We've gotten feedback recently that the expiration field causes
confusion among auditors who assume it has actual security relevance.
In reality, this is simply the maximum amount of time a connection
between Client and Gateway will stay alive for, and it has no relation
to "sessions" from a security perspective. As such, it's removed, and
the table renamed "Recent connections" to better name what these are.
The `expiration` column is also removed because this is not actionable
by the admin or end-user. In nearly all cases, the connection will have
been "expired" by some other means naturally, such as toggling Firezone
on/off or a policy or resource change. In other words, we do not rely on
this `expiration` field to enforce any security-related timeout.
Fixes#7712
Bumps [phoenix_ecto](https://github.com/phoenixframework/phoenix_ecto)
from 4.6.2 to 4.6.3.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/phoenixframework/phoenix_ecto/blob/main/CHANGELOG.md">phoenix_ecto's
changelog</a>.</em></p>
<blockquote>
<h2>v4.6.3</h2>
<ul>
<li>
<p>Enhancements</p>
<ul>
<li>Add prefix option to check repo status plug</li>
</ul>
</li>
<li>
<p>Bug fix</p>
<ul>
<li>Fix map.field notation warning on Elixir 1.17</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="edbf0d36da"><code>edbf0d3</code></a>
Release v4.6.3</li>
<li><a
href="fe00d3d095"><code>fe00d3d</code></a>
Add prefix option to check repo status plug (<a
href="https://redirect.github.com/phoenixframework/phoenix_ecto/issues/181">#181</a>)</li>
<li><a
href="b44088aed2"><code>b44088a</code></a>
Fix map.field notation warning on Elixir 1.17 (<a
href="https://redirect.github.com/phoenixframework/phoenix_ecto/issues/180">#180</a>)</li>
<li><a
href="b6f618d333"><code>b6f618d</code></a>
Fix language (<a
href="https://redirect.github.com/phoenixframework/phoenix_ecto/issues/179">#179</a>)</li>
<li><a
href="945de21681"><code>945de21</code></a>
fix matrix key</li>
<li><a
href="32a4270f98"><code>32a4270</code></a>
fix branch name in CI</li>
<li><a
href="3e325d3e52"><code>3e325d3</code></a>
Merge pull request <a
href="https://redirect.github.com/phoenixframework/phoenix_ecto/issues/178">#178</a>
from kianmeng/ci-housekeeping</li>
<li><a
href="6be9c3dc77"><code>6be9c3d</code></a>
CI housekeeping</li>
<li>See full diff in <a
href="https://github.com/phoenixframework/phoenix_ecto/compare/v4.6.2...v4.6.3">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Dependabot is having issues figuring out the opentelemetry bumps due to
a [package pull](https://github.com/firezone/firezone/pull/7788), so
this PR aims to alleviate that as a one-off fix.
This bumps a few deps' major versions. Nothing jumped out at first
glance when I reviewed the changelogs, but I figured we'll have a better
idea when this goes out to staging since OTLP is basically disabled in
dev/test.
Why:
* The fallback controller in the API was not catching `{:error,
:seat_limit_reached}` being returned and was then generating a 500
response when this happened. This commit adds the condition in the
fallback controller and adds a new template for a more specific error
message in the returned JSON.
Bumps [phoenix_html](https://github.com/phoenixframework/phoenix_html)
from 4.1.1 to 4.2.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/phoenixframework/phoenix_html/blob/main/CHANGELOG.md">phoenix_html's
changelog</a>.</em></p>
<blockquote>
<h2>4.2.0 (2024-12-28)</h2>
<ul>
<li>
<p>Enhancements</p>
<ul>
<li>Add <code>Phoenix.HTML.css_escape/1</code> to escape strings for use
inside CSS selectors</li>
<li>Add the ability to pass <code>:hr</code> to
<code>options_for_select/2</code> to render a horizontal rule</li>
</ul>
</li>
<li>
<p>Bug fixes</p>
<ul>
<li>Pass form action through in FormData implementation</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b7fd6b7ba7"><code>b7fd6b7</code></a>
Release v4.2.0</li>
<li><a
href="687cca874b"><code>687cca8</code></a>
Fix warnings on Elixir v1.19</li>
<li><a
href="b6d63e7908"><code>b6d63e7</code></a>
Document and pass through option accordingly</li>
<li><a
href="a8262adb45"><code>a8262ad</code></a>
update changelog</li>
<li><a
href="c1ad602073"><code>c1ad602</code></a>
Merge pull request <a
href="https://redirect.github.com/phoenixframework/phoenix_html/issues/452">#452</a>
from phoenixframework/sd-css-escape</li>
<li><a
href="6b67a083f1"><code>6b67a08</code></a>
Merge pull request <a
href="https://redirect.github.com/phoenixframework/phoenix_html/issues/451">#451</a>
from gilbertbw/gbw-hr</li>
<li><a
href="465c303eb9"><code>465c303</code></a>
Update lib/phoenix_html/form.ex</li>
<li><a
href="cdbc402aa4"><code>cdbc402</code></a>
add Phoenix.HTML.css_escape/1</li>
<li><a
href="2cea68e982"><code>2cea68e</code></a>
Fix formatting</li>
<li><a
href="d30c20b659"><code>d30c20b</code></a>
Add <hr/> to options_for_select</li>
<li>Additional commits viewable in <a
href="https://github.com/phoenixframework/phoenix_html/compare/v4.1.1...v4.2.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [dialyxir](https://github.com/jeremyjh/dialyxir) from 1.4.3 to
1.4.5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jeremyjh/dialyxir/releases">dialyxir's
releases</a>.</em></p>
<blockquote>
<h2>1.4.5</h2>
<h3>Fixed</h3>
<ul>
<li>Crash when default ignore file missing and custom file
specified</li>
<li>Revert format option ignore_file_string to ignore_file_strict</li>
</ul>
<h2>1.4.4</h2>
<h3>Fixed</h3>
<ul>
<li>Invalid contract formatting failed on OTP 26 & later.</li>
<li>Empty ignore files are ignored.</li>
<li>Several improvements and corrections to documentation.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Updated Erlex minimum version to 0.27, bringing in several fixes and
improvements.</li>
</ul>
<h3>Added</h3>
<ul>
<li>Multiple formatters can be used in the same invocation.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jeremyjh/dialyxir/blob/master/CHANGELOG.md">dialyxir's
changelog</a>.</em></p>
<blockquote>
<h2>Unreleased changes post [1.4.5]</h2>
<h2>[1.4.5] - 2024-11-17</h2>
<h3>Fixed</h3>
<ul>
<li>Crash when default ignore file missing and custom file
specified</li>
<li>Revert format option ignore_file_string to ignore_file_strict</li>
</ul>
<h2>[1.4.4] - 2024-09-28</h2>
<h3>Fixed</h3>
<ul>
<li>Invalid contract formatting failed on OTP 26 & later.</li>
<li>Empty ignore files are ignored.</li>
<li>Several improvements and corrections to documentation.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Updated Erlex minimum version to 0.27, bringing in several fixes and
improvements.</li>
</ul>
<h3>Added</h3>
<ul>
<li>Multiple formatters can be used in the same invocation.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="501ecd732b"><code>501ecd7</code></a>
Release 1.4.5</li>
<li><a
href="7fadd55027"><code>7fadd55</code></a>
Merge pull request <a
href="https://redirect.github.com/jeremyjh/dialyxir/issues/549">#549</a>
from pdm-jd/pdm-jd/fix/crash-on-custom-ignore-file</li>
<li><a
href="621fc4aded"><code>621fc4a</code></a>
fix: mix dialyzer crashes when a custom ignore file provided that
doesn't mat...</li>
<li><a
href="b960c7d545"><code>b960c7d</code></a>
Merge pull request <a
href="https://redirect.github.com/jeremyjh/dialyxir/issues/547">#547</a>
from neel-desh/bugfix/rename-format-option</li>
<li><a
href="bc8852ed8a"><code>bc8852e</code></a>
Bugfix: Revert format option ignore_file_string to
ignore_file_strict</li>
<li><a
href="3768413c94"><code>3768413</code></a>
Merge pull request <a
href="https://redirect.github.com/jeremyjh/dialyxir/issues/543">#543</a>
from lnenad/master</li>
<li><a
href="c7234e7e63"><code>c7234e7</code></a>
Add a check whether default_ignore file is empty during execution and
ignores...</li>
<li><a
href="b69c5d8954"><code>b69c5d8</code></a>
Fix matching of invalid_contract args. (<a
href="https://redirect.github.com/jeremyjh/dialyxir/issues/541">#541</a>)</li>
<li><a
href="4d76fe921c"><code>4d76fe9</code></a>
Support multiple formatters (<a
href="https://redirect.github.com/jeremyjh/dialyxir/issues/538">#538</a>)</li>
<li><a
href="d8cb107f85"><code>d8cb107</code></a>
Merge pull request <a
href="https://redirect.github.com/jeremyjh/dialyxir/issues/540">#540</a>
from kianmeng/ci-housekeeping</li>
<li>Additional commits viewable in <a
href="https://github.com/jeremyjh/dialyxir/compare/1.4.3...1.4.5">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Dependabot's workflow is set up in such a way it seems that it can't
find our `sha.exs` file.
This is a cleaner approach that doesn't rely on using external files for
the application version.
Interesting note: `mix compile` will happily use the cached `version`
even though it's computed from an env var, because `mix compile` uses
file hash and mtime to know when to recompile.
See https://github.com/firezone/firezone/network/updates/942719116
Why:
* An IdP sync can fail for different reasons and because of this we
previously put a threshold on when to send the first 'IdP sync failed'
email, which was set at 10 failed sync attempts. One thing that was
accidentally overlooked was that on one specific failure type (i.e. 401
- Unauthorized) the Firezone sync was automatically disabled and not
tried from that point forward. Unfortunately, that meant an email did
not get sent out because the threshold was not met. This PR resolves
that by making sure the 401 error will send out an email immediately,
while keeping the 10 failed sync threshold for all other errors.
Closes: #7725
Bumps
[@fontsource/source-sans-3](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/source-sans-3)
from 5.1.0 to 5.1.1.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/fontsource/font-files/commits/HEAD/fonts/google/source-sans-3">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
#7522 won't successfully complete on production because of the migration
in this PR. So, instead, we need to modify this migration, and then
manually apply the same operation to staging.
Why:
* Currently, when using the API, a user has no way of easily identifying
what identities they are pulling back as the response only includes the
`provider_identifier` which for most of our AuthProviders is an ID for
the IdP and not an email address. Along with that, when adding users to
an OIDC provider within Firezone, there is no check for whether or not
an identity has already been added with a given email address. By
creating a separate email column on the `auth_identities` table, it will
be very straight forward to know whether an email address exists for a
given identity, return it in an API response and allow the admin of a
Firezone account to track users (Identities) by email rather than IdP
identifier.
Fixes#7392
Why:
* The API endpoint for updating Resources was using
`Resources.fetch_resource_by_id_or_persistent_id`, however that function
was fetching all Resources, which included deleted Resources. In order
to prevent an API user from attempting to update a Resource that is
deleted, a new function was added to fetch active Resources only.
Fixes: #7492
Hi @firezone/engineering , this is the following of
https://github.com/firezone/firezone/pull/6649
I forgot that people can be member of multiple OUs, this PR aims to add
support for this.
Imagine I have this OU architecture in my google workspace:
```mermaid
flowchart TD
A[Employees] --> B[Engineering]
A --> C[HR]
B --> D[Devs]
B --> E[Ops]
D --> F{me}
```
Currently in Firezone, I will only be a member of the Firezone Group
`OU: Devs`.
With this PR: I will be a member of `OU: Devs`, `OU: Engineering` and
`OU: Employees`
Co-authored-by: Antoine <antoinelabarussias@gmail.com>
Why:
* The portal currently shows API clients in the Actors index list. Each
Actor in the list has a link to their own 'show' page. Prior to this
commit, selecting an API client from the list would result an error.
While API clients are technically an Actor, they aren't quite the same
as all other Actors because they are only used to configure the portal
for a given account. Because of this, they don't have the same
information to show as all other Actors. This commit sets the 'show' URL
for API clients to the 'settings' page to show the proper info for the
API client.
Fixes: #7370
Why:
* Recently we had an issue where a customer's payment info was
incorrectly entered, which caused the payment to not go through. When
something like this happens Stripe will send an update event with a
pending_update section (which we do not use currently). When the
customer fixes the payment info, and payment goes through we get another
update event with the correct subscription info, however, the previous
update (with the pending section) then gets expired and a
`pending_update_expired` event is sent to us. We had been inadvertantly
catching the event and updating the specified account with the info in
the event (which happened to be the previous state of the subscription)
Fixes: #7352
This ensure that we run prettier across all supported filetypes to check
for any formatting / style inconsistencies. Previously, it was only run
for files in the website/ directory using a deprecated pre-commit
plugin.
The benefit to keeping this in our pre-commit config is that devs can
optionally run these checks locally with `pre-commit run --config
.github/pre-commit-config.yaml`.
---------
Signed-off-by: Jamil <jamilbk@users.noreply.github.com>
Co-authored-by: Thomas Eizinger <thomas@eizinger.io>
Why:
* Two of the email templates using an `<a>` tag were not properly
interpolating a view variable. This happened when the templates were
moved from the `web` app using `.heex` files to the `domain` app using
`.eex` files.
Fixes#7294
Why:
* The Firezone website is hosting the component versions at the moment
and due to how Vercel works, occassionally a request will
timeout when being made to the /api/versions endpoint. This had been
throwing an error in the elixir logs and triggering an alert, but
because there is always a default set of component version values in
the elixir app there isn't really a need for an error/alert. With
that in mind the log level will be set to `warning` rather than
`error`.
Closes#7233
In order for the firezone terraform provider to work properly, the
Resources and Policies need to be able to be referenced by their
`persistent_id`, specifically in the portal API.
This PR implements the new idempotent control protocol for the gateway.
We retain backwards-compatibility with old clients to allow admins to
perform a disruption-free update to the latest version.
With this new control protocol, we are moving the responsibility of
exchanging the proxy IPs we assigned to DNS resources to a p2p protocol
between client and gateway. As a result, wildcard DNS resources only get
authorized on the first access. Accessing a new domain within the same
resource will thus no longer require a roundtrip to the portal.
Overall, users will see a greatly decreased connection setup latency. On
top of that, the new protocol will allow us to more easily implement
packet buffering which will be another UX boost for Firezone.
TODOs:
- [x] Switch to sending messages instead of replies
- [ ] Do not hide pre-filtered resources and render them with an error
instead (in case we will want to expose that on a client later)
- [x] Figure out how to generate PSK so that it stays across WS
connections
- Added semi-transparent shadow to the button so that it's more visible
when text is overlapping it. Padding did not look well because it
required scrollbar to be moved inside the parent container and it looked
very ugly
- Replaced custom phx hook with a new native Tailwind component
Closes#5973
Why:
* Without some type of notification, users do not realize that new
Gateway versions have been released and thus do not seem to be upgrading
their deployed Gateways.
Why:
* A handful of 'show' pages were throwing errors for entities created
using the API. The reason was due to the fact that the
`created_by_actor` was not being preloaded and when the details on the
show page were being rendered. This commit updates the various pages to
preload the `created_by_actor` to allow for both API created entities
and UI created entities.
