Represent control characters with reversible dashboard escapes, keep custom separators intact, and reject empty separators before loading keyword files. Document and test the full YAML round trip.
Fixes#1062
Record the backend, frontend, container, and CI dependency refresh in both v2.10.0 release guides.
Explain JWT wire compatibility, the sanitizer replacement, patched transitive pins, generator reproducibility, and unchanged release artifact layout.
Regenerate the Swagger specification and TypeScript client with the pinned generators, including accurate optional response fields and the verified-email SSO description.
Validate comment-list page data at the API boundary and normalize it back to the public ListData contract before storing or emitting the response.
BREAKING CHANGE: Beyond #997, #1007, and #1011, v2.10.0 changes default config/data discovery and relative-path semantics; raises source builds to Go 1.26.5; replaces the CGO-backed SQLite driver with a pure-Go implementation; fixes application timezone at process initialization, requiring a full restart to change it; removes the useBackendConf opt-out and remoteConfModifier; changes DI registration, Context mutation, update() return value, and created timing; and requires marked 18 with modern package resolution. Migration guide: https://artalk.js.org/en/guide/releases/v2.10.0.html
Update the UI, sidebar, plugins, documentation, lint, test, and build toolchains, including Vite 8.1, Marked 18.0.7, TypeScript 6, and current framework packages.
Pin patched transitive dependencies, move pnpm policy to the workspace configuration, approve the esbuild install script, and refresh generated router metadata.
* feat(auth): add SSO token exchange endpoint
Adds POST /api/v2/sso/exchange — accepts an access token from an
external OIDC IdP (verified by calling the IdP's /userinfo) and issues
an Artalk session JWT for the user identified by the email claim.
Use case: a surrounding application that already runs OIDC (e.g. an
Auth0 SPA) can drive Artalk sign-in without showing Artalk's own popup
login UI. The widget reads the resulting JWT from
localStorage["ArtalkUser"].token and treats the user as fully
authenticated for is_login/is_admin checks.
Implementation:
- One new handler at server/handler/auth_sso_exchange.go (~110 lines)
- Reuses dao.FindCreateUser + common.LoginGetUserToken; same JWT
format as /user/access_token, so no client-side changes needed
- Validation by calling {issuer}/userinfo with Authorization: Bearer
— OIDC-standard, no JWKS dep added
- Gated by auth.enabled && auth.sso.enabled (404 otherwise)
- Returns the same ResponseUserLogin shape as /auth/email/login
Config additions (conf/artalk.example.yml):
auth:
sso:
enabled: false
issuer: "" # e.g. "tenant.auth0.com"
Route registered alongside the existing social-login routes in
server/server.go.
Verified by go build ./... (clean).
* chore(config): regenerate env-path cache with auth.sso entries
Required so koanf actually maps ATK_AUTH_SSO_ENABLED/ISSUER env vars
to the new auth.sso config block introduced in feat: add SSO token
exchange endpoint. Without this regen the env vars are silently
ignored and the endpoint stays in its disabled state.
* docs: add sso token exchange section for auth docs
---------
Co-authored-by: qwqcode <qwqcode@gmail.com>
Add `preferRemoteConf` option (disabled by default).
Local config now takes priority, addressing the issue where remote config previously overrode local settings. (Closes#1000)
Updated config merging logic in `mount.ts`.
Deprecated `useBackendConf` in favor of `preferRemoteConf`.
(The prerequisite PR is #1007)
BREAKING CHANGE: UI client now prioritizes local config in the latest version, whereas previously, the remote config would override it. (See #1011)
A new HTTP API endpoint `GET /votes/:target_name/:target_id` is now available. (See https://artalk.js.org/http-api.html#tag/Vote/operation/GetVote)
- Implement GET endpoint for retrieving vote status
- Add tests for vote functionality
Related to: #997
This is a prerequisite PR for #983.
The original `POST /votes/:type/:target_id` endpoint for creating votes has been updated to `POST /votes/:target_name/:target_id/:choice`. The `target_name` can be either `comment` or `page`, the `target_id` is a numeric value, and the `choice` can be `up` or `down`. (https://artalk.js.org/http-api.html#tag/Vote/operation/CreateVote)
The HTTP response now includes two additional fields: `is_up` and `is_down`, which indicate the user's current voting state. The `up` and `down` fields remain unchanged and continue to be of numeric type, ensuring backward compatibility with existing clients.
- Change vote endpoint to include `{target_name}` and `{choice}`
- Update vote logic to handle `up` and `down` choices
- Modify request data models and API interfaces for new vote structure
- Ensure backward compatibility with existing vote response data
- Improve vote handling and response structure
BREAKING CHANGE: Vote HTTP API endpoint have been updated. (See #997)
- Introduce check:publish script to verify npm versions
- Ensure all projects have the latest versions on npm
- Skip private packages during version checks
- Allow filtering by specific project name with -F option
- Implemented `eslint-plugin-artalk` to enforce Artalk's development conventions.
- Added setup script for UI development environment.
- Created test cases for Artalk plugin rules.
- Configured TypeScript and build settings for the plugin.
- Updated documentation with installation and configuration instructions.
github-actions[bot]