mirror of
https://github.com/Termix-SSH/Termix.git
synced 2026-10-31 07:35:24 +00:00
release-2.9.0 (#1532)
* fix(macos): skip single-instance lock in Mac App Store builds (#1454)
fix(macos): skip single-instance lock in Mac App Store builds
* Fix/backend optional sharp (#1455)
Fix/backend optional sharp
* feat: issue #1218 (#1218)
https://github.com/Termix-SSH/Support/issues/1218
* feat: Add option to use saved global custom theme under Connection Defaults (#1209)
https://github.com/Termix-SSH/Support/issues/1209
* feat: Add Fleet Sharing functionality to the UI (#1228)
https://github.com/Termix-SSH/Support/issues/1228
* feat: Add a list view to the Docker management page (#1237)
https://github.com/Termix-SSH/Support/issues/1237
* feat: issue #1264 (#1264)
https://github.com/Termix-SSH/Support/issues/1264
* feat: 2FA With FortiToken (#1288)
https://github.com/Termix-SSH/Support/issues/1288
* feat: Allow to disable showing paths to folders (#1274)
https://github.com/Termix-SSH/Support/issues/1274
* feat: Sync Network Graph between Desktop and Remote Server (#1245)
https://github.com/Termix-SSH/Support/issues/1245
* feat: Version Number on offline servers (#1291)
https://github.com/Termix-SSH/Support/issues/1291
* feat: Support OrbStack Docker socket path on macOS / Fix "Docker is not installed" on mac... (#1302)
https://github.com/Termix-SSH/Support/issues/1302
* feat: Sidebar host click should focus existing tab instead of opening a new connection (#1289)
https://github.com/Termix-SSH/Support/issues/1289
* fix: Search in side bar shows overlapping hosts when grouped by tags (#1303)
https://github.com/Termix-SSH/Support/issues/1303
* fix: I can't send a file on its own. (#1304)
https://github.com/Termix-SSH/Support/issues/1304
* fix: sudo password not autofilling (#1248)
https://github.com/Termix-SSH/Support/issues/1248
* fix: node-MainThread (#1300)
https://github.com/Termix-SSH/Support/issues/1300
* fix: Tunnel authentication with shared credentials (#1295)
https://github.com/Termix-SSH/Support/issues/1295
* fix: host key updates not syncing, metrics 404 race on first connect
Host key writes never bumped updatedAt so sync never picked them up.
Also retry the first metrics fetch briefly instead of failing right away.
* chore: increment ver
* feat: add category and icon fields to plugin manifest schema
* ci(deps): bump the github-actions group with 2 updates (#1458)
Bumps the github-actions group with 2 updates: [crowdin/github-action](https://github.com/crowdin/github-action) and [actions/github-script](https://github.com/actions/github-script).
Updates `crowdin/github-action` from 2 to 3
- [Release notes](https://github.com/crowdin/github-action/releases)
- [Commits](https://github.com/crowdin/github-action/compare/v2...v3)
Updates `actions/github-script` from 7 to 9
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/v7...v9)
---
updated-dependencies:
- dependency-name: crowdin/github-action
dependency-version: '3'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: actions/github-script
dependency-version: '9'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps-dev): bump the dev-patch-updates group with 13 updates (#1459)
Bumps the dev-patch-updates group with 13 updates:
| Package | From | To |
| --- | --- | --- |
| [@codemirror/commands](https://github.com/codemirror/commands) | `6.11.0` | `6.11.1` |
| [@codemirror/search](https://github.com/codemirror/search) | `6.7.1` | `6.7.2` |
| [@codemirror/view](https://github.com/codemirror/view) | `6.43.9` | `6.43.12` |
| [@testing-library/dom](https://github.com/testing-library/dom-testing-library) | `10.4.1` | `10.4.2` |
| [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.2` | `16.3.3` |
| [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.5` | `14.6.7` |
| [@types/ssh2](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ssh2) | `1.15.5` | `1.15.6` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.0` | `6.1.1` |
| [cytoscape](https://github.com/cytoscape/cytoscape.js) | `3.34.1` | `3.34.3` |
| [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.4` | `0.5.7` |
| [i18next](https://github.com/i18next/i18next) | `26.4.0` | `26.4.2` |
| [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.8` |
| [react-i18next](https://github.com/i18next/react-i18next) | `17.0.12` | `17.0.14` |
Updates `@codemirror/commands` from 6.11.0 to 6.11.1
- [Changelog](https://github.com/codemirror/commands/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/commands/commits)
Updates `@codemirror/search` from 6.7.1 to 6.7.2
- [Changelog](https://github.com/codemirror/search/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/search/commits)
Updates `@codemirror/view` from 6.43.9 to 6.43.12
- [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/view/commits)
Updates `@testing-library/dom` from 10.4.1 to 10.4.2
- [Release notes](https://github.com/testing-library/dom-testing-library/releases)
- [Changelog](https://github.com/testing-library/dom-testing-library/blob/main/CHANGELOG.md)
- [Commits](https://github.com/testing-library/dom-testing-library/compare/v10.4.1...v10.4.2)
Updates `@testing-library/react` from 16.3.2 to 16.3.3
- [Release notes](https://github.com/testing-library/react-testing-library/releases)
- [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md)
- [Commits](https://github.com/testing-library/react-testing-library/compare/v16.3.2...v16.3.3)
Updates `@testing-library/user-event` from 14.6.5 to 14.6.7
- [Release notes](https://github.com/testing-library/user-event/releases)
- [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md)
- [Commits](https://github.com/testing-library/user-event/compare/v14.6.5...v14.6.7)
Updates `@types/ssh2` from 1.15.5 to 1.15.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ssh2)
Updates `@vitejs/plugin-react` from 6.1.0 to 6.1.1
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react)
Updates `cytoscape` from 3.34.1 to 3.34.3
- [Release notes](https://github.com/cytoscape/cytoscape.js/releases)
- [Commits](https://github.com/cytoscape/cytoscape.js/compare/v3.34.1...v3.34.3)
Updates `eslint-plugin-react-refresh` from 0.5.4 to 0.5.7
- [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases)
- [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/compare/v0.5.4...v0.5.7)
Updates `i18next` from 26.4.0 to 26.4.2
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](https://github.com/i18next/i18next/compare/v26.4.0...v26.4.2)
Updates `prettier` from 3.9.6 to 3.9.8
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.9.6...3.9.8)
Updates `react-i18next` from 17.0.12 to 17.0.14
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](https://github.com/i18next/react-i18next/compare/v17.0.12...v17.0.14)
---
updated-dependencies:
- dependency-name: "@codemirror/commands"
dependency-version: 6.11.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: "@codemirror/search"
dependency-version: 6.7.2
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: "@codemirror/view"
dependency-version: 6.43.12
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: "@testing-library/dom"
dependency-version: 10.4.2
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: "@testing-library/react"
dependency-version: 16.3.3
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: "@testing-library/user-event"
dependency-version: 14.6.7
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: "@types/ssh2"
dependency-version: 1.15.6
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: "@vitejs/plugin-react"
dependency-version: 6.1.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: cytoscape
dependency-version: 3.34.3
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: eslint-plugin-react-refresh
dependency-version: 0.5.7
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: i18next
dependency-version: 26.4.2
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: prettier
dependency-version: 3.9.8
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: react-i18next
dependency-version: 17.0.14
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps): bump the prod-patch-updates group with 6 updates (#1461)
Bumps the prod-patch-updates group with 6 updates:
| Package | From | To |
| --- | --- | --- |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.10` | `3.14.13` |
| [compression](https://github.com/expressjs/compression) | `1.8.1` | `1.8.2` |
| [jose](https://github.com/panva/jose) | `6.2.9` | `6.2.12` |
| [jszip](https://github.com/Stuk/jszip) | `3.10.1` | `3.10.2` |
| [socks](https://github.com/JoshGlazebrook/socks) | `2.8.9` | `2.8.10` |
| [undici](https://github.com/nodejs/undici) | `8.10.0` | `8.10.2` |
Updates `@tanstack/react-virtual` from 3.14.10 to 3.14.13
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.13/packages/react-virtual)
Updates `compression` from 1.8.1 to 1.8.2
- [Release notes](https://github.com/expressjs/compression/releases)
- [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md)
- [Commits](https://github.com/expressjs/compression/compare/v1.8.1...v1.8.2)
Updates `jose` from 6.2.9 to 6.2.12
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](https://github.com/panva/jose/compare/v6.2.9...v6.2.12)
Updates `jszip` from 3.10.1 to 3.10.2
- [Changelog](https://github.com/Stuk/jszip/blob/main/CHANGES.md)
- [Commits](https://github.com/Stuk/jszip/compare/v3.10.1...v3.10.2)
Updates `socks` from 2.8.9 to 2.8.10
- [Release notes](https://github.com/JoshGlazebrook/socks/releases)
- [Commits](https://github.com/JoshGlazebrook/socks/compare/2.8.9...2.8.10)
Updates `undici` from 8.10.0 to 8.10.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v8.10.0...v8.10.2)
---
updated-dependencies:
- dependency-name: "@tanstack/react-virtual"
dependency-version: 3.14.13
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: prod-patch-updates
- dependency-name: compression
dependency-version: 1.8.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: prod-patch-updates
- dependency-name: jose
dependency-version: 6.2.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: prod-patch-updates
- dependency-name: jszip
dependency-version: 3.10.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: prod-patch-updates
- dependency-name: socks
dependency-version: 2.8.10
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: prod-patch-updates
- dependency-name: undici
dependency-version: 8.10.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: prod-patch-updates
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* feat: add plugin worker protocol, bootstrap and plugin_storage table
Worker-side ctx proxy plus the message envelope it talks over, and the
per-plugin key/value table behind ctx.storage with migrations for all
three dialects. Rows cascade with the plugin so uninstalling leaves
nothing behind.
* feat: add allowlisted host view for plugins
An allowlist rather than a list of fields to strip. A blocklist rots:
the moment a new secret-bearing column lands on SSHHost it starts
leaking silently. With an allowlist a new field stays invisible to
plugins until someone adds it here on purpose.
* feat: add plugin loader with manifest validation and crash restart
Validates an unpacked plugin, spawns a worker_threads worker and manages
activate/deactivate/crash-restart with backoff, disabling after three
tries.
The crash counter clears only after a plugin stays up past a stability
window, not on activation. Clearing it on activation let a plugin that
activates cleanly and then dies restart forever, because every attempt
looked like the first.
loader.ts documents what the worker boundary does and does not buy you.
Node's permission model is process-wide, not per-worker, so it cannot be
enabled for plugin workers alone and is not claimed here.
* feat: route internal events through a shared plugin event bus
Formalises three ad-hoc publish paths that already existed:
automation-events.ts, metrics/automation-bridge.ts and the
hostSessionStatus singleton, now the host.session.status topic.
Both invariants the old code relied on are preserved. Publishing stays
fire-and-forget, so a failing subscriber cannot disturb a metrics poll or
a host delete. The automations engine subscribes to the bus at scheduler
start instead of being imported ad hoc, which keeps the edge
one-directional: automations may import repositories, hosts modules must
not import automations.
* feat: add plugin ctx broker with permission gate and audit
Every ctx call a plugin makes is checked against its granted
capabilities, performed by the main thread, then audited. A capability
must be both declared in the manifest and granted in the database, so
widening a plugin's reach always needs a new manifest the user can see,
never just a database row.
Audit attribution is set by the broker, not the plugin. The plugin
supplies only the details, so it cannot forge the actor.
fix: stop plugin workers seeing plaintext credentials in error messages
A failing ctx.ssh.connect handed the worker the raw error from deep in
the SSH stack, which embeds the connect config. The worker received, in
full:
Authentication failed for root using password <SECRET>
where <SECRET> was the host's real plaintext password. Any plugin with
ssh.exec could read it by catching the error, defeating the whole point
of the handle-based ssh API.
Errors crossing the boundary are now sanitised. Only PluginFacingError
and PluginPermissionError, both authored here, reach a plugin verbatim;
anything else becomes a generic message and the real one goes to the
log. This uses a marker class rather than matching on message text,
because matching would start leaking again the moment an upstream error
happened to contain a familiar phrase.
Covered by credential-isolation.test.ts, which plants a sentinel in
every secret-bearing field and asserts it appears in no message the
worker ever receives.
* feat: dispatch plugin HTTP routes and wire the runtime into startup
ctx.http.route now registers a real router on the /plugin-api/:pluginId
dispatcher, replacing its stub 404. A plugin never touches the Express
req/res: it gets a plain summary and returns a plain object, so sockets
and session cookies stay on this side of the boundary. Authorization and
cookie headers are not forwarded.
Plugins load last in the start-up sequence, after the server is fully
wired, and are terminated before the database on shutdown so none can
outlive it. A plugin that fails to load cannot stop the backend.
fix: correct the nginx plugin-api location regex
The pattern was ^/plugin-api/(/.*)?$, which needs a double slash and so
never matched /plugin-api/<id>/<route>. Every other block in the file
uses ^/prefix(/.*)?$. Left alone, plugin routes would work in dev and
404 only behind Docker.
* fix: update stale SFTP transfer test for single file destination paths
The test still asserted transferToHost was called with the destination
directory "/srv". Commit 7727fa09 (#1304) deliberately changed a single
file transfer to send the full destination path including the filename,
so the correct expectation is "/srv/remote-1.txt". The code was right
and the test was left behind.
* feat: ship the ssh terminal as a first-party in-process plugin
Adds a hardcoded process:transport-owner tier so the terminal can own its
WebSocket server and ssh2 clients, which cannot cross the worker boundary.
* feat: ship docker as a first-party in-process plugin
Moves docker backend and frontend into plugins/docker/, alongside
ssh-terminal. Adds a host editor tab seam, a dashboard card registry,
and a build step to compile plugin backends into dist.
* feat: ship host metrics as a first-party in-process plugin
* fix: harden plugin auth and add per-request identity for ctx calls
Require auth on /plugin-api, gate plugin enable/grant/revoke routes
behind admin.plugins.manage, and thread the calling user through
worker ctx.hosts/ctx.ssh calls instead of always using the install
owner. Also adds the plugin permissions grant/revoke UI.
* feat: ship the AI assistant as a first-party in-process plugin
Moves src/backend/ai and its routes into plugins/ai, mounted through a
small /ai dispatcher instead of its own port. Moves the ai-enabled and
ai-private-endpoints settings routes out of user-settings-routes.ts
into the plugin too, so it has no leftover core dependents.
* fix: remove compiled plugin JS left behind in plugins/ after build
copy-bundled-plugins.cjs compiled and rewrote plugin backend TS in
place, copied it to dist/plugins, but never deleted the .js it had
just emitted next to the .ts sources. Those files shadowed the real
source for vitest/tsx and had import paths rewritten for the dist
layout, so tests failed with "Cannot find module" once a local build
had run. Affects docker, host-metrics and ai, not just this one.
* feat: add a permission-gated backend service registry for plugins
* feat: add a permission-gated UI action registry and action slots for plugins
Moves the terminal toolbar's hardwired AI button into a slot the ssh-terminal
plugin offers and the ai plugin fills, gated on ai.services.use.
* feat: add cross-plugin secret references gated by the provider's RBAC permission
* feat: move proxmox discovery/import/sync into a first-party plugin
* feat: move remote desktop (RDP/VNC/Telnet) into a first-party plugin
Relocates guacamole backend/frontend source and tests into
plugins/remote-desktop, following the ssh-terminal/docker pattern.
* feat: wire remote-desktop plugin into core and rename i18n keys
Repoints core consumers (dispatcher, collab, session-sharing, tab
utils) at the plugin, adds isTabTypeAvailable gating for rdp/vnc/
telnet, widens hostCapability to accept an array, and renames the
guacamole i18n namespace to remoteDesktop.
* feat: move fleets into a first-party plugin
* feat: move automations into a first-party plugin
* feat: remove legacy alert rules, superseded by automations
Alert rules already auto-migrate into automations on boot and the old
engine stands down after. Deletes the rule/firing tables, routes, UI,
and AI tools; keeps notification channels since automations still use
them. Also fixes automations' notify step, which still called the
deleted repository.
* feat: move network topology into a first-party plugin
* feat: move tailscale device discovery and settings into a plugin
Adds plugins/tailscale/ with a devices sidebar tab, admin settings
section, and re-auth dialog. Host Metrics tailscale manager card and
SSH re-auth banner parsing stay in core.
* feat: move workspaces into a first-party plugin
* feat: move web endpoint into a first-party plugin
* feat: collapse plugin runtime to one tier behind a plugin SDK
* feat: make each plugin an npm workspace built by a termix-plugin CLI
* feat: give plugins their own tables, migrations and sync entities
* feat: serve plugin http and websockets from one mount instead of ports
* feat: namespace plugin permissions and keep them valid when a plugin is off
* feat: give plugins their own settings and one settings screen
* feat: load plugin frontends at runtime and remove plugin ids from the shell
* fix: mock the ai status fetch in its activate test
* feat: add auth extension points and one ssh connect pipeline
* feat: rebuild workspaces as the reference plugin
* fix: gate second factors after SSO/LDAP behind an admin setting
* feat: convert network-topology to a full plugin (B1)
* feat: move snippets backend and tables into a plugin (B2)
* feat: point core frontend snippets pickers at the plugin (B2)
* feat: add the snippets plugin (B2)
* feat: wire ai, automations, fleets and ssh-terminal to snippets (B2)
* feat: finish the tailscale plugin, including SSH auth (B3)
* feat: finish the fleets plugin, add ctx.hosts and host-commands SDK (B4)
* chore: update proxmox and host-metrics locale files for B5
* chore: regenerate drizzle migration journals for B5
* feat: add ctx.hosts create/update to the SDK, host-metrics drops proxmox
* feat: move proxmox node stats and collectors into the proxmox plugin
* feat: drop proxmox host columns, use plugin settings instead
* feat: finish the fleets plugin, add ctx.hosts and host-commands SDK (B4)
* feat: convert file manager into a plugin
* feat: convert ssh tunnels into a plugin
* feat: finish the web-endpoint plugin, add ctx.desktop (B8)
* feat: move the terminal fully into the ssh-terminal plugin (B9)
* feat: convert tmux monitoring into a plugin (B10)
* feat: convert serial console into the serial plugin
* feat: move session sharing and collab rooms into a plugin (B12)
* feat: turn session recording into a plugin (B13)
* feat: finish the remote-desktop plugin (B14)
* feat: finish the host-metrics plugin, move host status into core (B16)
* feat: finish the docker plugin (B15)
* feat: finish the automations plugin (B17)
* feat: finish the ai plugin (B18)
* feat: finish the homepage plugin, move service links and canvas out of core (B19)
* feat: convert wake-on-lan into a plugin (B20)
* feat: convert secret-sources into a plugin (B20)
* feat: move totp and passkeys into plugins (C1)
* feat: move sso and ldap logins into plugins (C2)
* feat: move opkssh and warpgate into plugins (C3)
* feat: move step-ca into a plugin (C4)
* feat: move vault ssh signing into a plugin (C5)
* feat: move termix identity into a plugin (C6)
* feat: move acme certificate automation into a plugin (C7)
* fix: finish 2.9.0 plugin moves and get every check green
* chore: lock the plugin boundary and remove 2.9.0 leftovers
* fix: harden the plugin runtime after the 2.9.0 security review
* feat: add plugin packing, signing, pinned trust and tmxplug bundling
* test: prove 2.8 to 2.9.0 upgrade is lossless and fix what it caught
* fix: give bundled plugin backends a real require for CJS deps
* feat: improve UI loading time and jitter
* feat: show credential sharing inline in the sidebar like host sharing
* feat: tailscale add host and copy ip, fix outbound fetch hang and plugin ESM warning
* feat: unify alerts into one plugin, channels, rules and inbox
* feat: rebuild desktop sync as linked server accounts, fix packaged plugin bundles and UI scaling
* fix: set blacksmith builder cache-key to stop broken gha cache fallback
* fix: link plugin-sdk workspace before npm ci in docker deps stage
* fix: link every plugin workspace before npm ci in docker deps stage
* fix(host-metrics): exclude image and firmware filesystems (#1469)
* fix(host-metrics): exclude image and firmware filesystems
* fix(ci): build plugin SDK before dependent checks
* fix(mysql): keep plugin settings scope indexes within limits
* test(mysql): refresh reviewed plugin upgrade SQL
* fix(hosts): normalize imported jump host references (#1470)
* fix(hosts): normalize imported jump host references
* fix(ci): build plugin SDK before dependent checks
* fix(mysql): keep plugin settings scope indexes within limits
* test(mysql): refresh reviewed plugin upgrade SQL
* fix(ci): build plugin SDK and repair MySQL settings migration (#1471)
* fix(ci): build plugin SDK before dependent checks
* fix(mysql): keep plugin settings scope indexes within limits
* test(mysql): refresh reviewed plugin upgrade SQL
* fix(file-manager): keep inline rename consistent (#1476)
* fix(ci): build plugin SDK before dependent checks
* fix(mysql): keep plugin settings scope indexes within limits
* test(mysql): refresh reviewed plugin upgrade SQL
* fix(file-manager): keep inline rename consistent
* fix(dashboard): reuse translated host status labels (#1475)
* fix(ci): build plugin SDK before dependent checks
* fix(mysql): keep plugin settings scope indexes within limits
* test(mysql): refresh reviewed plugin upgrade SQL
* fix(dashboard): reuse translated host status labels
* docs(api): clarify local and remote version fields (#1474)
* fix(ci): build plugin SDK before dependent checks
* fix(mysql): keep plugin settings scope indexes within limits
* test(mysql): refresh reviewed plugin upgrade SQL
* docs(api): clarify local and remote version fields
* fix(file-manager): preserve selected backgrounds on hover (#1473)
* fix(ci): build plugin SDK before dependent checks
* fix(mysql): keep plugin settings scope indexes within limits
* test(mysql): refresh reviewed plugin upgrade SQL
* fix(file-manager): preserve selection feedback on hover
* test(ui): await dialog focus cleanup before teardown
* fix(file-manager): restore Ctrl/Cmd+F file search (#1472)
* fix(ci): build plugin SDK before dependent checks
* fix(mysql): keep plugin settings scope indexes within limits
* test(mysql): refresh reviewed plugin upgrade SQL
* fix(file-manager): focus file search with Ctrl or Cmd F
* fix: keep rounded-full circular in production builds
* fix(file-manager): cancel uploads and stop remote writes (#1477)
* fix(file-manager): cancel uploads and stop remote writes
* test(css): exercise the configured PostCSS plugin chain
* fix(file-manager): apply compact density to directory tree (#1478)
* fix(file-manager): apply compact density to directory tree
* test(css): exercise the configured PostCSS plugin chain
* fix(file-manager): preserve font sizes in compact mode (#1480)
* fix(file-manager): preserve font sizes in compact mode
* test(css): exercise the configured PostCSS plugin chain
* fix(file-manager): prioritize file names in narrow lists (#1483)
* fix(file-manager): prioritize file names in narrow lists
* test(css): exercise the configured PostCSS plugin chain
* test(identity): preserve full Ed25519 public keys in fixtures
* test(remote-desktop): always mutate ciphertext in tamper test
* fix(remote-desktop): probe the saved host guacd endpoint (#1481)
* fix(remote-desktop): probe the saved host guacd endpoint
* test(css): exercise the configured PostCSS plugin chain
* test(identity): preserve full Ed25519 public keys in fixtures
* fix(homepage): check allowlisted private service reachability (#1479)
* fix(homepage): check allowlisted private service reachability
* test(css): exercise the configured PostCSS plugin chain
* fix(remote-desktop): stop unsolicited clipboard read prompts (#1482)
* fix(remote-desktop): read clipboard only on explicit paste
* test(css): exercise the configured PostCSS plugin chain
* test(identity): preserve full Ed25519 public keys in fixtures
* test(remote-desktop): always mutate ciphertext in tamper test
* chore: simplify plugin readmes, changelogs and manifest descriptions
* fix: keep plugins loaded after signing in from the login screen
* fix(file-manager): accept OS file drops over existing rows (#1484)
* fix(file-manager): accept OS file drops over existing rows
* test(file-manager): target the file label in drop tests
* test(css): exercise the configured PostCSS plugin chain
* test(identity): preserve full Ed25519 public keys in fixtures
* test(remote-desktop): always mutate ciphertext in tamper test
* fix(file-manager): pipeline SFTP download reads (#1485)
* feat: add plugin sdk build to beta release
* fix: make link-store secret check immune to random base64 matches
* fix(ldap): preserve the directory-provided bind DN (#1486)
* fix: compute beta changes across dev branches and move the beta tag
* chore: untrack plugin sdk ARCHITECTURE.md
* chore: remove references to plugin sdk ARCHITECTURE.md
* feat: merge host editor terminal tabs into one owned by ssh-terminal
* feat: add descriptions to plugin host enable toggles
* fix(file-manager): show download progress in file viewers (#1487)
* fix(electron): signal backend readiness over IPC (#1488)
* fix(split-screen): allow layout creation without randomUUID (#1490)
* fix(split-screen): allow layout creation without randomUUID
* test(credentials): avoid flaky Ed25519 key generation
* fix(sidebar): remeasure visible rows after density changes (#1489)
* fix(sidebar): remeasure visible rows after density changes
* test(credentials): avoid flaky Ed25519 key generation
* feat(split-screen): redesign split screen with free-form panes and pane picker
* feat(sidebar): add host click behavior setting, default to always opening a new tab
* feat(snippets): redesign panel to match the host list
* fix(session-recording): stop session logs panel from refetching in a loop
* feat(snippets): bring back sharing, target hosts and drag reorder
* feat(ssh-terminal): add toolbar position, start state, display and fade host settings
* feat(ssh-terminal): add host setting to turn off password prompt auto-fill
* fix(ai): stop streams getting cut off and keep tool steps across messages
* feat: improve quick connect system using plugin api
* fix: proxmox guest sync, startup snippet sync, drop dead cloudflare ssh transport
* feat: move terminal settings, look and ssh tools into ssh-terminal plugin
* feat: move snippets, keybinding actions and macros out of core into plugins
* feat: store rdp, vnc and telnet logins in a generic per-protocol table
* feat: type the plugin host record, move plugin strings out of core and add lint checks
* feat: replace core homepage widget registry with generic extension points
* feat: plugins only see their own host settings in the browser
* feat: harden plugin api for separate repos, signed updates and generic external login
* fix: keep plugin css below core utilities and version plugin assets by their css
* fix: load and save plugin host settings in the editor and tighten settings row spacing
* feat: redesign user host defaults system
* fix(remote-desktop): release held keys on focus loss (#1498)
* fix(session-sharing): replace local presentation after takeover (#1500)
* fix(file-manager): refresh disk usage with directory listing (#1503)
* fix(ssh-terminal): preserve input order during local echo reconciliation (#1505)
* feat(remote-desktop): expose display zoom controls for RDP (#1514)
* fix(file-manager): restore text selection and copying in Markdown previews (#1518)
* fix(sidebar): keep compact host addresses visible (#1524)
* fix(hosts): preserve plugin settings when reopening the editor (#1499)
* fix(ssh-terminal): close owner sockets when presentations unmount (#1501)
* fix(session-sharing): synchronize shared SSH terminal dimensions (#1502)
* fix(session-sharing): show participant presence in member terminals (#1504)
* fix(ai): sync provider configuration and keys across linked devices (#1506)
* feat(ssh-terminal): add a duplicate tab action (#1510)
* feat(file-manager): allow disabling move-to-trash confirmation (#1511)
* feat(file-manager): default to the remote login directory (#1512)
* feat(homepage): synchronize canvas layouts across devices (#1515)
* fix(shortcuts): prevent accidental double-Shift palette activation (#1519)
* feat(tmux-monitor): add a unified multi-host view (#1520)
* fix(electron): allow explicit quit with active connections (#1522)
* feat: reconnect all disconnected terminal tabs (#1523)
* fix(hosts): preserve recording and sharing settings in the dev editor (#1509)
* fix(database): preserve RDP domain during startup backfill (#1497)
* feat(sidebar): add keyboard type-ahead search for hosts (#1516)
* feat(automations): add per-host maintenance mode and recurring schedules (#1521)
* feat(tmux): add a per-host mouse toggle and preserve remote configuration (#1513)
* fix(session-sharing): use the linked server for desktop meetings and links (#1507)
* fix(tunnels): support TOTP for client tunnels and jump hosts (#1508)
* fix: type errors and lint failures from merged plugin prs
* feat(installer): make the Windows desktop shortcut optional (#1517)
* fix: ship the plugin sdk and serialport in desktop builds
* fix: prefer ipv4 when resolving ssh host names (#1365)
* fix: readable terminal selection with the light theme (#1319)
* fix: build desktop session share links on the linked server (#1350)
* fix: show meeting guests to members and hide the roster from guests (#1353)
* fix: reliable file manager saves with sudo prompt and no base64 guessing (#1335)
* fix: show disk usage for the mount being browsed (#1347)
* fix: load the linux tray icon reliably and log tray failures (#1332)
* fix: cover the gnome close path in the desktop quit test (#1332)
* fix: prompt for jump host TOTP in terminal, file manager and metrics (#1312)
* feat: optional auto reconnect for dropped ssh sessions (#1321)
* feat: tighter compact host rows with inline tags (#1325)
* feat: bring back the alert feed homepage widget
* feat: pick target terminals for snippets again
* feat: share button on connection tabs again
* feat: recent servers list when linking the desktop app
* feat: list the fixed app shortcuts in keyboard shortcuts
* fix: translate hardcoded toasts and drop em dashes from ui text
* fix: translate leftover hardcoded ui text
* fix: toolbar files button opens at the shell directory again
* fix: show the remote desktop note under connection origin again
* chore: openapi docs for host metrics manager routes
* chore: openapi docs for undocumented routes and fix two broken doc blocks
* fix: declare terminal.listSessions use for snippet targets
* revert: drop the alert feed widget, the notification center replaces it
* feat: restore the alert feed homepage widget
* fix: quick connect fills the host address from plugin auth editors like tailscale
* fix: docker container logs use the base background color
* chore: fix dependabot alerts and apply safe npm upgrades
* fix: proxmox stats tab reads its switch from plugin host settings
* fix: count plugin ssh logins toward host status and stop showing reachable as a warning
* fix: hide the built-in source pill in the host editor
* fix: host status shows online when the port answers and only warns on a failed login
* fix: drop the top border on the split layout menu
* fix: host defaults tabs sit where the host editor puts them and skip plugins with nothing to default
* fix: remote desktop auth method labels and notes for vnc and telnet
* fix: add description to the web endpoint enable switch
* fix: crowdin sync and pretranslate for plugin locales, run plugin tests on release
* feat: move telemetry out of core into a usage statistics plugin
* fix: recent activity card no longer cuts off host names early
* fix: remove duplicate top border on split screen menu
* fix: redesign session log player controls, fix tooltip overlap and drop dot separators
* fix: file manager and sftp text showing raw i18n keys
* fix: onboarding rerunning for existing users after upgrading
* fix: fleet detail buttons overflowing the sidebar
* fix: session log player scrolling off screen horizontally
* fix: network graph lag when adding hosts and on every render
* fix: maintenance index name, shared host read only view and badge polling
* fix: meeting tabs, workspace tab merging, rail panels as tabs and general ui lag
* chore: update release notes
* fix: remote desktop tabs reconnecting on every tab switch
* fix: build plugin sdk before linting in release workflow
* chore: lint, format, and bump version to 2.9.0
* chore: skip crowdin pre-translate in release for now
* chore: sync Crowdin translations for 2.9.0
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Koi <38512047+datlt4@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com>
This commit is contained in:
4405 files changed
+1341026
-289722
No files matched your search
@@ -0,0 +1,7 @@
|
||||
# Changelog
|
||||
|
||||
## 1.0.0
|
||||
|
||||
First release, bundled with Termix 2.9.0.
|
||||
|
||||
Fetches host passwords and keys from 1Password when you connect, using op:// references, so they are not stored in Termix.
|
||||
@@ -0,0 +1,23 @@
|
||||
# Secret Sources
|
||||
|
||||
Fetch host secrets from 1Password when you connect instead of storing them in Termix.
|
||||
|
||||
## Features
|
||||
|
||||
- Connect a 1Password Connect server as a secret source.
|
||||
- Use `op://` references in a host's password or key fields instead of the secret itself.
|
||||
- Secrets are fetched each time you connect and are not stored in Termix.
|
||||
|
||||
## Settings
|
||||
|
||||
### Admin
|
||||
|
||||
- Private endpoint allowlist: private or loopback hosts a secret source may reach, one per line. A self-hosted 1Password Connect server usually needs its address listed here.
|
||||
|
||||
## Development
|
||||
|
||||
```bash
|
||||
npm run build # build into dist/
|
||||
npm run test # run this plugin's tests
|
||||
npm run typecheck # type-check this plugin
|
||||
```
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "You can paste a 1Password reference (op://vault/item/field) instead of the secret. It is fetched from your secret source when connecting.",
|
||||
"manage": "Manage secret sources",
|
||||
"title": "Secret sources",
|
||||
"description": "External password managers Termix reads secrets from at connect time. Currently 1Password Connect (self-hosted). The access token is stored encrypted with your data key.",
|
||||
"new": "New source",
|
||||
"nameLabel": "Friendly name",
|
||||
"urlLabel": "Connect server URL",
|
||||
"tokenLabel": "Connect access token",
|
||||
"tokenKeep": "Leave empty to keep the current token",
|
||||
"sharedLabel": "Share with all users (admins only, resolves while you are signed in)",
|
||||
"shared": "shared",
|
||||
"test": "Test",
|
||||
"testOk": "Connected, {{count}} vault(s) visible",
|
||||
"testFailed": "Connection test failed",
|
||||
"required": "Name, server URL and token are required",
|
||||
"saved": "Secret source saved",
|
||||
"deleted": "Secret source deleted",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Private endpoint allowlist",
|
||||
"description": "Private or loopback hosts a secret source may reach, one per line. A self-hosted 1Password Connect server usually needs its own address listed here."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "Jy kan 'n 1Password-verwysing (op://vault/item/field) in plaas van die geheim plak. Dit word van jou geheime bron afgehaal wanneer jy koppel.",
|
||||
"manage": "Bestuur geheime bronne",
|
||||
"title": "Geheime bronne",
|
||||
"description": "Eksterne wagwoordbestuurders Termix lees geheime vanaf wanneer dit verbind word. Tans 1Password Connect (selfgehuisves). Die toegangstoken word geïnkripteer met jou datasleutel gestoor.",
|
||||
"new": "Nuwe bron",
|
||||
"nameLabel": "Vriendelike naam",
|
||||
"urlLabel": "Koppel bediener URL",
|
||||
"tokenLabel": "Koppel toegangstoken",
|
||||
"tokenKeep": "Los leeg om die huidige teken te behou",
|
||||
"sharedLabel": "Deel met alle gebruikers (slegs administrateurs, word opgelos terwyl jy aangemeld is)",
|
||||
"shared": "gedeel",
|
||||
"test": "Toets",
|
||||
"testOk": "Gekoppel, {{count}} kluis(se) sigbaar",
|
||||
"testFailed": "Verbindingstoets het misluk",
|
||||
"required": "Naam, bediener-URL en token word vereis",
|
||||
"saved": "Geheime bron gestoor",
|
||||
"deleted": "Geheime bron verwyder",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Privaat eindpunt-toelaatlys",
|
||||
"description": "Privaat of teruglusgashere wat 'n geheime bron mag bereik, een per lyn. 'n Selfgehosteerde 1Password Connect-bediener benodig gewoonlik sy eie adres wat hier gelys word."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "يمكنك لصق مرجع 1Password (op://vault/item/field) بدلاً من كلمة المرور السرية. يتم جلبها من مصدر كلمة المرور السرية عند الاتصال.",
|
||||
"manage": "إدارة المصادر السرية",
|
||||
"title": "مصادر سرية",
|
||||
"description": "يقرأ برنامج إدارة كلمات المرور الخارجي Termix البيانات السرية عند الاتصال. حاليًا، نستخدم 1Password Connect (مُستضاف ذاتيًا). يتم تخزين رمز الوصول مُشفّرًا باستخدام مفتاح البيانات الخاص بك.",
|
||||
"new": "مصدر جديد",
|
||||
"nameLabel": "اسم ودود",
|
||||
"urlLabel": "عنوان URL لخادم الاتصال",
|
||||
"tokenLabel": "رمز الوصول للاتصال",
|
||||
"tokenKeep": "اتركه فارغًا للاحتفاظ بالرمز المميز الحالي",
|
||||
"sharedLabel": "مشاركة مع جميع المستخدمين (للمسؤولين فقط، يتم حل المشكلة أثناء تسجيل دخولك)",
|
||||
"shared": "مشترك",
|
||||
"test": "اختبار",
|
||||
"testOk": "متصل، {{count}} الخزائن مرئية",
|
||||
"testFailed": "فشل اختبار الاتصال",
|
||||
"required": "الاسم وعنوان URL للخادم والرمز المميز مطلوبة",
|
||||
"saved": "تم حفظ المصدر السري",
|
||||
"deleted": "تم حذف المصدر السري",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "قائمة السماح لنقاط النهاية الخاصة",
|
||||
"description": "قد يصل مصدر سري إلى مضيفات خاصة أو مضيفات ذات اتصال داخلي، واحد لكل سطر. عادةً ما يحتاج خادم 1Password Connect المستضاف ذاتيًا إلى عنوانه الخاص المدرج هنا."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "Можете да поставите препратка към 1Password (op://vault/item/field) вместо тайната. Тя се извлича от вашия източник на тайна при свързване.",
|
||||
"manage": "Управлявайте тайните източници",
|
||||
"title": "Тайни източници",
|
||||
"description": "Външни мениджъри на пароли Termix четат тайни по време на свързване. В момента 1Password Connect (самостоятелно хостван). Токенът за достъп се съхранява криптиран с вашия ключ за данни.",
|
||||
"new": "Нов източник",
|
||||
"nameLabel": "Приятелско име",
|
||||
"urlLabel": "URL адрес на сървъра за свързване",
|
||||
"tokenLabel": "Свързване на токен за достъп",
|
||||
"tokenKeep": "Оставете празно, за да запазите текущия токен",
|
||||
"sharedLabel": "Споделяне с всички потребители (само за администратори, разрешава се, докато сте влезли)",
|
||||
"shared": "споделено",
|
||||
"test": "Тест",
|
||||
"testOk": "Свързано, {{count}} видими трезори",
|
||||
"testFailed": "Тестът за връзка не бе успешен",
|
||||
"required": "Име, URL адрес на сървъра и токен са задължителни",
|
||||
"saved": "Секретният източник е запазен",
|
||||
"deleted": "Секретният източник е изтрит",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Списък с разрешени частни крайни точки",
|
||||
"description": "Частни или loopback хостове, до които може да достигне таен източник, по един на ред. Самостоятелно хостван 1Password Connect сървър обикновено се нуждае от собствен адрес, посочен тук."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "You can paste a 1Password reference (op://vault/item/field) instead of the secret. It is fetched from your secret source when connecting.",
|
||||
"manage": "Manage secret sources",
|
||||
"title": "Secret sources",
|
||||
"description": "External password managers Termix reads secrets from at connect time. Currently 1Password Connect (self-hosted). The access token is stored encrypted with your data key.",
|
||||
"new": "New source",
|
||||
"nameLabel": "Friendly name",
|
||||
"urlLabel": "Connect server URL",
|
||||
"tokenLabel": "Connect access token",
|
||||
"tokenKeep": "Leave empty to keep the current token",
|
||||
"sharedLabel": "Share with all users (admins only, resolves while you are signed in)",
|
||||
"shared": "ভাগ করা হয়েছে",
|
||||
"test": "Test",
|
||||
"testOk": "Connected, {{count}} vault(s) visible",
|
||||
"testFailed": "Connection test failed",
|
||||
"required": "Name, server URL and token are required",
|
||||
"saved": "Secret source saved",
|
||||
"deleted": "Secret source deleted",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Private endpoint allowlist",
|
||||
"description": "Private or loopback hosts a secret source may reach, one per line. A self-hosted 1Password Connect server usually needs its own address listed here."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "Podeu enganxar una referència 1Password (op://vault/item/field) en comptes del secret. S'obté de la font del secret quan us connecteu.",
|
||||
"manage": "Gestiona fonts secretes",
|
||||
"title": "Fonts secretes",
|
||||
"description": "Els gestors de contrasenyes externes Termix llegeixen els secrets en el moment de la connexió. Actualment 1Password Connect (autoallotjat). El testimoni d'accés s'emmagatzema xifrat amb la vostra clau de dades.",
|
||||
"new": "Nova font",
|
||||
"nameLabel": "Nom amigable",
|
||||
"urlLabel": "URL de connexió del servidor",
|
||||
"tokenLabel": "Connecta el testimoni d'accés",
|
||||
"tokenKeep": "Deixeu-ho en blanc per mantenir el testimoni actual",
|
||||
"sharedLabel": "Comparteix amb tots els usuaris (només administradors, resol mentre tens la sessió iniciada)",
|
||||
"shared": "compartit",
|
||||
"test": "Prova",
|
||||
"testOk": "Connectat, {{count}} volta(es) visible(s)",
|
||||
"testFailed": "La prova de connexió ha fallat",
|
||||
"required": "El nom, l'URL del servidor i el testimoni són obligatoris",
|
||||
"saved": "Font secreta desada",
|
||||
"deleted": "Font secreta suprimida",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Llista permesa de punts finals privats",
|
||||
"description": "Amfitrions privats o de bucle que una font secreta pot assolir, un per línia. Un servidor 1Password Connect autoallotjat normalment necessita la seva pròpia adreça llistada aquí."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "Místo tajného hesla můžete vložit odkaz na heslo 1Password (op://vault/item/field). Ten se načte ze zdroje vašeho tajného hesla při připojování.",
|
||||
"manage": "Správa tajných zdrojů",
|
||||
"title": "Tajné zdroje",
|
||||
"description": "Externí správci hesel Termix čte tajné hesla v době připojení. Aktuálně 1Password Connect (samostatně hostovaný). Přístupový token je uložen zašifrovaný s vaším datovým klíčem.",
|
||||
"new": "Nový zdroj",
|
||||
"nameLabel": "Přátelský název",
|
||||
"urlLabel": "URL adresa serveru pro připojení",
|
||||
"tokenLabel": "Připojit přístupový token",
|
||||
"tokenKeep": "Pro zachování aktuálního tokenu ponechte prázdné.",
|
||||
"sharedLabel": "Sdílet se všemi uživateli (pouze pro administrátory, řeší se, když jste přihlášeni)",
|
||||
"shared": "sdílené",
|
||||
"test": "Test",
|
||||
"testOk": "Připojeno, viditelné {{count}} úložiště",
|
||||
"testFailed": "Test připojení selhal",
|
||||
"required": "Jméno, URL adresa serveru a token jsou povinné",
|
||||
"saved": "Tajný zdroj uložen",
|
||||
"deleted": "Tajný zdroj smazán",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Seznam povolených soukromých koncových bodů",
|
||||
"description": "Soukromé nebo zpětně loopbackové hostitele, na které může tajný zdroj dosáhnout, jeden na řádek. Samostatně hostovaný server 1Password Connect zde obvykle potřebuje uvedenou vlastní adresu."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "Du kan indsætte en 1Password-reference (op://vault/item/field) i stedet for hemmeligheden. Den hentes fra din hemmelige kilde, når du opretter forbindelse.",
|
||||
"manage": "Administrer hemmelige kilder",
|
||||
"title": "Hemmelige kilder",
|
||||
"description": "Eksterne adgangskodeadministratorer. Termix læser hemmeligheder fra ved tilslutning. I øjeblikket 1Password Connect (selvhostet). Adgangstokenet gemmes krypteret med din datanøgle.",
|
||||
"new": "Ny kilde",
|
||||
"nameLabel": "Venligt navn",
|
||||
"urlLabel": "URL til forbindelsesserver",
|
||||
"tokenLabel": "Forbind adgangstoken",
|
||||
"tokenKeep": "Lad feltet stå tomt for at beholde det aktuelle token",
|
||||
"sharedLabel": "Del med alle brugere (kun administratorer, løses mens du er logget ind)",
|
||||
"shared": "delt",
|
||||
"test": "Prøve",
|
||||
"testOk": "Forbundet, {{count}} boks(e) synlig(e)",
|
||||
"testFailed": "Forbindelsestest mislykkedes",
|
||||
"required": "Navn, server-URL og token er påkrævet",
|
||||
"saved": "Hemmelig kilde gemt",
|
||||
"deleted": "Hemmelig kilde slettet",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Tilladelsesliste for privat slutpunkt",
|
||||
"description": "Private eller loopback-værter, som en hemmelig kilde kan nå, én pr. linje. En selvhostet 1Password Connect-server skal normalt have sin egen adresse angivet her."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "Sie können anstelle des Geheimnisses eine 1Password-Referenz (op://vault/item/field) einfügen. Diese wird beim Verbindungsaufbau aus Ihrer Geheimnisquelle abgerufen.",
|
||||
"manage": "Geheime Quellen verwalten",
|
||||
"title": "Geheime Quellen",
|
||||
"description": "Externe Passwortmanager wie Termix lesen die Geheimnisse beim Verbindungsaufbau. Aktuell wird 1Password Connect (selbst gehostet) verwendet. Das Zugriffstoken wird mit Ihrem Datenschlüssel verschlüsselt gespeichert.",
|
||||
"new": "Neue Quelle",
|
||||
"nameLabel": "Freundlicher Name",
|
||||
"urlLabel": "Verbindungsserver-URL",
|
||||
"tokenLabel": "Zugriffstoken verbinden",
|
||||
"tokenKeep": "Lassen Sie dieses Feld leer, um das aktuelle Token beizubehalten.",
|
||||
"sharedLabel": "Mit allen Benutzern teilen (nur für Administratoren, wird ausgeführt, solange Sie angemeldet sind)",
|
||||
"shared": "geteilt",
|
||||
"test": "Test",
|
||||
"testOk": "Verbunden, {{count}} Tresor(e) sichtbar",
|
||||
"testFailed": "Verbindungstest fehlgeschlagen",
|
||||
"required": "Name, Server-URL und Token werden benötigt.",
|
||||
"saved": "Geheime Quelle gerettet",
|
||||
"deleted": "Geheime Quelle gelöscht",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Zulassungsliste für private Endpunkte",
|
||||
"description": "Private oder Loopback-Hosts, die eine geheime Quelle erreichen kann, jeweils einer pro Zeile. Ein selbst gehosteter 1Password Connect-Server benötigt in der Regel eine eigene Adresse, die hier aufgeführt wird."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "Μπορείτε να επικολλήσετε μια αναφορά 1Password (op://vault/item/field) αντί για το μυστικό. Λαμβάνεται από την μυστική σας πηγή κατά τη σύνδεση.",
|
||||
"manage": "Διαχείριση μυστικών πηγών",
|
||||
"title": "Μυστικές πηγές",
|
||||
"description": "Οι εξωτερικοί διαχειριστές κωδικών πρόσβασης Termix διαβάζουν μυστικά κατά τη στιγμή της σύνδεσης. Προς το παρόν 1Password Connect (αυτοφιλοξενείται). Το διακριτικό πρόσβασης αποθηκεύεται κρυπτογραφημένο με το κλειδί δεδομένων σας.",
|
||||
"new": "Νέα πηγή",
|
||||
"nameLabel": "Φιλικό όνομα",
|
||||
"urlLabel": "Σύνδεση URL διακομιστή",
|
||||
"tokenLabel": "Σύνδεση διακριτικού πρόσβασης",
|
||||
"tokenKeep": "Αφήστε κενό για να διατηρήσετε το τρέχον διακριτικό",
|
||||
"sharedLabel": "Κοινή χρήση με όλους τους χρήστες (μόνο για διαχειριστές, επιλύεται ενώ είστε συνδεδεμένοι)",
|
||||
"shared": "κοινόχρηστο",
|
||||
"test": "Δοκιμή",
|
||||
"testOk": "Συνδεδεμένο, {{count}} ορατό(α) θησαυροφυλάκιο(α)",
|
||||
"testFailed": "Η δοκιμή σύνδεσης απέτυχε.",
|
||||
"required": "Απαιτούνται όνομα, διεύθυνση URL διακομιστή και διακριτικό",
|
||||
"saved": "Η μυστική πηγή αποθηκεύτηκε",
|
||||
"deleted": "Η μυστική πηγή διαγράφηκε",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Λίστα επιτρεπόμενων ιδιωτικών τελικών σημείων",
|
||||
"description": "Ιδιωτικοί ή loopback hosts στους οποίους μπορεί να φτάσει μια μυστική πηγή, ένας ανά γραμμή. Ένας αυτοφιλοξενούμενος διακομιστής 1Password Connect συνήθως χρειάζεται τη δική του διεύθυνση να αναφέρεται εδώ."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "Puedes pegar una referencia de 1Password (op://vault/item/field) en lugar de la clave secreta. Esta se obtiene de tu fuente de claves secretas al conectarte.",
|
||||
"manage": "Gestionar fuentes secretas",
|
||||
"title": "Fuentes secretas",
|
||||
"description": "Termix lee los secretos de los gestores de contraseñas externos al conectarse. Actualmente, utiliza 1Password Connect (autoalojado). El token de acceso se almacena cifrado con su clave de datos.",
|
||||
"new": "Nueva fuente",
|
||||
"nameLabel": "Nombre amistoso",
|
||||
"urlLabel": "URL del servidor de conexión",
|
||||
"tokenLabel": "Token de acceso de Connect",
|
||||
"tokenKeep": "Déjelo vacío para conservar el token actual.",
|
||||
"sharedLabel": "Compartir con todos los usuarios (solo administradores, se resuelve mientras estés conectado).",
|
||||
"shared": "compartido",
|
||||
"test": "Probar",
|
||||
"testOk": "Conectado(s), {{count}} bóveda(s) visible(s)",
|
||||
"testFailed": "La prueba de conexión falló.",
|
||||
"required": "Se requieren nombre, URL del servidor y token.",
|
||||
"saved": "Fuente secreta guardada",
|
||||
"deleted": "Fuente secreta eliminada",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Lista de permitidos de puntos finales privados",
|
||||
"description": "Hosts privados o de bucle invertido a los que puede acceder una fuente secreta, uno por línea. Un servidor 1Password Connect autohospedado generalmente necesita su propia dirección IP que aparezca aquí."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "Voit liittää 1Password-viitteen (op://vault/item/field) salaisuuden sijaan. Se noudetaan salaisuuden lähteestäsi yhteyden muodostamisen yhteydessä.",
|
||||
"manage": "Hallitse salaisia lähteitä",
|
||||
"title": "Salaiset lähteet",
|
||||
"description": "Ulkoiset salasananhallintaohjelmat Termix lukevat salaisuudet yhteyden muodostamisen yhteydessä. Tällä hetkellä käytössä on 1Password Connect (itse isännöity). Käyttöoikeustunnus tallennetaan salattuna dataavaimellasi.",
|
||||
"new": "Uusi lähde",
|
||||
"nameLabel": "Ystävällinen nimi",
|
||||
"urlLabel": "Yhdistä palvelimen URL-osoite",
|
||||
"tokenLabel": "Yhdistä käyttöoikeustunnus",
|
||||
"tokenKeep": "Jätä tyhjäksi säilyttääksesi nykyisen tunnuksen",
|
||||
"sharedLabel": "Jaa kaikkien käyttäjien kanssa (vain järjestelmänvalvojille, ratkeaa, kun olet kirjautuneena sisään)",
|
||||
"shared": "jaettu",
|
||||
"test": "Testata",
|
||||
"testOk": "Yhdistetty, {{count}} holvia näkyvissä",
|
||||
"testFailed": "Yhteystesti epäonnistui",
|
||||
"required": "Nimi, palvelimen URL-osoite ja tunnus vaaditaan",
|
||||
"saved": "Salainen lähde tallennettu",
|
||||
"deleted": "Salainen lähde poistettu",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Yksityisten päätepisteiden sallittujen luettelo",
|
||||
"description": "Yksityiset tai loopback-isännät, joihin salainen lähde voi tavoittaa, yksi riviä kohden. Itse isännöity 1Password Connect -palvelin tarvitsee yleensä oman osoitteensa, joka luetellaan tässä."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "Vous pouvez coller une référence 1Password (op://vault/item/field) à la place du mot de passe. Elle sera récupérée depuis votre source de mots de passe lors de la connexion.",
|
||||
"manage": "Gérer les sources secrètes",
|
||||
"title": "Sources secrètes",
|
||||
"description": "Termix utilise des gestionnaires de mots de passe externes pour lire les secrets lors de la connexion. Actuellement, il s'agit de 1Password Connect (hébergé sur place). Le jeton d'accès est stocké chiffré avec votre clé de données.",
|
||||
"new": "Nouvelle source",
|
||||
"nameLabel": "Nom amical",
|
||||
"urlLabel": "URL du serveur de connexion",
|
||||
"tokenLabel": "Jeton d'accès Connect",
|
||||
"tokenKeep": "Laissez vide pour conserver le jeton actuel",
|
||||
"sharedLabel": "Partager avec tous les utilisateurs (administrateurs uniquement, résolution effectuée lorsque vous êtes connecté)",
|
||||
"shared": "partagé",
|
||||
"test": "Tester",
|
||||
"testOk": "Connecté, {{count}} coffre(s) visible(s)",
|
||||
"testFailed": "Le test de connexion a échoué.",
|
||||
"required": "Le nom, l'URL du serveur et le jeton sont requis.",
|
||||
"saved": "Source secrète sauvegardée",
|
||||
"deleted": "Source secrète supprimée",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "liste blanche des points de terminaison privés",
|
||||
"description": "Hôtes privés ou de bouclage auxquels une source secrète peut accéder, un par ligne. Un serveur 1Password Connect auto-hébergé nécessite généralement sa propre adresse indiquée ici."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "ניתן להדביק הפניה ל-1Password (op://vault/item/field) במקום הסוד. היא נלקחת ממקור הסוד שלך בעת ההתחברות.",
|
||||
"manage": "ניהול מקורות סודיים",
|
||||
"title": "מקורות סודיים",
|
||||
"description": "מנהלי סיסמאות חיצוניים של Termix קוראים סודות מ- בזמן ההתחברות. נכון לעכשיו, 1Password Connect (מארח עצמי). אסימון הגישה מאוחסן מוצפן עם מפתח הנתונים שלך.",
|
||||
"new": "מקור חדש",
|
||||
"nameLabel": "שם ידידותי",
|
||||
"urlLabel": "כתובת URL של שרת התחברות",
|
||||
"tokenLabel": "אסימון גישה להתחברות",
|
||||
"tokenKeep": "השאר ריק כדי לשמור את האסימון הנוכחי",
|
||||
"sharedLabel": "שתף עם כל המשתמשים (מנהלים בלבד, נפתר בזמן שאתה מחובר)",
|
||||
"shared": "מְשׁוּתָף",
|
||||
"test": "מִבְחָן",
|
||||
"testOk": "מחובר, כספת/ות {{count}} גלויה/יות",
|
||||
"testFailed": "בדיקת החיבור נכשלה",
|
||||
"required": "נדרשים שם, כתובת URL של השרת וטופס",
|
||||
"saved": "מקור סודי נשמר",
|
||||
"deleted": "מקור סודי נמחק",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "רשימת היתרים לנקודות קצה פרטיות",
|
||||
"description": "מארחים פרטיים או לולאה-חוזרים אליהם מקור סודי עשוי להגיע, אחד בכל שורה. שרת 1Password Connect המתארח באופן עצמאי זקוק בדרך כלל לכתובת משלו הרשומה כאן."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "You can paste a 1Password reference (op://vault/item/field) instead of the secret. It is fetched from your secret source when connecting.",
|
||||
"manage": "Manage secret sources",
|
||||
"title": "Secret sources",
|
||||
"description": "External password managers Termix reads secrets from at connect time. Currently 1Password Connect (self-hosted). The access token is stored encrypted with your data key.",
|
||||
"new": "New source",
|
||||
"nameLabel": "Friendly name",
|
||||
"urlLabel": "Connect server URL",
|
||||
"tokenLabel": "Connect access token",
|
||||
"tokenKeep": "Leave empty to keep the current token",
|
||||
"sharedLabel": "Share with all users (admins only, resolves while you are signed in)",
|
||||
"shared": "साझा",
|
||||
"test": "परीक्षण",
|
||||
"testOk": "Connected, {{count}} vault(s) visible",
|
||||
"testFailed": "Connection test failed",
|
||||
"required": "Name, server URL and token are required",
|
||||
"saved": "Secret source saved",
|
||||
"deleted": "Secret source deleted",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Private endpoint allowlist",
|
||||
"description": "Private or loopback hosts a secret source may reach, one per line. A self-hosted 1Password Connect server usually needs its own address listed here."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "A titkos kód helyett beilleszthetsz egy 1Password hivatkozást (op://vault/item/field). A titkos kód a csatlakozáskor a forrásból lesz lekérve.",
|
||||
"manage": "Titkos források kezelése",
|
||||
"title": "Titkos források",
|
||||
"description": "Külső jelszókezelők: A Termix a csatlakozáskor olvassa be a titkos kódokat. Jelenleg az 1Password Connect (saját tárhelyen). A hozzáférési token titkosítva tárolódik az adatkulccsal.",
|
||||
"new": "Új forrás",
|
||||
"nameLabel": "Barátságos név",
|
||||
"urlLabel": "Kapcsolódási szerver URL-címe",
|
||||
"tokenLabel": "Hozzáférési token csatlakoztatása",
|
||||
"tokenKeep": "Hagyja üresen az aktuális token megtartásához",
|
||||
"sharedLabel": "Megosztás az összes felhasználóval (csak rendszergazdák, bejelentkezés után oldódik meg)",
|
||||
"shared": "megosztott",
|
||||
"test": "Teszt",
|
||||
"testOk": "Csatlakoztatva, {{count}} trezor látható",
|
||||
"testFailed": "A kapcsolat tesztje sikertelen",
|
||||
"required": "Név, szerver URL és token megadása kötelező",
|
||||
"saved": "Titkos forrás mentve",
|
||||
"deleted": "Titkos forrás törölve",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Privát végpontok engedélyezőlistája",
|
||||
"description": "Privát vagy visszacsatolásos hosztok, amelyeket egy titkos forrás elérhet, soronként egy. Egy saját hosztolt 1Password Connect szervernek általában saját címre van szüksége, amely itt szerepel."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "You can paste a 1Password reference (op://vault/item/field) instead of the secret. It is fetched from your secret source when connecting.",
|
||||
"manage": "Manage secret sources",
|
||||
"title": "Secret sources",
|
||||
"description": "External password managers Termix reads secrets from at connect time. Currently 1Password Connect (self-hosted). The access token is stored encrypted with your data key.",
|
||||
"new": "New source",
|
||||
"nameLabel": "Friendly name",
|
||||
"urlLabel": "Connect server URL",
|
||||
"tokenLabel": "Connect access token",
|
||||
"tokenKeep": "Leave empty to keep the current token",
|
||||
"sharedLabel": "Share with all users (admins only, resolves while you are signed in)",
|
||||
"shared": "dibagikan",
|
||||
"test": "Test",
|
||||
"testOk": "Connected, {{count}} vault(s) visible",
|
||||
"testFailed": "Connection test failed",
|
||||
"required": "Name, server URL and token are required",
|
||||
"saved": "Secret source saved",
|
||||
"deleted": "Secret source deleted",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Private endpoint allowlist",
|
||||
"description": "Private or loopback hosts a secret source may reach, one per line. A self-hosted 1Password Connect server usually needs its own address listed here."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "Al posto del segreto, puoi incollare un riferimento a 1Password (op://vault/item/field). Questo verrà recuperato dalla tua fonte di segreti al momento della connessione.",
|
||||
"manage": "Gestire le fonti segrete",
|
||||
"title": "Fonti segrete",
|
||||
"description": "I gestori di password esterni Termix leggono le credenziali al momento della connessione. Attualmente, 1Password Connect (self-hosted) è il gestore di password esterno. Il token di accesso viene memorizzato crittografato insieme alla chiave dati.",
|
||||
"new": "Nuova fonte",
|
||||
"nameLabel": "Nome amichevole",
|
||||
"urlLabel": "URL del server di connessione",
|
||||
"tokenLabel": "Connetti il token di accesso",
|
||||
"tokenKeep": "Lascia vuoto per mantenere il token corrente",
|
||||
"sharedLabel": "Condividi con tutti gli utenti (solo amministratori, la modifica si applica solo se si è connessi)",
|
||||
"shared": "condiviso",
|
||||
"test": "Test",
|
||||
"testOk": "Connesso, {{count}} caveau visibile(i)",
|
||||
"testFailed": "Test di connessione fallito",
|
||||
"required": "Sono richiesti nome, URL del server e token.",
|
||||
"saved": "fonte segreta salvata",
|
||||
"deleted": "Fonte segreta eliminata",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Lista di endpoint privati consentiti",
|
||||
"description": "Host privati o di loopback raggiungibili da una fonte segreta, uno per riga. Un server 1Password Connect self-hosted di solito necessita di un proprio indirizzo elencato qui."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "シークレットの代わりに、1Passwordの参照（op://vault/item/field）を貼り付けることができます。これは接続時にシークレットソースから取得されます。",
|
||||
"manage": "秘密情報源の管理",
|
||||
"title": "秘密の情報源",
|
||||
"description": "Termixは、接続時に外部パスワードマネージャーから秘密情報を読み取ります。現在、1Password Connect（セルフホスト型）に対応しています。アクセストークンは、お客様のデータキーで暗号化されて保存されます。",
|
||||
"new": "新しい情報源",
|
||||
"nameLabel": "親しみやすい名前",
|
||||
"urlLabel": "接続サーバーURL",
|
||||
"tokenLabel": "接続アクセストークン",
|
||||
"tokenKeep": "現在のトークンを保持するには空欄のままにしてください。",
|
||||
"sharedLabel": "すべてのユーザーと共有（管理者のみ、ログイン中に解決されます）",
|
||||
"shared": "共有",
|
||||
"test": "テスト",
|
||||
"testOk": "接続済み、 {{count}} 個の保管庫が表示されています",
|
||||
"testFailed": "接続テストに失敗しました",
|
||||
"required": "名前、サーバーURL、トークンは必須です。",
|
||||
"saved": "秘密の情報源が保存されました",
|
||||
"deleted": "秘密情報源を削除",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "プライベートエンドポイントの許可リスト",
|
||||
"description": "秘密情報源がアクセスできるプライベートホストまたはループバックホストを、1行に1つずつ記述します。自己ホスト型の1Password Connectサーバーの場合、通常はここに独自のIPアドレスを記載する必要があります。"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "비밀 키 대신 1Password 참조(op://vault/item/field)를 붙여넣을 수 있습니다. 연결 시 비밀 키 소스에서 해당 참조를 가져옵니다.",
|
||||
"manage": "비밀 소스를 관리하세요",
|
||||
"title": "비밀 정보원",
|
||||
"description": "Termix는 외부 암호 관리자(현재 1Password Connect(자체 호스팅))에서 연결 시 비밀 키를 읽어옵니다. 액세스 토큰은 데이터 키로 암호화되어 저장됩니다.",
|
||||
"new": "새로운 소스",
|
||||
"nameLabel": "친근한 이름",
|
||||
"urlLabel": "서버 URL에 연결",
|
||||
"tokenLabel": "연결 액세스 토큰",
|
||||
"tokenKeep": "현재 토큰을 유지하려면 비워 두십시오.",
|
||||
"sharedLabel": "모든 사용자와 공유 (관리자만 가능, 로그인 상태에서 해결됨)",
|
||||
"shared": "공유",
|
||||
"test": "테스트",
|
||||
"testOk": "연결됨, {{count}} 금고가 보입니다",
|
||||
"testFailed": "연결 테스트 실패",
|
||||
"required": "이름, 서버 URL 및 토큰은 필수 입력 사항입니다.",
|
||||
"saved": "비밀 소스 저장됨",
|
||||
"deleted": "비밀 소스 삭제됨",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "개인 엔드포인트 허용 목록",
|
||||
"description": "비밀 소스가 접근할 수 있는 개인 또는 루프백 호스트를 한 줄에 하나씩 나열합니다. 자체 호스팅 1Password Connect 서버는 일반적으로 여기에 자체 주소를 나열해야 합니다."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "Je kunt in plaats van het geheim een 1Password-referentie (op://vault/item/field) plakken. Deze wordt opgehaald uit je geheime bron wanneer je verbinding maakt.",
|
||||
"manage": "Beheer geheime bronnen",
|
||||
"title": "Geheime bronnen",
|
||||
"description": "Externe wachtwoordmanagers die Termix gebruikt, lezen de geheimen uit tijdens het verbinden. Momenteel is dat 1Password Connect (zelf gehost). Het toegangstoken wordt versleuteld opgeslagen met uw gegevenssleutel.",
|
||||
"new": "Nieuwe bron",
|
||||
"nameLabel": "Vriendelijke naam",
|
||||
"urlLabel": "Verbindingsserver-URL",
|
||||
"tokenLabel": "Verbindingstoegangstoken",
|
||||
"tokenKeep": "Laat dit veld leeg om het huidige token te behouden.",
|
||||
"sharedLabel": "Delen met alle gebruikers (alleen beheerders, wordt opgelost terwijl u bent ingelogd)",
|
||||
"shared": "gedeeld",
|
||||
"test": "Test",
|
||||
"testOk": "Verbonden, {{count}} kluis(en) zichtbaar",
|
||||
"testFailed": "Verbindingstest mislukt",
|
||||
"required": "Naam, server-URL en token zijn vereist.",
|
||||
"saved": "Geheime bron opgeslagen",
|
||||
"deleted": "Geheime bron verwijderd",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Toegestane lijst voor privé-eindpunten",
|
||||
"description": "Privé- of loopback-hosts die een geheime bron kunnen bereiken, één per regel. Een zelfgehoste 1Password Connect-server heeft meestal een eigen adres nodig dat hier vermeld moet worden."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "You can paste a 1Password reference (op://vault/item/field) instead of the secret. It is fetched from your secret source when connecting.",
|
||||
"manage": "Manage secret sources",
|
||||
"title": "Secret sources",
|
||||
"description": "External password managers Termix reads secrets from at connect time. Currently 1Password Connect (self-hosted). The access token is stored encrypted with your data key.",
|
||||
"new": "New source",
|
||||
"nameLabel": "Friendly name",
|
||||
"urlLabel": "Connect server URL",
|
||||
"tokenLabel": "Connect access token",
|
||||
"tokenKeep": "Leave empty to keep the current token",
|
||||
"sharedLabel": "Share with all users (admins only, resolves while you are signed in)",
|
||||
"shared": "shared",
|
||||
"test": "Test",
|
||||
"testOk": "Connected, {{count}} vault(s) visible",
|
||||
"testFailed": "Connection test failed",
|
||||
"required": "Name, server URL and token are required",
|
||||
"saved": "Secret source saved",
|
||||
"deleted": "Secret source deleted",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Private endpoint allowlist",
|
||||
"description": "Private or loopback hosts a secret source may reach, one per line. A self-hosted 1Password Connect server usually needs its own address listed here."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "You can paste a 1Password reference (op://vault/item/field) instead of the secret. It is fetched from your secret source when connecting.",
|
||||
"manage": "Manage secret sources",
|
||||
"title": "Secret sources",
|
||||
"description": "External password managers Termix reads secrets from at connect time. Currently 1Password Connect (self-hosted). The access token is stored encrypted with your data key.",
|
||||
"new": "New source",
|
||||
"nameLabel": "Friendly name",
|
||||
"urlLabel": "Connect server URL",
|
||||
"tokenLabel": "Connect access token",
|
||||
"tokenKeep": "Leave empty to keep the current token",
|
||||
"sharedLabel": "Share with all users (admins only, resolves while you are signed in)",
|
||||
"shared": "współdzielony",
|
||||
"test": "Test",
|
||||
"testOk": "Connected, {{count}} vault(s) visible",
|
||||
"testFailed": "Connection test failed",
|
||||
"required": "Name, server URL and token are required",
|
||||
"saved": "Secret source saved",
|
||||
"deleted": "Secret source deleted",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Private endpoint allowlist",
|
||||
"description": "Private or loopback hosts a secret source may reach, one per line. A self-hosted 1Password Connect server usually needs its own address listed here."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "You can paste a 1Password reference (op://vault/item/field) instead of the secret. It is fetched from your secret source when connecting.",
|
||||
"manage": "Manage secret sources",
|
||||
"title": "Secret sources",
|
||||
"description": "External password managers Termix reads secrets from at connect time. Currently 1Password Connect (self-hosted). The access token is stored encrypted with your data key.",
|
||||
"new": "New source",
|
||||
"nameLabel": "Friendly name",
|
||||
"urlLabel": "Connect server URL",
|
||||
"tokenLabel": "Connect access token",
|
||||
"tokenKeep": "Leave empty to keep the current token",
|
||||
"sharedLabel": "Share with all users (admins only, resolves while you are signed in)",
|
||||
"shared": "shared",
|
||||
"test": "Test",
|
||||
"testOk": "Connected, {{count}} vault(s) visible",
|
||||
"testFailed": "Connection test failed",
|
||||
"required": "Name, server URL and token are required",
|
||||
"saved": "Secret source saved",
|
||||
"deleted": "Secret source deleted",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Private endpoint allowlist",
|
||||
"description": "Private or loopback hosts a secret source may reach, one per line. A self-hosted 1Password Connect server usually needs its own address listed here."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "You can paste a 1Password reference (op://vault/item/field) instead of the secret. It is fetched from your secret source when connecting.",
|
||||
"manage": "Manage secret sources",
|
||||
"title": "Secret sources",
|
||||
"description": "External password managers Termix reads secrets from at connect time. Currently 1Password Connect (self-hosted). The access token is stored encrypted with your data key.",
|
||||
"new": "New source",
|
||||
"nameLabel": "Friendly name",
|
||||
"urlLabel": "Connect server URL",
|
||||
"tokenLabel": "Connect access token",
|
||||
"tokenKeep": "Leave empty to keep the current token",
|
||||
"sharedLabel": "Share with all users (admins only, resolves while you are signed in)",
|
||||
"shared": "partilhado",
|
||||
"test": "Testar",
|
||||
"testOk": "Connected, {{count}} vault(s) visible",
|
||||
"testFailed": "Connection test failed",
|
||||
"required": "Name, server URL and token are required",
|
||||
"saved": "Secret source saved",
|
||||
"deleted": "Secret source deleted",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Private endpoint allowlist",
|
||||
"description": "Private or loopback hosts a secret source may reach, one per line. A self-hosted 1Password Connect server usually needs its own address listed here."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "Puteți lipi o referință 1Password (op://vault/item/field) în loc de secret. Aceasta este preluată din sursa secretului dvs. la conectare.",
|
||||
"manage": "Gestionați sursele secrete",
|
||||
"title": "Surse secrete",
|
||||
"description": "Managerii de parole externi Termix citesc secretele la momentul conectării. În prezent, 1Password Connect (găzduit automat). Tokenul de acces este stocat criptat cu cheia dvs. de date.",
|
||||
"new": "Sursă nouă",
|
||||
"nameLabel": "Nume prietenos",
|
||||
"urlLabel": "Conectați adresa URL a serverului",
|
||||
"tokenLabel": "Conectare jeton de acces",
|
||||
"tokenKeep": "Lăsați gol pentru a păstra token-ul curent",
|
||||
"sharedLabel": "Partajează cu toți utilizatorii (doar pentru administratori, se rezolvă în timp ce ești conectat)",
|
||||
"shared": "partajat",
|
||||
"test": "Test",
|
||||
"testOk": "Conectat, {{count}} seif(uri) vizibil(e)",
|
||||
"testFailed": "Testul de conexiune a eșuat",
|
||||
"required": "Numele, adresa URL a serverului și tokenul sunt obligatorii",
|
||||
"saved": "Sursă secretă salvată",
|
||||
"deleted": "Sursa secretă a fost ștearsă",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Listă permisă pentru puncte de terminare private",
|
||||
"description": "Gazde private sau loopback la care poate ajunge o sursă secretă, câte una pe linie. Un server 1Password Connect auto-găzduit are nevoie de obicei de propria adresă listată aici."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "You can paste a 1Password reference (op://vault/item/field) instead of the secret. It is fetched from your secret source when connecting.",
|
||||
"manage": "Manage secret sources",
|
||||
"title": "Secret sources",
|
||||
"description": "External password managers Termix reads secrets from at connect time. Currently 1Password Connect (self-hosted). The access token is stored encrypted with your data key.",
|
||||
"new": "New source",
|
||||
"nameLabel": "Friendly name",
|
||||
"urlLabel": "Connect server URL",
|
||||
"tokenLabel": "Connect access token",
|
||||
"tokenKeep": "Leave empty to keep the current token",
|
||||
"sharedLabel": "Share with all users (admins only, resolves while you are signed in)",
|
||||
"shared": "общий",
|
||||
"test": "Проверить",
|
||||
"testOk": "Connected, {{count}} vault(s) visible",
|
||||
"testFailed": "Connection test failed",
|
||||
"required": "Name, server URL and token are required",
|
||||
"saved": "Secret source saved",
|
||||
"deleted": "Secret source deleted",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Private endpoint allowlist",
|
||||
"description": "Private or loopback hosts a secret source may reach, one per line. A self-hosted 1Password Connect server usually needs its own address listed here."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "You can paste a 1Password reference (op://vault/item/field) instead of the secret. It is fetched from your secret source when connecting.",
|
||||
"manage": "Manage secret sources",
|
||||
"title": "Secret sources",
|
||||
"description": "External password managers Termix reads secrets from at connect time. Currently 1Password Connect (self-hosted). The access token is stored encrypted with your data key.",
|
||||
"new": "New source",
|
||||
"nameLabel": "Friendly name",
|
||||
"urlLabel": "Connect server URL",
|
||||
"tokenLabel": "Connect access token",
|
||||
"tokenKeep": "Leave empty to keep the current token",
|
||||
"sharedLabel": "Share with all users (admins only, resolves while you are signed in)",
|
||||
"shared": "shared",
|
||||
"test": "Test",
|
||||
"testOk": "Connected, {{count}} vault(s) visible",
|
||||
"testFailed": "Connection test failed",
|
||||
"required": "Name, server URL and token are required",
|
||||
"saved": "Secret source saved",
|
||||
"deleted": "Secret source deleted",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Private endpoint allowlist",
|
||||
"description": "Private or loopback hosts a secret source may reach, one per line. A self-hosted 1Password Connect server usually needs its own address listed here."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "You can paste a 1Password reference (op://vault/item/field) instead of the secret. It is fetched from your secret source when connecting.",
|
||||
"manage": "Manage secret sources",
|
||||
"title": "Secret sources",
|
||||
"description": "External password managers Termix reads secrets from at connect time. Currently 1Password Connect (self-hosted). The access token is stored encrypted with your data key.",
|
||||
"new": "New source",
|
||||
"nameLabel": "Friendly name",
|
||||
"urlLabel": "Connect server URL",
|
||||
"tokenLabel": "Connect access token",
|
||||
"tokenKeep": "Leave empty to keep the current token",
|
||||
"sharedLabel": "Share with all users (admins only, resolves while you are signed in)",
|
||||
"shared": "shared",
|
||||
"test": "Test",
|
||||
"testOk": "Connected, {{count}} vault(s) visible",
|
||||
"testFailed": "Connection test failed",
|
||||
"required": "Name, server URL and token are required",
|
||||
"saved": "Secret source saved",
|
||||
"deleted": "Secret source deleted",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Private endpoint allowlist",
|
||||
"description": "Private or loopback hosts a secret source may reach, one per line. A self-hosted 1Password Connect server usually needs its own address listed here."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "You can paste a 1Password reference (op://vault/item/field) instead of the secret. It is fetched from your secret source when connecting.",
|
||||
"manage": "Manage secret sources",
|
||||
"title": "Secret sources",
|
||||
"description": "External password managers Termix reads secrets from at connect time. Currently 1Password Connect (self-hosted). The access token is stored encrypted with your data key.",
|
||||
"new": "New source",
|
||||
"nameLabel": "Friendly name",
|
||||
"urlLabel": "Connect server URL",
|
||||
"tokenLabel": "Connect access token",
|
||||
"tokenKeep": "Leave empty to keep the current token",
|
||||
"sharedLabel": "Share with all users (admins only, resolves while you are signed in)",
|
||||
"shared": "shared",
|
||||
"test": "Test",
|
||||
"testOk": "Connected, {{count}} vault(s) visible",
|
||||
"testFailed": "Connection test failed",
|
||||
"required": "Name, server URL and token are required",
|
||||
"saved": "Secret source saved",
|
||||
"deleted": "Secret source deleted",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Private endpoint allowlist",
|
||||
"description": "Private or loopback hosts a secret source may reach, one per line. A self-hosted 1Password Connect server usually needs its own address listed here."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "You can paste a 1Password reference (op://vault/item/field) instead of the secret. It is fetched from your secret source when connecting.",
|
||||
"manage": "Manage secret sources",
|
||||
"title": "Secret sources",
|
||||
"description": "External password managers Termix reads secrets from at connect time. Currently 1Password Connect (self-hosted). The access token is stored encrypted with your data key.",
|
||||
"new": "New source",
|
||||
"nameLabel": "Friendly name",
|
||||
"urlLabel": "Connect server URL",
|
||||
"tokenLabel": "Connect access token",
|
||||
"tokenKeep": "Leave empty to keep the current token",
|
||||
"sharedLabel": "Share with all users (admins only, resolves while you are signed in)",
|
||||
"shared": "paylaşılan",
|
||||
"test": "Test Et",
|
||||
"testOk": "Connected, {{count}} vault(s) visible",
|
||||
"testFailed": "Connection test failed",
|
||||
"required": "Name, server URL and token are required",
|
||||
"saved": "Secret source saved",
|
||||
"deleted": "Secret source deleted",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Private endpoint allowlist",
|
||||
"description": "Private or loopback hosts a secret source may reach, one per line. A self-hosted 1Password Connect server usually needs its own address listed here."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "You can paste a 1Password reference (op://vault/item/field) instead of the secret. It is fetched from your secret source when connecting.",
|
||||
"manage": "Manage secret sources",
|
||||
"title": "Secret sources",
|
||||
"description": "External password managers Termix reads secrets from at connect time. Currently 1Password Connect (self-hosted). The access token is stored encrypted with your data key.",
|
||||
"new": "New source",
|
||||
"nameLabel": "Friendly name",
|
||||
"urlLabel": "Connect server URL",
|
||||
"tokenLabel": "Connect access token",
|
||||
"tokenKeep": "Leave empty to keep the current token",
|
||||
"sharedLabel": "Share with all users (admins only, resolves while you are signed in)",
|
||||
"shared": "shared",
|
||||
"test": "Test",
|
||||
"testOk": "Connected, {{count}} vault(s) visible",
|
||||
"testFailed": "Connection test failed",
|
||||
"required": "Name, server URL and token are required",
|
||||
"saved": "Secret source saved",
|
||||
"deleted": "Secret source deleted",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Private endpoint allowlist",
|
||||
"description": "Private or loopback hosts a secret source may reach, one per line. A self-hosted 1Password Connect server usually needs its own address listed here."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "You can paste a 1Password reference (op://vault/item/field) instead of the secret. It is fetched from your secret source when connecting.",
|
||||
"manage": "Manage secret sources",
|
||||
"title": "Secret sources",
|
||||
"description": "External password managers Termix reads secrets from at connect time. Currently 1Password Connect (self-hosted). The access token is stored encrypted with your data key.",
|
||||
"new": "New source",
|
||||
"nameLabel": "Friendly name",
|
||||
"urlLabel": "Connect server URL",
|
||||
"tokenLabel": "Connect access token",
|
||||
"tokenKeep": "Leave empty to keep the current token",
|
||||
"sharedLabel": "Share with all users (admins only, resolves while you are signed in)",
|
||||
"shared": "được chia sẻ",
|
||||
"test": "Kiểm tra",
|
||||
"testOk": "Connected, {{count}} vault(s) visible",
|
||||
"testFailed": "Connection test failed",
|
||||
"required": "Name, server URL and token are required",
|
||||
"saved": "Secret source saved",
|
||||
"deleted": "Secret source deleted",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Private endpoint allowlist",
|
||||
"description": "Private or loopback hosts a secret source may reach, one per line. A self-hosted 1Password Connect server usually needs its own address listed here."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "You can paste a 1Password reference (op://vault/item/field) instead of the secret. It is fetched from your secret source when connecting.",
|
||||
"manage": "Manage secret sources",
|
||||
"title": "Secret sources",
|
||||
"description": "External password managers Termix reads secrets from at connect time. Currently 1Password Connect (self-hosted). The access token is stored encrypted with your data key.",
|
||||
"new": "New source",
|
||||
"nameLabel": "Friendly name",
|
||||
"urlLabel": "Connect server URL",
|
||||
"tokenLabel": "Connect access token",
|
||||
"tokenKeep": "Leave empty to keep the current token",
|
||||
"sharedLabel": "Share with all users (admins only, resolves while you are signed in)",
|
||||
"shared": "已共享",
|
||||
"test": "测试",
|
||||
"testOk": "Connected, {{count}} vault(s) visible",
|
||||
"testFailed": "Connection test failed",
|
||||
"required": "Name, server URL and token are required",
|
||||
"saved": "Secret source saved",
|
||||
"deleted": "Secret source deleted",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Private endpoint allowlist",
|
||||
"description": "Private or loopback hosts a secret source may reach, one per line. A self-hosted 1Password Connect server usually needs its own address listed here."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"hint": "You can paste a 1Password reference (op://vault/item/field) instead of the secret. It is fetched from your secret source when connecting.",
|
||||
"manage": "Manage secret sources",
|
||||
"title": "Secret sources",
|
||||
"description": "External password managers Termix reads secrets from at connect time. Currently 1Password Connect (self-hosted). The access token is stored encrypted with your data key.",
|
||||
"new": "New source",
|
||||
"nameLabel": "Friendly name",
|
||||
"urlLabel": "Connect server URL",
|
||||
"tokenLabel": "Connect access token",
|
||||
"tokenKeep": "Leave empty to keep the current token",
|
||||
"sharedLabel": "Share with all users (admins only, resolves while you are signed in)",
|
||||
"shared": "已共用",
|
||||
"test": "測試",
|
||||
"testOk": "Connected, {{count}} vault(s) visible",
|
||||
"testFailed": "Connection test failed",
|
||||
"required": "Name, server URL and token are required",
|
||||
"saved": "Secret source saved",
|
||||
"deleted": "Secret source deleted",
|
||||
"settings": {
|
||||
"admin": {
|
||||
"privateEndpoints": {
|
||||
"label": "Private endpoint allowlist",
|
||||
"description": "Private or loopback hosts a secret source may reach, one per line. A self-hosted 1Password Connect server usually needs its own address listed here."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
{
|
||||
"id": "secret-sources",
|
||||
"name": "Secret Sources",
|
||||
"version": "1.0.0",
|
||||
"description": "Fetch host secrets from 1Password when you connect instead of storing them in Termix.",
|
||||
"author": {
|
||||
"name": "Termix"
|
||||
},
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/Termix-SSH/Termix",
|
||||
"category": "Access & Security",
|
||||
"icon": "KeyRound",
|
||||
"engine": {
|
||||
"termix": ">=2.9.0",
|
||||
"api": "1"
|
||||
},
|
||||
"capabilities": [
|
||||
"db:own",
|
||||
"secrets:own",
|
||||
"network:outbound",
|
||||
"network:serve",
|
||||
"auth:provide",
|
||||
"ui:surface",
|
||||
"users:impersonate"
|
||||
],
|
||||
"contributes": {
|
||||
"auth": {
|
||||
"secretSchemes": ["op"]
|
||||
},
|
||||
"settings": {
|
||||
"admin": [
|
||||
{
|
||||
"key": "privateEndpoints",
|
||||
"type": "textarea",
|
||||
"labelKey": "settings.admin.privateEndpoints.label",
|
||||
"descriptionKey": "settings.admin.privateEndpoints.description",
|
||||
"default": "localhost\n127.0.0.1\n::1\nhost.docker.internal"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"locales": "locales",
|
||||
"platforms": ["linux", "win32", "darwin"]
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
-- secret-sources 0001: adopt_secret_sources
|
||||
-- Generated by termix-plugin migrations. Review before committing.
|
||||
|
||||
CREATE TABLE IF NOT EXISTS `secret_sources` (
|
||||
`id` varchar(255) PRIMARY KEY NOT NULL,
|
||||
`user_id` varchar(255) NOT NULL,
|
||||
`name` text NOT NULL,
|
||||
`kind` text NOT NULL DEFAULT ('onepassword-connect'),
|
||||
`base_url` text NOT NULL,
|
||||
`shared` boolean NOT NULL DEFAULT false,
|
||||
`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
|
||||
`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
|
||||
FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE
|
||||
);
|
||||
RENAME TABLE `secret_sources` TO `p_secret_sources_sources`;
|
||||
@@ -0,0 +1,16 @@
|
||||
-- secret-sources 0001: adopt_secret_sources
|
||||
-- Generated by termix-plugin migrations. Review before committing.
|
||||
|
||||
CREATE TABLE IF NOT EXISTS "secret_sources" (
|
||||
"id" varchar(255) PRIMARY KEY NOT NULL,
|
||||
"user_id" varchar(255) NOT NULL,
|
||||
"name" text NOT NULL,
|
||||
"kind" text NOT NULL DEFAULT 'onepassword-connect',
|
||||
"base_url" text NOT NULL,
|
||||
"shared" boolean NOT NULL DEFAULT false,
|
||||
"created_at" text NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
"updated_at" text NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
FOREIGN KEY ("user_id") REFERENCES "users" ("id") ON DELETE CASCADE
|
||||
);
|
||||
CREATE INDEX IF NOT EXISTS "idx_secret_sources_user" ON "secret_sources" ("user_id");
|
||||
ALTER TABLE "secret_sources" RENAME TO "p_secret_sources_sources";
|
||||
@@ -0,0 +1,55 @@
|
||||
{
|
||||
"version": 1,
|
||||
"tables": {
|
||||
"sources": {
|
||||
"columns": {
|
||||
"id": {
|
||||
"type": "varchar",
|
||||
"length": 255,
|
||||
"primaryKey": true,
|
||||
"notNull": true
|
||||
},
|
||||
"userId": {
|
||||
"type": "refUser",
|
||||
"length": 255,
|
||||
"notNull": true
|
||||
},
|
||||
"name": {
|
||||
"type": "text",
|
||||
"notNull": true
|
||||
},
|
||||
"kind": {
|
||||
"type": "text",
|
||||
"notNull": true,
|
||||
"defaultValue": "onepassword-connect"
|
||||
},
|
||||
"baseUrl": {
|
||||
"type": "text",
|
||||
"notNull": true
|
||||
},
|
||||
"shared": {
|
||||
"type": "boolean",
|
||||
"notNull": true,
|
||||
"defaultValue": false
|
||||
},
|
||||
"createdAt": {
|
||||
"type": "timestamp",
|
||||
"notNull": true,
|
||||
"defaultNow": true
|
||||
},
|
||||
"updatedAt": {
|
||||
"type": "timestamp",
|
||||
"notNull": true,
|
||||
"defaultNow": true
|
||||
}
|
||||
},
|
||||
"indexes": [
|
||||
{
|
||||
"name": "idx_secret_sources_user",
|
||||
"columns": ["userId"]
|
||||
}
|
||||
],
|
||||
"adopts": "secret_sources"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
-- secret-sources 0001: adopt_secret_sources
|
||||
-- Generated by termix-plugin migrations. Review before committing.
|
||||
|
||||
CREATE TABLE IF NOT EXISTS "secret_sources" (
|
||||
"id" text PRIMARY KEY NOT NULL,
|
||||
"user_id" text NOT NULL,
|
||||
"name" text NOT NULL,
|
||||
"kind" text NOT NULL DEFAULT 'onepassword-connect',
|
||||
"base_url" text NOT NULL,
|
||||
"shared" integer NOT NULL DEFAULT 0,
|
||||
"created_at" text NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
"updated_at" text NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
FOREIGN KEY ("user_id") REFERENCES "users" ("id") ON DELETE CASCADE
|
||||
);
|
||||
CREATE INDEX IF NOT EXISTS "idx_secret_sources_user" ON "secret_sources" ("user_id");
|
||||
ALTER TABLE "secret_sources" RENAME TO "p_secret_sources_sources";
|
||||
@@ -0,0 +1,33 @@
|
||||
{
|
||||
"name": "@termix-plugin/secret-sources",
|
||||
"private": true,
|
||||
"version": "1.0.0",
|
||||
"type": "module",
|
||||
"scripts": {
|
||||
"build": "termix-plugin build",
|
||||
"test": "termix-plugin test",
|
||||
"typecheck": "tsc -p .",
|
||||
"validate": "termix-plugin validate"
|
||||
},
|
||||
"dependencies": {
|
||||
"lucide-react": "^1.33.0"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@termix/plugin-sdk": "^1.0.0",
|
||||
"@testing-library/dom": "^10.4.2",
|
||||
"@testing-library/react": "^16.3.3",
|
||||
"@types/node": "^26.2.0",
|
||||
"@types/react": "^19.2.18",
|
||||
"@types/react-dom": "^19.2.4",
|
||||
"better-sqlite3": "^13.0.3",
|
||||
"jsdom": "^30.0.1",
|
||||
"vitest": "^4.1.11"
|
||||
},
|
||||
"peerDependencies": {
|
||||
"@termix/plugin-sdk": "^1.0.0",
|
||||
"drizzle-orm": "^0.45.2",
|
||||
"express": "^5.2.1",
|
||||
"react": "^19.2.8",
|
||||
"sonner": "^2.0.8"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
/**
|
||||
* Where a secret source (a self-hosted 1Password Connect server) may be
|
||||
* reached. Every request goes through ctx.fetch, which refuses private and
|
||||
* loopback addresses unless the exact host is listed here, admin-only and
|
||||
* install-wide.
|
||||
*/
|
||||
|
||||
export const DEFAULT_PRIVATE_ALLOWLIST = [
|
||||
"localhost",
|
||||
"127.0.0.1",
|
||||
"::1",
|
||||
"host.docker.internal",
|
||||
];
|
||||
|
||||
/** The admin setting is one host per line. A line that is not a bare host is ignored. */
|
||||
const HOST_PATTERN = /^[a-z0-9._:-]+$/;
|
||||
|
||||
export function parseAllowlist(raw: unknown): string[] {
|
||||
if (typeof raw !== "string") return [...DEFAULT_PRIVATE_ALLOWLIST];
|
||||
const hosts: string[] = [];
|
||||
for (const line of raw.split(/[\r\n,]+/)) {
|
||||
const host = line.trim().toLowerCase();
|
||||
if (host && HOST_PATTERN.test(host) && !hosts.includes(host)) {
|
||||
hosts.push(host);
|
||||
}
|
||||
}
|
||||
return hosts;
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
import type { Router } from "express";
|
||||
import type { PluginContext } from "@termix/plugin-sdk/backend";
|
||||
import { sources } from "./tables.js";
|
||||
import { createSecretSourceRepository } from "./repository.js";
|
||||
import { createTokenStore } from "./token-store.js";
|
||||
import { registerSecretSourceRoutes } from "./routes.js";
|
||||
import { registerOnePasswordResolver } from "./resolver.js";
|
||||
|
||||
export async function activate(ctx: PluginContext) {
|
||||
const table = await ctx.db.define(sources);
|
||||
const repository = createSecretSourceRepository(ctx.db, table);
|
||||
const tokenStore = createTokenStore(ctx);
|
||||
|
||||
registerSecretSourceRoutes(
|
||||
ctx.http.router<Router>(),
|
||||
ctx,
|
||||
repository,
|
||||
tokenStore,
|
||||
);
|
||||
registerOnePasswordResolver(ctx, repository, tokenStore);
|
||||
|
||||
ctx.log.info("Secret sources routes mounted at /plugin-api/secret-sources");
|
||||
}
|
||||
|
||||
export async function deactivate() {
|
||||
// Everything above was registered through ctx and is disposed by core.
|
||||
}
|
||||
@@ -0,0 +1,136 @@
|
||||
import type { PluginFetch } from "@termix/plugin-sdk/backend";
|
||||
|
||||
/**
|
||||
* The slice of the 1Password Connect REST API needed to resolve a secret
|
||||
* reference: find the vault, find the item, read one field.
|
||||
* https://developer.1password.com/docs/connect/api-reference
|
||||
*/
|
||||
|
||||
export interface SecretReference {
|
||||
vault: string;
|
||||
item: string;
|
||||
field: string;
|
||||
}
|
||||
|
||||
const FETCH_TIMEOUT_MS = 10_000;
|
||||
|
||||
/** op://<vault>/<item>/<field> (a trailing ?query, as in ?ssh-format=openssh, is ignored) */
|
||||
export function parseSecretReference(raw: string): SecretReference | null {
|
||||
const match = /^op:\/\/([^/]+)\/([^/]+)\/([^/?]+)(?:\?.*)?$/.exec(raw.trim());
|
||||
if (!match) return null;
|
||||
const [, vault, item, field] = match.map((part) => decodeURIComponent(part));
|
||||
return { vault, item, field };
|
||||
}
|
||||
|
||||
export interface ConnectSource {
|
||||
baseUrl: string;
|
||||
token: string;
|
||||
allowedPrivateHosts: readonly string[];
|
||||
}
|
||||
|
||||
async function connectGet<T>(
|
||||
fetch: PluginFetch,
|
||||
source: ConnectSource,
|
||||
path: string,
|
||||
): Promise<T> {
|
||||
const base = source.baseUrl.replace(/\/+$/, "");
|
||||
const response = await fetch(`${base}${path}`, {
|
||||
method: "GET",
|
||||
headers: { Authorization: `Bearer ${source.token}` },
|
||||
timeoutMs: FETCH_TIMEOUT_MS,
|
||||
allowPrivateHosts: source.allowedPrivateHosts,
|
||||
});
|
||||
if (!response.ok) {
|
||||
throw new Error(
|
||||
`1Password Connect ${path} failed: HTTP ${response.status}`,
|
||||
);
|
||||
}
|
||||
return (await response.json()) as T;
|
||||
}
|
||||
|
||||
function eqFilter(value: string): string {
|
||||
return encodeURIComponent(`title eq "${value.replace(/"/g, '\\"')}"`);
|
||||
}
|
||||
|
||||
interface ConnectVault {
|
||||
id: string;
|
||||
name: string;
|
||||
}
|
||||
interface ConnectItemSummary {
|
||||
id: string;
|
||||
title: string;
|
||||
}
|
||||
interface ConnectField {
|
||||
id: string;
|
||||
label?: string;
|
||||
purpose?: string;
|
||||
type?: string;
|
||||
value?: string;
|
||||
}
|
||||
|
||||
/** Reachability + token validity: the vault list needs a valid token. */
|
||||
export async function testConnectSource(
|
||||
fetch: PluginFetch,
|
||||
source: ConnectSource,
|
||||
): Promise<number> {
|
||||
const vaults = await connectGet<ConnectVault[]>(fetch, source, "/v1/vaults");
|
||||
return vaults.length;
|
||||
}
|
||||
|
||||
const byIdOrName =
|
||||
(name: string) =>
|
||||
(candidate: { id: string; name?: string; title?: string }) =>
|
||||
candidate.id === name ||
|
||||
(candidate.name ?? candidate.title ?? "").toLowerCase() ===
|
||||
name.toLowerCase();
|
||||
|
||||
export async function resolveConnectReference(
|
||||
fetch: PluginFetch,
|
||||
source: ConnectSource,
|
||||
ref: SecretReference,
|
||||
): Promise<string> {
|
||||
const vaults = await connectGet<ConnectVault[]>(
|
||||
fetch,
|
||||
source,
|
||||
`/v1/vaults?filter=${eqFilter(ref.vault)}`,
|
||||
);
|
||||
const vault =
|
||||
vaults.find(byIdOrName(ref.vault)) ??
|
||||
(await connectGet<ConnectVault[]>(fetch, source, "/v1/vaults")).find(
|
||||
byIdOrName(ref.vault),
|
||||
);
|
||||
if (!vault) throw new Error(`1Password vault "${ref.vault}" not found`);
|
||||
|
||||
const items = await connectGet<ConnectItemSummary[]>(
|
||||
fetch,
|
||||
source,
|
||||
`/v1/vaults/${vault.id}/items?filter=${eqFilter(ref.item)}`,
|
||||
);
|
||||
const summary =
|
||||
items.find(byIdOrName(ref.item)) ??
|
||||
(ref.item.length >= 26 ? { id: ref.item, title: ref.item } : undefined);
|
||||
if (!summary) {
|
||||
throw new Error(`1Password item "${ref.item}" not found in "${ref.vault}"`);
|
||||
}
|
||||
|
||||
const item = await connectGet<{ fields?: ConnectField[] }>(
|
||||
fetch,
|
||||
source,
|
||||
`/v1/vaults/${vault.id}/items/${summary.id}`,
|
||||
);
|
||||
const wanted = ref.field.toLowerCase();
|
||||
const field = (item.fields ?? []).find(
|
||||
(f) =>
|
||||
f.id === ref.field ||
|
||||
f.label?.toLowerCase() === wanted ||
|
||||
f.purpose?.toLowerCase() === wanted ||
|
||||
(wanted === "private key" && f.id === "private_key") ||
|
||||
(wanted === "private_key" && f.label?.toLowerCase() === "private key"),
|
||||
);
|
||||
if (!field || field.value === undefined) {
|
||||
throw new Error(
|
||||
`1Password field "${ref.field}" not found on "${ref.item}"`,
|
||||
);
|
||||
}
|
||||
return field.value;
|
||||
}
|
||||
@@ -0,0 +1,116 @@
|
||||
import { eq, or } from "drizzle-orm";
|
||||
import type { PluginDatabase } from "@termix/plugin-sdk/backend";
|
||||
|
||||
export type SecretSourceKind = "onepassword-connect";
|
||||
|
||||
export interface SecretSourceRecord {
|
||||
id: string;
|
||||
userId: string;
|
||||
name: string;
|
||||
kind: SecretSourceKind;
|
||||
baseUrl: string;
|
||||
shared: boolean;
|
||||
createdAt: string;
|
||||
updatedAt: string;
|
||||
}
|
||||
|
||||
export interface SecretSourceCreateInput {
|
||||
id: string;
|
||||
userId: string;
|
||||
name: string;
|
||||
kind: SecretSourceKind;
|
||||
baseUrl: string;
|
||||
shared: boolean;
|
||||
}
|
||||
|
||||
export interface SecretSourceUpdateInput {
|
||||
name?: string;
|
||||
baseUrl?: string;
|
||||
shared?: boolean;
|
||||
}
|
||||
|
||||
/* eslint-disable @typescript-eslint/no-explicit-any */
|
||||
// The table comes from ctx.db.define, which the SDK hands back untyped, and
|
||||
// the drizzle handle is the server's own. Typed at this module's edge instead.
|
||||
type Table = any;
|
||||
type Drizzle = any;
|
||||
/* eslint-enable @typescript-eslint/no-explicit-any */
|
||||
|
||||
export type SecretSourceRepository = ReturnType<
|
||||
typeof createSecretSourceRepository
|
||||
>;
|
||||
|
||||
/**
|
||||
* Per-user secret source storage. The token is never in this table - it
|
||||
* lives in ctx.secrets under "source:<id>". A row with an id the caller
|
||||
* chose is written without RETURNING so it runs the same on all three
|
||||
* engines.
|
||||
*/
|
||||
export function createSecretSourceRepository(db: PluginDatabase, table: Table) {
|
||||
const client = () => db.client<Drizzle>();
|
||||
|
||||
async function findById(id: string): Promise<SecretSourceRecord | null> {
|
||||
const drizzle = await client();
|
||||
const rows = await drizzle
|
||||
.select()
|
||||
.from(table)
|
||||
.where(eq(table.id, id))
|
||||
.limit(1);
|
||||
return (rows[0] as SecretSourceRecord) ?? null;
|
||||
}
|
||||
|
||||
return {
|
||||
findById,
|
||||
|
||||
async listVisibleToUser(userId: string): Promise<SecretSourceRecord[]> {
|
||||
const drizzle = await client();
|
||||
return drizzle
|
||||
.select()
|
||||
.from(table)
|
||||
.where(or(eq(table.userId, userId), eq(table.shared, true)));
|
||||
},
|
||||
|
||||
async create(
|
||||
input: SecretSourceCreateInput,
|
||||
now = new Date().toISOString(),
|
||||
): Promise<SecretSourceRecord> {
|
||||
const drizzle = await client();
|
||||
await drizzle.insert(table).values({
|
||||
id: input.id,
|
||||
userId: input.userId,
|
||||
name: input.name,
|
||||
kind: input.kind,
|
||||
baseUrl: input.baseUrl,
|
||||
shared: input.shared,
|
||||
createdAt: now,
|
||||
updatedAt: now,
|
||||
});
|
||||
await db.persist();
|
||||
return (await findById(input.id)) as SecretSourceRecord;
|
||||
},
|
||||
|
||||
async update(
|
||||
row: SecretSourceRecord,
|
||||
input: SecretSourceUpdateInput,
|
||||
now = new Date().toISOString(),
|
||||
): Promise<void> {
|
||||
const drizzle = await client();
|
||||
await drizzle
|
||||
.update(table)
|
||||
.set({
|
||||
...(input.name !== undefined ? { name: input.name } : {}),
|
||||
...(input.baseUrl !== undefined ? { baseUrl: input.baseUrl } : {}),
|
||||
...(input.shared !== undefined ? { shared: input.shared } : {}),
|
||||
updatedAt: now,
|
||||
})
|
||||
.where(eq(table.id, row.id));
|
||||
await db.persist();
|
||||
},
|
||||
|
||||
async deleteById(id: string): Promise<void> {
|
||||
const drizzle = await client();
|
||||
await drizzle.delete(table).where(eq(table.id, id));
|
||||
await db.persist();
|
||||
},
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
import type { PluginContext } from "@termix/plugin-sdk/backend";
|
||||
import type { SecretSourceRepository } from "./repository.js";
|
||||
import type { TokenStore } from "./token-store.js";
|
||||
import { parseAllowlist } from "./egress.js";
|
||||
import {
|
||||
parseSecretReference,
|
||||
resolveConnectReference,
|
||||
} from "./onepassword-connect.js";
|
||||
|
||||
/** The user's own source first, else a shared one. */
|
||||
async function pickSecretSource(
|
||||
repository: SecretSourceRepository,
|
||||
userId: string,
|
||||
) {
|
||||
const sources = await repository.listVisibleToUser(userId);
|
||||
return (
|
||||
sources.find((source) => source.userId === userId) ?? sources[0] ?? null
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* The "op" scheme resolver: turns "op://vault/item/field" into the actual
|
||||
* secret, using whichever source the acting user can see (their own first,
|
||||
* else a shared one).
|
||||
*/
|
||||
export function registerOnePasswordResolver(
|
||||
ctx: PluginContext,
|
||||
repository: SecretSourceRepository,
|
||||
tokenStore: TokenStore,
|
||||
): void {
|
||||
ctx.credentials.registerSecretResolver("op", async (userId, reference) => {
|
||||
const ref = parseSecretReference(reference);
|
||||
if (!ref) throw new Error(`Invalid secret reference: ${reference}`);
|
||||
|
||||
const source = await pickSecretSource(repository, userId);
|
||||
if (!source) {
|
||||
throw new Error(
|
||||
"This host uses a secret reference but no secret source is configured",
|
||||
);
|
||||
}
|
||||
|
||||
const token = await tokenStore.getForOwner(source.id, source.userId);
|
||||
if (!token) {
|
||||
throw new Error(
|
||||
"The secret source owner's data is locked; they need to sign in first",
|
||||
);
|
||||
}
|
||||
|
||||
return resolveConnectReference(
|
||||
ctx.fetch,
|
||||
{
|
||||
baseUrl: source.baseUrl,
|
||||
token,
|
||||
allowedPrivateHosts: parseAllowlist(
|
||||
await ctx.settings.get<string>("privateEndpoints"),
|
||||
),
|
||||
},
|
||||
ref,
|
||||
);
|
||||
});
|
||||
}
|
||||
@@ -0,0 +1,270 @@
|
||||
import { randomUUID } from "node:crypto";
|
||||
import type { Request, Response, Router } from "express";
|
||||
import type { PluginContext } from "@termix/plugin-sdk/backend";
|
||||
import type { SecretSourceRepository } from "./repository.js";
|
||||
import type { TokenStore } from "./token-store.js";
|
||||
import { testConnectSource } from "./onepassword-connect.js";
|
||||
import { parseAllowlist } from "./egress.js";
|
||||
|
||||
const KINDS = ["onepassword-connect"] as const;
|
||||
|
||||
function isNonEmptyString(value: unknown): value is string {
|
||||
return typeof value === "string" && value.trim().length > 0;
|
||||
}
|
||||
|
||||
function validBaseUrl(raw: unknown): string | null {
|
||||
if (!isNonEmptyString(raw)) return null;
|
||||
try {
|
||||
const url = new URL(raw.trim());
|
||||
if (!["http:", "https:"].includes(url.protocol)) return null;
|
||||
return url.toString().replace(/\/+$/, "");
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
function errorMessage(error: unknown): string {
|
||||
return error instanceof Error ? error.message : String(error);
|
||||
}
|
||||
|
||||
export function registerSecretSourceRoutes(
|
||||
router: Router,
|
||||
ctx: PluginContext,
|
||||
repository: SecretSourceRepository,
|
||||
tokenStore: TokenStore,
|
||||
): void {
|
||||
const isAdmin = () => ctx.rbac.has("admin.plugins.manage");
|
||||
// Secret sources are credentials, so they follow core's credential
|
||||
// permissions. ctx.rbac.require only takes this plugin's own names.
|
||||
const requireCredentials =
|
||||
(action: "view" | "create" | "edit" | "delete") =>
|
||||
(req: Request, res: Response, next: () => void) => {
|
||||
void ctx.rbac.has(`credentials.${action}`).then((allowed) => {
|
||||
if (allowed) next();
|
||||
else {
|
||||
res.status(403).json({
|
||||
error: "Insufficient permissions",
|
||||
required: `credentials.${action}`,
|
||||
});
|
||||
}
|
||||
});
|
||||
};
|
||||
const allowedPrivateHosts = async () =>
|
||||
parseAllowlist(await ctx.settings.get<string>("privateEndpoints"));
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/secret-sources:
|
||||
* get:
|
||||
* summary: List secret sources visible to the caller (own + shared)
|
||||
* tags:
|
||||
* - Secret Sources
|
||||
*/
|
||||
router.get(
|
||||
"/",
|
||||
requireCredentials("view") as never,
|
||||
async (req: Request, res: Response) => {
|
||||
const userId = ctx.currentActor()!;
|
||||
try {
|
||||
const rows = await repository.listVisibleToUser(userId);
|
||||
res.json({
|
||||
sources: rows.map((row) => ({
|
||||
...row,
|
||||
owned: row.userId === userId,
|
||||
})),
|
||||
});
|
||||
} catch (error) {
|
||||
ctx.log.error("Failed to list secret sources", error);
|
||||
res.status(500).json({ error: "Failed to list secret sources" });
|
||||
}
|
||||
},
|
||||
);
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/secret-sources:
|
||||
* post:
|
||||
* summary: Create a secret source (1Password Connect)
|
||||
* description: Sharing a source with every user requires admin. The token is encrypted with the owner's data key.
|
||||
* tags:
|
||||
* - Secret Sources
|
||||
*/
|
||||
router.post(
|
||||
"/",
|
||||
requireCredentials("create") as never,
|
||||
async (req: Request, res: Response) => {
|
||||
const userId = ctx.currentActor()!;
|
||||
const {
|
||||
name,
|
||||
kind = "onepassword-connect",
|
||||
baseUrl,
|
||||
token,
|
||||
shared,
|
||||
} = req.body ?? {};
|
||||
const url = validBaseUrl(baseUrl);
|
||||
if (!isNonEmptyString(name) || !url || !isNonEmptyString(token)) {
|
||||
return res.status(400).json({
|
||||
error: "name, a valid http(s) baseUrl and token are required",
|
||||
});
|
||||
}
|
||||
if (!(KINDS as readonly string[]).includes(kind)) {
|
||||
return res
|
||||
.status(400)
|
||||
.json({ error: "Unsupported secret source kind" });
|
||||
}
|
||||
if (shared === true && !(await isAdmin())) {
|
||||
return res
|
||||
.status(403)
|
||||
.json({ error: "Only admins can share a secret source" });
|
||||
}
|
||||
try {
|
||||
const id = randomUUID();
|
||||
const created = await repository.create({
|
||||
id,
|
||||
userId,
|
||||
name: name.trim(),
|
||||
kind,
|
||||
baseUrl: url,
|
||||
shared: shared === true,
|
||||
});
|
||||
await tokenStore.set(id, token.trim());
|
||||
await ctx.audit.record({
|
||||
action: "secret_source_create",
|
||||
resourceType: "secret_source",
|
||||
resourceId: created.id,
|
||||
resourceName: created.name,
|
||||
success: true,
|
||||
});
|
||||
res.json({ source: { ...created, owned: true } });
|
||||
} catch (error) {
|
||||
ctx.log.error("Failed to create secret source", error);
|
||||
res.status(500).json({ error: "Failed to create secret source" });
|
||||
}
|
||||
},
|
||||
);
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/secret-sources/{id}:
|
||||
* put:
|
||||
* summary: Update a secret source (owner only; omit token to keep it)
|
||||
* tags:
|
||||
* - Secret Sources
|
||||
*/
|
||||
router.put(
|
||||
"/:id",
|
||||
requireCredentials("edit") as never,
|
||||
async (req: Request, res: Response) => {
|
||||
const userId = ctx.currentActor()!;
|
||||
const { name, baseUrl, token, shared } = req.body ?? {};
|
||||
try {
|
||||
const source = await repository.findById(String(req.params.id));
|
||||
if (!source) {
|
||||
return res.status(404).json({ error: "Secret source not found" });
|
||||
}
|
||||
if (source.userId !== userId) {
|
||||
return res
|
||||
.status(403)
|
||||
.json({ error: "Only the owner can change this source" });
|
||||
}
|
||||
const url = baseUrl === undefined ? undefined : validBaseUrl(baseUrl);
|
||||
if (baseUrl !== undefined && !url) {
|
||||
return res.status(400).json({ error: "baseUrl must be http(s)" });
|
||||
}
|
||||
if (shared === true && !source.shared && !(await isAdmin())) {
|
||||
return res
|
||||
.status(403)
|
||||
.json({ error: "Only admins can share a secret source" });
|
||||
}
|
||||
await repository.update(source, {
|
||||
...(isNonEmptyString(name) ? { name: name.trim() } : {}),
|
||||
...(url ? { baseUrl: url } : {}),
|
||||
...(typeof shared === "boolean" ? { shared } : {}),
|
||||
});
|
||||
if (isNonEmptyString(token)) {
|
||||
await tokenStore.set(source.id, token.trim());
|
||||
}
|
||||
res.json({ success: true });
|
||||
} catch (error) {
|
||||
ctx.log.error("Failed to update secret source", error);
|
||||
res.status(500).json({ error: "Failed to update secret source" });
|
||||
}
|
||||
},
|
||||
);
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/secret-sources/{id}:
|
||||
* delete:
|
||||
* summary: Delete a secret source (owner only)
|
||||
* tags:
|
||||
* - Secret Sources
|
||||
*/
|
||||
router.delete(
|
||||
"/:id",
|
||||
requireCredentials("delete") as never,
|
||||
async (req: Request, res: Response) => {
|
||||
const userId = ctx.currentActor()!;
|
||||
try {
|
||||
const source = await repository.findById(String(req.params.id));
|
||||
if (!source) {
|
||||
return res.status(404).json({ error: "Secret source not found" });
|
||||
}
|
||||
if (source.userId !== userId) {
|
||||
return res
|
||||
.status(403)
|
||||
.json({ error: "Only the owner can change this source" });
|
||||
}
|
||||
await repository.deleteById(source.id);
|
||||
await tokenStore.clear(source.id);
|
||||
await ctx.audit.record({
|
||||
action: "secret_source_delete",
|
||||
resourceType: "secret_source",
|
||||
resourceId: source.id,
|
||||
resourceName: source.name,
|
||||
success: true,
|
||||
});
|
||||
res.json({ success: true });
|
||||
} catch (error) {
|
||||
ctx.log.error("Failed to delete secret source", error);
|
||||
res.status(500).json({ error: "Failed to delete secret source" });
|
||||
}
|
||||
},
|
||||
);
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/secret-sources/{id}/test:
|
||||
* post:
|
||||
* summary: Check that the source is reachable and the token is accepted
|
||||
* tags:
|
||||
* - Secret Sources
|
||||
*/
|
||||
router.post(
|
||||
"/:id/test",
|
||||
requireCredentials("view") as never,
|
||||
async (req: Request, res: Response) => {
|
||||
const userId = ctx.currentActor()!;
|
||||
try {
|
||||
const source = await repository.findById(String(req.params.id));
|
||||
if (!source || (source.userId !== userId && !source.shared)) {
|
||||
return res.status(404).json({ error: "Secret source not found" });
|
||||
}
|
||||
const token = await tokenStore.getForOwner(source.id, source.userId);
|
||||
if (!token) {
|
||||
return res
|
||||
.status(200)
|
||||
.json({ ok: false, error: "No token stored for this source" });
|
||||
}
|
||||
const vaults = await testConnectSource(ctx.fetch, {
|
||||
baseUrl: source.baseUrl,
|
||||
token,
|
||||
allowedPrivateHosts: await allowedPrivateHosts(),
|
||||
});
|
||||
res.json({ ok: true, vaults });
|
||||
} catch (error) {
|
||||
res.status(200).json({ ok: false, error: errorMessage(error) });
|
||||
}
|
||||
},
|
||||
);
|
||||
}
|
||||
@@ -0,0 +1,42 @@
|
||||
import {
|
||||
adoptLegacyTable,
|
||||
boolean,
|
||||
defineTable,
|
||||
refUser,
|
||||
text,
|
||||
timestamp,
|
||||
varchar,
|
||||
} from "@termix/plugin-sdk/db";
|
||||
|
||||
/**
|
||||
* Adopted from core's secret_sources, so column and index names are the
|
||||
* legacy ones and the rename carries every row across.
|
||||
*
|
||||
* The access token is not a column here: it lives in ctx.secrets under
|
||||
* "source:<id>", the same move the ai plugin made for provider API keys. A
|
||||
* 2.8 database still has a token column, which the boot migration empties
|
||||
* after moving the value.
|
||||
*/
|
||||
export const sources = adoptLegacyTable(
|
||||
"secret_sources",
|
||||
defineTable(
|
||||
"sources",
|
||||
{
|
||||
id: varchar().primaryKey(),
|
||||
userId: refUser(),
|
||||
name: text().notNull(),
|
||||
// "onepassword-connect" for now; the reference syntax is per kind.
|
||||
kind: text().notNull().default("onepassword-connect"),
|
||||
baseUrl: text().notNull(),
|
||||
// Visible to every user; the token still decrypts with the owner's key.
|
||||
shared: boolean().notNull().default(false),
|
||||
createdAt: timestamp().notNull().defaultNow(),
|
||||
updatedAt: timestamp().notNull().defaultNow(),
|
||||
},
|
||||
{
|
||||
indexes: [{ name: "idx_secret_sources_user", columns: ["userId"] }],
|
||||
},
|
||||
),
|
||||
);
|
||||
|
||||
export const tables = [sources];
|
||||
@@ -0,0 +1,37 @@
|
||||
import type { PluginContext } from "@termix/plugin-sdk/backend";
|
||||
|
||||
/**
|
||||
* The access token for one source, kept out of the sources table and in
|
||||
* ctx.secrets instead, the same move the ai plugin made for provider API
|
||||
* keys: encrypted with the installation key rather than the owner's data
|
||||
* key, so it is readable whenever the plugin runs rather than only while the
|
||||
* owner is signed in. A shared source's token is still only ever handed to
|
||||
* its owner's part of the resolve, so a read for any other acting user runs
|
||||
* as the owner through ctx.asUser.
|
||||
*/
|
||||
|
||||
function tokenKey(sourceId: string): string {
|
||||
return `source:${sourceId}`;
|
||||
}
|
||||
|
||||
export function createTokenStore(ctx: PluginContext) {
|
||||
return {
|
||||
async set(sourceId: string, token: string): Promise<void> {
|
||||
await ctx.secrets.set(tokenKey(sourceId), token);
|
||||
},
|
||||
|
||||
async clear(sourceId: string): Promise<void> {
|
||||
await ctx.secrets.delete(tokenKey(sourceId));
|
||||
},
|
||||
|
||||
/** Reads the token as the source's owner, whoever is currently acting. */
|
||||
async getForOwner(
|
||||
sourceId: string,
|
||||
ownerId: string,
|
||||
): Promise<string | null> {
|
||||
return ctx.asUser(ownerId, () => ctx.secrets.get(tokenKey(sourceId)));
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
export type TokenStore = ReturnType<typeof createTokenStore>;
|
||||
@@ -0,0 +1,18 @@
|
||||
import { useTranslation } from "@termix/plugin-sdk/frontend";
|
||||
|
||||
/** One line under a secret field: references are allowed, here is where to set them up. */
|
||||
export function SecretReferenceHint({ onManage }: { onManage: () => void }) {
|
||||
const { t } = useTranslation();
|
||||
return (
|
||||
<p className="text-[10px] text-muted-foreground">
|
||||
{t("hint")}{" "}
|
||||
<button
|
||||
type="button"
|
||||
className="text-accent-brand hover:underline"
|
||||
onClick={onManage}
|
||||
>
|
||||
{t("manage")}
|
||||
</button>
|
||||
</p>
|
||||
);
|
||||
}
|
||||
@@ -0,0 +1,277 @@
|
||||
import { useCallback, useEffect, useMemo, useState } from "react";
|
||||
import { KeyRound, Pencil, Plus, Trash2, X } from "lucide-react";
|
||||
import { toast } from "sonner";
|
||||
import { Button, Input, PasswordInput } from "@termix/plugin-sdk/ui";
|
||||
import { usePluginApi, useTranslation } from "@termix/plugin-sdk/frontend";
|
||||
import {
|
||||
createSecretSourcesApi,
|
||||
type SecretSource,
|
||||
} from "./secret-sources-api";
|
||||
|
||||
function errorMessage(error: unknown): string {
|
||||
if (error && typeof error === "object" && "message" in error) {
|
||||
return String((error as { message?: unknown }).message ?? "");
|
||||
}
|
||||
return String(error);
|
||||
}
|
||||
|
||||
type FormState = {
|
||||
id?: string;
|
||||
name: string;
|
||||
baseUrl: string;
|
||||
token: string;
|
||||
shared: boolean;
|
||||
};
|
||||
|
||||
const emptyForm: FormState = {
|
||||
name: "",
|
||||
baseUrl: "",
|
||||
token: "",
|
||||
shared: false,
|
||||
};
|
||||
|
||||
export function SecretSourceManager({ onClose }: { onClose: () => void }) {
|
||||
const { t } = useTranslation();
|
||||
const pluginApi = usePluginApi();
|
||||
const api = useMemo(() => createSecretSourcesApi(pluginApi), [pluginApi]);
|
||||
const [sources, setSources] = useState<SecretSource[]>([]);
|
||||
const [form, setForm] = useState<FormState | null>(null);
|
||||
const [saving, setSaving] = useState(false);
|
||||
const [testing, setTesting] = useState<string | null>(null);
|
||||
|
||||
const reload = useCallback(async () => {
|
||||
try {
|
||||
setSources(await api.list());
|
||||
} catch (e) {
|
||||
toast.error(errorMessage(e));
|
||||
}
|
||||
}, [api]);
|
||||
|
||||
useEffect(() => {
|
||||
void reload();
|
||||
}, [reload]);
|
||||
|
||||
const setField = <K extends keyof FormState>(key: K, value: FormState[K]) =>
|
||||
setForm((prev) => (prev ? { ...prev, [key]: value } : prev));
|
||||
|
||||
const handleSave = async () => {
|
||||
if (!form) return;
|
||||
if (
|
||||
!form.name.trim() ||
|
||||
!form.baseUrl.trim() ||
|
||||
(!form.id && !form.token)
|
||||
) {
|
||||
toast.error(t("required"));
|
||||
return;
|
||||
}
|
||||
setSaving(true);
|
||||
try {
|
||||
if (form.id) {
|
||||
await api.update(form.id, {
|
||||
name: form.name,
|
||||
baseUrl: form.baseUrl,
|
||||
shared: form.shared,
|
||||
...(form.token ? { token: form.token } : {}),
|
||||
});
|
||||
} else {
|
||||
await api.create({
|
||||
name: form.name,
|
||||
baseUrl: form.baseUrl,
|
||||
token: form.token,
|
||||
shared: form.shared,
|
||||
});
|
||||
}
|
||||
toast.success(t("saved"));
|
||||
setForm(null);
|
||||
await reload();
|
||||
} catch (e) {
|
||||
toast.error(errorMessage(e));
|
||||
} finally {
|
||||
setSaving(false);
|
||||
}
|
||||
};
|
||||
|
||||
const handleDelete = async (source: SecretSource) => {
|
||||
try {
|
||||
await api.remove(source.id);
|
||||
toast.success(t("deleted"));
|
||||
await reload();
|
||||
} catch (e) {
|
||||
toast.error(errorMessage(e));
|
||||
}
|
||||
};
|
||||
|
||||
const handleTest = async (source: SecretSource) => {
|
||||
setTesting(source.id);
|
||||
try {
|
||||
const result = await api.test(source.id);
|
||||
if (result.ok) {
|
||||
toast.success(t("testOk", { count: result.vaults ?? 0 }));
|
||||
} else {
|
||||
toast.error(result.error ?? t("testFailed"));
|
||||
}
|
||||
} catch (e) {
|
||||
toast.error(errorMessage(e));
|
||||
} finally {
|
||||
setTesting(null);
|
||||
}
|
||||
};
|
||||
|
||||
return (
|
||||
<div className="flex flex-col gap-3 col-span-2 border border-border bg-muted/20 p-3">
|
||||
<div className="flex items-center justify-between">
|
||||
<span className="text-[10px] font-bold uppercase tracking-widest text-muted-foreground">
|
||||
{t("title")}
|
||||
</span>
|
||||
<button
|
||||
type="button"
|
||||
onClick={onClose}
|
||||
className="text-muted-foreground hover:text-foreground"
|
||||
>
|
||||
<X className="size-3.5" />
|
||||
</button>
|
||||
</div>
|
||||
<p className="text-[10px] text-muted-foreground">{t("description")}</p>
|
||||
|
||||
{!form && (
|
||||
<>
|
||||
{sources.map((source) => (
|
||||
<div
|
||||
key={source.id}
|
||||
className="flex items-center gap-2 border border-border bg-background px-2 py-1.5 text-xs"
|
||||
>
|
||||
<KeyRound className="size-3.5 text-muted-foreground shrink-0" />
|
||||
<div className="flex-1 min-w-0">
|
||||
<div className="truncate">
|
||||
{source.name}
|
||||
{source.shared && (
|
||||
<span className="ml-1 text-[9px] uppercase text-muted-foreground">
|
||||
{t("shared")}
|
||||
</span>
|
||||
)}
|
||||
</div>
|
||||
<div className="truncate text-[10px] text-muted-foreground">
|
||||
{source.baseUrl}
|
||||
</div>
|
||||
</div>
|
||||
<Button
|
||||
type="button"
|
||||
variant="ghost"
|
||||
size="sm"
|
||||
className="h-6 text-[10px]"
|
||||
disabled={testing === source.id}
|
||||
onClick={() => void handleTest(source)}
|
||||
>
|
||||
{t("test")}
|
||||
</Button>
|
||||
{source.owned && (
|
||||
<>
|
||||
<button
|
||||
type="button"
|
||||
className="text-muted-foreground hover:text-foreground"
|
||||
onClick={() =>
|
||||
setForm({
|
||||
id: source.id,
|
||||
name: source.name,
|
||||
baseUrl: source.baseUrl,
|
||||
token: "",
|
||||
shared: source.shared,
|
||||
})
|
||||
}
|
||||
>
|
||||
<Pencil className="size-3.5" />
|
||||
</button>
|
||||
<button
|
||||
type="button"
|
||||
className="text-muted-foreground hover:text-destructive"
|
||||
onClick={() => void handleDelete(source)}
|
||||
>
|
||||
<Trash2 className="size-3.5" />
|
||||
</button>
|
||||
</>
|
||||
)}
|
||||
</div>
|
||||
))}
|
||||
<Button
|
||||
type="button"
|
||||
variant="outline"
|
||||
size="sm"
|
||||
className="self-start border-accent-brand/40 text-accent-brand"
|
||||
onClick={() => setForm(emptyForm)}
|
||||
>
|
||||
<Plus className="size-3 mr-1" /> {t("new")}
|
||||
</Button>
|
||||
</>
|
||||
)}
|
||||
|
||||
{form && (
|
||||
<div className="flex flex-col gap-2">
|
||||
<div className="grid grid-cols-1 md:grid-cols-2 gap-2">
|
||||
<div className="flex flex-col gap-1">
|
||||
<label className="text-[9px] font-bold uppercase tracking-widest text-muted-foreground">
|
||||
{t("nameLabel")}
|
||||
</label>
|
||||
<Input
|
||||
className="h-8 text-xs"
|
||||
placeholder="Team 1Password"
|
||||
value={form.name}
|
||||
onChange={(e) => setField("name", e.target.value)}
|
||||
/>
|
||||
</div>
|
||||
<div className="flex flex-col gap-1">
|
||||
<label className="text-[9px] font-bold uppercase tracking-widest text-muted-foreground">
|
||||
{t("urlLabel")}
|
||||
</label>
|
||||
<Input
|
||||
className="h-8 text-xs"
|
||||
placeholder="https://connect.internal:8080"
|
||||
value={form.baseUrl}
|
||||
onChange={(e) => setField("baseUrl", e.target.value)}
|
||||
/>
|
||||
</div>
|
||||
</div>
|
||||
<div className="flex flex-col gap-1">
|
||||
<label className="text-[9px] font-bold uppercase tracking-widest text-muted-foreground">
|
||||
{t("tokenLabel")}
|
||||
</label>
|
||||
<PasswordInput
|
||||
className="h-8 text-xs pr-8"
|
||||
placeholder={form.id ? t("tokenKeep") : "eyJhbGciOi..."}
|
||||
value={form.token}
|
||||
onChange={(e) => setField("token", e.target.value)}
|
||||
/>
|
||||
</div>
|
||||
<label className="flex items-center gap-2 text-xs text-foreground">
|
||||
<input
|
||||
type="checkbox"
|
||||
checked={form.shared}
|
||||
onChange={(e) => setField("shared", e.target.checked)}
|
||||
/>
|
||||
{t("sharedLabel")}
|
||||
</label>
|
||||
<div className="flex justify-end gap-2">
|
||||
<Button
|
||||
type="button"
|
||||
variant="ghost"
|
||||
size="sm"
|
||||
onClick={() => setForm(null)}
|
||||
disabled={saving}
|
||||
>
|
||||
{t("common.cancel")}
|
||||
</Button>
|
||||
<Button
|
||||
type="button"
|
||||
variant="outline"
|
||||
size="sm"
|
||||
className="border-accent-brand/40 text-accent-brand"
|
||||
onClick={() => void handleSave()}
|
||||
disabled={saving}
|
||||
>
|
||||
{form.id ? t("common.save") : t("common.create")}
|
||||
</Button>
|
||||
</div>
|
||||
</div>
|
||||
)}
|
||||
</div>
|
||||
);
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
import type { TermixApp } from "@termix/plugin-sdk/frontend";
|
||||
import { SecretSourceManager } from "./SecretSourceManager";
|
||||
import { SecretReferenceHint } from "./SecretReferenceHint";
|
||||
|
||||
export function activate(app: TermixApp): void {
|
||||
app.registerComponent("credentials.secretHint", SecretReferenceHint);
|
||||
app.registerComponent("credentials.secretManager", SecretSourceManager);
|
||||
}
|
||||
@@ -0,0 +1,51 @@
|
||||
import type { PluginApiClient } from "@termix/plugin-sdk/frontend";
|
||||
|
||||
export type SecretSourceKind = "onepassword-connect";
|
||||
|
||||
export interface SecretSource {
|
||||
id: string;
|
||||
name: string;
|
||||
kind: SecretSourceKind;
|
||||
baseUrl: string;
|
||||
shared: boolean;
|
||||
owned: boolean;
|
||||
createdAt: string;
|
||||
updatedAt: string;
|
||||
}
|
||||
|
||||
export interface SecretSourceInput {
|
||||
name: string;
|
||||
baseUrl: string;
|
||||
token: string;
|
||||
shared?: boolean;
|
||||
}
|
||||
|
||||
export interface SecretSourceUpdateInput {
|
||||
name?: string;
|
||||
baseUrl?: string;
|
||||
token?: string;
|
||||
shared?: boolean;
|
||||
}
|
||||
|
||||
/** The secret-sources routes, through the plugin's own client. */
|
||||
export function createSecretSourcesApi(api: PluginApiClient) {
|
||||
const data = async <T>(request: Promise<{ data: T }>) => (await request).data;
|
||||
|
||||
return {
|
||||
list: () =>
|
||||
data(api.get<{ sources: SecretSource[] }>("/")).then((r) => r.sources),
|
||||
create: (body: SecretSourceInput) =>
|
||||
data(api.post<{ source: SecretSource }>("/", body)).then((r) => r.source),
|
||||
update: (id: string, body: SecretSourceUpdateInput) =>
|
||||
data(api.put<{ success: boolean }>(`/${id}`, body)),
|
||||
remove: (id: string) => data(api.delete<{ success: boolean }>(`/${id}`)),
|
||||
test: (id: string) =>
|
||||
data(
|
||||
api.post<{ ok: boolean; vaults?: number; error?: string }>(
|
||||
`/${id}/test`,
|
||||
),
|
||||
),
|
||||
};
|
||||
}
|
||||
|
||||
export type SecretSourcesApi = ReturnType<typeof createSecretSourcesApi>;
|
||||
@@ -0,0 +1,103 @@
|
||||
import http from "node:http";
|
||||
import type { AddressInfo } from "node:net";
|
||||
import { fileURLToPath } from "node:url";
|
||||
import express, { type Router } from "express";
|
||||
import {
|
||||
createMockCtx,
|
||||
createTestDb,
|
||||
type MockPluginContext,
|
||||
type TestDb,
|
||||
} from "@termix/plugin-sdk/testing";
|
||||
import type { PluginManifest } from "@termix/plugin-sdk/manifest";
|
||||
import manifestJson from "../../manifest.json";
|
||||
|
||||
export const pluginDir = fileURLToPath(new URL("../..", import.meta.url));
|
||||
export const manifest = manifestJson as unknown as PluginManifest;
|
||||
|
||||
export const ALL_PERMISSIONS = [
|
||||
"credentials.view",
|
||||
"credentials.create",
|
||||
"credentials.edit",
|
||||
"credentials.delete",
|
||||
];
|
||||
|
||||
export interface TestServer {
|
||||
db: TestDb;
|
||||
mock: MockPluginContext;
|
||||
request: (
|
||||
method: string,
|
||||
path: string,
|
||||
options?: { user?: string; body?: unknown },
|
||||
// Route bodies vary per test; asserting on them is the point.
|
||||
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
||||
) => Promise<{ status: number; body: any }>;
|
||||
close: () => Promise<void>;
|
||||
}
|
||||
|
||||
/**
|
||||
* The plugin activated against a real in-memory database, its router mounted
|
||||
* on an express app the way core mounts it: JSON parsed, the acting user set
|
||||
* from the request, everything else left to the plugin.
|
||||
*/
|
||||
export async function startServer(
|
||||
options: {
|
||||
permissions?: string[];
|
||||
users?: string[];
|
||||
fetch?: (url: string, init?: unknown) => Promise<Response>;
|
||||
} = {},
|
||||
): Promise<TestServer> {
|
||||
const db = await createTestDb(pluginDir);
|
||||
for (const user of options.users ?? ["user-1", "user-2"]) {
|
||||
db.sqlite
|
||||
.prepare("INSERT INTO users (id, username) VALUES (?, ?)")
|
||||
.run(user, user);
|
||||
}
|
||||
|
||||
let router: Router | null = null;
|
||||
const mock = createMockCtx({
|
||||
pluginId: manifest.id,
|
||||
manifest,
|
||||
capabilities: manifest.capabilities,
|
||||
db: db.database,
|
||||
router: () => (router = express.Router()),
|
||||
permissions: options.permissions ?? ALL_PERMISSIONS,
|
||||
fetch: options.fetch as never,
|
||||
});
|
||||
|
||||
const { activate } = await import("../../src/backend/index.js");
|
||||
await activate(mock.ctx);
|
||||
|
||||
const app = express();
|
||||
app.use(express.json());
|
||||
app.use((req, _res, next) => {
|
||||
mock.setActor(req.header("x-test-user") ?? undefined);
|
||||
next();
|
||||
});
|
||||
app.use((req, res, next) => router!(req, res, next));
|
||||
|
||||
const server = http.createServer(app);
|
||||
await new Promise<void>((resolve) => server.listen(0, resolve));
|
||||
const { port } = server.address() as AddressInfo;
|
||||
|
||||
return {
|
||||
db,
|
||||
mock,
|
||||
async request(method, path, { user = "user-1", body: given } = {}) {
|
||||
const body = method === "GET" ? undefined : given;
|
||||
const response = await fetch(`http://127.0.0.1:${port}${path}`, {
|
||||
method,
|
||||
headers: {
|
||||
"x-test-user": user,
|
||||
...(body !== undefined ? { "content-type": "application/json" } : {}),
|
||||
},
|
||||
body: body !== undefined ? JSON.stringify(body) : undefined,
|
||||
});
|
||||
const text = await response.text();
|
||||
return { status: response.status, body: text ? JSON.parse(text) : null };
|
||||
},
|
||||
async close() {
|
||||
await new Promise<void>((resolve) => server.close(() => resolve()));
|
||||
db.close();
|
||||
},
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,117 @@
|
||||
import { describe, expect, it, vi } from "vitest";
|
||||
import {
|
||||
parseSecretReference,
|
||||
resolveConnectReference,
|
||||
testConnectSource,
|
||||
} from "../../src/backend/onepassword-connect.js";
|
||||
import type { PluginFetch } from "@termix/plugin-sdk/backend";
|
||||
|
||||
function jsonResponse(body: unknown, ok = true, status = 200): Response {
|
||||
return {
|
||||
ok,
|
||||
status,
|
||||
json: async () => body,
|
||||
} as unknown as Response;
|
||||
}
|
||||
|
||||
describe("1Password secret references", () => {
|
||||
it("parses op://vault/item/field, ignoring a query suffix", () => {
|
||||
expect(parseSecretReference("op://Infra/prod-db/password")).toEqual({
|
||||
vault: "Infra",
|
||||
item: "prod-db",
|
||||
field: "password",
|
||||
});
|
||||
expect(
|
||||
parseSecretReference(
|
||||
"op://Infra/deploy key/private key?ssh-format=openssh",
|
||||
),
|
||||
).toEqual({ vault: "Infra", item: "deploy key", field: "private key" });
|
||||
expect(parseSecretReference("op://Infra/only-two")).toBeNull();
|
||||
expect(parseSecretReference("https://x")).toBeNull();
|
||||
});
|
||||
});
|
||||
|
||||
describe("testConnectSource", () => {
|
||||
it("returns the vault count when the token is valid", async () => {
|
||||
const fetch = vi.fn().mockResolvedValue(
|
||||
jsonResponse([
|
||||
{ id: "v1", name: "Infra" },
|
||||
{ id: "v2", name: "Dev" },
|
||||
]),
|
||||
) as unknown as PluginFetch;
|
||||
|
||||
const count = await testConnectSource(fetch, {
|
||||
baseUrl: "https://connect.internal",
|
||||
token: "tok",
|
||||
allowedPrivateHosts: ["connect.internal"],
|
||||
});
|
||||
expect(count).toBe(2);
|
||||
expect(fetch).toHaveBeenCalledWith(
|
||||
"https://connect.internal/v1/vaults",
|
||||
expect.objectContaining({
|
||||
headers: { Authorization: "Bearer tok" },
|
||||
allowPrivateHosts: ["connect.internal"],
|
||||
}),
|
||||
);
|
||||
});
|
||||
|
||||
it("throws when the server answers with a non-2xx status", async () => {
|
||||
const fetch = vi
|
||||
.fn()
|
||||
.mockResolvedValue(
|
||||
jsonResponse([], false, 401),
|
||||
) as unknown as PluginFetch;
|
||||
|
||||
await expect(
|
||||
testConnectSource(fetch, {
|
||||
baseUrl: "https://connect.internal",
|
||||
token: "bad",
|
||||
allowedPrivateHosts: [],
|
||||
}),
|
||||
).rejects.toThrow(/HTTP 401/);
|
||||
});
|
||||
});
|
||||
|
||||
describe("resolveConnectReference", () => {
|
||||
it("resolves a field by label across vault, item and field lookups", async () => {
|
||||
const fetch = vi
|
||||
.fn()
|
||||
.mockResolvedValueOnce(jsonResponse([{ id: "vid", name: "Infra" }]))
|
||||
.mockResolvedValueOnce(jsonResponse([{ id: "iid", title: "prod-db" }]))
|
||||
.mockResolvedValueOnce(
|
||||
jsonResponse({
|
||||
fields: [{ id: "f1", label: "password", value: "s3cret" }],
|
||||
}),
|
||||
) as unknown as PluginFetch;
|
||||
|
||||
const value = await resolveConnectReference(
|
||||
fetch,
|
||||
{
|
||||
baseUrl: "https://connect.internal",
|
||||
token: "tok",
|
||||
allowedPrivateHosts: [],
|
||||
},
|
||||
{ vault: "Infra", item: "prod-db", field: "password" },
|
||||
);
|
||||
expect(value).toBe("s3cret");
|
||||
});
|
||||
|
||||
it("fails clearly when the vault is not found", async () => {
|
||||
const fetch = vi
|
||||
.fn()
|
||||
.mockResolvedValueOnce(jsonResponse([]))
|
||||
.mockResolvedValueOnce(jsonResponse([])) as unknown as PluginFetch;
|
||||
|
||||
await expect(
|
||||
resolveConnectReference(
|
||||
fetch,
|
||||
{
|
||||
baseUrl: "https://connect.internal",
|
||||
token: "tok",
|
||||
allowedPrivateHosts: [],
|
||||
},
|
||||
{ vault: "Missing", item: "x", field: "y" },
|
||||
),
|
||||
).rejects.toThrow(/vault "Missing" not found/);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,93 @@
|
||||
import { fileURLToPath } from "node:url";
|
||||
import { describe, expect, it, vi } from "vitest";
|
||||
import { createMockCtx, createTestDb } from "@termix/plugin-sdk/testing";
|
||||
import { createSecretSourceRepository } from "../../src/backend/repository.js";
|
||||
import { createTokenStore } from "../../src/backend/token-store.js";
|
||||
import { registerOnePasswordResolver } from "../../src/backend/resolver.js";
|
||||
import { sources } from "../../src/backend/tables.js";
|
||||
import manifestJson from "../../manifest.json";
|
||||
import type { PluginManifest } from "@termix/plugin-sdk/manifest";
|
||||
|
||||
const manifest = manifestJson as unknown as PluginManifest;
|
||||
const pluginDir = fileURLToPath(new URL("../..", import.meta.url));
|
||||
|
||||
function jsonResponse(body: unknown): Response {
|
||||
return {
|
||||
ok: true,
|
||||
status: 200,
|
||||
json: async () => body,
|
||||
} as unknown as Response;
|
||||
}
|
||||
|
||||
async function setUp(fetchMock: ReturnType<typeof vi.fn>) {
|
||||
const db = await createTestDb(pluginDir);
|
||||
db.sqlite
|
||||
.prepare("INSERT INTO users (id, username) VALUES (?, ?)")
|
||||
.run("owner-1", "owner-1");
|
||||
|
||||
const mock = createMockCtx({
|
||||
pluginId: manifest.id,
|
||||
manifest,
|
||||
capabilities: manifest.capabilities,
|
||||
db: db.database,
|
||||
actor: "owner-1",
|
||||
fetch: fetchMock as never,
|
||||
});
|
||||
|
||||
const table = await mock.ctx.db.define(sources);
|
||||
const repository = createSecretSourceRepository(mock.ctx.db, table as never);
|
||||
const tokenStore = createTokenStore(mock.ctx);
|
||||
registerOnePasswordResolver(mock.ctx, repository, tokenStore);
|
||||
|
||||
const resolve = mock.auth.secretResolvers.get("op");
|
||||
if (!resolve) throw new Error("resolver was not registered");
|
||||
|
||||
return { db, repository, tokenStore, resolve };
|
||||
}
|
||||
|
||||
describe("op:// secret resolver", () => {
|
||||
it("registers under the declared scheme", async () => {
|
||||
const { resolve } = await setUp(vi.fn());
|
||||
expect(typeof resolve).toBe("function");
|
||||
});
|
||||
|
||||
it("resolves through the owner's source", async () => {
|
||||
const fetchMock = vi
|
||||
.fn()
|
||||
.mockResolvedValueOnce(jsonResponse([{ id: "vid", name: "Infra" }]))
|
||||
.mockResolvedValueOnce(jsonResponse([{ id: "iid", title: "prod-db" }]))
|
||||
.mockResolvedValueOnce(
|
||||
jsonResponse({
|
||||
fields: [{ id: "f1", label: "password", value: "s3cret" }],
|
||||
}),
|
||||
);
|
||||
const { repository, tokenStore, resolve } = await setUp(fetchMock);
|
||||
|
||||
const source = await repository.create({
|
||||
id: "src-1",
|
||||
userId: "owner-1",
|
||||
name: "n",
|
||||
kind: "onepassword-connect",
|
||||
baseUrl: "https://connect.internal",
|
||||
shared: false,
|
||||
});
|
||||
await tokenStore.set(source.id, "tok");
|
||||
|
||||
const value = await resolve("owner-1", "op://Infra/prod-db/password");
|
||||
expect(value).toBe("s3cret");
|
||||
});
|
||||
|
||||
it("fails clearly with no configured source", async () => {
|
||||
const { resolve } = await setUp(vi.fn());
|
||||
await expect(
|
||||
resolve("nobody", "op://Infra/prod-db/password"),
|
||||
).rejects.toThrow(/no secret source is configured/);
|
||||
});
|
||||
|
||||
it("rejects a malformed reference", async () => {
|
||||
const { resolve } = await setUp(vi.fn());
|
||||
await expect(resolve("owner-1", "op://only-two")).rejects.toThrow(
|
||||
/Invalid secret reference/,
|
||||
);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,177 @@
|
||||
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
|
||||
import { startServer, type TestServer } from "./helpers.js";
|
||||
|
||||
function jsonResponse(body: unknown, ok = true, status = 200): Response {
|
||||
return { ok, status, json: async () => body } as unknown as Response;
|
||||
}
|
||||
|
||||
let server: TestServer;
|
||||
|
||||
afterEach(async () => {
|
||||
await server?.close();
|
||||
});
|
||||
|
||||
describe("secret-sources routes", () => {
|
||||
beforeEach(async () => {
|
||||
server = await startServer();
|
||||
});
|
||||
|
||||
it("refuses a request without the matching core permission", async () => {
|
||||
await server.close();
|
||||
server = await startServer({ permissions: [] });
|
||||
const res = await server.request("GET", "/");
|
||||
expect(res.status).toBe(403);
|
||||
});
|
||||
|
||||
it("creates, lists and hides the token from the owner's own list", async () => {
|
||||
const create = await server.request("POST", "/", {
|
||||
body: {
|
||||
name: "Team 1Password",
|
||||
baseUrl: "https://connect.internal",
|
||||
token: "s3cret-token",
|
||||
},
|
||||
});
|
||||
expect(create.status).toBe(200);
|
||||
expect(create.body.source).toMatchObject({
|
||||
name: "Team 1Password",
|
||||
baseUrl: "https://connect.internal",
|
||||
owned: true,
|
||||
shared: false,
|
||||
});
|
||||
expect(create.body.source.token).toBeUndefined();
|
||||
|
||||
const list = await server.request("GET", "/");
|
||||
expect(list.body.sources).toHaveLength(1);
|
||||
expect(list.body.sources[0].owned).toBe(true);
|
||||
});
|
||||
|
||||
it("rejects a create missing a required field", async () => {
|
||||
const res = await server.request("POST", "/", {
|
||||
body: { name: "", baseUrl: "https://x", token: "t" },
|
||||
});
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
|
||||
it("rejects an http(s)-only baseUrl", async () => {
|
||||
const res = await server.request("POST", "/", {
|
||||
body: { name: "n", baseUrl: "ftp://x", token: "t" },
|
||||
});
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
|
||||
it("refuses shared: true for a non-admin", async () => {
|
||||
const res = await server.request("POST", "/", {
|
||||
body: {
|
||||
name: "n",
|
||||
baseUrl: "https://connect.internal",
|
||||
token: "t",
|
||||
shared: true,
|
||||
},
|
||||
});
|
||||
expect(res.status).toBe(403);
|
||||
});
|
||||
|
||||
it("allows shared: true for an admin", async () => {
|
||||
await server.close();
|
||||
server = await startServer({
|
||||
permissions: [
|
||||
"credentials.view",
|
||||
"credentials.create",
|
||||
"credentials.edit",
|
||||
"credentials.delete",
|
||||
"admin.plugins.manage",
|
||||
],
|
||||
});
|
||||
const res = await server.request("POST", "/", {
|
||||
body: {
|
||||
name: "n",
|
||||
baseUrl: "https://connect.internal",
|
||||
token: "t",
|
||||
shared: true,
|
||||
},
|
||||
});
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.source.shared).toBe(true);
|
||||
});
|
||||
|
||||
it("shows a shared source to another user, unowned", async () => {
|
||||
await server.close();
|
||||
server = await startServer({
|
||||
permissions: [
|
||||
"credentials.view",
|
||||
"credentials.create",
|
||||
"credentials.edit",
|
||||
"credentials.delete",
|
||||
"admin.plugins.manage",
|
||||
],
|
||||
});
|
||||
await server.request("POST", "/", {
|
||||
body: { name: "n", baseUrl: "https://x", token: "t", shared: true },
|
||||
});
|
||||
const list = await server.request("GET", "/", { user: "user-2" });
|
||||
expect(list.body.sources).toHaveLength(1);
|
||||
expect(list.body.sources[0].owned).toBe(false);
|
||||
});
|
||||
|
||||
it("refuses an update or delete from a non-owner", async () => {
|
||||
const created = await server.request("POST", "/", {
|
||||
body: { name: "n", baseUrl: "https://x", token: "t" },
|
||||
});
|
||||
const id = created.body.source.id;
|
||||
|
||||
const update = await server.request("PUT", `/${id}`, {
|
||||
user: "user-2",
|
||||
body: { name: "hijacked" },
|
||||
});
|
||||
expect(update.status).toBe(403);
|
||||
|
||||
const del = await server.request("DELETE", `/${id}`, { user: "user-2" });
|
||||
expect(del.status).toBe(403);
|
||||
});
|
||||
|
||||
it("updates without a token keeping the existing one, and deletes cleanly", async () => {
|
||||
const created = await server.request("POST", "/", {
|
||||
body: { name: "n", baseUrl: "https://x", token: "orig-token" },
|
||||
});
|
||||
const id = created.body.source.id;
|
||||
|
||||
const update = await server.request("PUT", `/${id}`, {
|
||||
body: { name: "renamed" },
|
||||
});
|
||||
expect(update.status).toBe(200);
|
||||
|
||||
const test = await server.request("POST", `/${id}/test`);
|
||||
// Reaches out through ctx.fetch, unstubbed here, so it fails softly.
|
||||
expect(test.status).toBe(200);
|
||||
expect(test.body.ok).toBe(false);
|
||||
|
||||
const del = await server.request("DELETE", `/${id}`);
|
||||
expect(del.status).toBe(200);
|
||||
|
||||
const list = await server.request("GET", "/");
|
||||
expect(list.body.sources).toHaveLength(0);
|
||||
});
|
||||
|
||||
it("tests a source through ctx.fetch and reports the vault count", async () => {
|
||||
await server.close();
|
||||
const fetchMock = vi
|
||||
.fn()
|
||||
.mockResolvedValue(jsonResponse([{ id: "v1", name: "Infra" }]));
|
||||
server = await startServer({ fetch: fetchMock });
|
||||
|
||||
const created = await server.request("POST", "/", {
|
||||
body: { name: "n", baseUrl: "https://connect.internal", token: "tok" },
|
||||
});
|
||||
const id = created.body.source.id;
|
||||
|
||||
const test = await server.request("POST", `/${id}/test`);
|
||||
expect(test.status).toBe(200);
|
||||
expect(test.body).toEqual({ ok: true, vaults: 1 });
|
||||
expect(fetchMock).toHaveBeenCalledWith(
|
||||
"https://connect.internal/v1/vaults",
|
||||
expect.objectContaining({
|
||||
headers: { Authorization: "Bearer tok" },
|
||||
}),
|
||||
);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,46 @@
|
||||
import { describe, expect, it } from "vitest";
|
||||
import { createMockCtx } from "@termix/plugin-sdk/testing";
|
||||
import { createTokenStore } from "../../src/backend/token-store.js";
|
||||
import manifestJson from "../../manifest.json";
|
||||
import type { PluginManifest } from "@termix/plugin-sdk/manifest";
|
||||
|
||||
const manifest = manifestJson as unknown as PluginManifest;
|
||||
|
||||
function mockCtx(actor?: string) {
|
||||
return createMockCtx({
|
||||
pluginId: manifest.id,
|
||||
manifest,
|
||||
capabilities: manifest.capabilities,
|
||||
actor,
|
||||
});
|
||||
}
|
||||
|
||||
describe("token store", () => {
|
||||
it("stores and reads back a token for the acting user", async () => {
|
||||
const { ctx } = mockCtx("owner-1");
|
||||
const store = createTokenStore(ctx);
|
||||
|
||||
await store.set("src-1", "s3cret");
|
||||
await expect(store.getForOwner("src-1", "owner-1")).resolves.toBe("s3cret");
|
||||
});
|
||||
|
||||
it("reads the owner's token for a caller currently acting as someone else", async () => {
|
||||
const { ctx, setActor } = mockCtx("owner-1");
|
||||
const store = createTokenStore(ctx);
|
||||
await store.set("src-1", "s3cret");
|
||||
|
||||
// A shared source's test/resolve runs as the recipient viewing it.
|
||||
setActor("recipient-1");
|
||||
await expect(store.getForOwner("src-1", "owner-1")).resolves.toBe("s3cret");
|
||||
// ctx.asUser restores the previous actor once it returns.
|
||||
expect(ctx.currentActor()).toBe("recipient-1");
|
||||
});
|
||||
|
||||
it("clears a token", async () => {
|
||||
const { ctx } = mockCtx("owner-1");
|
||||
const store = createTokenStore(ctx);
|
||||
await store.set("src-1", "s3cret");
|
||||
await store.clear("src-1");
|
||||
await expect(store.getForOwner("src-1", "owner-1")).resolves.toBeNull();
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,61 @@
|
||||
import { afterEach, describe, expect, it, vi } from "vitest";
|
||||
import { render, screen } from "@testing-library/react";
|
||||
import {
|
||||
renderWithApp,
|
||||
type RenderedPluginApp,
|
||||
} from "@termix/plugin-sdk/testing";
|
||||
import { PluginComponent } from "@termix/plugin-sdk/ui";
|
||||
import type { PluginManifest } from "@termix/plugin-sdk/manifest";
|
||||
import * as plugin from "../../src/frontend/index";
|
||||
import manifestJson from "../../manifest.json";
|
||||
import locales from "../../locales/en.json";
|
||||
|
||||
const manifest = manifestJson as unknown as PluginManifest;
|
||||
|
||||
let rendered: RenderedPluginApp | null = null;
|
||||
|
||||
afterEach(async () => {
|
||||
await rendered?.deactivate();
|
||||
rendered = null;
|
||||
});
|
||||
|
||||
describe(`${manifest.id} activate`, () => {
|
||||
it("registers the hint and manager components", async () => {
|
||||
rendered = await renderWithApp(plugin, { manifest, locales });
|
||||
render(
|
||||
<PluginComponent
|
||||
id="credentials.secretHint"
|
||||
onManage={vi.fn()}
|
||||
fallback={<span>fallback</span>}
|
||||
/>,
|
||||
);
|
||||
expect(await screen.findByText(locales.hint)).toBeTruthy();
|
||||
});
|
||||
|
||||
it("renders the manager and can be closed", async () => {
|
||||
rendered = await renderWithApp(plugin, {
|
||||
manifest,
|
||||
locales,
|
||||
api: {
|
||||
get: vi.fn(async () => ({ data: { sources: [] } })),
|
||||
} as never,
|
||||
});
|
||||
const onClose = vi.fn();
|
||||
render(
|
||||
<PluginComponent id="credentials.secretManager" onClose={onClose} />,
|
||||
);
|
||||
expect(await screen.findByText(locales.title)).toBeTruthy();
|
||||
});
|
||||
|
||||
it("removes both components on deactivate", async () => {
|
||||
const app = await renderWithApp(plugin, { manifest, locales });
|
||||
await app.deactivate();
|
||||
render(
|
||||
<PluginComponent
|
||||
id="credentials.secretHint"
|
||||
fallback={<span>gone</span>}
|
||||
/>,
|
||||
);
|
||||
expect(await screen.findByText("gone")).toBeTruthy();
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,4 @@
|
||||
{
|
||||
"extends": "@termix/plugin-sdk/tsconfig.plugin.json",
|
||||
"include": ["src/**/*.ts", "src/**/*.tsx", "tests/**/*.ts", "tests/**/*.tsx"]
|
||||
}
|
||||
@@ -0,0 +1,3 @@
|
||||
import { pluginVitestConfig } from "@termix/plugin-sdk/vitest-preset";
|
||||
|
||||
export default pluginVitestConfig(import.meta.url);
|
||||
Reference in new issue
Block a user