e985d8724b
Merge remote-tracking branch 'origin/1.9.x' into unique-exception
...
# Conflicts:
# composer.json
# composer.lock
# tests/e2e/Services/Databases/DatabasesBase.php
Co-authored-by: abnegate <5857008+abnegate@users.noreply.github.com >
2026-04-29 06:49:59 +00:00
dae9cbcf45
Merge pull request #12070 from appwrite/realtime-action-channels
...
Realtime action channels
2026-04-29 10:49:13 +05:30
67d24d3ef1
Merge branch '1.9.x' into feat/impersonation-query-params
2026-04-28 19:11:14 +05:30
87ed7c3817
feat: add query param fallback for all impersonation params and simplify tests
2026-04-28 19:10:55 +05:30
cb4cff120b
Add Keycloak oauth support
2026-04-28 10:54:13 +02:00
49e6a38e7f
Add fusionauth oauth
2026-04-28 10:43:16 +02:00
bda823ac0e
chore: format
2026-04-28 13:38:00 +05:30
5afc8f462d
fix: allow same-site in CSRF guard to support Console on subdomains
2026-04-28 13:26:13 +05:30
d25707346f
Add console oauth endpoint
2026-04-28 09:47:27 +02:00
a3f6cf4645
fix: restrict CSRF guard to same-origin only, drop same-site
2026-04-28 13:00:18 +05:30
5465be6301
fix: make CSRF guard fail-closed by requiring explicit same-origin Sec-Fetch-Site
2026-04-28 12:27:57 +05:30
46a457bfa3
fix: block impersonateUserId query param on cross-site requests to prevent CSRF
2026-04-28 12:10:51 +05:30
4c989f99c3
fix: cast impersonateUserId query param to string to prevent array injection
2026-04-28 12:05:02 +05:30
8f1d73a6cb
chore: clarify intentional header-only restriction for email/phone impersonation
2026-04-28 12:02:00 +05:30
01b5fa8ecb
fix: restrict impersonation query param fallback to userId only
...
Remove query param fallback for impersonateEmail and impersonatePhone
to avoid PII exposure in server logs, browser history, and Referer
headers. Only impersonateUserId (an opaque internal ID) is safe to
pass via URL query param.
2026-04-28 11:58:25 +05:30
d73b7a70d8
feat: add query param fallback for impersonation headers
...
Allow impersonation to be specified via URL query params
(?impersonateUserId, ?impersonateEmail, ?impersonatePhone) as a
fallback to the existing headers, enabling Console to embed
impersonation in direct file/image URLs where headers cannot be set.
2026-04-28 11:44:39 +05:30
b28b851bb2
microsoft oauth endpoint
2026-04-27 15:49:44 +02:00
a781325679
Add oauth read operations
2026-04-27 14:47:47 +02:00
3f12062259
updated
2026-04-27 17:54:48 +05:30
15f94d99ca
Add Kick OAuth adapter
2026-04-27 14:02:30 +02:00
ca105ff9bc
feat(Realtime): implement rebindAccountChannels method for userId changes and add corresponding tests
2026-04-27 17:31:31 +05:30
2e960b90df
Fix unused env variable
2026-04-27 13:38:26 +02:00
e4bfb38a57
add okta provider
2026-04-26 11:14:50 +02:00
d25dac7d60
Manual quality improvmenets
2026-04-26 10:29:41 +02:00
1f18e16310
Merge branch '1.9.x' into feat-public-oauth2-endpoints
2026-04-25 12:45:34 +02:00
ffd0dbd406
Add OIDC endpoint
2026-04-25 10:20:00 +02:00
8200d079c6
Simplify specs
2026-04-24 16:37:27 +02:00
d9d87f813f
apple oauth endpoints
2026-04-24 16:31:21 +02:00
db7acd4b8b
More OAuth endpoints
2026-04-24 15:02:36 +02:00
a62ca8612d
More OAuth endpoints
2026-04-24 14:31:38 +02:00
8cdcd379c8
Add more oauth endpoints
2026-04-24 14:15:34 +02:00
1ca75c73df
Merge branch '1.9.x' into realtime-logs
2026-04-24 16:35:25 +05:30
fe08978851
More OAuth provider endpoints
2026-04-24 12:58:32 +02:00
0633662695
removed dispatch experiment
2026-04-24 16:22:57 +05:30
89819db775
added exporter
2026-04-24 16:12:42 +05:30
c097d9fcdd
Dropbox adapter
2026-04-24 12:20:48 +02:00
335b1c2f6c
Figma OAuth endpoint
2026-04-24 11:45:59 +02:00
36435d940d
Add Discord OAuth endpoint
2026-04-24 11:35:30 +02:00
93f7a0d902
GitHub oauth endpoint
2026-04-24 11:17:18 +02:00
7fbfb6266b
GitHub oauth response model
2026-04-24 10:56:39 +02:00
bdbc5b92df
Fix after code review
2026-04-23 13:47:31 +02:00
a0a3849b16
Remove unsupported bulk endpoints
2026-04-23 13:37:32 +02:00
b99139661e
Migrate delete project endpoint
2026-04-23 13:37:19 +02:00
6d86b8fd0d
Removal of project JWTs
2026-04-23 13:25:21 +02:00
cef7a5197f
List policies API
2026-04-23 13:24:39 +02:00
34930e6d67
Merge branch '1.9.x' into fix-membership-privacy
2026-04-23 10:18:32 +02:00
9dad7cef9e
Merge branch '1.9.x' into feat-mocks-public-api
2026-04-23 10:17:32 +02:00
9e23867f0a
Merge pull request #11976 from appwrite/feat-auth-methods-api
...
Feat: Auth methods public API
2026-04-23 10:14:34 +02:00
c36b8fbabf
Fix membershiip privacy bug on production
2026-04-23 10:07:32 +02:00
c2e5bbe0f7
updated
2026-04-22 18:11:32 +05:30
copilot-swe-agent[bot]
ArnabChatterjee20k
Harsh Mahajan
harsh mahajan
Matej Bačo
ArnabChatterjee20k
Matej Bačo