This adds optional two factor authentication based on shared
TOTP-secrets to both login variants (password and AIO token
authentication).
The 2FA can be enabled as soon as the containers are running in a
section below the backup configuration. As long as it is not enabled,
the AIO UI shows a warning at the top, and inside the Nextcloud a
notification is shown to all Nextcloud admins, strongly recommending to
enable it. The Nextcloud admin notification is sent via the
mastercontainer's `cron.sh`, thus will be renewed whenever it is
dismissed.
In order to show the notices, this PR includes a notification system for
the AIO UI, providing two variants: notices, and warnings. Notices have
a green background and border and vanish after 5 seconds. Warnings have
a orange-leaning yellow background and border and don't vanish (and
can't be dismissed manually, neither).
Another visual improvement is highlighted section headlines: If the URL
hash matches an `h2` element's ID, the `h2` is highlighted and if the
`h2` is followed by a `detail` element, that `detail` is opened. If
effect, browsing to `#two-factor-auth` jumps to the section, which is
highlighted and opened already (as shown in the second screenshot
below).
Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>
AI-assistant: Claude Opus 4.8
Previously it was three boolean options, which were supposed to be mutually
exclusive, which had to be taken care of manually.
Also previously there was only indirect indication of the choice "none", which
is brittle, too.
Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>
A slug typed into the deSEC form was lost when the form re-rendered after a
201 redirect (e.g. on the awaiting-verification step), forcing the user to
re-enter it. Persist the requested slug in the AIO config when register()
runs and pre-fill the slug input from it on every step, then clear it once a
domain is set. Stored in configuration.json rather than a URL parameter so it
survives the multi-step flow without leaking into the iframe address.
Signed-off-by: Simon L. <szaimen@e.mail.de>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Move the deSEC "register a free domain" flow out of the inline containers
page form and into a modal backed by a dedicated /desec view loaded in an
iframe. The multi-step register -> verify -> domain process now re-renders
inside the modal, so the user can adjust the details and complete email
verification without reloading the whole page each step. Only once the
domain is fully registered does the view reload the parent containers page.
- add /desec route + desec.twig standalone view
- add desec-modal.js (open/close, backdrop + Escape) and desec-done.js
(parent reload on completion)
- redirect register POST to the /desec view so steps stay in the modal
- drop the redundant <details> wrapper in desec-register.twig, add heading
- style the modal and let <button class="button"> pick up button styles
- drive the modal iframe in the Playwright specs and update the QA checklist
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
- includes/desec-register.twig renders the multi-step deSEC flow: enter email
(optionally an existing password), the awaiting-verification step, and the
account-registered step, with friendly messaging for the ambiguous "email
already registered" case (deSEC returns 202 either way to prevent enumeration).
- containers.twig includes the deSEC section under the domain-entry UI; index.php
passes the deSEC config/state (email, password, registered/awaiting flags) to
the view.
- Move the deSEC password reveal from an inline style to a CSS class (no inline
CSS/JS in templates) and bump the style.css cache-buster to v13 in layout.twig
and log.twig.
Co-Authored-By: szaimen <42591237+szaimen@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
The session cookie was recently renamed from `PHPSESSID` to
`__Host-Http-PHPSESSID` (commit 3871179a). When watchtower updates the
mastercontainer, the browser still holds the old `PHPSESSID` cookie, but the
new code only looks for `__Host-Http-PHPSESSID`. The old cookie is ignored, a
fresh unauthenticated session is created, and the user is logged out.
Fix: before starting the new session in index.php, check if the old `PHPSESSID`
cookie exists and carries an authenticated session. If it does, destroy the old
session and mark the new one as authenticated via `SetAuthState(true)`.
Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/cba0ea31-e257-4ec1-82ae-dd66f0f34d98
---
refactor: address review comments - use constant for session key and activity interval
Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/cba0ea31-e257-4ec1-82ae-dd66f0f34d98
Co-Authored-By: szaimen <42591237+szaimen@users.noreply.github.com>
Pablo Zmdl