Jason (Json)
7eec1345f9
fix(gateway): preserve Control UI access across device-auth upgrades ( #112558 )
...
* fix(gateway): preserve device auth upgrade recovery
* fix(gateway): satisfy device auth upgrade gates
* fix(doctor): clean disabled device auth bypass
* fix(gateway): recheck migration operator boundary
* fix(gateway): keep migration guard internal
* fix(gateway): preserve insecure migration access
* fix(gateway): reject stale migration handshakes
* fix(gateway): revoke legacy migration sessions
* fix(gateway): bound device-less migration authority
* fix(gateway): require explicit migration pairing
* fix(gateway): revoke alternate migration sessions
* fix(gateway): close migration admission races
* style(gateway): format migration pairing import
* fix(security): audit pending device-auth migration
* fix(gateway): reconcile migration on startup
* fix(gateway): cap device auth migration scopes
* fix(gateway): retain migration socket restrictions
* perf(ui): trim migration startup bundle
* perf(ui): lazy-load device auth migration
* fix(gateway): bind migration completion to approved key
* fix(gateway): preserve migration authorization bounds
* fix(gateway): grant migrated device pairing capability
* fix(ui): preserve device migration bundle budget
* fix(ui): stabilize migration startup budget
* chore(ui): retain startup budget headroom
* fix(ui): split migration overlay helpers
2026-07-22 18:44:48 -06:00
Peter Steinberger
31e52dc5c5
feat(gateway): allow explicit operator.admin in device auto-approval with critical audit finding ( #111509 )
2026-07-19 12:05:04 -07:00
Peter Steinberger
30e2129ace
docs(gateway): document x-openclaw-scopes cap on trusted-proxy device auto-approval ( #111228 )
2026-07-18 22:35:32 -07:00
Peter Steinberger
5e51c4bbcc
feat(gateway): auto-approve trusted-proxy browser device pairing ( #111189 )
...
* feat(gateway): auto-approve trusted-proxy browser device pairing
Adds gateway.auth.trustedProxy.deviceAutoApprove so team gateways behind an
identity-aware proxy (Cloudflare Access, oauth2-proxy, Pomerium) can skip the
manual `openclaw devices approve` step for new Control UI/WebChat devices.
Auto-approval fires only for a new (unpaired) operator browser device on a
connection that already passed trusted-proxy auth with a resolved allowUsers
user. Scope upgrades on existing devices and node pairing stay manual. Granted
scopes are capped to the configured set intersected with the connection's
x-openclaw-scopes proxy cap, operator.admin is rejected at config validation,
and the pairing-store approval rechecks new-device status under the store lock
so a repair/upgrade or concurrent approval can never be silently widened. Each
auto-approval emits an audit log line with the proxy user and granted scopes,
and `openclaw security audit` warns when the mode is enabled.
* docs: regenerate docs map for trusted-proxy auto-approval section
2026-07-18 21:23:55 -07:00
Peter Steinberger
f7d7148cf0
docs: rewrite published docs grounded in current source ( #100142 )
...
Source-grounded rewrite of 529 published docs pages with per-unit information-loss verification: 1,713 factual corrections cited to src/**, generated surfaces regenerated, frontmatter titles preserved for i18n, release notes pages untouched. All docs gates green.
Closes #100141
2026-07-05 00:32:47 -04:00
Niels Kaspers
96a49caffa
docs: clarify trusted-proxy websocket scopes ( #85950 )
2026-06-09 12:40:12 -07:00
Peter Steinberger
bb5010b89a
docs: absorb docs sweep
...
Co-authored-by: Kai <kai@itskai.dev >
Co-authored-by: Weihang <gwh7078@163.com >
Co-authored-by: Scott Long <longstoryscott@gmail.com >
Co-authored-by: moejaberr <mjaber@uoguelph.ca >
Co-authored-by: huihui0822 <109355071+huihui0822@users.noreply.github.com >
2026-05-22 21:52:01 +01:00
Josh Avant
7d99f8b021
fix(gateway): allow trusted-proxy local-direct password fallback ( #82953 )
...
* fix(gateway): restore trusted-proxy local password fallback
* docs(changelog): note trusted-proxy password fallback fix
* docs(changelog): clarify trusted-proxy fallback policy
2026-05-17 01:35:59 -05:00
Peter Steinberger
78a12706ec
fix(docs): make docs formatter mintlify-safe
2026-04-28 08:13:21 +01:00
Peter Steinberger
424560c6c2
docs: normalize mintlify component closings
2026-04-28 07:54:15 +01:00
Vincent Koc
7b18bd03bb
fix(gateway): allow explicit loopback trusted proxy auth
...
Fixes #59167 .
Supersedes #63379 .
2026-04-27 22:01:06 -07:00
Peter Steinberger
1a98938479
fix: allow trusted-proxy local password fallback
2026-04-27 23:10:22 +01:00
Vincent Koc
64a7a34c83
docs(trusted-proxy-auth): rewrite with Steps for handshake, Tabs for TLS, AccordionGroup for proxy examples and troubleshooting
2026-04-26 01:04:51 -07:00
Vincent Koc
c5c163d078
docs: standardize frontmatter field order (summary before title)
2026-04-23 13:18:17 -07:00
Vincent Koc
2777b089b5
docs: normalize frontmatter titles to sentence case
2026-04-23 13:15:17 -07:00
Vincent Koc
4a2cd533ac
docs: remove duplicate H1 where frontmatter title already sets it
2026-04-23 13:11:14 -07:00
Vincent Koc
c8aec6b951
docs: Control UI identity + gateway pairing hardening + release verification
2026-04-22 23:52:37 -07:00
Peter Steinberger
7985cf5531
docs: refresh trusted proxy auth guidance
2026-04-04 13:44:34 +01:00
Peter Steinberger
7671f4f1e3
docs: clarify gateway and plugin http auth scopes
2026-04-04 09:01:05 +01:00
Vincent Koc
5c9408d3ca
docs: update docs for unreleased channel and gateway changes
...
Cover Teams member-info action, Teams/Matrix sender-allowlist
context filtering, macOS MagicDNS discovery preference, and
trusted-proxy mixed token config hardening.
2026-04-01 02:20:44 +09:00
Vincent Koc
c3b05fc4d9
docs: add missing title, remove stale description fields from frontmatter
2026-03-19 15:26:26 -07:00
Peter Steinberger
a12cbf8994
docs: refresh CLI and trusted-proxy docs
2026-02-25 02:40:12 +00:00
Peter Steinberger
9af3ec92a5
fix(gateway): add HSTS header hardening and docs
2026-02-23 19:47:29 +00:00
Mariano
094dbdaf2b
fix(gateway): require loopback proxy IP for trusted-proxy + bind=loopback ( #22082 )
...
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: 6ff3ca9b5d132747814+mbelinky@users.noreply.github.com >
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com >
Reviewed-by: @mbelinky
2026-02-20 18:03:53 +00:00
Nick Taylor
1fb52b4d7b
feat(gateway): add trusted-proxy auth mode ( #15940 )
...
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: 279d4b304f833231+nickytonline@users.noreply.github.com >
Co-authored-by: steipete <58493+steipete@users.noreply.github.com >
Reviewed-by: @steipete
2026-02-14 12:32:17 +01:00
