
2025-12-18 09:33:31 -06:00
Evan Jarrett
66037c332e
locks locks locks locks
2025-11-24 22:49:17 -06:00
Evan Jarrett
fb7ddd0d53
try and create a cache for layer pushing again
2025-11-24 13:25:24 -06:00
Evan Jarrett
3bdc0da90b
try and lock session get/update
2025-11-09 15:04:44 -06:00
Evan Jarrett
628f8b7c62
try and trace oauth failures
2025-11-09 13:07:35 -06:00
Evan Jarrett
15d3684cf6
try and fix bad oauth cache
2025-11-08 20:47:57 -06:00
Evan Jarrett
4667d34b46
try and persist session tokens
2025-11-07 22:43:44 -06:00
Evan Jarrett
65d155f74f
try and invalidate sessions
2025-11-04 23:27:15 -06:00
Evan Jarrett
9af56daa34
make navbar a component
2025-10-29 17:25:39 -05:00
Evan Jarrett
6793ba6a50
use confidential oauth in production
2025-10-29 12:06:47 -05:00
Evan Jarrett
6ef2aaf709
more test coverage. clean up docs
2025-10-28 20:39:57 -05:00
Evan Jarrett
b0799cd94d
unit tests
2025-10-28 17:40:11 -05:00
Evan Jarrett
e62ebdaa53
clean up duplicate functions
2025-10-28 09:43:43 -05:00
Evan Jarrett
4cfe6f221d
create identity resolver to reduce duplicate lookups
2025-10-26 23:08:03 -05:00
Evan Jarrett
0b22082f89
lower cached plc hits to 8 hours
2025-10-26 22:50:42 -05:00
Evan Jarrett
35ba417a96
more slog
2025-10-25 10:14:19 -05:00
Evan Jarrett
f75d9ceafb
big scary refactor. sync enable_bluesky_posts with captain record. implement oauth logout handler. implement crew assignment to hold. this caused a lot of circular dependencies and needed to move functions around in order to fix
2025-10-24 23:51:32 -05:00
Evan Jarrett
9eb69e2ea7
more linting fixes
2025-10-24 01:05:19 -05:00
Evan Jarrett
751fa1a3f0
post to bluesky when manifests uploaded. linting fixes
2025-10-23 12:24:04 -05:00
Evan Jarrett
16f354b7b9
fix some backfill and db queries
2025-10-21 20:52:51 -05:00
Evan Jarrett
0404ea025b
try and wildcard scope
2025-10-21 14:03:20 -05:00
Evan Jarrett
2708af614a
use transition:generic for now :(
2025-10-21 13:27:03 -05:00
Evan Jarrett
1f72d90726
fix issue with mismatched scopes locally
2025-10-21 10:49:06 -05:00
Evan Jarrett
08fb8abb41
invalidate sessions when scopes change
2025-10-21 09:54:23 -05:00
Evan Jarrett
5d52007104
general bug fixes
2025-10-21 09:21:51 -05:00
Evan Jarrett
965e73881b
try and support multi-arch manifest types. add more unit tests. add scope for oras blobs for future proofing
2025-10-19 22:26:47 -05:00
Evan Jarrett
7228b532ba
bug fixes, code cleanup, tests. trying to get multipart uploads working for the 12th time
2025-10-19 20:55:18 -05:00
Evan Jarrett
1658a53cad
docker push works, hold endpoints require auth
2025-10-18 20:11:36 -05:00
Evan Jarrett
80b65ee619
fix all the places where did used to be an endpoint
2025-10-17 20:40:04 -05:00
Evan Jarrett
48414be75d
lots of unit testing for xrpc endpoints. start pointing appview to the new endpoints. remove legacy api endpoints
2025-10-17 15:41:20 -05:00
Evan JarrettandClaude Fable 5