release-2.7.1 (#1296)

* Add Helm and GitOps deployment setup

* fix: build better-sqlite3 from source in Docker (#1267)

* fix: preserve runtime SSL settings (#1268)

* fix: support forwarding from the memory SSH agent (#1269)

* fix: support forwarding from the memory agent

* style: format memory agent test

* fix: prompt for encrypted SFTP key passphrases (#1270)

* fix: prompt for SFTP key passphrases

* style: format SSH key utility test

* fix: include host context in automation notifications (#1271)

* fix: include host context in automation notifications

* style: format automation notification changes

* fix: reserve sidebar height for host tags (#1272)

* fix: keep host action rows stable at large font sizes (#1273)

* fix: honor certificate setting during server probe (#1274)

* fix: package standard Linux icon sizes (#1275)

* fix: avoid duplicate Docker HTTPS listener (#1276)

* Fix host status without metrics collection (#1277)

* fix: allow eight-digit secure auth codes (#1263)

Allow TOTP prompts to accept secure auth codes longer than six digits without blocking valid authentication attempts.

Generated with Codebuff 🤖

Co-authored-by: Chetan <chetan.development@gmail.com>
Co-authored-by: Codebuff <noreply@codebuff.com>

* Harden Helm deployment defaults

* Update Helm workflow action

* Exclude Helm templates from Prettier

* Fix browser RDP file drops (#1279)

* Fix Proxmox guest credential usernames (#1280)

* Add WSL local terminal option (#1281)

* refactor: split the transfer engine into focused modules (#1282)

* refactor: extract SFTP promisify helpers into sftp-promisify module

* refactor: extract transfer timing and rate stats into transfer-stats module

* refactor: extract transfer error classes and recovery checks into transfer-errors module

* refactor: extract host/path utility helpers into transfer-host-utils module

* refactor: extract SFTP directory tree helpers into transfer-sftp-dir module

* refactor: extract segment copy job builder into transfer-segment-copy module

* refactor: extract file scan and sample helpers into transfer-scan module

* refactor: move throttled progress helper into transfer-stats module

* style: format transfer modules

* perf: optimize tmux monitor aggregation (#1283)

* fix: reserve credential tag row height (#1284)

* feat: edit AI provider model settings (#1285)

* fix: clarify click-to-expand host setting (#1286)

* fix: allow portable imports on remote databases (#1287)

* fix: allow HTTPS to share the configured port (#1288)

* fix: resolve synced jump hosts on the server (#1289)

* fix: make terminal clipboard shortcuts layout independent (#1290)

* fix: use compatible fetch dispatcher for Tailscale (#1291)

* fix: add OIDC environment recovery override (#1292)

* fix: coalesce rapid mobile terminal input (#1293)

* fix: coalesce rapid mobile terminal input

* fix: support clean xterm patch installs

* fix: resolve synced remote desktop host IDs (#1295)

* feat: make the SFTP file manager path bar editable (#1294)

Co-authored-by: Maxime Bonillo <257463937+dropafterfree@users.noreply.github.com>
Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com>

* feat: add passkey sign in to the login screen

* fix: remove rounded corners from the host list search bar

* fix: stop image storage settings text wrapping to one word per line

* fix: prevent malformed websocket messages from crashing the server

* chore: increment version

* fix: remove gaps between host rows in the sidebar list

Keep sub-pixel row measurements and stop wiping the size cache on hover.

* fix: Failed to connect through jump hosts (#1180)

https://github.com/Termix-SSH/Support/issues/1180

* feat: Progress bar for file downloads in the file manager (#1158)

https://github.com/Termix-SSH/Support/issues/1158

* feat: Allow setting Silent OIDC Login via ENV var (#1174)

https://github.com/Termix-SSH/Support/issues/1174

* feat: `IdentityFile` to limit the number of attempts by agents (#1165)

https://github.com/Termix-SSH/Support/issues/1165

* feat: Credentials clone (#1159)

https://github.com/Termix-SSH/Support/issues/1159

* chore: update release notes

* docs: move helm setup guide to the docs site

* fix: type errors in FilteredAgent agent identity handling

* fix: remove stale better-sqlite3 prebuilds so the source build is used

* fix: actually build better-sqlite3 from source so arm64 docker images work

* fix: credential edit pencil in host editor and add clone action to credential list

* fix: clear editingHost so the credential pencil actually opens the editor

* chore: run format and lint

* fix: folder drag and drop upload failing in the file manager

* chore: sync Crowdin translations for 2.7.1

---------

Co-authored-by: alex-ctms <alex-ctms@users.noreply.github.com>
Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com>
Co-authored-by: Chetan Kumar <74929596+ckloop@users.noreply.github.com>
Co-authored-by: Chetan <chetan.development@gmail.com>
Co-authored-by: Codebuff <noreply@codebuff.com>
Co-authored-by: ZacharyZcR <payasonorahc@protonmail.com>
Co-authored-by: dropafterfree <maxime.bonillo@gmail.com>
Co-authored-by: Maxime Bonillo <257463937+dropafterfree@users.noreply.github.com>

src/backend/tests/database/repositories/host-repository.test.ts

@@ -1,7 +1,8 @@
 import { sql } from "drizzle-orm";
-import { afterEach, describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 import { TestSqliteDatabase } from "./test-support.js";
 import { HostRepository } from "../../../database/repositories/host-repository.js";
+import { DataCrypto } from "../../../utils/data-crypto.js";
 
 describe("HostRepository.reorderForUser", () => {
   let adapter: TestSqliteDatabase | null = null;
@@ -72,3 +73,100 @@ describe("HostRepository.reorderForUser", () => {
     await expect(repo.reorderForUser("user-1", [])).resolves.toBe(0);
   });
 });
+
+describe("HostRepository Proxmox sync inserts", () => {
+  let adapter: TestSqliteDatabase | null = null;
+
+  afterEach(async () => {
+    vi.restoreAllMocks();
+    await adapter?.close();
+    adapter = null;
+  });
+
+  it("creates a discovered guest using the scheduled-sync payload", async () => {
+    adapter = new TestSqliteDatabase();
+    const context = await adapter.connect();
+    await adapter.exec(`
+      INSERT INTO users (id, username, password_hash)
+      VALUES ('user-1', 'alice', 'hash');
+      INSERT INTO ssh_credentials (id, user_id, name, auth_type, username)
+      VALUES (7, 'user-1', 'guest key', 'key', 'alice');
+    `);
+    const repository = new HostRepository(context);
+    const now = new Date().toISOString();
+    vi.spyOn(DataCrypto, "validateUserAccess").mockReturnValue(
+      Buffer.alloc(32, 1),
+    );
+
+    const created = await repository.createEncryptedForUser("user-1", {
+      userId: "user-1",
+      name: "guest",
+      ip: "10.0.0.8",
+      port: 22,
+      username: "",
+      connectionType: "ssh",
+      folder: "Proxmox",
+      tags: "proxmox,qemu,node-1,vm-100",
+      proxmoxConfig: JSON.stringify({
+        source: {
+          source: "proxmox",
+          sourceHostId: 1,
+          node: "node-1",
+          vmid: 100,
+          type: "qemu",
+        },
+      }),
+      updatedAt: now,
+      createdAt: now,
+      pin: false,
+      authType: "credential",
+      credentialId: 7,
+      overrideCredentialUsername: 0,
+      password: null,
+      key: null,
+      keyPassword: null,
+      keyType: null,
+      enableTerminal: true,
+      enableFileManager: true,
+      enableTunnel: true,
+      enableDocker: false,
+      enableSsh: true,
+      enableRdp: false,
+      rdpUser: null,
+      rdpPassword: null,
+      rdpDomain: null,
+      rdpSecurity: null,
+      rdpIgnoreCert: 0,
+      rdpPort: null,
+      vncUser: null,
+      vncPassword: null,
+      vncPort: null,
+      telnetUser: null,
+      telnetPassword: null,
+      telnetPort: null,
+      defaultPath: "/",
+      tunnelConnections: "[]",
+      jumpHosts: null,
+      quickActions: null,
+      statsConfig: null,
+      dockerConfig: null,
+      terminalConfig: null,
+      forceKeyboardInteractive: "false",
+      useSocks5: 0,
+      socks5Host: null,
+      socks5Port: null,
+      socks5Username: null,
+      socks5Password: null,
+      socks5ProxyChain: null,
+      portKnockSequence: null,
+      showTerminalInSidebar: 0,
+      showFileManagerInSidebar: 0,
+      showTunnelInSidebar: 0,
+      showDockerInSidebar: 0,
+      showServerStatsInSidebar: 0,
+    });
+
+    expect(created.username).toBe("");
+    expect(created.credentialId).toBe(7);
+  });
+});

src/backend/tests/database/repositories/sqlite-foreign-keys.test.ts

@@ -0,0 +1,51 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+const factory = vi.hoisted(() => ({
+  getCurrentRepositorySqlite: vi.fn(),
+}));
+
+vi.mock("../../../database/repositories/factory.js", () => factory);
+
+import {
+  withCurrentSqliteForeignKeysDisabled,
+  withSqliteForeignKeysDisabled,
+} from "../../../database/repositories/sqlite-foreign-keys.js";
+
+const previousDatabaseDialect = process.env.DATABASE_DIALECT;
+
+afterEach(() => {
+  if (previousDatabaseDialect === undefined)
+    delete process.env.DATABASE_DIALECT;
+  else process.env.DATABASE_DIALECT = previousDatabaseDialect;
+  vi.clearAllMocks();
+});
+
+describe("withSqliteForeignKeysDisabled", () => {
+  it("restores foreign keys after an import", async () => {
+    const sqlite = { exec: vi.fn() };
+
+    await expect(
+      withSqliteForeignKeysDisabled(sqlite, async () => "imported"),
+    ).resolves.toBe("imported");
+    expect(sqlite.exec.mock.calls).toEqual([
+      ["PRAGMA foreign_keys = OFF"],
+      ["PRAGMA foreign_keys = ON"],
+    ]);
+  });
+});
+
+describe("withCurrentSqliteForeignKeysDisabled", () => {
+  it.each(["postgres", "mysql"])(
+    "runs portable imports with constraints enabled on %s",
+    async (dialect) => {
+      process.env.DATABASE_DIALECT = dialect;
+      const operation = vi.fn().mockResolvedValue("imported");
+
+      await expect(
+        withCurrentSqliteForeignKeysDisabled(operation),
+      ).resolves.toBe("imported");
+      expect(operation).toHaveBeenCalledOnce();
+      expect(factory.getCurrentRepositorySqlite).not.toHaveBeenCalled();
+    },
+  );
+});

src/backend/tests/database/routes/proxmox-import-auth.test.ts

@@ -9,7 +9,7 @@ describe("resolveProxmoxImportAuth", () => {
     expect(resolveProxmoxImportAuth("key", 7)).toEqual({
       authType: "credential",
       credentialId: 7,
-      overrideCredentialUsername: 1,
+      overrideCredentialUsername: 0,
     });
   });
 
@@ -17,7 +17,7 @@ describe("resolveProxmoxImportAuth", () => {
     expect(resolveProxmoxImportAuth("password", 7)).toEqual({
       authType: "credential",
       credentialId: 7,
-      overrideCredentialUsername: 1,
+      overrideCredentialUsername: 0,
     });
   });
 
@@ -35,7 +35,7 @@ describe("resolveProxmoxImportAuth", () => {
     expect(resolveProxmoxImportAuth(undefined, 42)).toEqual({
       authType: "credential",
       credentialId: 42,
-      overrideCredentialUsername: 1,
+      overrideCredentialUsername: 0,
     });
     expect(resolveProxmoxImportAuth(undefined, null)).toEqual({
       authType: "none",

src/backend/tests/database/routes/sso-provider-routes.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("../../../utils/auth-manager.js", () => ({
+  AuthManager: {
+    getInstance: () => ({ createAdminMiddleware: vi.fn() }),
+  },
+}));
+
+const { isValidOidcIssuer } =
+  await import("../../../database/routes/sso-provider-routes.js");
+
+describe("isValidOidcIssuer", () => {
+  it("rejects userinfo endpoints used as issuer URLs", () => {
+    expect(
+      isValidOidcIssuer("https://auth.example/application/o/userinfo/"),
+    ).toBe(false);
+  });
+
+  it("accepts an Authentik application issuer", () => {
+    expect(isValidOidcIssuer("https://auth.example/application/o/termix")).toBe(
+      true,
+    );
+  });
+});

src/backend/tests/database/routes/user-oidc-utils.test.ts

@@ -21,6 +21,7 @@ const {
   resolveOidcMappedRoles,
   verifyOIDCToken,
   describeFetchFailure,
+  isOIDCEnvOverrideEnabled,
 } = await import("../../../database/routes/user-oidc-utils.js");
 
 const BACKCHANNEL_LOGOUT_EVENT =
@@ -281,6 +282,7 @@ describe("getOIDCConfigFromEnv", () => {
     "OIDC_SCOPES",
     "OIDC_ALLOWED_USERS",
     "OIDC_ADMIN_GROUP",
+    "OIDC_ENV_OVERRIDE",
   ];
   const saved: Record<string, string | undefined> = {};
 
@@ -334,6 +336,12 @@ describe("getOIDCConfigFromEnv", () => {
     expect(config?.identifier_path).toBe("email");
     expect(config?.scopes).toBe("openid");
   });
+
+  it("only enables database recovery override when explicitly requested", () => {
+    expect(isOIDCEnvOverrideEnabled()).toBe(false);
+    process.env.OIDC_ENV_OVERRIDE = "true";
+    expect(isOIDCEnvOverrideEnabled()).toBe(true);
+  });
 });
 
 describe("extractOidcGroups", () => {