fa02ee8494
feat(signin): Add regex for enabling signin confirmation ( #1290 ) r=pbooth
...
* feat(signin): Add ability to enable signin confirmation on an email regex
* feat(signin): Add missing email domain regex test
* feat(signin): Updated docs
2016-06-16 12:40:02 +01:00
f68eea1eb7
feat(signin): Signin confirmation feature ( #1275 ) r=rfk
...
* feat(signin): Signin confirmation feature
* feat(signin): Fix some merge and failing test cases
* feat(signin): Show device info on signin email
* feat(signin): Send new device email if sign-in confirmation disabled
* feat(signin): Added fallback in recovery_email/status endpoint
* feat(signin): Simplify /resend_code and add legacy fallback
* feat(signin): PR Fixes and signin confirm only for desktop clients
* feat(signin): Removed metricsContext from resend_code
* feat(signin): PR Fixes
* feat(signin): Latest PR Fixes
* feat(signin): Fixed typos
* feat(signin): Add check for invalid verification code
* Final nits on signin confirmation PR (#1288 ) r=vbudhram
* fix(signin): Final nits on signin confirmation PR
* fix(signin): Add test for legacy account verification functionality
* feat(signin): Fix cert sign with verified session=true test
2016-06-10 12:33:05 -04:00
5007b4da57
feat(email): add verification reminders
...
Fixes #1081
2016-06-09 10:16:58 -04:00
3b23422baf
Merge pull request #1272 from l-hedgehog/multiple-cors-origin
...
feat(config): accept CORS requests from multiple origins
2016-06-08 15:21:19 +10:00
76c60cdd1e
Merge pull request #1277 from mozilla/remove-smtp-blackout
...
fix(mail): Remove the "resend blackout period".
2016-06-02 09:05:36 +10:00
c4119f1a9a
feat(metrics): Log metrics about whether metrics are transmitted correctly.
...
You might like to think of them as "meta-metrics"...
2016-06-01 14:23:29 +10:00
27082beb79
fix(mail): Remove the "resend blackout period".
...
Rate-limiting of outgoing mail is now handled by customs-server,
we don't need special-case logic for it here.
2016-06-01 10:01:49 +10:00
f792d352a9
feat(config): accept CORS requests from multiple origins
2016-05-31 10:01:42 +08:00
864659155e
feat(locale): add Finnish locale
...
Related https://github.com/mozilla/fxa-content-server/pull/3738
2016-05-13 11:04:23 -04:00
a13e32a8f0
feat(locale): add Arabic locale support
2016-05-11 14:29:01 -04:00
af748bee76
feat(devices): Add metrics on device updates, and a flag to disable them
2016-05-02 19:06:31 +10:00
f7508cbd82
feat(mailer): Add "re-confirm your email" templates.
...
Add `sendVerifyLoginEmail` which calls `mailer.verifyLoginEmail`.
Primarily @vbudhram's work, @shane-tomlinson made some name changes and
squashed the commits.
2016-04-26 10:41:45 +01:00
dac114e41e
log failed uids in must-reset.js, other nits
2016-04-12 00:51:50 -04:00
d7638a67b9
feat(reset): Ability to put a users account in a "must reset" state, per dannycoates (PATCH)
2016-04-12 00:11:31 -04:00
3d4d5f99d1
fix(email): Add feature-flag for new-login notification email.
2016-04-11 23:54:48 -04:00
517fbff776
fix(clientAddress): allow location of the client ip address in forward headers to be specified in config
2016-04-11 22:20:36 -04:00
0beade7993
chore(api): Add signin config value
2016-03-07 11:18:43 -05:00
c7c73c90b1
fix(config): adjust localized post-verification links
2016-02-23 11:04:02 -05:00
f8abfe269a
feat(config): Add 'oauth.keepAlive' config option.
2016-02-08 16:34:21 +11:00
68572fa507
fix(config): Pass 'options.extra.email' to hapi-fxa-oauth, not 'options.email'.
2016-02-08 16:33:17 +11:00
35d8291d17
fix(log): add mozlog fmt properly
...
Fixes #1138
2015-12-29 19:37:51 -05:00
b77c58c190
chore(docs): remove misleading references to awsbox
2015-12-21 17:50:44 -08:00
f1306c9854
feat(oauth): pass email=false when verifying oauth tokens
...
Closes #1109
2015-11-13 09:37:51 -08:00
f051b21414
fix(mail): update email support url
2015-11-11 16:07:03 -05:00
e6617f9799
fix(locale): reenable pt-PT locale
2015-11-06 13:41:58 -05:00
1db917f4c8
refactor(locale): sync new locale list
2015-11-06 13:19:12 -05:00
9ebec1a32b
feat(profile): Add oauth-authenticated /account/profile endpoint.
2015-10-30 14:58:04 +11:00
30a2651852
Merge pull request #1073 from mozilla/issue-1037-extract-basket-events
...
refactor(basket): move basket event processing into separate repo.
2015-10-20 21:15:49 +11:00
664d73ef14
feat(server): optionally enforce a strict CORS origin
2015-10-16 10:29:25 +01:00
6c90637e19
Merge pull request #1064 from dannycoates/i1025
...
multiple public keys
2015-10-05 15:10:09 -07:00
7d0a4fd376
refactor(basket): move basket event processing into separate repo.
...
The basket event-processing logic now lives in a basket-specific repo,
https://github.com/mozilla/fxa-basket-proxy/
2015-10-05 15:53:57 +11:00
c0f419bf2a
feat(i18n): Enable Romainian `ro` support.
...
fixes mozilla/fxa-content-server#3125
2015-10-02 18:06:05 +01:00
9a21e38e56
wip on multiple public keys
2015-09-21 17:14:23 -07:00
c3eb84d4ff
added post verify email
2015-09-10 12:36:27 -07:00
929666815b
Merge pull request #1026 from mozilla/rfk/enable-fa-l10n
...
feat(l10n): add fa as a supported locale.
2015-08-31 09:18:14 -07:00
63842b0016
feat(metrics): add DataDog to activity events, email verified activity events
...
Fixes #922
2015-08-25 20:25:41 -04:00
c4b3bd236d
feat(l10n): add fa as a supported locale.
2015-08-25 16:16:26 +10:00
ff5dd20a6c
WIP on openid
2015-08-18 15:29:44 -07:00
980236aa4d
feat(l10n): add en-GB as a supported locale.
2015-08-18 10:00:00 +10:00
9f4747fa2d
refactor(config): Use human-readable duration values in config
2015-08-11 14:40:44 -07:00
07a8ba1dff
chore(build): Replacing JSHint with ESLint
2015-06-18 17:39:32 -07:00
34ae5d02c6
feat: Add account notification emails.
...
* password changed
* password reset
* new sync device (though not yet hooked up)
2015-06-18 14:17:00 +01:00
2c5d523795
chore(config): Update convict and switch on strict validation.
2015-06-10 11:43:50 +10:00
8ebb1c1e21
Renaming toolbusy config option to maxEventLoopDelay
...
https://github.com/mozilla/fxa-auth-server/issues/741
2015-05-19 22:09:01 -07:00
7df36f4ff0
moar ENV
...
This adds environment variable names for all config parameters. It
also adds 'envc' to help make using them easier in dev and replaces
the default json files. This is a baby step in configuring the
process purely with the env which should make containerizing easier.
2015-05-13 20:33:58 -07:00
2817971924
reorganized source files
2015-05-10 12:11:59 -07:00
28625226eb
tests(preverify): add 321done to trusted jkus for dev
2015-05-08 14:41:26 -07:00
0251cb804a
fix(mailer): split out the list of supported locales, for easier maintenance
2015-04-27 11:58:06 -07:00
f61863d3d7
allow the sns notifier to be disabled in config
2015-03-11 16:58:49 -07:00
cbad29619c
Locked account updates.
...
* `lockAccount` takes both `lockedAt` and `unlockCode`
* Expose the `unlockCode` endpoint to get the unlock code
* Add an `/account/lock` endpoint. Used for testing.
* Sending an account unlock email requires the account to be locked.
* Add API docs for /account/lock
* Point to the mozilla repo for fxa-auth-db-mem
* Add an `enableLockout` configuration option.
* Extract the route removal code into a module.
* Add a new error `accountNotLocked`. Error is only returned for `/account/unlock/resend_code`
* A new `locked` event is logged whenever an account is locked. Can be used to determine the number of locked accounts over a timespan.
2015-02-26 20:43:37 +00:00
087abb2d99
Initial account lockout work
...
* API spec
* Add account/unlock/resend_code, account/unlock/verify_code routes and and related logic.
2015-02-26 16:06:22 +00:00
de28ab61e1
Increase passwordForgotToken lifetime to 1 hour.
2015-01-28 15:04:22 +11:00
6ead098acc
Make scrypt.maxPending a config option.
...
This also renames some internal uses of "max_pending" to match the
prevailing capitalization style.
2014-09-30 16:27:51 +10:00
70c3cc9a20
basket api notifier
2014-09-28 18:51:53 -07:00
a3f2200e18
chore(config): Add a default trusted JKU for local development.
...
* `trustedJKUs` is set to allow a local 123done to be a trusted preVerifyToken generating RP.
2014-09-05 16:15:50 +01:00
53e3591105
Merge pull request #784 from dannycoates/pvt
...
Support for preVerifiedTokens in /account/create to allow trusted reliers who have already verified the the user's email to more easily transition users to FxA. A valid preVerified token allows the user to skip the email verification step, i.e., the user's account is verified after /account/create completes.
fixes #780
r=rfk,ckarlof
2014-09-03 14:15:32 -07:00
c4f5e0b75a
Removed some bonus trailing commas and dupe vars
2014-09-03 13:20:06 -07:00
90c192d975
removed iss from preVerifyToken JWT
2014-09-03 11:55:23 -07:00
74145117d8
config cleanup
2014-08-28 11:26:23 -07:00
674ed5de72
WIP on public-key preVerifyTokens
2014-08-22 18:06:34 -07:00
73a0432d31
added a test for invalid preverifytoken, default config to no secret
2014-08-22 11:15:21 -07:00
0e66115b9e
initial sketch of preVerifiedTokens
2014-08-22 11:15:21 -07:00
e6ea9c0f14
resolved all custom git dependencies and removed mysql and heap db.
...
the new fxa-auth-db-mem dev dep hosts a memory db over the httpdb
api.
2014-07-23 12:49:59 -07:00
3ca7277630
added locale to account
2014-07-08 14:54:25 -07:00
1ee6de9db4
disable maxLag until we can dial in a default
2014-06-08 20:59:38 -07:00
100d816bd0
reorganize test related files and removed unuse code
2014-06-03 12:00:06 -07:00
c364d1fc02
use fxa-auth-mailer as a library
2014-06-02 11:00:29 -07:00
ade06da9f7
serve directly over https
...
new config options useHttps, keyPath, certPath
must add useHttps because publicUrl may be https://...
when we are running behind an https proxy but not wanting to
serve https from the application.
2014-05-28 20:47:12 +02:00
6c58e0083c
add http datastore api
...
The intent here is to eventually eliminate the mysql specific
implementation and only have heap (for quick testing) and httpdb
for real life. To ease the transition I've kept db/mysql.js
so we can test the httpdb implementation on a subset of
instances in parallel with the current setup. I already moved
db_patcher and the schema patches to the db server codebase
because those are run manually in production. The httpdb.js
implementation is working but could probably use some tidying up.
2014-05-04 19:31:22 -07:00
c5c942c514
Merge pull request #696 from dannycoates/i517
...
deprecate smtp.verificationUrl and passwordResetUrl
2014-04-24 10:32:06 +10:00
e480f4885a
deprecate smtp.verificationUrl and passwordResetUrl in favor of contentServer.url
2014-04-23 16:42:42 -07:00
ff69888873
feature(server): Add ability to set displayed log level from an environment variable.
...
* Use the `LOG_LEVEL` environment variable.
2014-04-22 15:07:41 +01:00
acb7791bba
train-11.1 ... already
2014-04-21 17:22:51 -07:00
2206cfe718
default customsUrl to localhost
2014-04-21 13:11:33 -07:00
515678ca13
broke out customs server into a seperate process/repo
2014-04-18 19:05:47 -07:00
6849cfa4c1
phase 1 of ses bounce processing
2014-04-10 15:58:36 -07:00
ebf5fbf669
set the resendBlackoutPeriod to 0 in dev.json
2014-03-25 14:55:42 -07:00
c8b3217762
resend blackout period
2014-03-24 19:10:14 -07:00
f7fb99e734
Add a bin/db_patcher.js script, run it with start-local.sh
2014-03-19 17:10:20 +13:00
6fcf0b056f
Fixes #632 : Remove then-redis, regenerate npm-shrinkwrap.json
2014-03-19 14:16:09 +13:00
85c62912f5
Add (temporary) SNS notifications of account delete events.
2014-03-18 11:24:22 -07:00
a5c3ec5e99
awsbox.json use env:dev
2014-03-11 16:10:55 -07:00
0c0e3fb5c5
default config.env to prod
2014-03-11 14:53:44 -07:00
a51deaa714
fix email links in local development mode
...
The contentServerUrl should use the same host/port as the default content-server in
local development.
2014-03-10 13:29:22 -07:00
278cc596ae
step 1 in fixing i18n
2014-03-09 17:33:52 -07:00
03d80cd0cb
Fixes #606 : Add back in it-CH as default, remove en-AU, fix tests
2014-03-05 10:16:17 +13:00
6b8019e0a2
i18n is busted. hacked up until we get the errors sorted. should fix #598
2014-02-28 12:35:48 -08:00
76361514c9
Add a templateServer config item
2014-02-26 12:01:19 +13:00
01a1097cca
Add separate config files for various tests for local template server
2014-02-26 12:01:19 +13:00
427dc01b15
Use our own fake content server when testing
2014-02-26 12:01:19 +13:00
9e46fe1a91
Remove email templates since now fetch from fxa-content-server
2014-02-26 12:01:19 +13:00
67b44eec3c
Fetch all localised templates from the fxa-content-server and use them
2014-02-26 12:01:19 +13:00
0412d23f32
default mysql connection limits to 10
2014-02-23 18:35:35 -08:00
5cd39e419e
Implement log summary line
2014-02-13 22:21:26 -08:00
bac97bd5c9
Add "queueLimit" config option for mysql.
2014-02-13 14:47:22 +11:00
696ab882e6
add content-langauge header to sent emails
2014-02-10 14:14:50 -08:00
62602bd945
Fixes #527 : Remove 'Report It' link
2014-02-04 10:31:43 +13:00
0178635d4e
Fixes #523 : Correct passwordForgotToken
2014-01-28 10:15:58 +13:00
e6a5729642
refactored crypto/password.js and added verifierVersion config parameter
2014-01-21 11:26:26 -08:00
7be72d8b1f
added app level token expiry
2014-01-15 13:23:29 -08:00
Vijay
Vlad Filippov
Ryan Kelly
Ryan Kelly
Hector Zhao
Vijay Budhram
Danny Coates
John Morrison
Sean McArthur
Phil Booth
Shane Tomlinson
Peter deHaan
Rishi Baldawa
Zachary Carter
Ryan Kelly
ckarlof
Eric Le Lay
Andrew Chilton