v26.10.3 (#1692)

* feat: shell controller, TabStage, layout and theme plugins with repair view * feat: move the classic layout into its own bundled plugin * feat: move color themes into a bundled themes plugin * fix: plugin tests and type checks work with a linked sdk * fix: home tab, layout switch and missing layout fallbacks for looks * chore: add classic layout and themes to the readme * chore: drop example plugin links from the plugin guide * feat: plugin filters by type, paged browse, hide plugins needing newer termix * feat: move desktop, status, import, audit and branding features into plugins * feat: host lock api so a plugin can load hosts from a config file (#1581) * chore: add hosts config to the plugin table * feat: login policy hook for plugins and optional https redirect (#1584) * chore: add login security to the plugin table * feat: api key socket tickets so a master can open remote sessions (#1654) * feat: sync moves to a plugin, desktop gets multiple accounts (#1580, #1654) * chore: add sync to the plugin table * feat: move the sync screens and wizard out of core into the plugin (#1580) * fix: add a neutral linked desktop hook for plugins (#1580) * fix: show the linked account's name and admin flag in the app (#1580) * feat: ssh transport providers, core ssh relay and plugin folders api * feat: support FIDO2 security keys through ssh agent * feat: add companion panels beside host tabs * feat: mTLS client certificates for desktop server links * feat: native web view for plugins in the desktop app * fix: detect the desktop link window by Electron's default user agent Fixes #1675 * fix: changelog for desktop link fix * fix: keep text primary keys in the plugin data export * fix: ship sharp binaries for Windows arm64 builds * feat: client cert on the sync link types (sdk 1.0.18) * chore: update translations * feat: themed title bar for the desktop app (#1690) * chore: changelog for the themed title bar * fix: draw the title bar in the sidebar color * feat: per host layout for the terminal panel bar * chore: sdk 1.0.19 for the panel bar layout * chore: bundle all 43 plugins for 26.10.3 * chore: update translations --------- Co-authored-by: SirHephaistos <60616553+SirHephaistos@users.noreply.github.com> Co-authored-by: Giovanny Aranda <garanda21@gmail.com>
2026-10-30 07:05:24 +00:00 · 2026-10-20 16:03:29 -05:00
1 parent aff29a9581
commit a89ccc6b07
@@ -0,0 +1,70 @@
+/**
+ * Admin option force_https: when HTTPS is on, plain HTTP requests are sent to
+ * the HTTPS port and HTTPS responses carry HSTS. Off by default, so a reverse
+ * proxy that terminates TLS itself keeps working. A request counts as HTTPS
+ * when it came in over TLS or a proxy says so in X-Forwarded-Proto.
+ */
+
+import type { NextFunction, Request, Response } from "express";
+import { createCurrentSettingsRepository } from "../database/repositories/factory.js";
+import { getTlsConfig } from "./tls-service.js";
+
+export const FORCE_HTTPS_KEY = "force_https";
+const HSTS = "max-age=31536000";
+// Certificate checks and health probes must still work over plain HTTP.
+const EXEMPT = [/^\/\.well-known\/acme-challenge\//, /^\/health$/];
+
+let forceHttps: boolean | null = null;
+
+export async function isForceHttpsEnabled(): Promise<boolean> {
+  if (forceHttps === null) {
+    forceHttps = await createCurrentSettingsRepository()
+      .getBoolean(FORCE_HTTPS_KEY, false)
+      .catch(() => false);
+  }
+  return forceHttps;
+}
+
+export async function setForceHttps(enabled: boolean): Promise<void> {
+  await createCurrentSettingsRepository().set(
+    FORCE_HTTPS_KEY,
+    enabled ? "true" : "false",
+  );
+  forceHttps = enabled;
+}
+
+/** Test seam. */
+export function resetHttpsPolicyForTests(): void {
+  forceHttps = null;
+}
+
+export function isSecureRequest(req: Request): boolean {
+  if (req.secure) return true;
+  const forwarded = req.get("x-forwarded-proto");
+  return forwarded?.split(",")[0].trim().toLowerCase() === "https";
+}
+
+function httpsUrl(req: Request, port: number): string {
+  const host = (req.get("host") || "localhost").replace(/:\d+$/, "");
+  const suffix = port === 443 ? "" : `:${port}`;
+  return `https://${host}${suffix}${req.originalUrl || req.url}`;
+}
+
+export async function httpsPolicyMiddleware(
+  req: Request,
+  res: Response,
+  next: NextFunction,
+): Promise<void> {
+  try {
+    const tls = getTlsConfig();
+    if (!tls.enabled || !(await isForceHttpsEnabled())) return next();
+    if (isSecureRequest(req)) {
+      res.setHeader("Strict-Transport-Security", HSTS);
+      return next();
+    }
+    if (EXEMPT.some((pattern) => pattern.test(req.path))) return next();
+    res.redirect(308, httpsUrl(req, tls.port));
+  } catch (error) {
+    next(error);
+  }
+}