Kristoffer Dalby
8ea774564d
api/v2: show a tagged device's creator as its user
...
A tagged device shows the login that made the key it joined with.
Its owner stays its tags.
2026-10-28 18:28:23 +00:00
Kristoffer Dalby
83d8a29b62
api/v2: list token-made auth keys to a token without all=true
...
Keys an OAuth token makes are marked so. No listing holds an invalid
key.
2026-10-28 18:28:23 +00:00
Kristoffer Dalby
6c03637c8e
api/v2: show userId on admin-made tagged keys
...
An admin key's user is recorded as the creator of the tagged keys it
makes. A tagged key re-registers a machine by its tags, whoever made it.
2026-10-28 18:28:23 +00:00
Kristoffer Dalby
ca560946e7
api/v2: refuse an unknown keyType
2026-10-28 18:28:23 +00:00
Kristoffer Dalby
6394a04e06
api/v2: ignore unknown properties in request bodies
...
Tailscale's API ignores them.
2026-10-28 18:28:23 +00:00
Kristoffer Dalby
bba7252ec5
db: keep at most 1000 access tokens per OAuth client
...
Minting needs only the client secret, whatever its scopes, and
added one row per mint. Each mint now ends tokens past the newest 1000.
2026-10-28 18:28:23 +00:00
Kristoffer Dalby
d1cfc513db
api/v2: check the createKey scope before reading the body
...
createKey has no static scope, so any token got its body parsed
and validated before the handler's scope check.
2026-10-28 18:28:23 +00:00
Kristoffer Dalby
66d9727cba
api/v2: stop echoing request values in error responses
...
huma sets an unexpected property's value to the whole request object.
A refused policy, or another 400, now carries its reason in message,
and a failed test run one data entry per failing test naming its src.
2026-10-28 18:28:23 +00:00
Kristoffer Dalby
fab5833a6a
api/v2: keep a tagged all-scope client's tokens inside its tags
...
Only an untagged all-scope client may mint tokens for any tag, so a
tagged token may not create one.
2026-10-28 18:28:23 +00:00
Kristoffer Dalby
83d0bb6380
policy/v2: label sshTests failures with the dst alias
...
The report goes back to the policy author: name src and dst as written,
one line per dst occurrence, and a dst with no node as not reached.
2026-10-28 18:28:21 +00:00
Kristoffer Dalby
c31c8187b1
policy/v2: refuse an empty policy
...
SetPolicy returned a nil error for empty input it ignored, so the v1
API stored it as valid. Reload skips only the nil "no policy" case.
2026-10-28 18:28:21 +00:00
Kristoffer Dalby
45948f2feb
hscontrol, servertest: add key list scope golden data
...
Read-only and key-making OAuth tokens of each tag set list auth keys
with and without all=true, over admin- and token-made keys of every tag
relation, one admin key made after the token-made ones.
2026-10-28 14:31:41 +00:00
Kristoffer Dalby
4ee0fff157
hscontrol: compare API replay fields per object
...
One aggregate per field hid a partial fix. Device users are compared,
and headscale's oauthClientId resolves to the SaaS label.
2026-10-28 14:30:12 +00:00
Kristoffer Dalby
8adb93a3ef
hscontrol: check API replay outcomes apart from status
...
A listed status hid a call flipping between allowed and refused, and
validate refusals SaaS answers with 200 went unchecked.
2026-10-28 14:30:12 +00:00
Kristoffer Dalby
cb7148933b
hscontrol, servertest: add v2 OAuth and policy API golden data
...
OAuth clients, tokens, keys and tag writes by principal, and policy
writes over a baseline, replayed through v1 and v2; a deleted parent
client's key joins real clients.
2026-10-28 14:29:32 +00:00
Kristoffer Dalby