Evan Jarrett and Claude Fable 5
37bab324d7
fix OAuth refresh-token burn on client cancellation causing sign-outs
...
When a Docker client canceled a slow /auth/token request mid-refresh, the
token-refresh POST was aborted client-side but completed on the PDS, which
rotated the refresh token. The rotated token was never received or persisted,
so the next refresh replayed the consumed token, got invalid_grant, and the
session (OAuth + UI) was deleted, signing the user out everywhere.
- Detach refresh POSTs from the inbound request context via a per-session
RoundTripper (WithoutCancel + 30s cap); once a refresh starts it completes
- Persist session updates (rotated tokens, DPoP nonces) on a detached context
- Gate session deletion on IsSessionInvalidError: cancellation, timeouts, and
transport errors no longer delete sessions; genuine invalid_grant still does
- Add phase timing to /auth/token and per-DID lock wait warnings to attribute
the ~14s pre-refresh stalls that push requests past Docker's deadline
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-08-02 13:38:45 -05:00
Evan Jarrett
038993c814
fix concurrency test
2026-05-16 12:18:06 -05:00
Evan Jarrett
902fba4553
convert alert to modal. go fix the codebase
2026-05-16 11:59:47 -05:00
Evan Jarrett
a0cc862798
lots of new work for authenticating between appview -> hold. fixed quota handling, improve integration tests for round-trip push/pull/auth/quota checking
2026-05-11 09:20:55 -05:00
Evan Jarrett
25628dad2c
update the login page
2026-04-11 21:01:31 -05:00
Evan Jarrett
9033d74a19
fix validation on dids with hyphens
2026-04-07 22:26:21 -05:00
Evan Jarrett
a68477033a
use hyphens as the encode for dids
2026-04-07 21:47:51 -05:00
Evan Jarrett
21b6f6301a
allow dids on docker login
2026-04-07 21:32:51 -05:00
Evan Jarrett
f20170f595
digest page improvements
2026-03-29 13:01:40 -07:00
Evan Jarrett
6b87539ef8
update scanner, fix tests, fix dockerfile, move keys to db instead of flat files for appview
2026-02-16 21:04:40 -06:00
Evan Jarrett
834bb8d36c
libsql instead of sqlite for turso/bunnydb replicated sqlite
2026-02-05 20:43:04 -06:00
Evan Jarrett
51f6917444
add log shipper begin envvar cleanup
2026-01-08 22:52:32 -06:00
Evan Jarrett
9704fe091d
use chi/render to simplify returned json
2026-01-06 22:47:21 -06:00
Evan Jarrett
af815fbc7d
use for range and wg.Go
2026-01-04 22:39:48 -06:00
Evan Jarrett
efef46b15a
various linting fixes
2026-01-04 22:02:01 -06:00
Evan Jarrett
fbcaf56fce
fixup unused functions/vars
2026-01-04 21:16:02 -06:00
Evan Jarrett
a7175f9e3e
interface{} -> any
2026-01-04 21:10:29 -06:00
Evan Jarrett
e6bd4c122e
fix sql migration bug. add better error logs for auth failures. fix showing incorrect pull commands with helm charts
2026-01-03 17:26:25 -06:00
Evan Jarrett
7f2d780b0a
move packages out of token that are not related to docker jwt token
2025-12-29 16:57:14 -06:00
Evan Jarrett
2a60a47fd5
fix issues pulling other users images. fix labels taking priority over annotations. fix various auth errors
2025-12-23 16:20:52 -06:00
Evan Jarrett
509a1c0306
some lexicon json cleanup. code formatting
2025-12-20 10:46:40 -06:00
Evan Jarrett
4063544cdf
cleanup view around attestations. credential helper self upgrades. better oauth support
2025-12-18 09:33:31 -06:00
Evan Jarrett
5f1eb05a96
try and provide more helpful reponses when oauth expires and when pushing manifest lists
2025-11-25 09:25:38 -06:00
Evan Jarrett
66037c332e
locks locks locks locks
2025-11-24 22:49:17 -06:00
Evan Jarrett
fb7ddd0d53
try and create a cache for layer pushing again
2025-11-24 13:25:24 -06:00
Evan Jarrett
ecf84ed8bc
type-ahead login api. fix app-passwords not working without oauth
2025-11-09 21:57:28 -06:00
Evan Jarrett
628f8b7c62
try and trace oauth failures
2025-11-09 13:07:35 -06:00
Evan Jarrett
15d3684cf6
try and fix bad oauth cache
2025-11-08 20:47:57 -06:00
Evan Jarrett
6ef2aaf709
more test coverage. clean up docs
2025-10-28 20:39:57 -05:00
Evan Jarrett
b0799cd94d
unit tests
2025-10-28 17:40:11 -05:00
Evan Jarrett
4cfe6f221d
create identity resolver to reduce duplicate lookups
2025-10-26 23:08:03 -05:00
Evan Jarrett
0b22082f89
lower cached plc hits to 8 hours
2025-10-26 22:50:42 -05:00
Evan Jarrett
c831d3f735
auth/token needs GET
2025-10-25 19:42:54 -05:00
Evan Jarrett
35ba417a96
more slog
2025-10-25 10:14:19 -05:00
Evan Jarrett
f75d9ceafb
big scary refactor. sync enable_bluesky_posts with captain record. implement oauth logout handler. implement crew assignment to hold. this caused a lot of circular dependencies and needed to move functions around in order to fix
2025-10-24 23:51:32 -05:00
Evan Jarrett
9eb69e2ea7
more linting fixes
2025-10-24 01:05:19 -05:00
Evan Jarrett
751fa1a3f0
post to bluesky when manifests uploaded. linting fixes
2025-10-23 12:24:04 -05:00
Evan Jarrett
ce7160cdca
add backlinks to tags
2025-10-21 09:29:40 -05:00
Evan Jarrett
5d52007104
general bug fixes
2025-10-21 09:21:51 -05:00
Evan Jarrett
48414be75d
lots of unit testing for xrpc endpoints. start pointing appview to the new endpoints. remove legacy api endpoints
2025-10-17 15:41:20 -05:00
Evan Jarrett
70e802764b
crazy refactor to start using holds embedded pds for crew/captain validation
2025-10-16 00:05:45 -05:00
Evan Jarrett
ab7e0f07ac
fix authentication message
2025-10-12 22:45:44 -05:00
Evan Jarrett
9a64804807
better unauth message
2025-10-12 22:30:24 -05:00
Evan Jarrett
9025c89cc6
attempt gorelease and goat builds
2025-10-12 22:09:03 -05:00
Evan Jarrett
776b5f444c
try and use multipart uploads
2025-10-10 20:50:21 -05:00
Evan Jarrett
08d5fce21f
move file store cache to sqlite. implement repository page
2025-10-07 21:51:53 -05:00
Evan Jarrett
5bcedac3c1
update docker credential helper to remove configure and store devices, not api keys. improve ui, fetch profile image
2025-10-07 19:52:26 -05:00
Evan Jarrett
2d16bbfee3
cleanup more auth
2025-10-07 10:58:11 -05:00
Evan Jarrett
31e235a2a1
cleanup oauth
2025-10-04 13:50:28 -05:00
Evan Jarrett
85d0bd2463
initial commit
2025-10-02 11:03:59 -05:00
Evan JarrettandClaude Fable 5