mirror of
https://github.com/Termix-SSH/Termix.git
synced 2026-10-31 23:55:23 +00:00
v26.10.0 (#1573)
* feat: optional auto reconnect for dropped ssh sessions (#1321) * feat: tighter compact host rows with inline tags (#1325) * feat: bring back the alert feed homepage widget * feat: pick target terminals for snippets again * feat: share button on connection tabs again * feat: recent servers list when linking the desktop app * feat: list the fixed app shortcuts in keyboard shortcuts * fix: translate hardcoded toasts and drop em dashes from ui text * fix: translate leftover hardcoded ui text * fix: toolbar files button opens at the shell directory again * fix: show the remote desktop note under connection origin again * chore: openapi docs for host metrics manager routes * chore: openapi docs for undocumented routes and fix two broken doc blocks * fix: declare terminal.listSessions use for snippet targets * revert: drop the alert feed widget, the notification center replaces it * feat: restore the alert feed homepage widget * fix: quick connect fills the host address from plugin auth editors like tailscale * fix: docker container logs use the base background color * chore: fix dependabot alerts and apply safe npm upgrades * fix: proxmox stats tab reads its switch from plugin host settings * fix: count plugin ssh logins toward host status and stop showing reachable as a warning * fix: hide the built-in source pill in the host editor * fix: host status shows online when the port answers and only warns on a failed login * fix: drop the top border on the split layout menu * fix: host defaults tabs sit where the host editor puts them and skip plugins with nothing to default * fix: remote desktop auth method labels and notes for vnc and telnet * fix: add description to the web endpoint enable switch * fix: crowdin sync and pretranslate for plugin locales, run plugin tests on release * feat: move telemetry out of core into a usage statistics plugin * fix: recent activity card no longer cuts off host names early * fix: remove duplicate top border on split screen menu * fix: redesign session log player controls, fix tooltip overlap and drop dot separators * fix: file manager and sftp text showing raw i18n keys * fix: onboarding rerunning for existing users after upgrading * fix: fleet detail buttons overflowing the sidebar * fix: session log player scrolling off screen horizontally * fix: network graph lag when adding hosts and on every render * fix: maintenance index name, shared host read only view and badge polling * fix: meeting tabs, workspace tab merging, rail panels as tabs and general ui lag * chore: update release notes * fix: remote desktop tabs reconnecting on every tab switch * fix: build plugin sdk before linting in release workflow * chore: lint, format, and bump version to 2.9.0 * chore: skip crowdin pre-translate in release for now * chore: switch to calver, bump version to 26.10.0 * fix(sso): send the PKCE verifier for GitHub login (#1534) * fix(remote-desktop): clip cursor overflow without disabling zoom (#1535) * test(remote-desktop): preserve sessions beyond one hour (#1536) * fix(hosts): expose controls for overflowing editor tabs (#1537) * fix(hosts): expose controls for overflowing editor tabs * test(hosts): mock resize observation in admin panel tests * fix(status): skip TCP probes while host sessions are active (#1538) * fix(database): batch session activity persistence (#1539) * docs(api): describe cookie and API key authentication (#1540) * fix(snippets): repair missing note column on SQLite upgrades (#1541) * fix(docker): retain stored SSH credential association (#1543) * fix(file-manager): render transfer toasts without plugin hooks (#1546) * feat(hosts): keep compact row actions inline (#1547) * fix(auth): allow retrying unavailable second-factor interfaces (#1549) * fix(auth): reject unresolved legacy identity provisioning (#1550) * fix(desktop): ship the plugin SDK inside Mac App Store builds (#1551) * fix(tmux): pass full session info to the terminal's session picker (#1552) The tmux.sessions service reduced detected sessions to bare names, but the picker reads session.name, so every entry rendered blank and selecting one sent an empty name, which created a new session instead of attaching. * fix(ssh): read force keyboard-interactive as a boolean when resolving hosts (#1553) The column holds the text "true"/"false", and the resolver passed it through as-is. The string "false" is truthy, so the password provider treated every saved host as forced keyboard-interactive and left the password out. Jump hops are built straight from the resolved host, so a password hop whose server doesn't offer keyboard-interactive failed with "All configured authentication methods failed". * fix(database): batch database saves for bulk host writes (#1554) * fix(database): yield to the event loop between database saves Each SQLite save serializes and encrypts the whole database into new buffers, which V8 only releases once the event loop turns. Boot migrations and bulk host import write plugin settings per host and per key in an awaited loop, so hundreds of full copies piled up and the container ran out of memory. * fix(database): save once per bulk host write instead of once per row On SQLite every repository write force-saves the whole database. Boot plugin data migrations, host defaults materialization and the bulk host routes write one row per host per setting, so they serialized and encrypted the full database hundreds of times in a row. DatabaseSaveTrigger.batched wraps a function so force saves made while it runs collapse into a single save when it finishes. Nested scopes fold into the outer one, and work that outlives its scope saves normally. * feat(hosts): add instance-wide predefined tag suggestions (#1548) * feat(hosts): add shared predefined tag suggestions * style(hosts): format tag catalog routes * test(database): advance fake timers past the save yield (#1555) * fix(i18n): complete Simplified Chinese core and plugin translations (#1542) * fix(i18n): complete Chinese onboarding and navigation labels * fix(i18n): translate remaining Chinese core and plugin interfaces * fix(i18n): translate host editor tab overflow controls * fix(i18n): use consistent Chinese fleet terminology * fix(i18n): localize hardcoded controls and plugin views * fix(i18n): translate built-in homepage widget catalog * test(homepage): follow translated timezone placeholder * fix(i18n): translate plugin-provided homepage widgets * fix(i18n): localize feature settings section titles * fix: 2.8 oidc accounts unable to sign in after upgrading (#1381) * fix: plugins losing the saved ssh login when copying a host (#1391) * fix: fleets, proxmox and automations not getting the host sudo password * fix: host imports running a defaults pass and metrics restart per host (#1384) * fix: high cpu from status probes and full database saves on every sample (#1300) * fix: user data export freezing the server (#1393) * fix: op:// secret references rejected as ssh keys on credentials (#1394) * fix: slow file deletes from the trash lookups on every delete (#1390) * fix: add openapi docs and error handling to host tag routes * test: compare download stream buffers directly so it stops timing out * chore: drop em dash from host row comment * chore: update release notes for 2.9.1 * feat(ai): add remote coding agent sessions for SSH hosts (#1545) * feat(ai): add host coding agent sessions with configured providers * Wait for agent initialization and shutdown before resuming sessions * Keep Pi transcripts outside its configuration migration directory * Cover Pi session directory separation * Update core permission catalog expectations for remote agents * Install remote agent runtimes from verified official sources * Wait for the identity panel credentials request in its test * Add scoped SSH forwarding setup for remote agents * Verify forwarding setup through a fresh SSH connection * Bound the SSH forwarding verification timeout * Return the forwarding verification callback result * fix(ai): support agent send and interrupt keyboard shortcuts * feat(ai): add agent queues attachments worktrees and session recovery * fix(ai): handle deleted workspace paths and duplicate status events * fix(ai): accept file references in root workspaces * fix(ai): refresh paused queues after agent errors * fix(ai): store agent sessions in plugin tables and lock down OpenCode Agent sessions lived in a single ctx.kv value holding up to 2000 events, which passed the 256 KB kv limit within minutes of a normal run. Every save after that failed, so history, nativeId, queue and archive changes were lost and every event wrote a kv audit row. Sessions, events and queued prompts now have their own tables. A running agent appends events in batches at most once a second with a lazy save; session and queue changes save immediately. Prompts, drafts and stored event text are capped in UTF-8 bytes to fit MySQL TEXT. kv:own is no longer requested. The OpenCode server now requires a per-session password, so other local accounts on the host cannot drive the agent through its loopback port. * test(upgrade): include agent session tables in the reviewed upgrade SQL * test: run the posix-only ai agent tests on linux only * fix: restore space to add host tags and redesign predefined tags editor * fix: host key silently accepted when the host is missing from the database (#1397) * fix: clearer host login failed status label and fix its translations (#1396) * chore: add host key and status label fixes to release notes * fix: sso and ldap provider dialogs overflowing the screen and using mismatched toggles * chore: increment ver * fix(audit): store plugin entries with no acting user as a null user_id (#1556) Plugin audit entries written outside a request used the literal "system" as user_id. That column references users.id, so the insert was refused (Postgres logs it as an FK violation) and the entry was silently dropped. Write null instead and keep "system" / plugin:<id> in username. * chore: add sso/ldap dialog and audit log fixes to release notes * fix: tunnels and host settings missing from shared hosts on desktop * fix: remote desktop logins missing from shared hosts on desktop * fix: simplify host status to online/offline and keep it live without a refresh * chore: sync Crowdin translations for 2.9.1 * fix: build docker frontend/backend natively to stop arm64 hang, build sdk before openapi * chore: rework plugin readmes, json changelogs and standalone repo setup * chore: move plugins to their own repos and drop the plugins folder * chore(deps-dev): bump globals (#1560) Bumps the dev-minor-updates group with 1 update: [globals](https://github.com/sindresorhus/globals). Updates `globals` from 17.12.0 to 17.13.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.12.0...v17.13.0) --- updated-dependencies: - dependency-name: globals dependency-version: 17.13.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: drop the 2.8 columns, moves and aliases kept for a downgrade * chore: remove the 2.9 finish list * feat: port the demo redesign with Manage and Settings tabs * chore: pin the plugin signing key and use TERMIX_PAT in workflows * chore: rename the plugin sdk to @termix-ssh/plugin-sdk * feat: add a publish workflow for the plugin sdk * chore: cleanup * fix: harden plugin sockets, public routes, prebuilt binaries and login fallback * chore: add a 2.9.1 upgrade check for postgres and mysql * fix: stop full database rewrites on every plugin db call * fix: stop full database rewrites on every plugin db call * fix: restore release video link in 2.9.2 notes * fix: use TERMIX_PAT in workflows * feat: pin the official plugins in the docker image * feat: implement plugin management UI * feat: shared list kit, settings search, rail order and ui consistency fixes * chore: run all workflows on blacksmith runners * chore: split dashboard quick actions into quarters and drop host status row lines * fix: open plain settings from the profile button, navigation only from the rail menu * feat: consent check, developer mode file installs, install counts and issue links for plugins * feat: row detail options for hosts and credentials, open manage from sidebar header * fix: unify connection failure screens and rebuild stale local plugins * feat: dev:all runner for web, electron and docker with plugin hot reload, termix-plugin dev * chore: clean up npm scripts, make npm run dev the full runner and drop concurrently * fix: settle quick connect panel loads in tests so they stop flaking * fix: stop the dev runner rebuilding plugins when windows reports file reads as changes * chore: update the plugin sdk ui export snapshot * feat: full screen onboarding with a plugin picker and per step versions * feat: changelog.md release notes, v tags, plugin release notes and videos * chore: add temp changelog * chore: release the plugin sdk as 1.0.1 * feat: show only the latest plugin release notes and cap long ones * chore: publish docker images to termix-ssh on ghcr and termixssh on docker hub * chore: rename docker hub token secret to DOCKERHUB_BUGATTIGUY527_TOKEN * chore: renew mac app store provisioning profile * chore: drop docs job from release workflow * chore: run sdk publish on github hosted runner * chore: remove dependabot * chore: general file cleanup * chore: rewrite readme and taglines for plugin-based termix * chore: drop optional from ai plugin row in readme * feat: per-repo issue forms and prefilled bug reports instead of the support repo * feat: add report a bug link to the your account settings section * fix: open settings goes to the plugin's page and hides when it has none * feat: show plugin features from the manifest on the plugin page * fix: retry failed or blocked plugins on restart instead of leaving them disabled * fix: refresh plugin settings after enabling a plugin and match select and disabled bar styling * feat: request a feature link for plugins and use the bug form for unverified plugins * feat: beta channels for core and plugins with one stable/beta release workflow * fix(sync): resolve shared hosts for connect-only recipients (#1568) * fix(ssh): accept full passwords in keyboard-interactive prompts (#1569) * fix(ssh): normalize PKCS8 private keys before connecting (#1570) * fix(sidebar): reclaim space from hidden folder actions (#1571) * fix(hosts): display protocol credential usernames for non-SSH hosts (#1572) * fix: ask for a push/TOTP menu choice as text instead of a push confirm * fix: keep client tunnels open when one of their connections fails (Support#1417) * fix: send plugin form uploads to the plugin's route (Support#1406, Support#1420) * fix: add missing sync ids to old snippet tables so snippets sync again (Support#1419) * fix: start the macOS local terminal when the shell or spawn helper is broken (Support#1418) * fix: refresh cached plugin translations when only a translation changes (Support#1411) * fix: import sshpk as a default so the backend starts under ESM * feat: add a plugin sdk changelog and tag sdk releases, release 1.0.2 * fix: drop the ./ from the plugin sdk bin path so npm stops warning * chore: name core and sdk releases Termix vX and Plugin SDK vX * fix: lock the desktop backend to the app's own origin (GHSA-frx8-qqgg-7j7g) * fix: trust devices by a server-issued token, not a client header (GHSA-6gr3-r7jx-wfmh) * fix: keep global settings out of non-admin data exports (GHSA-v3vp-ffww-q7pw) * fix: refuse sessionless tokens and keep the secrets file owner only * feat: add TRUSTED_PROXIES to choose who nginx takes client IPs from (GHSA-7j7m-85p4-2cpm) * chore: standardize repo setup files * chore: remove unused knip config * chore: add LICENSE and use Node 24 from .nvmrc * chore: update translation guidance, only en.json needs editing * feat: plugin docs and env manifest fields, in-app docs links, SDK 1.0.3 * fix: header separators render as borders and center the status divider * fix: lighter confirm prompt overlay to stop lag when it opens * fix: put plugin-only tailwind classes in core's utilities layer, SDK 1.0.4 * fix: dev stages local plugin builds on paths with spaces and builds them with the local SDK * fix: keep plugin tailwind variants in core's layer so overrides keep their order * fix: manage tab refetches before giving up on a host or credential it cannot find * fix: tab buttons like share show as soon as the terminal is ready * fix: folder rows no longer nest action buttons inside a button * fix: repin remote-desktop after its 1.0.0 re-release * chore: repin bundled plugins after the 1.0.0 re-release * fix: recent activity rows use the same separator as host status * feat: upload banner * fix: reject expired sessions on sockets, api key desktop links and 192.0.0.0/24 * fix: plugin sdk 1.0.5 with optional ui peers, safer timeouts and validate checks * fix: bundled plugins path for source runs and backend cleanup * fix: load plugin strings on guest pages, plugin wording and drop unused keys * fix: beta version stamping, homebrew cask bump, dockerignore and readme platforms * docs: 26.10.0 changelog * fix: current version in the version route example * chore: stop pushing the release- docker tag * feat: remove the donation reminder and its column * docs: note the removed donation reminder * fix: link server wizard always opens inline, onboarding card grows for it * feat: plugin text columns are longtext on mysql so they are not capped at 64KB * fix: linked desktops keep a plugin when its update from the server fails * chore: default mobile download links to v tags * fix: sso only accounts cannot sign in with a passkey or other local method * feat: note in the plugins tab that community plugins are coming * fix: plugin validate accepts beta versions * chore: pin bundled plugins rebuilt on sdk 1.0.5 * fix: skip locale fetches for disabled plugins * fix: show translated names for the built-in admin and user roles * fix: show host keys as SHA256 fingerprints like ssh-keygen * fix: host editor scrolls to a newly enabled protocol section * fix: pass the host to dashboard host row plugins * fix: plugin cards show dividers between author, version and category * fix: refuse plugin archives with paths outside the plugin folder * fix: theme picker shows one dropdown arrow * fix: read activity and audit times as UTC so they show in local time * fix: show the real error for a wrong password or code on plugin sign in * fix: explain that external sign in needs Auto-create external accounts * fix: clear leftover plugin unpack folders at startup * fix: shared session links open for guests again * fix: share panels no longer list yourself as a share target * fix: a host update without an auth type keeps the saved password * fix: guest pages get the tab ids a guest plugin registers * fix: refuse a 2.8 database, which already had a plugins table * fix: dashboard cards fit on a phone * fix: desktop setup no longer asks to secure the local account * fix: the desktop app keeps the desktop layout in a narrow window * fix: the desktop app shows the rail and no phone bar in a narrow window * fix: name every sync type in the Sync panel and pluralize the link prompt * chore: update the sdk ui snapshot for the host key dialog * fix: turning a plugin back on restarts the plugins it turned off * fix: quick connect asks to trust the host key * fix: revoking a manager also removes the shares they handed out * fix: database export works for users with TOTP on (#1426) * fix: rdp and vnc logins use the folder credential when none is picked (#1429) * fix: imported hosts get status checks without a restart * fix: re-pin bundled plugins after 1.0.0 re-release * fix: re-pin bundled plugins after search bar fix * chore: update app icon to smaller version * chore: round the readme logo, keep square source for app icons * feat: grid columns and table view in the plugins tab * fix: match the host key copy button to the fingerprint height * fix: use brand color for toggles in sync settings * fix: re-pin bundled plugins after 1.0.0 re-release * fix: web terminals failing auth behind a proxy that rewrites Host (Support#651) * fix: re-pin snippets and termix-identity after 1.0.0 overwrite * fix: re-pin file-manager after 1.0.0 overwrite * fix: re-pin file-manager after 1.0.0 overwrite * chore: remove Crowdin from the release workflow * chore: remove crowdin config --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This commit is contained in:
3656 files changed
+116210
-460999
No files matched your search
@@ -22,7 +22,7 @@ function readForwardSetting(key: string): string | null {
|
||||
|
||||
/**
|
||||
* How many consecutive failures before the forwarder stops complaining on every
|
||||
* entry. It keeps trying — this only throttles the log noise, and it reports
|
||||
* entry. It keeps trying, this only throttles the log noise, and it reports
|
||||
* again once delivery recovers.
|
||||
*/
|
||||
const QUIET_AFTER_FAILURES = 5;
|
||||
|
||||
@@ -13,7 +13,8 @@ import { logAudit, getRequestMeta } from "./audit-logger.js";
|
||||
import type { Request, Response, NextFunction } from "express";
|
||||
import bcrypt from "bcryptjs";
|
||||
import { nanoid } from "nanoid";
|
||||
import { and, eq, inArray } from "drizzle-orm";
|
||||
import { inArray, isNotNull } from "drizzle-orm";
|
||||
import type { ExternalSessionRef } from "../auth/types.js";
|
||||
import type { DeviceType } from "./user-agent-parser.js";
|
||||
import { getDb } from "../database/db/index.js";
|
||||
import { sessions } from "../database/db/schema.js";
|
||||
@@ -41,6 +42,8 @@ interface JWTPayload {
|
||||
userId: string;
|
||||
sessionId?: string;
|
||||
pendingTOTP?: boolean;
|
||||
/** Set on a short-lived socket ticket, which only a socket upgrade takes. */
|
||||
purpose?: "ws";
|
||||
dataKeyWrap?: WrappedDataKey;
|
||||
iat?: number;
|
||||
exp?: number;
|
||||
@@ -68,6 +71,29 @@ interface RequestWithHeaders extends Request {
|
||||
};
|
||||
}
|
||||
|
||||
function serializeExternalSession(
|
||||
ref: ExternalSessionRef | null | undefined,
|
||||
): string | null {
|
||||
if (!ref || (!ref.sub && !ref.sid)) return null;
|
||||
return JSON.stringify({
|
||||
providerId: ref.providerId ?? null,
|
||||
sub: ref.sub ?? null,
|
||||
sid: ref.sid ?? null,
|
||||
});
|
||||
}
|
||||
|
||||
function parseExternalSession(
|
||||
value: string | null | undefined,
|
||||
): ExternalSessionRef | null {
|
||||
if (!value) return null;
|
||||
try {
|
||||
const parsed = JSON.parse(value) as ExternalSessionRef;
|
||||
return parsed && typeof parsed === "object" ? parsed : null;
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
const ADMIN_TARGET_USER_HEADER = "x-admin-target-user";
|
||||
|
||||
// Core data-plane routes an admin may hit on behalf of another user.
|
||||
@@ -283,9 +309,7 @@ class AuthManager {
|
||||
rememberMe?: boolean;
|
||||
deviceType?: DeviceType;
|
||||
deviceInfo?: string;
|
||||
oidcSub?: string | null;
|
||||
oidcSid?: string | null;
|
||||
ssoProviderId?: number | null;
|
||||
externalSession?: ExternalSessionRef | null;
|
||||
} = {},
|
||||
): Promise<string> {
|
||||
const jwtSecret = await this.systemCrypto.getJWTSecret();
|
||||
@@ -331,9 +355,7 @@ class AuthManager {
|
||||
jwtToken: token,
|
||||
deviceType: options.deviceType,
|
||||
deviceInfo: options.deviceInfo,
|
||||
oidcSub: options.oidcSub ?? null,
|
||||
oidcSid: options.oidcSid ?? null,
|
||||
ssoProviderId: options.ssoProviderId ?? null,
|
||||
externalSessionRef: serializeExternalSession(options.externalSession),
|
||||
createdAt,
|
||||
expiresAt,
|
||||
lastActiveAt: createdAt,
|
||||
@@ -373,11 +395,32 @@ class AuthManager {
|
||||
}
|
||||
}
|
||||
|
||||
async verifyJWTToken(token: string): Promise<JWTPayload | null> {
|
||||
/**
|
||||
* A one minute token for opening a WebSocket. A browser cannot read its
|
||||
* HttpOnly cookie, and a proxy that rewrites Host makes the cookie look
|
||||
* like it came from another site, so the page asks for one of these.
|
||||
*/
|
||||
async issueSocketTicket(userId: string, sessionId: string): Promise<string> {
|
||||
const payload: JWTPayload = { userId, sessionId, purpose: "ws" };
|
||||
return jwt.sign(payload, await this.systemCrypto.getJWTSecret(), {
|
||||
expiresIn: 60,
|
||||
} as jwt.SignOptions);
|
||||
}
|
||||
|
||||
async verifyJWTToken(
|
||||
token: string,
|
||||
options: { allowSocketTicket?: boolean } = {},
|
||||
): Promise<JWTPayload | null> {
|
||||
try {
|
||||
const jwtSecret = await this.systemCrypto.getJWTSecret();
|
||||
|
||||
const payload = jwt.verify(token, jwtSecret) as JWTPayload;
|
||||
if (
|
||||
payload.purpose !== undefined &&
|
||||
!(payload.purpose === "ws" && options.allowSocketTicket)
|
||||
) {
|
||||
return null;
|
||||
}
|
||||
|
||||
if (payload.sessionId) {
|
||||
try {
|
||||
@@ -394,6 +437,10 @@ class AuthManager {
|
||||
return null;
|
||||
}
|
||||
|
||||
if (new Date(sessionRecord.expiresAt).getTime() < Date.now()) {
|
||||
return null;
|
||||
}
|
||||
|
||||
await this.migrateDataKeyFromPayload(payload);
|
||||
} catch (dbError) {
|
||||
databaseLogger.error(
|
||||
@@ -406,8 +453,12 @@ class AuthManager {
|
||||
);
|
||||
return null;
|
||||
}
|
||||
} else {
|
||||
} else if (payload.pendingTOTP) {
|
||||
await this.migrateDataKeyFromPayload(payload);
|
||||
} else {
|
||||
// Every real login has a session row to revoke; a signed token
|
||||
// without one did not come from this server's login.
|
||||
return null;
|
||||
}
|
||||
return payload;
|
||||
} catch (error) {
|
||||
@@ -506,35 +557,36 @@ class AuthManager {
|
||||
}
|
||||
|
||||
async revokeSessionsByExternalSession(params: {
|
||||
ssoProviderId?: number | null;
|
||||
providerId?: number | null;
|
||||
sub?: string | null;
|
||||
sid?: string | null;
|
||||
}): Promise<number> {
|
||||
const { ssoProviderId, sub, sid } = params;
|
||||
const { providerId, sub, sid } = params;
|
||||
if (!sub && !sid) return 0;
|
||||
|
||||
try {
|
||||
const conditions = [
|
||||
sid ? eq(sessions.oidcSid, sid) : eq(sessions.oidcSub, sub!),
|
||||
];
|
||||
if (ssoProviderId != null)
|
||||
conditions.push(eq(sessions.ssoProviderId, ssoProviderId));
|
||||
|
||||
const db = getDb();
|
||||
const matched = await db
|
||||
.select()
|
||||
const candidates = await db
|
||||
.select({ id: sessions.id, ref: sessions.externalSessionRef })
|
||||
.from(sessions)
|
||||
.where(conditions.length === 1 ? conditions[0] : and(...conditions));
|
||||
.where(isNotNull(sessions.externalSessionRef));
|
||||
|
||||
if (matched.length === 0) return 0;
|
||||
const matchedIds = candidates
|
||||
.filter((row) => {
|
||||
const ref = parseExternalSession(row.ref);
|
||||
if (!ref) return false;
|
||||
if (sid ? ref.sid !== sid : ref.sub !== sub) return false;
|
||||
return providerId == null || ref.providerId === providerId;
|
||||
})
|
||||
.map((row) => row.id);
|
||||
|
||||
const matchedIds = matched.map((s) => s.id);
|
||||
if (matchedIds.length === 0) return 0;
|
||||
|
||||
await db.delete(sessions).where(inArray(sessions.id, matchedIds));
|
||||
|
||||
authLogger.info("Sessions revoked via OIDC back-channel logout", {
|
||||
operation: "oidc_backchannel_logout",
|
||||
ssoProviderId,
|
||||
authLogger.info("Sessions revoked via back-channel logout", {
|
||||
operation: "external_backchannel_logout",
|
||||
providerId,
|
||||
sessionCount: matchedIds.length,
|
||||
});
|
||||
|
||||
@@ -544,9 +596,13 @@ class AuthManager {
|
||||
|
||||
return matchedIds.length;
|
||||
} catch (error) {
|
||||
databaseLogger.error("Failed to revoke sessions via OIDC", error, {
|
||||
operation: "oidc_backchannel_logout_failed",
|
||||
});
|
||||
databaseLogger.error(
|
||||
"Failed to revoke sessions via back-channel logout",
|
||||
error,
|
||||
{
|
||||
operation: "external_backchannel_logout_failed",
|
||||
},
|
||||
);
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -6,8 +6,8 @@ import { type Request, type RequestHandler, type Response } from "express";
|
||||
*
|
||||
* The default is 1KB; this is slightly higher because almost every response
|
||||
* under a few KB here is a small status or preference object where the CPU and
|
||||
* the extra headers are not worth it. The payloads that matter — host lists,
|
||||
* audit pages, fleet inventories — are orders of magnitude above this.
|
||||
* the extra headers are not worth it. The payloads that matter, host lists,
|
||||
* audit pages, fleet inventories, are orders of magnitude above this.
|
||||
*/
|
||||
const MIN_RESPONSE_BYTES = 2048;
|
||||
|
||||
|
||||
@@ -14,15 +14,28 @@ function getAllowedOrigins(): string[] {
|
||||
.filter(Boolean);
|
||||
}
|
||||
|
||||
/**
|
||||
* Origins allowed to drive the embedded desktop backend: the desktop app
|
||||
* itself and the dev server. Any website open in a browser on the same
|
||||
* machine can reach loopback too, so nothing else gets in.
|
||||
*/
|
||||
export function isDesktopAppOrigin(origin: string | undefined): boolean {
|
||||
if (!origin) return true;
|
||||
return (
|
||||
DEV_ORIGINS.includes(origin) || origin.startsWith(ELECTRON_FILE_ORIGIN)
|
||||
);
|
||||
}
|
||||
|
||||
export function isCorsOriginAllowed(
|
||||
req: Request,
|
||||
origin: string | undefined,
|
||||
): boolean {
|
||||
if (!origin) return true;
|
||||
if (DEV_ORIGINS.includes(origin)) return true;
|
||||
if (origin.startsWith(ELECTRON_FILE_ORIGIN)) return true;
|
||||
if (isDesktopAppOrigin(origin)) return true;
|
||||
|
||||
const configured = getAllowedOrigins();
|
||||
if (process.env.ELECTRON_EMBEDDED === "true") {
|
||||
return configured.includes(origin) || origin === getRequestOrigin(req);
|
||||
}
|
||||
if (configured.length === 0) return true;
|
||||
if (configured.includes(origin)) return true;
|
||||
|
||||
@@ -42,6 +55,7 @@ export function createCorsMiddleware(
|
||||
"User-Agent",
|
||||
"X-Electron-App",
|
||||
"X-Termix-Device-ID",
|
||||
"X-Termix-Trust-Token",
|
||||
"Cache-Control",
|
||||
"x-admin-target-user",
|
||||
...extraHeaders,
|
||||
|
||||
@@ -1,110 +0,0 @@
|
||||
/**
|
||||
* Copies the status check options out of ssh_data.stats_config into the
|
||||
* status_check_enabled and status_check_interval columns. Status checks are
|
||||
* core; the rest of stats_config belongs to the host-metrics plugin and is
|
||||
* moved by host-metrics-settings-migration.ts.
|
||||
*
|
||||
* The stats_config column stays in the database, unused: core's drizzle
|
||||
* migrations run before this does, so dropping it there would lose the data.
|
||||
*
|
||||
* Runs once, marked by a settings row, because the new columns have defaults
|
||||
* and there is no other way to tell a copied row from an untouched one.
|
||||
*/
|
||||
|
||||
import { sql } from "drizzle-orm";
|
||||
import { databaseLogger } from "../logger.js";
|
||||
import { createCurrentSettingsRepository } from "../../database/repositories/factory.js";
|
||||
import { runStatement, selectRows } from "./raw-rows.js";
|
||||
|
||||
export const HOST_STATUS_CONFIG_MIGRATED = "host_status_config_migrated";
|
||||
|
||||
export interface LegacyStatusConfig {
|
||||
statusCheckEnabled: boolean;
|
||||
statusCheckInterval: number | null;
|
||||
}
|
||||
|
||||
/** The status part of an old stats_config value. */
|
||||
export function statusConfigFromStatsConfig(
|
||||
raw: string | null,
|
||||
): LegacyStatusConfig {
|
||||
let parsed: unknown = null;
|
||||
try {
|
||||
parsed = raw ? JSON.parse(raw) : null;
|
||||
// Some rows were stringified twice.
|
||||
if (typeof parsed === "string") parsed = JSON.parse(parsed);
|
||||
} catch {
|
||||
parsed = null;
|
||||
}
|
||||
const config =
|
||||
parsed && typeof parsed === "object"
|
||||
? (parsed as Record<string, unknown>)
|
||||
: {};
|
||||
const seconds = Number(config.statusCheckInterval);
|
||||
return {
|
||||
statusCheckEnabled:
|
||||
config.statusCheckEnabled !== false && config.disableTcpPing !== true,
|
||||
statusCheckInterval:
|
||||
config.useGlobalStatusInterval === false &&
|
||||
Number.isInteger(seconds) &&
|
||||
seconds >= 5
|
||||
? seconds
|
||||
: null,
|
||||
};
|
||||
}
|
||||
|
||||
export interface HostStatusConfigMigrationResult {
|
||||
skipped: boolean;
|
||||
hostsMoved: number;
|
||||
}
|
||||
|
||||
export async function runHostStatusConfigMigration(): Promise<HostStatusConfigMigrationResult> {
|
||||
const settings = createCurrentSettingsRepository();
|
||||
try {
|
||||
if ((await settings.get(HOST_STATUS_CONFIG_MIGRATED)) === "true") {
|
||||
return { skipped: true, hostsMoved: 0 };
|
||||
}
|
||||
} catch {
|
||||
return { skipped: true, hostsMoved: 0 };
|
||||
}
|
||||
|
||||
let hostsMoved = 0;
|
||||
try {
|
||||
// Raw SQL: schema.ts no longer declares stats_config.
|
||||
const rows = await selectRows<{ id: number; stats_config: string | null }>(
|
||||
sql`SELECT id, stats_config FROM ssh_data WHERE stats_config IS NOT NULL`,
|
||||
);
|
||||
for (const row of rows) {
|
||||
const config = statusConfigFromStatsConfig(row.stats_config);
|
||||
if (config.statusCheckEnabled && config.statusCheckInterval === null) {
|
||||
continue;
|
||||
}
|
||||
// TRUE and FALSE as literals: SQLite cannot bind a JS boolean.
|
||||
await runStatement(sql`
|
||||
UPDATE ssh_data
|
||||
SET status_check_enabled = ${sql.raw(config.statusCheckEnabled ? "TRUE" : "FALSE")},
|
||||
status_check_interval = ${config.statusCheckInterval}
|
||||
WHERE id = ${row.id}
|
||||
`);
|
||||
hostsMoved++;
|
||||
}
|
||||
} catch {
|
||||
// A fresh install never had the column.
|
||||
}
|
||||
|
||||
try {
|
||||
await settings.set(HOST_STATUS_CONFIG_MIGRATED, "true");
|
||||
} catch (error) {
|
||||
databaseLogger.warn("Could not mark the host status migration done", {
|
||||
operation: "host_status_config_migration",
|
||||
error: error instanceof Error ? error.message : String(error),
|
||||
});
|
||||
}
|
||||
|
||||
if (hostsMoved > 0) {
|
||||
databaseLogger.info(
|
||||
`Moved status check options for ${hostsMoved} host(s) out of stats_config`,
|
||||
{ operation: "host_status_config_migration" },
|
||||
);
|
||||
}
|
||||
return { skipped: false, hostsMoved };
|
||||
}
|
||||
@@ -47,7 +47,7 @@ export async function runLegacySharedCredentialCleanup(): Promise<{
|
||||
|
||||
// Nothing to clean up on an engine this application has never run on. A
|
||||
// Postgres or MySQL database is created by the drizzle migrations, which have
|
||||
// never emitted these legacy columns, so there is nothing to drop — and the
|
||||
// never emitted these legacy columns, so there is nothing to drop, and the
|
||||
// check itself needs a synchronous PRAGMA that only SQLite offers.
|
||||
if (!needsExplicitPersist(resolveDatabaseDialect())) return result;
|
||||
|
||||
|
||||
@@ -1,57 +0,0 @@
|
||||
/**
|
||||
* Copies each host's SSH connection options out of ssh_data.terminal_config
|
||||
* into ssh_data.ssh_options: keepalive, legacy algorithms, the agent socket
|
||||
* and identity, agent forwarding and environment variables. The terminal's
|
||||
* look and behavior in the same JSON belong to the ssh-terminal plugin and
|
||||
* are moved by upgrade/ssh-terminal-host-settings-migration.ts.
|
||||
*
|
||||
* terminal_config keeps its values; nothing reads these keys from it any
|
||||
* more. Old Cloudflare Access keys are left behind on purpose.
|
||||
*
|
||||
* Idempotent: only rows whose ssh_options is still null are read, and every
|
||||
* row it reads gets a value, even an empty object.
|
||||
*/
|
||||
|
||||
import { sql } from "drizzle-orm";
|
||||
import { databaseLogger } from "../logger.js";
|
||||
import { runStatement, selectRows } from "./raw-rows.js";
|
||||
import { parseSshOptions } from "../../hosts/ssh-options.js";
|
||||
|
||||
export interface SshOptionsMigrationResult {
|
||||
hostsMoved: number;
|
||||
}
|
||||
|
||||
export async function runSshOptionsMigration(): Promise<SshOptionsMigrationResult> {
|
||||
let hostsMoved = 0;
|
||||
try {
|
||||
const rows = await selectRows<{
|
||||
id: number;
|
||||
terminal_config: string | null;
|
||||
}>(sql`
|
||||
SELECT id, terminal_config FROM ssh_data
|
||||
WHERE ssh_options IS NULL AND terminal_config IS NOT NULL
|
||||
`);
|
||||
for (const row of rows) {
|
||||
const options = parseSshOptions(row.terminal_config);
|
||||
await runStatement(sql`
|
||||
UPDATE ssh_data SET ssh_options = ${JSON.stringify(options)}
|
||||
WHERE id = ${row.id} AND ssh_options IS NULL
|
||||
`);
|
||||
if (Object.keys(options).length > 0) hostsMoved++;
|
||||
}
|
||||
} catch (error) {
|
||||
databaseLogger.warn("SSH options migration failed", {
|
||||
operation: "ssh_options_migration",
|
||||
error: error instanceof Error ? error.message : String(error),
|
||||
});
|
||||
return { hostsMoved };
|
||||
}
|
||||
|
||||
if (hostsMoved > 0) {
|
||||
databaseLogger.info(
|
||||
`Moved SSH options for ${hostsMoved} host(s) out of terminal_config`,
|
||||
{ operation: "ssh_options_migration" },
|
||||
);
|
||||
}
|
||||
return { hostsMoved };
|
||||
}
|
||||
@@ -201,7 +201,7 @@ class DataCrypto {
|
||||
migratedFieldsCount: number;
|
||||
}> {
|
||||
// Only a database that predates field encryption has plaintext to migrate,
|
||||
// and only SQLite deployments can predate it — Postgres and MySQL support
|
||||
// and only SQLite deployments can predate it, Postgres and MySQL support
|
||||
// arrived after. The store also needs synchronous queries no other driver
|
||||
// has, so this would throw rather than find nothing to do.
|
||||
if (!needsExplicitPersist(resolveDatabaseDialect())) {
|
||||
|
||||
@@ -14,7 +14,7 @@ export class DataDirMisconfiguredError extends Error {
|
||||
|
||||
/**
|
||||
* Directories Termix has shipped or documented as a data location. A deployment
|
||||
* that loses DATA_DIR — an unloaded .env file, an unmounted volume — falls back
|
||||
* that loses DATA_DIR, an unloaded .env file, an unmounted volume, falls back
|
||||
* to the default and finds an empty directory, which is indistinguishable from a
|
||||
* first run. Checking these tells the two apart.
|
||||
*/
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
/**
|
||||
* Extract a stable, human-readable message from an unknown thrown value.
|
||||
*
|
||||
* A thrown value is not guaranteed to be an `Error` — libraries may throw
|
||||
* A thrown value is not guaranteed to be an `Error`, libraries may throw
|
||||
* strings or plain objects, which carry no useful `.message`. When that
|
||||
* happens the caller gets `fallback` instead, so error paths never surface a
|
||||
* raw `[object Object]` in logs or responses.
|
||||
|
||||
@@ -0,0 +1,26 @@
|
||||
export type SettingData = {
|
||||
key: string;
|
||||
value: string;
|
||||
};
|
||||
|
||||
const SECRET_SETTING_PREFIXES = [
|
||||
"reset_code_",
|
||||
"temp_reset_token_",
|
||||
"audit_log_forward_token",
|
||||
];
|
||||
|
||||
/**
|
||||
* Global settings are instance config, not user data: only an admin's export
|
||||
* carries them (import only applies them for admins anyway), and never the
|
||||
* one-time reset codes or the audit forwarding token.
|
||||
*/
|
||||
export function selectExportableSettings(
|
||||
rows: SettingData[],
|
||||
isAdmin: boolean,
|
||||
): SettingData[] {
|
||||
if (!isAdmin) return [];
|
||||
return rows.filter(
|
||||
(row) =>
|
||||
!SECRET_SETTING_PREFIXES.some((prefix) => row.key.startsWith(prefix)),
|
||||
);
|
||||
}
|
||||
@@ -15,7 +15,7 @@ class FieldCrypto {
|
||||
private static readonly SALT_LENGTH = 32;
|
||||
|
||||
private static readonly ENCRYPTED_FIELDS = {
|
||||
users: new Set(["passwordHash", "clientSecret", "oidcIdentifier"]),
|
||||
users: new Set(["passwordHash"]),
|
||||
ssh_data: new Set([
|
||||
"password",
|
||||
"key",
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
import semver from "semver";
|
||||
import { databaseLogger } from "./logger.js";
|
||||
import { getProxyAgent } from "./proxy-agent.js";
|
||||
import type {
|
||||
@@ -36,29 +37,32 @@ class GitHubCache {
|
||||
|
||||
const githubCache = new GitHubCache();
|
||||
|
||||
function parseSemver(
|
||||
version: string | undefined,
|
||||
): [number, number, number] | null {
|
||||
const match = String(version || "").match(/(\d+)\.(\d+)(?:\.(\d+))?/);
|
||||
/**
|
||||
* A release tag or version as full semver, keeping any prerelease part:
|
||||
* "v2.8" is 2.8.0 and "v26.11.0-beta.2" stays a prerelease.
|
||||
*/
|
||||
export function normalizeVersion(version: string | undefined): string | null {
|
||||
const match = String(version || "").match(
|
||||
/(\d+)\.(\d+)(?:\.(\d+))?(-[0-9A-Za-z.-]+)?/,
|
||||
);
|
||||
if (!match) return null;
|
||||
const normalized = `${match[1]}.${match[2]}.${match[3] || 0}${match[4] || ""}`;
|
||||
return semver.valid(normalized);
|
||||
}
|
||||
|
||||
return [Number(match[1]), Number(match[2]), Number(match[3] || 0)];
|
||||
export function isPrereleaseVersion(version: string | undefined): boolean {
|
||||
const normalized = normalizeVersion(version);
|
||||
return Boolean(normalized && semver.prerelease(normalized));
|
||||
}
|
||||
|
||||
export function compareSemver(
|
||||
a: string | undefined,
|
||||
b: string | undefined,
|
||||
): number | null {
|
||||
const parsedA = parseSemver(a);
|
||||
const parsedB = parseSemver(b);
|
||||
const parsedA = normalizeVersion(a);
|
||||
const parsedB = normalizeVersion(b);
|
||||
if (!parsedA || !parsedB) return null;
|
||||
|
||||
for (let i = 0; i < 3; i += 1) {
|
||||
if (parsedA[i] > parsedB[i]) return 1;
|
||||
if (parsedA[i] < parsedB[i]) return -1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
return semver.compare(parsedA, parsedB);
|
||||
}
|
||||
|
||||
const GITHUB_API_BASE = "https://api.github.com";
|
||||
@@ -116,28 +120,72 @@ export async function fetchGitHubAPI<T>(
|
||||
}
|
||||
}
|
||||
|
||||
export type UpdateChannel = "stable" | "beta";
|
||||
|
||||
export interface LatestRelease {
|
||||
version: string;
|
||||
tagName: string;
|
||||
name: string;
|
||||
url: string;
|
||||
publishedAt: string;
|
||||
prerelease: boolean;
|
||||
notes: string;
|
||||
}
|
||||
|
||||
/** The newest Termix release on GitHub, cached for 30 minutes. */
|
||||
export async function fetchLatestRelease(): Promise<LatestRelease | null> {
|
||||
const release = await fetchGitHubAPI<GitHubRelease>(
|
||||
`/repos/${REPO_OWNER}/${REPO_NAME}/releases/latest`,
|
||||
"latest_release",
|
||||
);
|
||||
const rawTag = release.data.tag_name || release.data.name || "";
|
||||
const version = rawTag.match(/(\d+\.\d+(\.\d+)?)/)?.[1];
|
||||
function toLatestRelease(release: GitHubRelease): LatestRelease | null {
|
||||
const version = normalizeVersion(release.tag_name || release.name || "");
|
||||
if (!version) return null;
|
||||
return {
|
||||
version,
|
||||
tagName: release.data.tag_name,
|
||||
name: release.data.name,
|
||||
url: release.data.html_url,
|
||||
publishedAt: release.data.published_at,
|
||||
tagName: release.tag_name,
|
||||
name: release.name,
|
||||
url: release.html_url,
|
||||
publishedAt: release.published_at,
|
||||
prerelease: Boolean(release.prerelease) || !!semver.prerelease(version),
|
||||
notes: (release.body || "").slice(0, 20_000),
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* The newest Termix release on GitHub, cached for 30 minutes. On the beta
|
||||
* channel a newer beta wins over the newest stable release.
|
||||
*/
|
||||
export async function fetchLatestRelease(
|
||||
channel: UpdateChannel = "stable",
|
||||
): Promise<LatestRelease | null> {
|
||||
if (channel === "stable") {
|
||||
const release = await fetchGitHubAPI<GitHubRelease>(
|
||||
`/repos/${REPO_OWNER}/${REPO_NAME}/releases/latest`,
|
||||
"latest_release",
|
||||
);
|
||||
return toLatestRelease(release.data);
|
||||
}
|
||||
const releases = await fetchGitHubAPI<GitHubRelease[]>(
|
||||
`/repos/${REPO_OWNER}/${REPO_NAME}/releases?per_page=30`,
|
||||
"latest_releases",
|
||||
);
|
||||
let newest: LatestRelease | null = null;
|
||||
for (const release of releases.data) {
|
||||
if (release.draft) continue;
|
||||
const parsed = toLatestRelease(release);
|
||||
if (parsed && (!newest || semver.gt(parsed.version, newest.version))) {
|
||||
newest = parsed;
|
||||
}
|
||||
}
|
||||
return newest;
|
||||
}
|
||||
|
||||
export type UpdateStatus = "up_to_date" | "beta" | "requires_update";
|
||||
|
||||
/** How the running version compares with the newest release on its channel. */
|
||||
export function updateStatus(
|
||||
localVersion: string,
|
||||
latestVersion: string | null | undefined,
|
||||
): UpdateStatus {
|
||||
const comparison = latestVersion
|
||||
? compareSemver(localVersion, latestVersion)
|
||||
: null;
|
||||
if (comparison !== null && comparison < 0) return "requires_update";
|
||||
if (isPrereleaseVersion(localVersion) || (comparison ?? 0) > 0) return "beta";
|
||||
return "up_to_date";
|
||||
}
|
||||
@@ -11,10 +11,8 @@ export class LazyFieldEncryption {
|
||||
private_key: "privateKey",
|
||||
public_key: "publicKey",
|
||||
password_hash: "passwordHash",
|
||||
client_secret: "clientSecret",
|
||||
totp_secret: "totpSecret",
|
||||
totp_backup_codes: "totpBackupCodes",
|
||||
oidc_identifier: "oidcIdentifier",
|
||||
|
||||
keyPassword: "key_password",
|
||||
sudoPassword: "sudo_password",
|
||||
@@ -22,10 +20,8 @@ export class LazyFieldEncryption {
|
||||
privateKey: "private_key",
|
||||
publicKey: "public_key",
|
||||
passwordHash: "password_hash",
|
||||
clientSecret: "client_secret",
|
||||
totpSecret: "totp_secret",
|
||||
totpBackupCodes: "totp_backup_codes",
|
||||
oidcIdentifier: "oidc_identifier",
|
||||
};
|
||||
|
||||
static isPlaintextField(value: string): boolean {
|
||||
@@ -95,8 +91,6 @@ export class LazyFieldEncryption {
|
||||
"socks5Password",
|
||||
"privateKey",
|
||||
"publicKey",
|
||||
"clientSecret",
|
||||
"oidcIdentifier",
|
||||
];
|
||||
|
||||
if (sensitiveFields.includes(fieldName)) {
|
||||
@@ -241,8 +235,6 @@ export class LazyFieldEncryption {
|
||||
publicKey: "public_key",
|
||||
sudoPassword: "sudo_password",
|
||||
socks5Password: "socks5_password",
|
||||
clientSecret: "client_secret",
|
||||
oidcIdentifier: "oidc_identifier",
|
||||
};
|
||||
|
||||
static getSensitiveFieldsForTable(tableName: string): string[] {
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
[
|
||||
{ "name": "Auth", "description": "Sign in, sign out and login methods" },
|
||||
{ "name": "Users", "description": "Accounts, profiles and sessions" },
|
||||
{ "name": "API Keys", "description": "API keys for scripts and the CLI" },
|
||||
{ "name": "Encryption", "description": "Data key setup and unlock" },
|
||||
{ "name": "SSH", "description": "Hosts, folders and connections" },
|
||||
{
|
||||
"name": "SSH Auth",
|
||||
"description": "SSH auth types the server can connect with"
|
||||
},
|
||||
{
|
||||
"name": "Host Defaults",
|
||||
"description": "Admin, user and folder host defaults"
|
||||
},
|
||||
{ "name": "Host Enrollment", "description": "Adding hosts from a script" },
|
||||
{ "name": "Credentials", "description": "Saved credentials" },
|
||||
{ "name": "RBAC", "description": "Roles and sharing" },
|
||||
{ "name": "Dashboard", "description": "Dashboard stats and recent activity" },
|
||||
{ "name": "Audit", "description": "Audit log search and export" },
|
||||
{ "name": "Plugins", "description": "Installing and managing plugins" },
|
||||
{ "name": "Sync", "description": "Desktop sync with a linked server" },
|
||||
{ "name": "Database", "description": "Database export, import and health" },
|
||||
{ "name": "General", "description": "Server info and settings" },
|
||||
{ "name": "Open Tabs", "description": "Saved open tabs" },
|
||||
{ "name": "User Preferences", "description": "Per-user preferences" },
|
||||
{ "name": "UI Preferences", "description": "Interface layout preferences" },
|
||||
{ "name": "Host Sidebar", "description": "Host sidebar display options" },
|
||||
{
|
||||
"name": "Credential Sidebar",
|
||||
"description": "Credential sidebar display options"
|
||||
}
|
||||
]
|
||||
@@ -295,7 +295,7 @@ class PermissionManager {
|
||||
* queries instead of one call per host.
|
||||
*
|
||||
* canAccessHost costs between one and four queries, so filtering a list with
|
||||
* it is linear in host count — and the status poll does exactly that every
|
||||
* it is linear in host count, and the status poll does exactly that every
|
||||
* few seconds for the whole fleet. This answers the same question for many
|
||||
* hosts at once using the same three rules, in the same order: owner, then
|
||||
* an unexpired grant, then admin bypass.
|
||||
|
||||
@@ -112,7 +112,10 @@ export function getRequestOrigin(req: Request | IncomingMessage): string {
|
||||
function getRequestOriginWithForceHTTPS(
|
||||
req: Request | IncomingMessage,
|
||||
): string {
|
||||
if (process.env.OIDC_FORCE_HTTPS === "true") {
|
||||
// OIDC_FORCE_HTTPS is the 2.9 name, still read for one release.
|
||||
const forceHttps =
|
||||
process.env.EXTERNAL_FORCE_HTTPS ?? process.env.OIDC_FORCE_HTTPS;
|
||||
if (forceHttps === "true") {
|
||||
const origin = getRequestOrigin(req);
|
||||
return origin.replace(/^http:/, "https:");
|
||||
}
|
||||
|
||||
@@ -40,6 +40,7 @@ const blockedIpv4Ranges = [
|
||||
["127.0.0.0", 8],
|
||||
["169.254.0.0", 16], // link-local
|
||||
["172.16.0.0", 12],
|
||||
["192.0.0.0", 24], // IETF protocol assignments
|
||||
["192.168.0.0", 16],
|
||||
["198.18.0.0", 15], // benchmarking
|
||||
["224.0.0.0", 4], // multicast
|
||||
@@ -70,7 +71,7 @@ export function isBlockedAddress(address: string): boolean {
|
||||
}
|
||||
|
||||
// Extracted so the blocklist decision can be tested directly against a
|
||||
// fake DNS resolver, instead of only through a real fetch()/Agent call —
|
||||
// fake DNS resolver, instead of only through a real fetch()/Agent call,
|
||||
// the actual bug here lived entirely in this callback, several layers
|
||||
// below where undici's own "fetch failed" wrapping would otherwise hide it.
|
||||
export function createDnsLookupHook(
|
||||
|
||||
@@ -34,7 +34,7 @@ try {
|
||||
// The pure-JS fallback in ssh2 for chacha20-poly1305@openssh.com is broken and
|
||||
// corrupts the transport: the target sshd aborts the KEX with
|
||||
// "ssh_dispatch_run_fatal: ... incomplete message [preauth]" and the client times out.
|
||||
// A working OpenSSL "chacha20" cipher is NOT sufficient here — only the native
|
||||
// A working OpenSSL "chacha20" cipher is NOT sufficient here, only the native
|
||||
// binding (sshcrypto.node) makes chacha20-poly1305 usable. Keep it disabled otherwise
|
||||
// so filterCiphers() drops it and the connection negotiates AES-GCM instead.
|
||||
ssh2BindingAvailable = false;
|
||||
|
||||
@@ -1,6 +1,9 @@
|
||||
import { createPrivateKey } from "node:crypto";
|
||||
import sshpk from "sshpk";
|
||||
import { getErrorMessage } from "./error-message.js";
|
||||
import ssh2Pkg from "ssh2";
|
||||
const ssh2Utils = ssh2Pkg.utils;
|
||||
const { parsePrivateKey } = sshpk;
|
||||
|
||||
function detectKeyTypeFromContent(keyContent: string): string {
|
||||
const content = keyContent.trim();
|
||||
@@ -246,7 +249,26 @@ export function preparePrivateKeyForSSH2(
|
||||
privateKeyData: string,
|
||||
passphrase?: string,
|
||||
): Buffer {
|
||||
const cleanKey = normalizePrivateKeyText(privateKeyData);
|
||||
let cleanKey = normalizePrivateKeyText(privateKeyData);
|
||||
if (
|
||||
/^-----BEGIN (?:ENCRYPTED )?PRIVATE KEY-----/.test(cleanKey) &&
|
||||
ssh2Utils.parseKey(cleanKey, passphrase) instanceof Error
|
||||
) {
|
||||
try {
|
||||
const pem = createPrivateKey({ key: cleanKey, format: "pem", passphrase })
|
||||
.export({ type: "pkcs8", format: "pem" })
|
||||
.toString();
|
||||
cleanKey = parsePrivateKey(pem, "pkcs8").toString("openssh");
|
||||
} catch {
|
||||
throw new Error(
|
||||
cleanKey.startsWith("-----BEGIN ENCRYPTED PRIVATE KEY-----")
|
||||
? "Could not decrypt PKCS#8 private key; check the passphrase"
|
||||
: "Invalid or unsupported PKCS#8 private key",
|
||||
);
|
||||
}
|
||||
const parsed = ssh2Utils.parseKey(cleanKey);
|
||||
if (parsed instanceof Error) throw parsed;
|
||||
}
|
||||
const keyInfo = parseSSHKey(cleanKey, passphrase);
|
||||
|
||||
if (!keyInfo.success) {
|
||||
|
||||
@@ -1,219 +0,0 @@
|
||||
import swaggerJSDoc from "@deadendjs/swagger-jsdoc";
|
||||
import path from "path";
|
||||
import { fileURLToPath } from "url";
|
||||
import { promises as fs } from "fs";
|
||||
import { systemLogger } from "./logger.js";
|
||||
|
||||
type SwaggerJSDocOptions = Parameters<typeof swaggerJSDoc>[0];
|
||||
|
||||
const __filename = fileURLToPath(import.meta.url);
|
||||
const __dirname = path.dirname(__filename);
|
||||
// dist/backend/backend/utils -> the repository.
|
||||
const REPO_ROOT = path.join(__dirname, "..", "..", "..", "..");
|
||||
|
||||
/**
|
||||
* A tag per plugin, named and described by its manifest, so the reference
|
||||
* groups a plugin's routes without core naming any plugin.
|
||||
*/
|
||||
async function pluginTags(): Promise<{ name: string; description: string }[]> {
|
||||
const pluginsDir = path.join(REPO_ROOT, "plugins");
|
||||
const tags: { name: string; description: string }[] = [];
|
||||
let entries: string[] = [];
|
||||
try {
|
||||
entries = await fs.readdir(pluginsDir);
|
||||
} catch {
|
||||
return tags;
|
||||
}
|
||||
for (const entry of entries.sort()) {
|
||||
try {
|
||||
const manifest = JSON.parse(
|
||||
await fs.readFile(
|
||||
path.join(pluginsDir, entry, "manifest.json"),
|
||||
"utf8",
|
||||
),
|
||||
) as { name?: string; description?: string };
|
||||
if (manifest.name) {
|
||||
tags.push({
|
||||
name: manifest.name,
|
||||
description: manifest.description ?? "",
|
||||
});
|
||||
}
|
||||
} catch {
|
||||
// Not a plugin folder.
|
||||
}
|
||||
}
|
||||
return tags;
|
||||
}
|
||||
|
||||
const swaggerOptions: SwaggerJSDocOptions = {
|
||||
definition: {
|
||||
openapi: "3.0.3",
|
||||
info: {
|
||||
title: "Termix API",
|
||||
version: "0.0.0",
|
||||
description: "Termix Backend API Reference",
|
||||
},
|
||||
servers: [
|
||||
{
|
||||
url: "http://localhost:30001",
|
||||
description: "Main database and authentication server",
|
||||
},
|
||||
],
|
||||
components: {
|
||||
securitySchemes: {
|
||||
bearerAuth: {
|
||||
type: "http",
|
||||
scheme: "bearer",
|
||||
bearerFormat: "JWT",
|
||||
description: "Session JWT sent as Authorization: Bearer <JWT>.",
|
||||
},
|
||||
cookieAuth: {
|
||||
type: "apiKey",
|
||||
in: "cookie",
|
||||
name: "jwt",
|
||||
description:
|
||||
"Session JWT cookie set at sign-in. When present, it takes precedence over the Authorization header.",
|
||||
},
|
||||
apiKeyAuth: {
|
||||
type: "http",
|
||||
scheme: "bearer",
|
||||
bearerFormat: "tmx_<api key>",
|
||||
description:
|
||||
"API key sent as Authorization: Bearer tmx_<api key>. Permissions follow the key owner's account; encrypted data must be unlocked separately. API keys cannot impersonate another user.",
|
||||
},
|
||||
},
|
||||
schemas: {
|
||||
Error: {
|
||||
type: "object",
|
||||
properties: {
|
||||
error: { type: "string" },
|
||||
details: { type: "string" },
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
security: [
|
||||
{
|
||||
bearerAuth: [],
|
||||
},
|
||||
{
|
||||
cookieAuth: [],
|
||||
},
|
||||
{
|
||||
apiKeyAuth: [],
|
||||
},
|
||||
],
|
||||
tags: [
|
||||
{
|
||||
name: "Credentials",
|
||||
description: "SSH credential management",
|
||||
},
|
||||
{
|
||||
name: "RBAC",
|
||||
description: "Role-based access control for host sharing",
|
||||
},
|
||||
{
|
||||
name: "Users",
|
||||
description: "User management and authentication",
|
||||
},
|
||||
{
|
||||
name: "Dashboard",
|
||||
description: "Dashboard statistics and activity",
|
||||
},
|
||||
{
|
||||
name: "SSH",
|
||||
description: "SSH host management and configuration",
|
||||
},
|
||||
{
|
||||
name: "Host Enrollment",
|
||||
description: "Host enrollment and onboarding",
|
||||
},
|
||||
{
|
||||
name: "Open Tabs",
|
||||
description: "Per-user open tab state",
|
||||
},
|
||||
{
|
||||
name: "Audit",
|
||||
description: "Audit log querying and export",
|
||||
},
|
||||
{
|
||||
name: "API Keys",
|
||||
description: "API key management",
|
||||
},
|
||||
{
|
||||
name: "Sync",
|
||||
description: "Remote sync between desktop and server",
|
||||
},
|
||||
{
|
||||
name: "User Preferences",
|
||||
description: "Per-user application preferences",
|
||||
},
|
||||
{
|
||||
name: "UI Preferences",
|
||||
description: "Interface layout and display preferences",
|
||||
},
|
||||
{
|
||||
name: "Host Sidebar",
|
||||
description: "Host sidebar display preferences",
|
||||
},
|
||||
{
|
||||
name: "Credential Sidebar",
|
||||
description: "Credential sidebar display preferences",
|
||||
},
|
||||
],
|
||||
},
|
||||
apis: [
|
||||
path.join(__dirname, "..", "database", "database.js").replace(/\\/g, "/"),
|
||||
path
|
||||
.join(__dirname, "..", "database", "routes", "*.js")
|
||||
.replace(/\\/g, "/"),
|
||||
path.join(__dirname, "..", "services", "*.js").replace(/\\/g, "/"),
|
||||
path.join(__dirname, "..", "hosts", "*.js").replace(/\\/g, "/"),
|
||||
path.join(__dirname, "..", "hosts", "**", "*.js").replace(/\\/g, "/"),
|
||||
// Plugin routes document themselves. Read from source, because a plugin's
|
||||
// bundle drops comments.
|
||||
path
|
||||
.join(REPO_ROOT, "plugins", "*", "src", "backend", "**", "*.ts")
|
||||
.replace(/\\/g, "/"),
|
||||
],
|
||||
};
|
||||
|
||||
async function generateOpenAPISpec() {
|
||||
try {
|
||||
systemLogger.info("Generating OpenAPI specification", {
|
||||
operation: "openapi_generate_start",
|
||||
});
|
||||
|
||||
const definition = swaggerOptions.definition as { tags?: unknown[] };
|
||||
definition.tags = [...(definition.tags ?? []), ...(await pluginTags())];
|
||||
const swaggerSpec = await swaggerJSDoc(swaggerOptions);
|
||||
|
||||
const outputPath = path.join(
|
||||
__dirname,
|
||||
"..",
|
||||
"..",
|
||||
"..",
|
||||
"..",
|
||||
"openapi.json",
|
||||
);
|
||||
|
||||
await fs.writeFile(
|
||||
outputPath,
|
||||
JSON.stringify(swaggerSpec, null, 2),
|
||||
"utf-8",
|
||||
);
|
||||
|
||||
systemLogger.success("OpenAPI specification generated", {
|
||||
operation: "openapi_generate_success",
|
||||
});
|
||||
} catch (error) {
|
||||
systemLogger.error("Failed to generate OpenAPI specification", error, {
|
||||
operation: "openapi_generation",
|
||||
});
|
||||
process.exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
generateOpenAPISpec();
|
||||
|
||||
export { swaggerOptions, generateOpenAPISpec };
|
||||
@@ -3,6 +3,16 @@ import { promises as fs } from "fs";
|
||||
import path from "path";
|
||||
import { databaseLogger } from "./logger.js";
|
||||
|
||||
/** Owner-only access for the secrets file. Not meaningful on Windows. */
|
||||
export async function restrictToOwner(filePath: string): Promise<void> {
|
||||
if (process.platform === "win32") return;
|
||||
try {
|
||||
await fs.chmod(filePath, 0o600);
|
||||
} catch {
|
||||
// best effort, new files are already written with 0600
|
||||
}
|
||||
}
|
||||
|
||||
class SystemCrypto {
|
||||
private static instance: SystemCrypto;
|
||||
private jwtSecret: string | null = null;
|
||||
@@ -58,9 +68,9 @@ class SystemCrypto {
|
||||
|
||||
const dataDir = process.env.DATA_DIR || "./db/data";
|
||||
const envPath = path.join(dataDir, ".env");
|
||||
|
||||
try {
|
||||
const envContent = await fs.readFile(envPath, "utf8");
|
||||
await restrictToOwner(envPath);
|
||||
const jwtMatch = envContent.match(/^JWT_SECRET=(.+)$/m);
|
||||
if (jwtMatch && jwtMatch[1] && jwtMatch[1].length >= 64) {
|
||||
this.jwtSecret = jwtMatch[1];
|
||||
@@ -349,7 +359,7 @@ class SystemCrypto {
|
||||
const envPath = path.join(dataDir, ".env");
|
||||
|
||||
try {
|
||||
await fs.mkdir(dataDir, { recursive: true });
|
||||
await fs.mkdir(dataDir, { recursive: true, mode: 0o700 });
|
||||
|
||||
let envContent = "";
|
||||
|
||||
@@ -370,7 +380,8 @@ class SystemCrypto {
|
||||
envContent += `${key}=${value}\n`;
|
||||
}
|
||||
|
||||
await fs.writeFile(envPath, envContent);
|
||||
await fs.writeFile(envPath, envContent, { mode: 0o600 });
|
||||
await restrictToOwner(envPath);
|
||||
|
||||
process.env[key] = value;
|
||||
} catch (error) {
|
||||
|
||||
@@ -7,7 +7,7 @@ import { SystemCrypto } from "./system-crypto.js";
|
||||
* Per-user field encryption (DataCrypto/FieldCrypto) derives its key from the
|
||||
* user's DEK, which works for host passwords and SSH keys. It does not work for
|
||||
* SSO provider configuration: `sso_providers` has no `userId`, and the OIDC
|
||||
* client secret and LDAP bind password must be readable during login — before
|
||||
* client secret and LDAP bind password must be readable during login, before
|
||||
* any user is authenticated, let alone unlocked.
|
||||
*
|
||||
* Those secrets were previously stored base64-encoded behind an `encoded:`
|
||||
|
||||
@@ -1,5 +1,4 @@
|
||||
import type { Request } from "express";
|
||||
import crypto from "crypto";
|
||||
|
||||
export type DeviceType = "web" | "desktop" | "mobile";
|
||||
|
||||
@@ -249,22 +248,3 @@ function parseMacVersion(userAgent: string): string {
|
||||
}
|
||||
return "macOS";
|
||||
}
|
||||
|
||||
/** Return the installation-scoped identifier used for trusted-device checks. */
|
||||
export function getDeviceId(req: Request): string | null {
|
||||
const value = req.headers["x-termix-device-id"];
|
||||
if (typeof value !== "string" || !/^[a-f0-9]{64}$/.test(value)) return null;
|
||||
return value;
|
||||
}
|
||||
|
||||
/** Bind a trusted-device record to one client installation and platform. */
|
||||
export function generateDeviceFingerprint(
|
||||
deviceInfo: DeviceInfo,
|
||||
deviceId: string | null,
|
||||
): string | null {
|
||||
if (!deviceId) return null;
|
||||
return crypto
|
||||
.createHash("sha256")
|
||||
.update(`${deviceInfo.type}|${deviceId}`)
|
||||
.digest("hex");
|
||||
}
|
||||
@@ -7,10 +7,14 @@ const JWT_PROTOCOL_PREFIX = "termix.jwt.";
|
||||
* same site, including a sibling subdomain. The cookie only counts when the
|
||||
* page that opened the socket is this server. A non-web origin (the desktop
|
||||
* app) or no Origin at all is not a browser page on another host.
|
||||
*
|
||||
* Sec-Fetch-Site is set by the browser itself, so it holds even behind a
|
||||
* proxy that rewrites Host.
|
||||
*/
|
||||
export function isCookieOriginAllowed(req: IncomingMessage): boolean {
|
||||
const origin = req.headers.origin;
|
||||
if (!origin) return true;
|
||||
if (req.headers["sec-fetch-site"] === "same-origin") return true;
|
||||
let parsed: URL;
|
||||
try {
|
||||
parsed = new URL(origin);
|
||||
|
||||
Reference in new issue
Block a user