v26.10.3 (#1692)

* feat: shell controller, TabStage, layout and theme plugins with repair view

* feat: move the classic layout into its own bundled plugin

* feat: move color themes into a bundled themes plugin

* fix: plugin tests and type checks work with a linked sdk

* fix: home tab, layout switch and missing layout fallbacks for looks

* chore: add classic layout and themes to the readme

* chore: drop example plugin links from the plugin guide

* feat: plugin filters by type, paged browse, hide plugins needing newer termix

* feat: move desktop, status, import, audit and branding features into plugins

* feat: host lock api so a plugin can load hosts from a config file (#1581)

* chore: add hosts config to the plugin table

* feat: login policy hook for plugins and optional https redirect (#1584)

* chore: add login security to the plugin table

* feat: api key socket tickets so a master can open remote sessions (#1654)

* feat: sync moves to a plugin, desktop gets multiple accounts (#1580, #1654)

* chore: add sync to the plugin table

* feat: move the sync screens and wizard out of core into the plugin (#1580)

* fix: add a neutral linked desktop hook for plugins (#1580)

* fix: show the linked account's name and admin flag in the app (#1580)

* feat: ssh transport providers, core ssh relay and plugin folders api

* feat: support FIDO2 security keys through ssh agent

* feat: add companion panels beside host tabs

* feat: mTLS client certificates for desktop server links

* feat: native web view for plugins in the desktop app

* fix: detect the desktop link window by Electron's default user agent

Fixes #1675

* fix: changelog for desktop link fix

* fix: keep text primary keys in the plugin data export

* fix: ship sharp binaries for Windows arm64 builds

* feat: client cert on the sync link types (sdk 1.0.18)

* chore: update translations

* feat: themed title bar for the desktop app (#1690)

* chore: changelog for the themed title bar

* fix: draw the title bar in the sidebar color

* feat: per host layout for the terminal panel bar

* chore: sdk 1.0.19 for the panel bar layout

* chore: bundle all 43 plugins for 26.10.3

* chore: update translations

---------

Co-authored-by: SirHephaistos <60616553+SirHephaistos@users.noreply.github.com>
Co-authored-by: Giovanny Aranda <garanda21@gmail.com>

src/backend/auth/policy.ts

@@ -0,0 +1,125 @@
+/**
+ * Login policy from plugins through ctx.auth.policy.provide: idle timeout,
+ * session length, remember me and a required second factor. Core asks every
+ * provider and the strictest answer wins. A provider that throws at login
+ * refuses the login, since skipping a security rule is worse than a failed
+ * sign in. The idle timeout is stored on the session at login. Desktop
+ * loopback, sync link and plugin minted sessions are device credentials, not
+ * logins, so the policy never reaches them.
+ */
+
+import type {
+  PluginAuthPolicyDecision,
+  PluginAuthPolicyInput,
+  PluginAuthPolicyProvider,
+} from "@termix-ssh/plugin-sdk/backend";
+import { authLogger } from "../utils/logger.js";
+import { LoginMethodError } from "./types.js";
+
+/** sessions.restriction of a session that may only set up a second factor. */
+export const SECOND_FACTOR_SETUP = "second-factor-setup";
+
+interface Entry {
+  pluginId: string;
+  provider: PluginAuthPolicyProvider;
+}
+
+const providers = new Map<symbol, Entry>();
+
+export function provideAuthPolicy(
+  pluginId: string,
+  provider: PluginAuthPolicyProvider,
+): () => void {
+  const key = Symbol(pluginId);
+  providers.set(key, { pluginId, provider });
+  return () => {
+    providers.delete(key);
+  };
+}
+
+/** Test seam. */
+export function clearAuthPolicies(): void {
+  providers.clear();
+}
+
+export function hasAuthPolicies(): boolean {
+  return providers.size > 0;
+}
+
+export interface AuthPolicy {
+  allowRememberDevice: boolean;
+  maxSessionSeconds: number | null;
+  idleTimeoutSeconds: number | null;
+  secondFactor: "always" | "new-device" | null;
+}
+
+const NO_POLICY: AuthPolicy = {
+  allowRememberDevice: true,
+  maxSessionSeconds: null,
+  idleTimeoutSeconds: null,
+  secondFactor: null,
+};
+
+function shortest(current: number | null, next: unknown): number | null {
+  if (typeof next !== "number" || !(next > 0)) return current;
+  const value = Math.floor(next);
+  return current === null ? value : Math.min(current, value);
+}
+
+function merge(policy: AuthPolicy, next: PluginAuthPolicyDecision): AuthPolicy {
+  let secondFactor = policy.secondFactor;
+  if (next.secondFactor === "always") secondFactor = "always";
+  else if (next.secondFactor === "new-device" && secondFactor !== "always") {
+    secondFactor = "new-device";
+  }
+  return {
+    allowRememberDevice:
+      policy.allowRememberDevice && next.allowRememberDevice !== false,
+    maxSessionSeconds: shortest(
+      policy.maxSessionSeconds,
+      next.maxSessionSeconds,
+    ),
+    idleTimeoutSeconds: shortest(
+      policy.idleTimeoutSeconds,
+      next.idleTimeoutSeconds,
+    ),
+    secondFactor,
+  };
+}
+
+export async function evaluateAuthPolicy(
+  input: PluginAuthPolicyInput,
+): Promise<AuthPolicy> {
+  let policy = NO_POLICY;
+  for (const entry of providers.values()) {
+    let decision: PluginAuthPolicyDecision;
+    try {
+      decision = (await entry.provider.evaluate(input)) ?? {};
+    } catch (error) {
+      authLogger.warn("Login policy failed, refusing the login", {
+        operation: "auth_policy",
+        pluginId: entry.pluginId,
+        error: error instanceof Error ? error.message : String(error),
+      });
+      throw new LoginMethodError(
+        "Sign in is not available right now. Contact an admin.",
+        503,
+        "auth_policy_unavailable",
+      );
+    }
+    policy = merge(policy, decision);
+  }
+  return policy;
+}
+
+/** Whether the login page should offer remember me. */
+export function rememberDeviceAllowed(): boolean {
+  for (const entry of providers.values()) {
+    try {
+      if (entry.provider.allowRememberDevice?.() === false) return false;
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}