v26.10.3 (#1692)

* feat: shell controller, TabStage, layout and theme plugins with repair view

* feat: move the classic layout into its own bundled plugin

* feat: move color themes into a bundled themes plugin

* fix: plugin tests and type checks work with a linked sdk

* fix: home tab, layout switch and missing layout fallbacks for looks

* chore: add classic layout and themes to the readme

* chore: drop example plugin links from the plugin guide

* feat: plugin filters by type, paged browse, hide plugins needing newer termix

* feat: move desktop, status, import, audit and branding features into plugins

* feat: host lock api so a plugin can load hosts from a config file (#1581)

* chore: add hosts config to the plugin table

* feat: login policy hook for plugins and optional https redirect (#1584)

* chore: add login security to the plugin table

* feat: api key socket tickets so a master can open remote sessions (#1654)

* feat: sync moves to a plugin, desktop gets multiple accounts (#1580, #1654)

* chore: add sync to the plugin table

* feat: move the sync screens and wizard out of core into the plugin (#1580)

* fix: add a neutral linked desktop hook for plugins (#1580)

* fix: show the linked account's name and admin flag in the app (#1580)

* feat: ssh transport providers, core ssh relay and plugin folders api

* feat: support FIDO2 security keys through ssh agent

* feat: add companion panels beside host tabs

* feat: mTLS client certificates for desktop server links

* feat: native web view for plugins in the desktop app

* fix: detect the desktop link window by Electron's default user agent

Fixes #1675

* fix: changelog for desktop link fix

* fix: keep text primary keys in the plugin data export

* fix: ship sharp binaries for Windows arm64 builds

* feat: client cert on the sync link types (sdk 1.0.18)

* chore: update translations

* feat: themed title bar for the desktop app (#1690)

* chore: changelog for the themed title bar

* fix: draw the title bar in the sidebar color

* feat: per host layout for the terminal panel bar

* chore: sdk 1.0.19 for the panel bar layout

* chore: bundle all 43 plugins for 26.10.3

* chore: update translations

---------

Co-authored-by: SirHephaistos <60616553+SirHephaistos@users.noreply.github.com>
Co-authored-by: Giovanny Aranda <garanda21@gmail.com>

src/backend/tests/utils/auth-manager-token.test.ts

@@ -8,6 +8,8 @@ const encryptionKey = crypto.randomBytes(32);
 const mocks = vi.hoisted(() => ({
   hasUserDEK: vi.fn(() => false),
   adoptRecoveredDEK: vi.fn(async () => {}),
+  revoke: vi.fn(async () => true),
+  created: [] as Array<Record<string, unknown>>,
 }));
 
 vi.mock("../../database/db/index.js", () => ({
@@ -19,10 +21,27 @@ vi.mock("../../database/db/index.js", () => ({
 vi.mock("../../database/repositories/factory.js", () => ({
   createCurrentSettingsRepository: () => ({ get: async () => null }),
   createCurrentSessionRepository: () => ({
-    findById: async (id: string) =>
-      id === "expired"
-        ? { id, expiresAt: new Date(Date.now() - 1000).toISOString() }
-        : { id },
+    findById: async (id: string) => {
+      const minutesAgo = (n: number) =>
+        new Date(Date.now() - n * 60_000).toISOString();
+      if (id === "expired") {
+        return { id, expiresAt: new Date(Date.now() - 1000).toISOString() };
+      }
+      if (id === "idle") {
+        return { id, idleTimeout: 600, lastActiveAt: minutesAgo(11) };
+      }
+      if (id === "active") {
+        return { id, idleTimeout: 600, lastActiveAt: minutesAgo(5) };
+      }
+      if (id === "setup") return { id, restriction: "second-factor-setup" };
+      return { id };
+    },
+    create: async (row: Record<string, unknown>) => {
+      mocks.created.push(row);
+      return row;
+    },
+    revoke: mocks.revoke,
+    touch: async () => true,
   }),
   createCurrentUserRepository: () => ({}),
   createCurrentApiKeyRepository: () => ({}),
@@ -54,7 +73,9 @@ vi.mock("../../utils/system-crypto.js", () => ({
   },
 }));
 
-const { AuthManager } = await import("../../utils/auth-manager.js");
+const { AuthManager, allowsSetupSession } =
+  await import("../../utils/auth-manager.js");
+const { registerSecondFactor } = await import("../../auth/registry.js");
 const authManager = AuthManager.getInstance();
 
 function makeLegacyDataKeyWrap(
@@ -74,6 +95,8 @@ function makeLegacyDataKeyWrap(
 }
 
 beforeEach(() => {
+  mocks.created.length = 0;
+  mocks.revoke.mockClear();
   mocks.hasUserDEK.mockReset().mockReturnValue(false);
   mocks.adoptRecoveredDEK.mockReset().mockResolvedValue(undefined);
 });
@@ -191,6 +214,30 @@ describe("AuthManager token handling", () => {
     expect(payload?.userId).toBe("user-1");
   });
 
+  it("gives an API key a ticket on a short session that only a socket takes", async () => {
+    mocks.created.length = 0;
+    const ticket = await authManager.issueApiKeySocketTicket(
+      "user-1",
+      "key-12345678",
+    );
+    const payload = jwt.decode(ticket) as Record<string, number | string>;
+
+    expect(payload.userId).toBe("user-1");
+    expect(payload.purpose).toBe("ws");
+    expect(Number(payload.exp) - Number(payload.iat)).toBe(60);
+
+    const [session] = mocks.created;
+    expect(session.userId).toBe("user-1");
+    expect(session.id).toBe(payload.sessionId);
+    expect(session.deviceInfo).toBe("api-key: socket key-1234");
+    const lifetime =
+      new Date(String(session.expiresAt)).getTime() -
+      new Date(String(session.createdAt)).getTime();
+    expect(lifetime).toBe(120_000);
+
+    expect(await authManager.verifyJWTToken(ticket)).toBeNull();
+  });
+
   it("rejects a socket ticket whose session has expired", async () => {
     const ticket = await authManager.issueSocketTicket("user-1", "expired");
     expect(
@@ -209,3 +256,97 @@ describe("AuthManager token handling", () => {
     ).toBeNull();
   });
 });
+
+describe("login policy on sessions", () => {
+  const sign = (sessionId: string) =>
+    jwt.sign({ userId: "user-1", sessionId }, jwtSecret, { expiresIn: "1h" });
+
+  it("caps the lifetime and stores the idle timeout and restriction", async () => {
+    const token = await authManager.generateJWTToken("user-1", {
+      rememberMe: true,
+      deviceType: "web",
+      deviceInfo: "Firefox",
+      maxAgeSeconds: 600,
+      idleTimeoutSeconds: 300,
+      restriction: "second-factor-setup",
+    });
+    const payload = jwt.decode(token) as { iat: number; exp: number };
+    expect(payload.exp - payload.iat).toBe(600);
+    expect(mocks.created[0]).toMatchObject({
+      idleTimeout: 300,
+      restriction: "second-factor-setup",
+    });
+    const lifetime =
+      new Date(mocks.created[0].expiresAt as string).getTime() -
+      new Date(mocks.created[0].createdAt as string).getTime();
+    expect(lifetime).toBe(600_000);
+  });
+
+  it("ends a session idle past its timeout and keeps an active one", async () => {
+    expect(await authManager.verifyJWTToken(sign("idle"))).toBeNull();
+    expect(mocks.revoke).toHaveBeenCalledWith("idle");
+    expect(await authManager.verifyJWTToken(sign("active"))).not.toBeNull();
+  });
+
+  it("only lets a setup session reach setup routes", async () => {
+    const middleware = authManager.createAuthMiddleware();
+    const call = async (url: string) => {
+      const res = {
+        statusCode: 200,
+        body: undefined as unknown,
+        status(code: number) {
+          res.statusCode = code;
+          return res;
+        },
+        json(body: unknown) {
+          res.body = body;
+          return res;
+        },
+        clearCookie() {
+          return res;
+        },
+      };
+      const next = vi.fn();
+      await middleware(
+        {
+          cookies: { jwt: sign("setup") },
+          headers: {},
+          originalUrl: url,
+          url,
+        } as never,
+        res as never,
+        next,
+      );
+      return { res, next };
+    };
+
+    const blocked = await call("/host/db/host");
+    expect(blocked.res.statusCode).toBe(403);
+    expect(blocked.res.body).toMatchObject({
+      code: "SECOND_FACTOR_SETUP_REQUIRED",
+    });
+    expect(blocked.next).not.toHaveBeenCalled();
+
+    const me = await call("/users/me");
+    expect(me.next).toHaveBeenCalled();
+  });
+
+  it("allows second factor plugins' routes and nothing else", () => {
+    const dispose = registerSecondFactor({
+      id: "key",
+      pluginId: "keys",
+      labelKey: "key",
+      isEnrolled: async () => false,
+      verify: async () => true,
+    });
+    try {
+      expect(allowsSetupSession("/plugin-api/keys/register")).toBe(true);
+      expect(allowsSetupSession("/plugin-api/other/thing")).toBe(false);
+      expect(allowsSetupSession("/users/logout")).toBe(true);
+      expect(allowsSetupSession("/users/me/token")).toBe(false);
+      expect(allowsSetupSession("/credentials")).toBe(false);
+    } finally {
+      dispose();
+    }
+  });
+});