15 Commits

Author SHA1 Message Date
coryHawkvelt d48e6b2f97 feat: add sliding session timeout with idle and absolute caps 2026-04-26 18:12:37 +09:30
nexgen_mirrors f16bb88ad2 feat(scripts): add generic job runner for scheduled tasks
Add a configurable job runner script that executes Flask CLI commands
at specified intervals within Docker containers. Supports graceful
shutdown via SIGTERM/SIGINT signals and includes built-in job commands
for ZeroTier reconciliation and MFA compliance checks.
2026-04-10 00:37:38 +09:30
nexgen_mirrors ab967e8ec0 checkpoint: spiral-unknown-1775746582535 2026-04-10 00:26:22 +09:30
nexgen_mirrors d90a06437e feat(docker): add Docker deployment configuration
Add production-ready Docker setup with multi-stage Dockerfile, docker-compose
orchestration for API, PostgreSQL, Redis, and Nginx services. Includes
health checks, non-root user execution, and proper networking.

- Add multi-stage Dockerfile with gunicorn/gevent workers
- Add docker-compose.yml with api, db, redis, nginx services
- Add nginx reverse proxy configuration with security headers
- Update .env.example with Docker and production variables
- Add email provider configuration (Mailgun, SendGrid)
- Add requests dependency for HTTP client support
- Update documentation with Docker deployment guide
- Rebrand project name from Gatehouse to Secuird
2026-04-04 16:51:19 +10:30
JamesBhattarai 16d04bd5f7 Chore: Setup and Env 2026-03-22 16:04:29 +05:45
nexgen_mirrors 1789590167 feat(zerotier): add ZeroTier network governance module
Add comprehensive ZeroTier integration for managing network access:

- Portal networks: manager-created ZeroTier network bindings
- Device registration: user-owned ZeroTier node endpoints
- Approval workflows: request/approve/revoke network access
- Activation sessions: time-limited network authorization
- Kill switch: emergency access revocation
- Reconciliation job: sync portal state with ZeroTier controller

Includes ZeroTier client SDK supporting both Central and self-hosted
controller APIs, with full CRUD operations for networks and members.
2026-03-20 21:50:20 +10:30
JamesBhattarai cc9dc5064e Fix: Migration
oidc_jwks_keys table doesn't exist
uix_org_provider_type constraint multiple use
transaction abort/never rolled back
2026-03-05 11:35:09 +05:45
JamesBhattarai a0d4e59c24 Feat(Chore): Verify Flow, Invites, Suspend, Depart Cert Policy
feat: add password reset and email verification flow
feat: add org invite listing, cancellation, and invite link fallback
feat: add user suspend/unsuspend with audit logging
feat: add department certificate policy (expiry, extensions)
feat: enforce dept cert policy on SSH certificate signing
feat: wire up OIDC consent and token flow (replace mocks)
feat: rework CLI auth bridge to use frontend login flow
feat: add admin OAuth provider management (CRUD)
chore: refactor model import paths after module reorganisation
chore: clean up config, decorators, and dev tooling
2026-03-01 20:42:48 +05:45
JamesBhattarai 1ba5738d52 Feat: OIDC UI bridge, Microsoft SSO,, and schema session flaws
- OAuth Callback to Use Gatehouse UI to login instead of Backend Served dull ui
- Setup Autoregister of user + org, on oauth
- Microsoft Oauth Support
- OIDCRefreshToken.access_token_id  had a narrow Column increased to VAR(255) and remove FK to sessions.id which had no use
- client_id and client.id mismatch ,backup-code consumption
2026-02-26 23:18:31 +05:45
nexgen_mirrors f1fff22f3e tidy up 2026-02-23 13:25:17 +10:30
coryHawkvelt ae2421763a google login works 2026-01-21 03:09:46 +10:30
coryHawkvelt 2c0aaf484b move app to gatehouse-app 2026-01-15 03:40:29 +10:30
nexgen_mirrors a6474f55c1 feat(oidc): add debug logging and migrate client secret hashing to Flask-Bcrypt
- Add comprehensive debug logging across OIDC endpoints and services for development troubleshooting
- Implement backward-compatible password hash checking with automatic migration from raw bcrypt to Flask-Bcrypt format
- Refactor logging configuration to ensure proper propagation across all app modules
- Configure root logger and disable Werkzeug duplication for cleaner log output
- Initialize OIDC JWKS service on application startup
- Update seed script to use Flask-Bcrypt for client secret hashing
- Fix audit service to use correct event_metadata parameter

BREAKING CHANGE: Client secrets created with old raw bcrypt format will be automatically migrated to Flask-Bcrypt format on first successful authentication
2026-01-09 12:59:53 +10:30
nexgen_mirrors 5e060f267d major checkpoint 2026-01-08 15:59:53 +10:30
nexgen_mirrors 211854ca0a inital 2026-01-08 01:00:26 +10:30