CI failed on a different set of tests each run because bun runs every test
file in one process and the file order differs between machines:
- the secretsmanager route test replaced the whole ../aws module, so files
loaded after it lost awsClients, lambda and defaultAccountId (API Gateway,
SES)
- the Lightsail tests restored FLOCI_ENDPOINT by assigning undefined, which
stores the string "undefined" (runtime diagnostics)
- the auth tests used full-strength argon2 for ~30 sign-ins and timed out on
slower runners; the OIDC cleanup test cached a discovery document without
userinfo_endpoint for the shared issuer
Checked with 20 runs under bun test --randomize.
The Cognito panel gains a test sign-in that shows the decoded ID and
access token claims, a groups section, and a per-user panel to enable or
disable, confirm, sign out everywhere, reset or set a password and change
group membership.
Delete confirmations (row and bulk) now say what else goes, driven by
the schema's deleteImpact, and the inspector follows list refreshes
instead of the click-time snapshot.
The runtime leaves EstimatedNumberOfUsers at 0, so the pool metadata now
carries a userCount from ListUsers (capped at 1000), which the delete
confirmation reads.
Adds enable, disable, confirm, sign-out, password reset and set-password
for one user; user group membership; group list, create and delete; and a
test sign-in that returns decoded token claims. A refused test sign-in is
an outcome rather than a 401, which would end the console session.
Also adds a generic GET for one flat item and a schema deleteImpact so
delete confirmations can say what else goes with a resource.
Adds a users panel under the selected user pool: copyable app client ids, a create-user form that follows the pool's sign-in method, and the user list with delete. Maps the userpools icon key to the Cognito artwork.
Adds a userpools catalog entry, schema and AwsUserPoolsAdapter, verified
against Floci core:
- list/get/create/delete user pools; create can set email or username
sign-in, a relaxed password policy for local test users, and a public
app client (on by default) whose id is surfaced in the pool metadata
- users as the pool's child items: list (paged), get, create and delete;
passwords are set permanent by default so users can sign in at once
- map Cognito's HTTP-400 error names (UserNotFoundException,
UsernameExistsException, AliasExistsException, InvalidPasswordException)
- link Floci's cognito-idp service to the new page on the diagnostics page
Below 640px the search shrinks, the account switcher shows only its icon, and the connection indicator collapses to its status dot with the label kept for screen readers.
The login page stored its theme under thecloud-theme while the console read floci-theme, so a choice made at sign-in was lost. Both now use floci-theme (falling back to the old key once), and useTheme tolerates unavailable storage.
Adds GET /api/clouds/:cloud/diagnostics and a Diagnostics page in the
General nav. The report combines, in one call:
- runtime reachability, latency, version and edition from /_floci/health
- every service the runtime emulates, with the console pages backed by it
- per-console-service probes (the existing status check)
- EC2 instance containers from /_floci/diagnose
- console uptime, sign-in mode and active session count
Each source is optional, so a down runtime still yields a partial report.
- CodeDeploy: query the redesigned form's labels.
- CloudFormation: expect the parameters and capabilities fields the form
now submits.
- ALB listeners: advance the five-second minimum create state before
deleting, since row actions are disabled while it is pending.
- Lightsail: cast the fetch mock as a whole so it type-checks.
- TargetGroupPanel: depend on the stable refetch function to satisfy
react-hooks/exhaustive-deps.
- safeReturnTo resolves the target against a placeholder origin and rejects
backslashes and control characters, so `/\evil.example` and similar
payloads can no longer redirect off-site after sign-in.
- Add a real unauthenticated /api/health and answer unknown /api/* paths
with a JSON 404 instead of the SPA shell.
- Limit request bodies: 16 KB for /api/auth/* (read before a session
exists), 128 MB for resource create/update and uploads, 10 MB elsewhere.
- Run the production image as an unprivileged user and add a Docker
HEALTHCHECK against /api/health.
Adds the cyber theme to the console and login page, replaces the dark/light toggle with a theme switcher, and moves the login page script to /login.js so it is served under the existing CSP.
- Key login throttling on the real peer address; read X-Forwarded-For only
from FLOCI_UI_TRUSTED_PROXIES (right-most untrusted hop). Add a per-IP
limit across usernames so one attacker can no longer lock out the admin.
- Require an OIDC allow-list (FLOCI_UI_OIDC_ALLOWED_GROUPS / _EMAILS, or
FLOCI_UI_OIDC_ALLOW_ALL_USERS=true); fall back to UserInfo for groups
when the ID token omits them. Redirect IdP and token errors to /login
instead of returning 500s; cache discovery and JWKS.
- Sweep expired sessions, attempts and pending OIDC requests every 60s,
cap each map, and throttle OIDC sign-in starts per IP.
- Fix the .ts import extension that broke the API type-check.
- Add auth.test.ts and document the new settings.
Zakaria
Zakaria