Poznote

Recent Commits

• Timothé Poznanski(16 Oct 26)

  Merge pull request #1648 from timothepoznanski/dev Release 6.120.0

• timothepoznanski(16 Oct 26)

  feat: update version to 6.120.0

• Timothé Poznanski(16 Oct 26)

  Merge pull request #1615 from grep-ankh/feat/mcp-per-caller-auth feat(mcp): optional per-caller authentication (provider-agnostic)

• timothepoznanski(16 Oct 26)

  feat: improve comment handling in markup processing for inline scripts

• timothepoznanski(16 Oct 26)

  feat: enhance shared workspace handling in API responses and documentation

• timothepoznanski(16 Oct 26)

  feat: enhance attachment handling by supporting forwarded ports and normalizing URLs

• grep-ankh(16 Oct 26)

  review: guard restore and the global settings, and attribute MCP refusals The API cannot enforce these for us: requireGlobalSettingsAdmin() calls isCurrentUserAdmin(), which sees the service token (an administrator) rather than the profile named by X-User-ID, so every admin check passes for every MCP caller. The check therefore has to happen in the MCP server, where caller_is_admin() resolves the caller. - restore_backup replaces the whole instance, so it is now limited to administrator callers. - get_app_setting and update_app_setting reach an instance-wide value when the key is a global one, so those keys are refused for a non-administrator. Per-profile keys are unaffected and still work. - A refusal raised by the MCP server is no longer reported as a Poznote API error. IdentityMismatch and IdentityUnmapped now read "MCP server refused this request", and IdentityProviderUnavailable reads "MCP server could not verify the caller's identity". - The if __name__ == "__main__" block moved to the end of test_auth_external.py. It sat in the middle, so running the file directly executed 42 of the 50 tests; both documented run paths now execute all 66. - Tests added for the guard (refusal, admin allowed, a per-profile key still working, and failing closed when the admin lookup raises), for IdentityMismatch through _headers_for_user(), and for the error attribution. Each was verified to fail without the fix. The global key list is duplicated from SettingsController::$globalSettings because GET /settings merges global and per-profile values with no marker distinguishing them, so the MCP cannot tell them apart from a normal call. It is commented as a known limitation, and checked against the PHP list.

• grep-ankh(12 Oct 26)

  review: close the user_id bypass, guard the system tools, fix the test import Reworked against the review. The first two are real holes rather than polish. Blocking: - _headers_for_user() returned before resolving the caller's identity whenever an explicit user_id was passed, and most tools accept that argument, so any authenticated caller could act as any profile, the administrator included. An explicit user_id that disagrees with the resolved profile is now refused (IdentityMismatch); one that agrees is allowed. Both are tested. - get_system_info, list_backups, create_backup and delete_backup do not go through _headers_for_user(), so they act as the server's default profile. They are now limited to callers whose resolved profile is an administrator, via _deny_non_admin_caller(). Correctness: - test_auth_external.py used os.environ without importing os, so 26 of the 40 tests errored. Fixed, and the suite is now run rather than only compiled: 50 tests pass. - verify_token() is async but called httpx synchronously, so a slow provider blocked the event loop for up to the timeout. The provider call now runs in a thread. Security defaults: - POZNOTE_MCP_IDENTITY_MATCH defaults to oidc_subject:sub alone. Matching on preferred_username or email is weaker than Poznote's own sign-in, which matches an email only when it is verified, so it is an explicit opt-in. - Added POZNOTE_MCP_AUTH_AUDIENCE, an optional expected audience, so a token the same provider issued for a different application is refused. Docs: - POZNOTE_MCP_AUTH_HEADER is the header this server sends TO the provider, not the one callers use. Corrected in the table, in .env.template and in the module. - Documented that the default profile has to be an administrator, since the profile lookup reads GET /api/v1/admin/users, plus the two consequences of the mode: the user_id restriction, and the tools that take no user_id. - Fixture identities replaced with placeholders. - All eight MCP-SERVER pages updated; python3 tools/docs-i18n.py check passes.

• grep-ankh(12 Oct 26)

  review: target dev, and stop silently ignoring a setting Addresses the feedback left on #1616, which applies here too. - Rebased onto `dev` rather than `main`, since that is where changes land before a release. A squash merge is no longer needed to keep release merge commits out of dev's history. - `POZNOTE_MCP_AUTH_CLIENT_ID` / `_CLIENT_SECRET` apply to `introspection` only; `userinfo` sends the caller's token and nothing else. They were read and then ignored, which is indistinguishable from a typo. They are still parsed, but the server now warns when they are set under another provider. Both directions are covered by tests. - Documented the seven variables in `.env.template`, the canonical environment reference, alongside `POZNOTE_MCP_AUTH_TOKEN`. - Added the section to the seven `docs/MCP-SERVER.<lang>.md` translations. They are maintained in lockstep (all seven were identical at 322 lines), so an English-only addition would have broken that. The variable table is reproduced verbatim, as names and values do not translate.

• grep-ankh(12 Oct 26)

  feat(mcp): optional per-caller authentication The MCP server resolves a caller to a Poznote profile in exactly two ways: one shared inbound token (POZNOTE_MCP_AUTH_TOKEN), and a target profile taken from POZNOTE_USER_ID or an explicit `user_id` argument. One instance is therefore one identity, and `user_id` is a targeting argument rather than an authorization boundary. This adds an optional third mode. Each caller presents its own token, the server resolves it against an external identity provider, and the resolved identity is mapped to that caller's Poznote profile. One instance then serves many callers, each correctly identified, with no per-caller static token list to maintain. It is deliberately provider-agnostic: anything that can answer "which subject does this token belong to" through an OpenID Connect UserInfo endpoint or an RFC 7662 introspection endpoint works. No provider-specific code. Disabled by default — with POZNOTE_MCP_AUTH_PROVIDER unset the server behaves exactly as before, including the shared-token and open modes. An identity that matches no profile is refused rather than mapped to a default, because the default is profile 1, the first administrator: a silent fallback there would turn a revoked or unrecognised token into an administrator. A disabled profile is likewise never a match candidate.

• timothepoznanski(16 Oct 26)

  feat: implement landing note visibility handling in index.php and tabs.js

• timothepoznanski(16 Oct 26)

  feat: add backup events to webhooks and implement dispatch logic - Introduced `backup.completed` and `backup.failed` events to the admin webhooks. - Updated documentation in multiple languages to reflect the new backup events. - Enhanced `LocalBackupService` and `S3BackupService` to record backup run summaries and dispatch corresponding webhooks. - Added error handling for webhook dispatch failures. - Updated translations for backup event descriptions in various languages.

• timothepoznanski(16 Oct 26)

  Add UI styles for popup and options pages with responsive design

• timothepoznanski(16 Oct 26)

  Add options page for Poznote URL Saver with connection settings and workspace management - Implemented common.js for shared encryption and URL handling functions. - Created options.html for the settings interface, including connection form and workspace selection. - Developed options.js to handle connection logic, workspace and folder loading, and user feedback. - Added ui.css for styling the options page, ensuring a consistent look and feel with Poznote's design.

• timothepoznanski(16 Oct 26)

  refactor: improve delete button click handling for workspace actions

• Timothé Poznanski(15 Oct 26)

  Merge pull request #1633 from timothepoznanski/dev Release 6.119.3

• timothepoznanski(15 Oct 26)

  chore: update version from 6.119.3-beta to 6.119.3

• timothepoznanski(15 Oct 26)

  chore: update version to 6.119.3-beta

• timothepoznanski(15 Oct 26)

  feat: enhance heading deletion handling to remove empty lines above headings

• timothepoznanski(15 Oct 26)

  Implement instance statistics API with token management and public access options - Added InstanceStatistics class to handle statistics collection and token management. - Introduced statistics token generation, validation, and revocation methods. - Implemented caching for statistics summary to optimize performance. - Created public route for accessing statistics without authentication, configurable by admin. - Developed frontend JavaScript for managing statistics token and public access settings. - Added unit tests for statistics token generation, validation, and update checks. - Included helper functions for statistics-related operations in lib/statistics.php.

• timothepoznanski(15 Oct 26)

  refactor: update diary switch button functionality and remove delete option

• timothepoznanski(15 Oct 26)

  feat: add calendar button to open or create entries for selected dates

• timothepoznanski(15 Oct 26)

  Refactor CodeMirror position handling in markdown editor - Updated `restoreMarkdownEditorPosition` to use `revealPos` with a `keep` option for better control over scrolling behavior. - Simplified `scrollMarkdownEditorLineToTop` by removing unnecessary scroll adjustments after calling `revealPos`, now utilizing the `yMargin` option for smoother scrolling.

• timothepoznanski(15 Oct 26)

  docs: update build toolchain description for Excalidraw and CodeMirror components

• timothepoznanski(15 Oct 26)

  fix: prevent note link from using title as ID to resolve issue #1634

• timothepoznanski(15 Oct 26)

  fix: handle undefined note id in serverCopyFromEntry function

• timothepoznanski(15 Oct 26)

  chore: update version to 6.119.2

• timothepoznanski(15 Oct 26)

  Implement new feature for user authentication and improve error handling

• timothepoznanski(15 Oct 26)

  feat: add support for diagram zoom button interaction in live preview

• timothepoznanski(15 Oct 26)

  feat: enhance live preview styling for editor word wrap functionality