deSEC

Recent Commits

• Peter Thomassen(21 Sept 26)

  feat(webapp): announce suspension of .dedyn.io registration

• Peter Thomassen(21 Sept 26)

  fix(webapp): restore alert and page card styling after Vuetify 3 migration

• dependabot[bot](19 Sept 26)

  chore(deps): bump the pip-api group across 1 directory with 6 updates Updates the requirements on [celery](https://github.com/celery/celery), [cryptography](https://github.com/pyca/cryptography), [django-prometheus](https://github.com/korfuri/django-prometheus), [pyotp](https://github.com/pyauth/pyotp), [psycopg](https://github.com/psycopg/psycopg) and [requests](https://github.com/psf/requests) to permit the latest version. Updates `celery` to 5.6.3 - [Release notes](https://github.com/celery/celery/releases) - [Changelog](https://github.com/celery/celery/blob/v5.6.3/Changelog.rst) - [Commits](https://github.com/celery/celery/compare/v5.6.2...v5.6.3) Updates `cryptography` to 50.0.1 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pyca/cryptography/compare/46.0.5...50.0.1) Updates `django-prometheus` to 2.5.0 - [Release notes](https://github.com/korfuri/django-prometheus/releases) - [Changelog](https://github.com/django-commons/django-prometheus/blob/master/CHANGELOG.md) - [Commits](https://github.com/korfuri/django-prometheus/compare/v2.4.1...v2.5.0) Updates `pyotp` to 2.10.0 - [Release notes](https://github.com/pyauth/pyotp/releases) - [Changelog](https://github.com/pyauth/pyotp/blob/main/Changes.rst) - [Commits](https://github.com/pyauth/pyotp/compare/v2.9.0...v2.10.0) Updates `psycopg` to 3.3.5 - [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst) - [Commits](https://github.com/psycopg/psycopg/compare/3.3.4...3.3.5) Updates `requests` to 2.34.2 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](https://github.com/psf/requests/compare/v2.32.5...v2.34.2) --- updated-dependencies: - dependency-name: celery dependency-version: 5.6.3 dependency-type: direct:production dependency-group: pip-api - dependency-name: cryptography dependency-version: 50.0.1 dependency-type: direct:production dependency-group: pip-api - dependency-name: django-prometheus dependency-version: 2.5.0 dependency-type: direct:production dependency-group: pip-api - dependency-name: psycopg dependency-version: 3.3.5 dependency-type: direct:production dependency-group: pip-api - dependency-name: pyotp dependency-version: 2.10.0 dependency-type: direct:production dependency-group: pip-api - dependency-name: requests dependency-version: 2.34.2 dependency-type: direct:production dependency-group: pip-api ... Signed-off-by: dependabot[bot] <[email protected]>

• Jeff Dairiki(17 Sept 26)

  fix(api): always include all fields in canonicalization of LOC records

• Peter Thomassen(04 Sept 26)

  fix(webapp): explain how the domain limit grows Align the domain list with desecapi.permissions.WithinDomainLimit.

• Peter Thomassen(02 Sept 26)

  fix(webapp): don't claim a domain limit of zero before it is known `limit_domains` started out as 0 and was replaced only once the request to auth/account/ came back, so until then -- or forever, if that request failed -- the create dialog said "You have 0 of 0 domains left", disabled the Save button and warned that the maximum number of domains had been reached. A user with one of one domain used reported exactly this. null is already the component's value for "no limit applies", so starting there costs the quota hint instead of locking the user out of domain creation, and the server still enforces the actual limit.

• Peter Thomassen(02 Sept 26)

  fix(webapp): apply the app's typography and colors inside dialogs Vuetify teleports overlays into a .v-overlay-container that it appends next to .v-application rather than inside it, so rules written as `.v-application p` stop at the dialog boundary: paragraphs in dialogs lose their bottom margin and run together, and `.text-primary` falls back to vuetify's amber instead of ours. Name both containers, as the vuetify 3 migration in f8dd7bb already did for links. With the list rules reaching into dialogs, the scoped rule for the DNSSEC list is redundant and goes: its padding-left now comes from the app-wide rule in both contexts, and list-style-position: outside was always the initial value.

• Peter Thomassen(02 Sept 26)

  fix(webapp): keep dialog alerts from being squeezed into their padding Vuetify styles alerts with `flex: 1 1 0`, which makes an alert that sits directly inside a card a shrinkable flex item. Once a dialog wants more height than the viewport offers, the flex algorithm takes it out of the alert, laying it out shorter than its own content: in the domain creation confirmation, the success message's 16px padding drops to 6px on a narrow window, and in a short window the text is clipped by the bottom edge. DomainSetupDialog, TOTPVerifyDialog and MFA put alerts directly inside the card and are affected; the CrudList dialogs wrap theirs in a v-form, whose children are not flex items.

• Peter Thomassen(02 Sept 26)

  ci: lint the webapp `npm run lint` was not run anywhere in CI, so nothing caught the broken lint invocation fixed in b23ee08, and nothing guards the eslint flat config now. Run it in the test-webapp job, which already has the dependencies installed.

• Peter Thomassen(01 Sept 26)

  build(webapp): migrate eslint to flat config, upgrade to eslint 9 eslint 8 is out of support since October 2024, but dependabot was told to ignore it in a75ced2 because eslint 9 has breaking changes and the plugins were not compatible at the time. The plugins are ready now (eslint-plugin-vue, -import, -vuetify and -vue-scoped-css all declare eslint 9 support and ship flat configs), so the config format was the only thing left. Translate .eslintrc.cjs to eslint.config.js, and take the opportunity to lint against the Vue 3 rule sets. The eslintrc `extends` referred to `plugin:vue/essential` and `plugin:vue-scoped-css/recommended`, which are the Vue 2 variants (58 and 4 rules) even though the webapp has been on Vue 3 for a while; the flat config uses `flat/essential` and `flat/recommended` instead (82 and 9 rules). The three "Preparation for vue3" rule overrides and the deep combinator override are dropped, as the Vue 3 sets enable all four as errors. eslint-plugin-vue is bumped to ^10 because eslint-plugin-vuetify depends on ^10.8 and registers it under the `vue` plugin key; with our ^9 the two copies collide as "Cannot redefine plugin". @eslint/js and globals become direct dependencies, as flat config imports them. `--ignore-path .gitignore` is gone in eslint 9, so the ignores move into the config, and the lint globs lose the `json` extension: the only JSON file under src/ sits in the ignored vendored module directory. Two code changes fall out of the stricter setup. eslint 9 flipped the `no-unused-vars` `caughtErrors` default from "none" to "all", which surfaces two unused catch bindings; both catch blocks ignore the error, so they lose the binding. And the Vue 3 scoped-css rules reject the argument-less `::v-deep` in CrudListRecord.vue, which becomes `:deep(...)` and compiles to the same `[data-v-*] <selector>` output. Verified with node 24: `npm run lint` covers 73 files without findings, `npm test` and `npm run build` pass.

• Peter Thomassen(01 Sept 26)

  feat(deps): track webapp javascript dependencies again The npm ecosystem was dropped from the dependabot configuration in 9c67472, leaving www/webapp unwatched. Track it again, at a monthly interval, with updates collated into one group PR for runtime dependencies and one for development dependencies. The `sass` ignore from 8a6bb2c is dropped: it was added because sass warned about the then-current Vue 2 era vuetify, which no longer applies. The `eslint` ignore stays, as eslint 9 requires migrating .eslintrc.cjs to flat config first.

• Peter Thomassen(01 Sept 26)

  chore(deps): split api dev requirements, fix dependabot grouping Dependabot never grouped the api pip updates: the `pip-api` group used `update-types`, which dependabot-core only evaluates when it knows the dependency's current version. For a plain requirements.txt that is the case only for `==` pins, so every `~=` requirement failed the check and got its own PR. Use `patterns: "*"` instead, and split the group by dependency type. For pip, dependabot derives the type from the file name (anything containing "dev" is a development dependency), so move the two test-only packages to requirements-dev.txt. Django and Django REST framework are excluded from the production group so that their updates keep coming as separate PRs.

• Peter Thomassen(01 Sept 26)

  fix(webapp): focus the code input in the TOTP dialogs Autofocus the first digit, so that the code can be typed as soon as the dialog opens. In the 2FA dialog, this applies when the account has a single TOTP token, which is preselected. With several tokens, focus stays on the dialog, where the token is picked first.

• Peter Thomassen(01 Sept 26)

  fix(webapp): align the captcha block with the fields above it Put the captcha and its buttons at the right end of the form row, so that they line up with the right border of the input fields, and lay the buttons out across the captcha's width in a compact size. The solution field is centered next to the block and takes the width the captcha leaves, which is more in image mode than in audio mode.

• Peter Thomassen(01 Sept 26)

  fix(webapp): validate the sign-up domain only once it has content Picking a domain type validates the domain field, and a type is picked when the page opens, so the field showed its error message before anything could be entered. Reset the validation instead while the field is empty. Fixes #1204

• Peter Thomassen(01 Sept 26)

  fix(webapp): scroll the caret into view on Home and End Home and End place the caret with setSelectionRange, which does not scroll the cell that record values are scrolled in, so in a record with a single long value, such as a DKIM key, the caret ends up outside the visible area. Measure the text before the caret and scroll the cell accordingly, which also covers the other places that set the caret, such as deleting across a field boundary. The measuring mirror takes its font from the input, including the letter spacing that Vuetify sets there, and is absolutely positioned so that it shrinks to its text; the sizing mirror takes the same font, as it otherwise makes the field too narrow for its text, which then scrolls its own content beyond the reach of the cell's scroll position.

• Peter Thomassen(01 Sept 26)

  fix(webapp): let row colors show through crud table fields App.vue gives every field a white background, which put white boxes into colored table rows. Make the fields transparent inside table rows, so the dirty and error colorings, the hover tint and the save flash cover the row evenly.

• Peter Thomassen(01 Sept 26)

  fix(webapp): flash rows on save in every crud list Track the rows to highlight in component state and let itemClass emit the successFade class, so the highlight survives the re-render that follows a save, and start it once the server has confirmed the update. Highlight rows on hover in all lists, not just where rows are clickable.

• Peter Thomassen(01 Sept 26)

  fix(webapp): revive crud list row styles The rules used ::v-deep in an unscoped style block, where it ships as an invalid selector, so none of them applied. Anchor them on the .crud-item row class that the data table puts on every item row, restoring top-aligned cells, the green flash after saving, the highlighted save button on dirty rows and the white background of focused inputs in the domain and token lists. Also drop the rules for .text-disabled, a class no longer applied anywhere, and the copies of these rules in CrudListRecord.

• Peter Thomassen(01 Sept 26)

  fix(webapp): keep record content from widening the table The Content column was capped at 45vw by CSS targeting the Vuetify 2 data table markup (.theme--light.v-data-table > .v-data-table__wrapper). Those selectors match nothing in Vuetify 3, so the cell grew to the width of the hidden mirror element that RecordItem uses to size its inputs, pushing TTL, Last touched and Actions out of view for long values such as DKIM keys. Cap the column with the data table's own maxWidth instead, which restores scrolling inside the cell, and drop the remaining dead Vuetify 2 rules. Fixes #1216

• Peter Thomassen(01 Sept 26)

  fix(docs): correct duration notation for token max_age fields Django's duration parser only accepts hours when both minutes and seconds follow, so "5:30" is 5 minutes 30 seconds, not 5 hours 30 seconds. The notation is thus [DD] [[HH:]MM:]ss, not [DD] [HH:[MM:]]ss. Fix it in the API docs and in the web UI form hint, which also gains an example.

• Peter Thomassen(01 Sept 26)

  docs(auth): note perm_manage_tokens requirement for account endpoint The /auth/account/ endpoint requires the perm_manage_tokens permission for both GET and PATCH, which was not documented anywhere.

• Peter Thomassen(04 Sept 26)

  feat(gatekeeper): drop registrations for blocklisted email addresses The arbiter matches the address of a registration attempt against the patterns in email-blocklist.txt and answers with a drop verdict naming the matching line, so that no account is created and no activation email is sent while the client receives the usual response. Patterns are shell-style globs matched case-insensitively; a line starting with ! is an exception, and the first matching line decides. The file is read on every request, and the directory holding it is mounted read-only into the gatekeeper container as configured by DESECSTACK_GATEKEEPER_CONF; if it cannot be read, no address is blocked.

• Peter Thomassen(04 Sept 26)

  feat(gatekeeper): ask an external arbiter about account registrations The api hands the facts of a registration attempt (email address, client IP address, user agent, requested domain, captcha state) to the gatekeeper service and acts on its verdict: allow, drop (discard the request, but give the client the regular response), or reject (400 Bad Request). The arbiter runs in its own container, reachable from api only and without access to the rest of the stack; its reasoning is logged, but never disclosed to the client, and failure to obtain a verdict allows the request. The arbiter shipped here allows everything; gatekeeper/README.md documents the interface.

• Peter Thomassen(17 Aug 26)

  feat(api): re-check delegations on domain creation and limit denial Creating a domain, and being denied one by the domain limit, both enqueue checks for the user's domains that are not yet known to be secure. Bounded to one plan per user per minute and 20 domains per plan; neither trigger raises. The limit message now says that a re-check is under way.

• Peter Thomassen(18 Aug 26)

  feat(api): sweep delegation checks from cron A cron entry in the api container runs check-delegation --stale 79200 --concurrency 0 every two hours, which gets each domain re-checked about once a day.

• Peter Thomassen(18 Aug 26)

  feat(api): hand domains to the delegation workers with --concurrency 0 check-delegation with --concurrency 0 enqueues one task per selected domain on the bulk queue instead of checking them inline, reusing the same selection and passing --stale on so the workers can re-check it; --dry-run reports what would be enqueued. Negative values are rejected.

• Peter Thomassen(18 Aug 26)

  feat(api): add a Celery worker for delegation checks New celery-delegation service, a second instance of the api image consuming the delegation_bulk and delegation_adhoc queues at one domain per task. desecapi.tasks holds check_domain_delegation, which re-checks staleness before measuring and leaves the domain for later when the resolver is unavailable, and plan_user_delegation_checks, which puts a user's not-yet-secure domains on the ad-hoc queue, capped at 20 per plan and one plan per user per minute.

• Peter Thomassen(17 Aug 26)

  feat(api): let "limit domains ... auto" restore the computed limit Support can pin an account's domain limit by setting a number; there was no way back. "auto" writes null, which is what the computed limit is spelled as, and the command reports the value that results rather than the null it wrote.

• Peter Thomassen(17 Aug 26)

  feat(api): derive the domain limit from securely delegated domains A null User.limit_domains -- now the default -- makes the enforced limit s + max(DOMAIN_LIMIT_INSECURE_HEADROOM, round(sqrt(e))), with s the user's securely delegated domains and e the externally delegated ones; an explicit value still pins it. LIMIT_USER_DOMAIN_COUNT_DEFAULT is renamed to DOMAIN_LIMIT_INSECURE_HEADROOM, its environment variable unchanged, and now floors the headroom rather than the limit. Domain.secure_delegation_since, maintained by DelegationCheck.objects.record(), is what those counts read. The account endpoint keeps reporting limit_domains as the enforced number and gains secure_domains. Migration 0048 adds the field, backfills it from the checks already recorded, and makes limit_domains nullable by default.