v26.10.3 (#1692)

* feat: shell controller, TabStage, layout and theme plugins with repair view

* feat: move the classic layout into its own bundled plugin

* feat: move color themes into a bundled themes plugin

* fix: plugin tests and type checks work with a linked sdk

* fix: home tab, layout switch and missing layout fallbacks for looks

* chore: add classic layout and themes to the readme

* chore: drop example plugin links from the plugin guide

* feat: plugin filters by type, paged browse, hide plugins needing newer termix

* feat: move desktop, status, import, audit and branding features into plugins

* feat: host lock api so a plugin can load hosts from a config file (#1581)

* chore: add hosts config to the plugin table

* feat: login policy hook for plugins and optional https redirect (#1584)

* chore: add login security to the plugin table

* feat: api key socket tickets so a master can open remote sessions (#1654)

* feat: sync moves to a plugin, desktop gets multiple accounts (#1580, #1654)

* chore: add sync to the plugin table

* feat: move the sync screens and wizard out of core into the plugin (#1580)

* fix: add a neutral linked desktop hook for plugins (#1580)

* fix: show the linked account's name and admin flag in the app (#1580)

* feat: ssh transport providers, core ssh relay and plugin folders api

* feat: support FIDO2 security keys through ssh agent

* feat: add companion panels beside host tabs

* feat: mTLS client certificates for desktop server links

* feat: native web view for plugins in the desktop app

* fix: detect the desktop link window by Electron's default user agent

Fixes #1675

* fix: changelog for desktop link fix

* fix: keep text primary keys in the plugin data export

* fix: ship sharp binaries for Windows arm64 builds

* feat: client cert on the sync link types (sdk 1.0.18)

* chore: update translations

* feat: themed title bar for the desktop app (#1690)

* chore: changelog for the themed title bar

* fix: draw the title bar in the sidebar color

* feat: per host layout for the terminal panel bar

* chore: sdk 1.0.19 for the panel bar layout

* chore: bundle all 43 plugins for 26.10.3

* chore: update translations

---------

Co-authored-by: SirHephaistos <60616553+SirHephaistos@users.noreply.github.com>
Co-authored-by: Giovanny Aranda <garanda21@gmail.com>

src/backend/tests/tls/https-policy.test.ts

@@ -0,0 +1,108 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const h = vi.hoisted(() => ({
+  settings: new Map<string, string>(),
+  tlsEnabled: true,
+}));
+
+vi.mock("../../database/repositories/factory.js", () => ({
+  createCurrentSettingsRepository: () => ({
+    getBoolean: async (key: string, fallback: boolean) =>
+      h.settings.has(key) ? h.settings.get(key) === "true" : fallback,
+    set: async (key: string, value: string) => {
+      h.settings.set(key, value);
+    },
+  }),
+}));
+vi.mock("../../tls/tls-service.js", () => ({
+  getTlsConfig: () => ({ enabled: h.tlsEnabled, port: 8443 }),
+}));
+
+const { httpsPolicyMiddleware, setForceHttps, resetHttpsPolicyForTests } =
+  await import("../../tls/https-policy.js");
+
+function run(
+  path: string,
+  { secure = false, headers = {} as Record<string, string> } = {},
+) {
+  const all: Record<string, string> = { host: "termix.lan:8080", ...headers };
+  const req = {
+    secure,
+    path,
+    originalUrl: path,
+    url: path,
+    get: (name: string) => all[name.toLowerCase()],
+  };
+  const res = {
+    headers: {} as Record<string, string>,
+    redirected: null as null | { status: number; url: string },
+    setHeader(name: string, value: string) {
+      res.headers[name] = value;
+    },
+    redirect(status: number, url: string) {
+      res.redirected = { status, url };
+    },
+  };
+  const next = vi.fn();
+  return httpsPolicyMiddleware(req as never, res as never, next).then(() => ({
+    res,
+    next,
+  }));
+}
+
+beforeEach(() => {
+  h.settings.clear();
+  h.tlsEnabled = true;
+  resetHttpsPolicyForTests();
+});
+
+describe("https policy", () => {
+  it("is off by default", async () => {
+    const { res, next } = await run("/users/me");
+    expect(next).toHaveBeenCalled();
+    expect(res.redirected).toBeNull();
+    expect(res.headers).toEqual({});
+  });
+
+  it("does nothing while HTTPS is off, even when turned on", async () => {
+    await setForceHttps(true);
+    h.tlsEnabled = false;
+    const { res, next } = await run("/users/me");
+    expect(next).toHaveBeenCalled();
+    expect(res.redirected).toBeNull();
+  });
+
+  it("redirects plain HTTP to the HTTPS port", async () => {
+    await setForceHttps(true);
+    const { res, next } = await run("/users/me?x=1");
+    expect(next).not.toHaveBeenCalled();
+    expect(res.redirected).toEqual({
+      status: 308,
+      url: "https://termix.lan:8443/users/me?x=1",
+    });
+  });
+
+  it("trusts X-Forwarded-Proto and sends HSTS over HTTPS", async () => {
+    await setForceHttps(true);
+    const forwarded = await run("/users/me", {
+      headers: { "x-forwarded-proto": "https, http" },
+    });
+    expect(forwarded.next).toHaveBeenCalled();
+    expect(forwarded.res.headers["Strict-Transport-Security"]).toBe(
+      "max-age=31536000",
+    );
+
+    const direct = await run("/users/me", { secure: true });
+    expect(direct.next).toHaveBeenCalled();
+    expect(direct.res.headers["Strict-Transport-Security"]).toBeDefined();
+  });
+
+  it("leaves certificate checks and health probes on HTTP", async () => {
+    await setForceHttps(true);
+    for (const path of ["/.well-known/acme-challenge/abc", "/health"]) {
+      const { res, next } = await run(path);
+      expect(next).toHaveBeenCalled();
+      expect(res.redirected).toBeNull();
+    }
+  });
+});