127 Commits

Author SHA1 Message Date
Oliver Günther 92a0c03c42 Fix fetching of SAML metadata for large aggregate endpoints (#23531)
* Fix fetching of SAML metadata for large aggregate endpoints

https://community.openproject.org/work_packages/OP-19420

* Use XML pull parser to avoid text parsing
2026-06-09 09:13:52 +02:00
Oliver Günther 86e2b04fda Add SSRF protection to SAML metadata 2026-05-05 07:46:58 +02:00
Henriette Darge c633ed3f29 Harmonize dangerDialog titles and headings to match lookbook expectations 2026-04-10 10:56:14 +02:00
Henriette Darge 5d7f409d1a Replace old danger zone with new dangerDialog for saml providers 2026-04-10 10:56:14 +02:00
Oliver Günther 4d731dcab6 Replace raw and explicit html_safe calls 2026-03-20 09:49:10 +01:00
Jan Sandbrink 9e216690d2 Validate schemes for CopyToClipboardComponent
When trying to use this component, I wanted to use the input scheme
that I copied from elsewhere in the code. At first I was surprised that
the lookbook didn't yet contain a playground, where I could try this style out.

After adding it, I was surprised that it didn't look like an input at all and learned
that this scheme does not even exist... But it was already used multiple times :O
2026-03-02 16:54:58 +01:00
Alexander Brandon Coles e1c6f3aad2 [#70148] Fix ERb/HTML markup (Herb Parse errors)
Fix malformed HTML (e.g. unmatched closing tags) as well as other issues
identified as "parse errors" when running:

    herb analyze .

https://community.openproject.org/work_packages/70148
2025-12-22 10:39:03 -03:00
Jan Sandbrink 660dea1909 Fix SAML single logout
We were already using a few configuration values that work on the 2.x line
of the omniauth-saml gem, but not on version 1.10, which is the one we are still
using.

Since we totally want to migrate to the 2.x line going foward (once we can use omniauth 2.x),
I changed the built configuration to be compatible to both versions of the gem at once,
so that a future upgrade is hopefully smoother.
2025-11-26 16:12:26 +01:00
Alexander Brandon Coles 1991826037 Merge branch 'dev' into merge-release/16.5-20251008034048 2025-10-08 08:39:27 +01:00
Jan Sandbrink 66def0cbf5 Rubocop optimization
Extracting method, mostly for the purpose of making Rubocop a bit happier,
but also hoping that it helps in readability.
2025-10-06 09:05:02 +02:00
Jan Sandbrink 4f351a56cc Redirect user to show view after creating SAML provider
This allows them to see the sidebar that's regularly part of the
show view and only hidden during the initial creation of a provider.

For that we needed to change the show action to not render a turbostream
response anymore. This behaviour is now consistent with the OpenID Connect
provider controller again.
2025-10-06 09:05:02 +02:00
Jan Sandbrink b44bf0dd96 Rename edit_mode to new_mode for SAML as well
Also here (similar to OIDC), the old terminology was rather confusing,
because this mode was exclusively set from the #new action, but it was never
set during editing of a provider at a later point.
2025-10-06 09:05:02 +02:00
Oliver Günther 14192a74c3 Replace confirm with turbo-confirm, method with turbo-method 2025-09-26 09:15:04 +02:00
Jan Sandbrink 0fe8b5ba2b Change target parameter of link_translate to boolean
It's now called external and can only switch between external and non-external links.
This does not only affect the link target, but additionally also adds a trailing visual icon
as it is suggested by our Lookbook.

Since this made me go through all calls of link_translate, I took the opportunity to also replace
occurences of manual calls to OpenProject::Static::Links with the new abbreviated call syntax.
2025-07-31 08:52:40 +02:00
Henriette Darge 10abcbcb3a Fix some breadcrumbs for better mobile behaviour 2025-07-07 09:14:15 +02:00
Alexander Brandon Coles 40968b5166 Merge pull request #19353 from opf/titan-freezing
Freeze string literals in two more modules
2025-07-01 08:42:55 +01:00
Jan Sandbrink 40aff02f11 Remove params argument from BaseCallable#perform
This is making the interface of BaseCallable more consistent.
Previously it was unclear, whether the params passed to perform
should be used to reference parameters or whether the attribute accessor
should be used. Different code used different approaches.

To apply this change more consistently, BaseContracted also removed
params from the methods called inside its own perform method, e.g.
before_perform or after_validate.

At a later point we might consider removing this argument from other large
inheritors as well, for example `BaseServices::SetAttributes#set_attributes`.
2025-06-30 11:47:03 +02:00
Jan Sandbrink 4bf16e5215 Freeze string literals in two more modules
Diff was achieved by running

    rubocop -A --only Style/FrozenStringLiteralComment,Layout/EmptyLineAfterMagicComment,Style/RedundantFreeze

for the module folders of the affected modules.
This change is part of the effort to slowly roll out frozen
string literals across the entire application.
2025-06-30 09:51:24 +02:00
Jan Sandbrink d17ef286ee Add ScimClient model
Including basic services to manipulate them. The
service account is managed as part of the ScimClient's lifecycle.

After creation there is no way to change the chosen authentication method.
This is a simplification for us, since we do not need to care about revoking
earlier ways of authentication etc.
2025-06-12 09:58:44 +02:00
Henriette Darge d7c006ce82 Update SubHeader implementations to new mobile requirements in version 0.66.1 2025-05-19 15:11:05 +02:00
Jan Sandbrink 6829f14a24 Fix parsing of multiple certificates from metadata
Once the XML contains multiple certificates, the metadata hash
has a nil idp_cert. The idp_cert_multi key is always populated. However,
we never tried parsing data from there, so it was lost.

The way that the Saml::Provider right now represents multiple certificates
is to concatenate them inside the idp_cert, so the metadata parsing
has been adapted to use that.
2025-05-12 13:47:12 +02:00
Jan Sandbrink 4325c39440 Use certificate fingerprint as a fallback only
As far as I can tell from existing code and forms, we only want to use
the fingerprint as a fallback and not as a primary means of authentication.

However, the HashBuilder would have only returned the fingerprint, if both
a fingerprint and a certificate were present, which sadly always seems to be
the case, because even when creating a new provider, we fill the fingerprint
from the provided certificate.

Since the omniauth configuration happens from the provider hash, this means
that we so far only ever used the fingerprint for validation.
2025-05-05 16:15:58 +02:00
Oliver Günther e27ac494d3 Consistent naming of upsell, not upsale 2025-04-24 15:52:34 +02:00
Henriette Darge ee8452282a [63485] Remove show_local_breadcrumb and default_breadcrumb (#18663)
* add a new helper for breadcrumb in wiki page

* set page header in destroy page

* set page header in edit page

* set page header in history and rename and edit parent pages

* change toolbar items into page header items

* add new wiki action to sub header

* remove version edit page which is not in use any more

* add export as a menu item of the header

* fix rubocup errors

* fix failing tests

* replace page header in annotate page

* replace page header in diff page

* add page header in select menu page

* fix rubocup errors

* fix errors on rename test

* fix errors on selecting items from toolbar

* fix errors on tests for child pages

* set correct permission for configure menu item

* replace page header in summary page

* replace page header in summary details page

* edit docs of sub header

* add page header in wiki new page

* remove controller and a route for edit method

* undo changes for docs of sub header

* extract header in show page into a new component

* use helper method in header component

* add wiki module to the breadcrumb

* rename page header component for wiki page

* simplify how lock and lock implemented

* extract sub header

* remove wiki title from header of history page

* fix page header in new page

* use page.find_test_selector in test

* fix failing test for summary page

* fix failing test for wiki child pages

* change the summary test

* use test selector for page header title

* undo changes for activate user in admin

* use test selector in adding editing history test

* use test selector in attachment upload test

* use test selector in child pages tests

* use test selector in wiki menu items tests

* change test selector for breadcrumbs

* extract conditions to show edit button into a method

* extract conditions to show rollback action menu item into a method

* extract conditions to show create button into a method

* fix duplicated code in test

* Remove outdated `show_local_breadcrumb` method which is replaced by the Primer::PageHeader breadcrumb

* Remove `default_breadcrumb` method as it serves no prupose any more

* Remove the old breadcrumb and its hook completely

* remove breadcrumbs path from rename

* fix translations errors in storages

* undo changes on translations

* remove default breadcrumbs in time tracking controller

---------

Co-authored-by: Behrokh Satarnejad <b.satarnejad@openproject.com>
Co-authored-by: Behrokh Satarnejad <62008897+bsatarnejad@users.noreply.github.com>
2025-04-23 10:40:43 +02:00
Dombi Attila 10dc5538a2 [#63386] Use rescue_from ActiveRecord::RecordNotFound
https://community.openproject.org/work_packages/63386
2025-04-14 13:44:28 +03:00
Oliver Günther b531ad3ec8 Allow i18n_scope, use banner for SAML and OIDC
SAML uses an outdated feature image and should be replaced with a banner
2025-04-07 10:55:22 +02:00
Jan Sandbrink 112ae02926 Update Ruby copyright headers using rake task
This effectively removes the year from a bunch of copyright headers.
We stopped indicating a specific year at some point, but
didn't propagate this change to every file yet.
2025-03-18 14:23:54 +01:00
Oliver Günther e91d4860ef Move SAML and OIDC keys under activerecord, not activemodel 2025-02-25 10:47:21 +01:00
Ivan Kuchin ca5f8fb878 erb_lint auto fix trailing commas 2025-02-11 18:49:21 +01:00
Ivan Kuchin a98789d986 erb_lint auto fix part of style 2/3 2025-02-11 18:49:21 +01:00
Ivan Kuchin fba9d4b506 erb_lint auto fix quoted symbol 2025-02-11 18:49:21 +01:00
Ivan Kuchin 0f6a12da3a erb_lint auto fix layout 2025-02-11 18:49:20 +01:00
Ivan Kuchin fb715f21b9 erb_lint auto fix quotes 2025-02-11 18:49:19 +01:00
Ivan Kuchin 0b1f73ec79 erb_lint auto except rubocop linter 2025-02-11 18:49:19 +01:00
Oliver Günther ffd8f9a35e Set default name identifier format to unspecified, making no assertions 2025-01-15 08:28:01 +01:00
Mir Bhatia 73281b53ac Rename wide columns to main column and update width 2024-11-26 15:50:15 +01:00
ulferts 91509bb9b2 Merge remote-tracking branch 'origin/merge-release/15.0-20241122034127' into dev 2024-11-22 08:49:11 +01:00
Oliver Günther d9c81b9701 Accept fingerprint as present 2024-11-21 14:16:17 +01:00
Oliver Günther 34909477a2 Start implementing mobile behavior for border-box table (#17216)
* Start implementing mobile behavior for border-box table

* Auto column

* Allow labels

* Hide rows on mobile

* Change order of project and start time

* Add implementation for oidc

* Reimplement wide columns

* Documentation

* Remove custom mobile labels

* Extract heading class

* Fix spacing between rows in mobile BorderBoxTable

* Remove doubled code block

---------

Co-authored-by: Henriette Darge <h.darge@openproject.com>
2024-11-19 11:33:58 +01:00
OpenProject Actions CI 381c2c81d3 Merge branch 'release/15.0' into dev 2024-11-19 03:42:21 +00:00
Oliver Günther ff04f1e691 Respect self-registration in saml 2024-11-18 16:18:10 +01:00
OpenProject Actions CI 9133774d34 Merge branch 'release/15.0' into dev 2024-11-16 03:40:02 +00:00
Markus Kahl f42fbc735a make sure limit_self_registration is included in saml provider hash 2024-11-15 15:00:22 +00:00
OpenProject Actions CI c63722ee69 Merge branch 'release/15.0' into dev 2024-11-08 03:36:56 +00:00
Oliver Günther 3532d8e1d8 Migrate SAML entries with an empty contract, ignoring errors 2024-11-07 14:15:27 +01:00
Oliver Günther fdd2611c0a Merge branch 'dev' into experiment/enable-turbo-drive 2024-10-30 08:29:55 +01:00
Oliver Günther ec6f8a71ca Ensure empty uid_attribute is not output
https://community.openproject.org/work_packages/58592
2024-10-29 16:12:59 +01:00
Oliver Günther 8f83971f0e Merge remote-tracking branch 'origin/dev' into experiment/enable-turbo-drive 2024-10-28 13:23:21 +01:00
Oliver Günther 7989cdb55e Show delete warning for deleting SSO providers (#16981) 2024-10-21 13:03:51 +02:00
Oliver Günther 15dcc7603a Allow setting omniauth direct login provider to the new auth providers 2024-10-21 13:03:51 +02:00