Matthew Meszaros 1387541bf0 feat: make self-hosted auth work without a mail relay by rewriting the platform SMTP transport with real AUTH and TLS (it did neither, so SMTP_USERNAME/SMTP_PASSWORD were dead and every documented relay was unreachable), adding MAIL_TRANSPORT=smtp|log|ses with a log transport that prints codes so a fresh install can sign in with no relay, demoting the emailed login code to AUTH_LOGIN_CODE=always|new_device|off (off on self-host, per NIST SP 800-63B and OWASP ASVS), claiming the first owner through a single-use setup link or WARMBLY_BOOTSTRAP_* instead of register-then-psql, deriving every emailed URL from APP_URL rather than a hardcoded app.warmbly.com that leaked live reset tokens to the vendor, fixing the confirm hooks that read path params against paramless routes and broke login, register and reset confirmation in the dashboard everywhere, adding generic OIDC with PKCE, one-time state, verified nonce and (issuer,subject) identity binding, enforcing 2FA on the social paths that skipped it, adding a per-IP limiter and trusted-proxy handling to the unthrottled auth group, refusing boot on the published default secrets, and dropping mailpit from the default stack

2026-08-14 10:37:14 +02:00

..

reference

docs: refresh the documentation site, fix inaccurate claims and contact addresses, add SEO primitives (#90)

2026-08-05 10:37:27 +02:00

authentication.mdx

docs: refresh the documentation site, fix inaccurate claims and contact addresses, add SEO primitives (#90)

2026-08-05 10:37:27 +02:00

endpoints.mdx

feat: make self-hosted auth work without a mail relay by rewriting the platform SMTP transport with real AUTH and TLS (it did neither, so SMTP_USERNAME/SMTP_PASSWORD were dead and every documented relay was unreachable), adding MAIL_TRANSPORT=smtp|log|ses with a log transport that prints codes so a fresh install can sign in with no relay, demoting the emailed login code to AUTH_LOGIN_CODE=always|new_device|off (off on self-host, per NIST SP 800-63B and OWASP ASVS), claiming the first owner through a single-use setup link or WARMBLY_BOOTSTRAP_* instead of register-then-psql, deriving every emailed URL from APP_URL rather than a hardcoded app.warmbly.com that leaked live reset tokens to the vendor, fixing the confirm hooks that read path params against paramless routes and broke login, register and reset confirmation in the dashboard everywhere, adding generic OIDC with PKCE, one-time state, verified nonce and (issuer,subject) identity binding, enforcing 2FA on the social paths that skipped it, adding a per-IP limiter and trusted-proxy handling to the unthrottled auth group, refusing boot on the published default secrets, and dropping mailpit from the default stack

2026-08-14 10:37:14 +02:00

error-codes.mdx

feat: make self-hosted auth work without a mail relay by rewriting the platform SMTP transport with real AUTH and TLS (it did neither, so SMTP_USERNAME/SMTP_PASSWORD were dead and every documented relay was unreachable), adding MAIL_TRANSPORT=smtp|log|ses with a log transport that prints codes so a fresh install can sign in with no relay, demoting the emailed login code to AUTH_LOGIN_CODE=always|new_device|off (off on self-host, per NIST SP 800-63B and OWASP ASVS), claiming the first owner through a single-use setup link or WARMBLY_BOOTSTRAP_* instead of register-then-psql, deriving every emailed URL from APP_URL rather than a hardcoded app.warmbly.com that leaked live reset tokens to the vendor, fixing the confirm hooks that read path params against paramless routes and broke login, register and reset confirmation in the dashboard everywhere, adding generic OIDC with PKCE, one-time state, verified nonce and (issuer,subject) identity binding, enforcing 2FA on the social paths that skipped it, adding a per-IP limiter and trusted-proxy handling to the unthrottled auth group, refusing boot on the published default secrets, and dropping mailpit from the default stack

2026-08-14 10:37:14 +02:00

index.mdx

docs: refresh the documentation site, fix inaccurate claims and contact addresses, add SEO primitives (#90)

2026-08-05 10:37:27 +02:00

mcp.mdx

docs: refresh the documentation site, fix inaccurate claims and contact addresses, add SEO primitives (#90)

2026-08-05 10:37:27 +02:00

meta.json

feat: restyle the docs site without decorative sidebar icons (frontmatter icons dropped, lucide source plugin disabled, AGENTS.md conventions updated), add LangTab language-logo code tabs, and document the new agent tools plus panel resize/placement/shortcuts in the assistant guide and MCP reference

2026-07-16 07:50:24 +02:00

oauth.mdx

feat: add one-command MCP OAuth connect on api.warmbly.com/v1/mcp — RFC 7591 dynamic client registration for public PKCE clients (dcr.go), RFC 9728 protected-resource metadata + WWW-Authenticate challenge via MCPAuthMiddleware, /v1/mcp now accepts an API key or OAuth token, public-client auth with no secret and mandatory PKCE reusing the existing OAuth 2.1 server (nullable-org clients, migration 000066), executable-redirect-scheme hardening on the open register endpoint, plus mcp/oauth/authentication/endpoints docs

2026-07-16 08:57:19 +02:00

openapi.mdx

feat: restyle the docs site without decorative sidebar icons (frontmatter icons dropped, lucide source plugin disabled, AGENTS.md conventions updated), add LangTab language-logo code tabs, and document the new agent tools plus panel resize/placement/shortcuts in the assistant guide and MCP reference

2026-07-16 07:50:24 +02:00

permissions.mdx

docs: refresh the documentation site, fix inaccurate claims and contact addresses, add SEO primitives (#90)

2026-08-05 10:37:27 +02:00

realtime.mdx

feat: restyle the docs site without decorative sidebar icons (frontmatter icons dropped, lucide source plugin disabled, AGENTS.md conventions updated), add LangTab language-logo code tabs, and document the new agent tools plus panel resize/placement/shortcuts in the assistant guide and MCP reference

2026-07-16 07:50:24 +02:00

sdks.mdx

feat: restyle the docs site without decorative sidebar icons (frontmatter icons dropped, lucide source plugin disabled, AGENTS.md conventions updated), add LangTab language-logo code tabs, and document the new agent tools plus panel resize/placement/shortcuts in the assistant guide and MCP reference

2026-07-16 07:50:24 +02:00