Replace the Floci logo, screenshots and architecture diagram with TheCloud's
logo, a current screenshot and a redrawn diagram; say TheCloud in prose while
keeping literal identifiers (env vars, image and compose service names); point
the runtime setup at FlociClone; drop the upstream release and Docker badges
and the upstream community section; keep the credit to Floci under License.
Labels, empty states, error messages and defaults the console shows now name
TheCloud or its runtimes. Identifiers that must match the emulator (FLOCI_*
settings, the X-Floci-CSRF header, emulator-returned host names) are unchanged.
- Key login throttling on the real peer address; read X-Forwarded-For only
from FLOCI_UI_TRUSTED_PROXIES (right-most untrusted hop). Add a per-IP
limit across usernames so one attacker can no longer lock out the admin.
- Require an OIDC allow-list (FLOCI_UI_OIDC_ALLOWED_GROUPS / _EMAILS, or
FLOCI_UI_OIDC_ALLOW_ALL_USERS=true); fall back to UserInfo for groups
when the ID token omits them. Redirect IdP and token errors to /login
instead of returning 500s; cache discovery and JWKS.
- Sweep expired sessions, attempts and pending OIDC requests every 60s,
cap each map, and throttle OIDC sign-in starts per IP.
- Fix the .ts import extension that broke the API type-check.
- Add auth.test.ts and document the new settings.
Zakaria