webgate 0.2.0__tar.gz → 0.2.2__tar.gz

{webgate-0.2.0 → webgate-0.2.2}/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## v0.2.2 (2026-04-15)
+
+### Features
+
+- **Demo mode** (`WEBGATE_DEMO_MODE=true`) -- read-only public demo deployments. Blocks every write request on `/api/*` (except login), disables the WebSocket quick-connect endpoint, seeds a `demo`/`demo` user with a sample server, and shows a top banner in the UI.
+- **`Dockerfile.demo`** -- single-container image bundling webgate + a sandboxed `sshd` target via supervisord. Ready for free hosting tiers.
+- **`fly.toml`** -- Fly.io configuration for one-command demo deployments (`flyctl deploy`).
+
+### Details
+
+- New public endpoint `GET /api/config` exposes `{"demo_mode": bool}` for the frontend to render the banner before login
+- `WEBGATE_DEMO_MODE=true` adds an HTTP middleware that returns `403` for any `POST/PUT/PATCH/DELETE` on `/api/*` (allowlist: `/api/auth/login`, `/api/auth/totp/verify`)
+- Demo seed (`webgate.demo`) is idempotent and only runs when the flag is on
+- Hourly state reset for the public demo can be done with a cron pinging the container restart, so DB returns to seed state
+
+---
+
+## v0.2.1 (2026-04-15)
+
+### Features
+
+- **Reverse proxy sub-path support** -- webgate can now be served behind a reverse proxy at a URL prefix (e.g. `https://example.com/webgate/`). Previously the frontend used absolute `/api/...` paths that broke under any prefix.
+
+### Details
+
+- New config setting: `WEBGATE_ROOT_PATH` (default `""`), passed to FastAPI's `root_path` for correct OpenAPI URLs behind proxies
+- Frontend derives the path prefix at runtime from `window.location.pathname` and prepends it to all REST calls and the terminal WebSocket URL
+- README documents nginx, Apache, and Traefik reverse-proxy configurations for sub-path deployments
+- The proxy must forward the prefix unchanged (do not strip it) -- webgate handles the prefix natively
+
+---
+
 ## v0.2.0 (2026-04-09)
 
 ### Features

webgate-0.2.2/Dockerfile.demo

@@ -0,0 +1,63 @@
+# Single-container demo image: webgate + a sandboxed SSH/SFTP target
+# managed by supervisord. Suitable for free tiers (Fly.io, Render) where
+# spinning a sidecar VM isn't ideal.
+#
+# Build:  docker build -f Dockerfile.demo -t webgate-demo .
+# Run:    docker run -p 8443:8443 -e WEBGATE_SECRET_KEY=demo webgate-demo
+
+# --- Stage 1: build webgate ---
+FROM python:3.13-slim AS builder
+WORKDIR /app
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+COPY pyproject.toml uv.lock README.md ./
+RUN uv sync --frozen --no-dev --no-editable
+COPY src/ src/
+
+# --- Stage 2: runtime with webgate + sshd + supervisord ---
+FROM python:3.13-slim
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        openssh-server supervisor procps curl nano htop tree && \
+    rm -rf /var/lib/apt/lists/*
+
+# sshd config: only the demo user, password auth allowed for the demo
+RUN mkdir -p /run/sshd && \
+    sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config && \
+    sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config && \
+    useradd -m -s /bin/bash demo && \
+    echo 'demo:demo' | chpasswd
+
+# Sample tree so SFTP browsing has something to show
+RUN mkdir -p /home/demo/projects/webgate /home/demo/projects/api-server \
+             /home/demo/documents /home/demo/logs /home/demo/scripts && \
+    printf '# webgate\nSelf-hosted SSH + SFTP manager\n' > /home/demo/projects/webgate/README.md && \
+    printf '{"name":"api-server","version":"2.1.0"}\n' > /home/demo/projects/api-server/package.json && \
+    printf 'Hello from the webgate demo!\n' > /home/demo/documents/welcome.txt && \
+    printf '2026-04-08 10:00:00 INFO  Server started on port 8080\n' > /home/demo/logs/app.log && \
+    printf '#!/bin/bash\necho "Deploy complete"\n' > /home/demo/scripts/deploy.sh && \
+    chmod +x /home/demo/scripts/deploy.sh && \
+    chown -R demo:demo /home/demo
+
+# webgate
+WORKDIR /app
+COPY --from=builder /app/.venv /app/.venv
+COPY --from=builder /app/src /app/src
+RUN mkdir -p /data
+ENV PATH="/app/.venv/bin:$PATH" \
+    PYTHONPATH="/app/src" \
+    WEBGATE_HOST=0.0.0.0 \
+    WEBGATE_PORT=8443 \
+    WEBGATE_DB_URL=sqlite+aiosqlite:////data/webgate.db \
+    WEBGATE_LOG_LEVEL=info \
+    WEBGATE_DEMO_MODE=true
+
+# supervisord config
+RUN printf '[supervisord]\nnodaemon=true\nuser=root\nlogfile=/dev/stdout\nlogfile_maxbytes=0\n\n[program:sshd]\ncommand=/usr/sbin/sshd -D -e\nautorestart=true\nstdout_logfile=/dev/stdout\nstdout_logfile_maxbytes=0\nstderr_logfile=/dev/stderr\nstderr_logfile_maxbytes=0\n\n[program:webgate]\ncommand=python -m webgate\nautorestart=true\nstdout_logfile=/dev/stdout\nstdout_logfile_maxbytes=0\nstderr_logfile=/dev/stderr\nstderr_logfile_maxbytes=0\n' > /etc/supervisor/conf.d/webgate.conf
+
+EXPOSE 8443
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+    CMD curl -fsS http://localhost:8443/api/health || exit 1
+
+CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/webgate.conf"]

{webgate-0.2.0 → webgate-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: webgate
-Version: 0.2.0
+Version: 0.2.2
 Summary: Self-hosted web application for remote server management via SSH terminal and SFTP file browser
 Project-URL: Homepage, https://github.com/kalexnolasco/webgate
 Project-URL: Documentation, https://kalexnolasco.github.io/webgate/
@@ -34,8 +34,10 @@ Requires-Dist: fastapi>=0.115.0
 Requires-Dist: passlib[bcrypt]>=1.7.4
 Requires-Dist: pydantic-settings>=2.7.0
 Requires-Dist: pydantic>=2.10.0
+Requires-Dist: pyotp>=2.9.0
 Requires-Dist: python-jose[cryptography]>=3.3.0
 Requires-Dist: python-multipart>=0.0.18
+Requires-Dist: qrcode[pil]>=8.2
 Requires-Dist: slowapi>=0.1.9
 Requires-Dist: sqlalchemy>=2.0.36
 Requires-Dist: uvicorn[standard]>=0.34.0
@@ -56,6 +58,8 @@ Description-Content-Type: text/markdown
 Self-hosted web application for remote server management via **SSH terminal** and **SFTP file browser**. A modern Python replacement combining the best of [webssh](https://github.com/huashengdun/webssh) and [filebrowser](https://github.com/filebrowser/filebrowser) into a single unified tool with a FileZilla-inspired interface.
 
 > **Documentation: [kalexnolasco.github.io/webgate](https://kalexnolasco.github.io/webgate/)**
+>
+> **🎮 Live demo: [webgate-demo.fly.dev](https://webgate-demo.fly.dev/)** — login `demo` / `demo` (read-only, resets hourly)
 
 ---
 
@@ -233,6 +237,9 @@ flowchart TB
 ### Audit Log
 ![Audit](docs/screenshots/audit.png)
 
+### Light Theme
+![Light Theme](docs/screenshots/light-theme.png)
+
 ## Quick Start
 
 ### Docker (recommended)
@@ -443,6 +450,8 @@ All settings are configurable via environment variables with the `WEBGATE_` pref
 | `WEBGATE_SECRET_KEY` | `change-me-in-production` | JWT signing + Fernet encryption key |
 | `WEBGATE_DB_URL` | `sqlite+aiosqlite:///./webgate.db` | Database URL |
 | `WEBGATE_ALLOWED_ORIGINS` | `*` | CORS origins (comma-separated) |
+| `WEBGATE_ROOT_PATH` | `` (empty) | URL prefix when served behind a reverse proxy at a sub-path (e.g. `/webgate`) |
+| `WEBGATE_DEMO_MODE` | `false` | Read-only public demo: blocks all writes, seeds a `demo`/`demo` user and shows a banner |
 | `WEBGATE_LOG_LEVEL` | `info` | Log level |
 | `WEBGATE_SESSION_TIMEOUT` | `3600` | SSH session timeout (seconds) |
 | `WEBGATE_MAX_UPLOAD_SIZE` | `104857600` | Max upload size (100 MB) |
@@ -499,6 +508,105 @@ webgate.example.com {
 }
 ```
 
+### Reverse proxy at a sub-path (e.g. `https://example.com/webgate/`)
+
+When webgate is exposed behind an existing site under a URL prefix, set `WEBGATE_ROOT_PATH` so FastAPI and the frontend both build URLs with the prefix. The frontend derives the prefix automatically from `window.location.pathname`, but `WEBGATE_ROOT_PATH` is still needed on the backend for OpenAPI URLs.
+
+**Docker Compose:**
+
+```yaml
+services:
+  webgate:
+    image: kalexnolasco/webgate:latest
+    environment:
+      WEBGATE_SECRET_KEY: "${WEBGATE_SECRET_KEY}"
+      WEBGATE_ROOT_PATH: "/webgate"
+```
+
+> **Important:** the reverse proxy must **forward the prefix unchanged** (not strip it). Webgate receives requests as `/webgate/api/...` and handles them natively — do not rewrite them to `/api/...`.
+
+#### nginx
+
+```nginx
+server {
+    listen 443 ssl http2;
+    server_name example.com;
+
+    ssl_certificate     /etc/ssl/certs/example.com.crt;
+    ssl_certificate_key /etc/ssl/private/example.com.key;
+
+    # WebSocket (xterm.js terminal) -- must come before the generic location
+    location /webgate/api/ws/ {
+        proxy_pass http://127.0.0.1:8443;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade    $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host       $host;
+        proxy_read_timeout 86400s;   # keep long-lived SSH sessions alive
+        proxy_send_timeout 86400s;
+    }
+
+    location /webgate/ {
+        proxy_pass http://127.0.0.1:8443;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-Prefix /webgate;
+        client_max_body_size 100m;       # match WEBGATE_MAX_UPLOAD_SIZE
+    }
+}
+```
+
+#### Apache 2.4
+
+```apache
+# Required modules: proxy proxy_http proxy_wstunnel headers rewrite ssl
+# sudo a2enmod proxy proxy_http proxy_wstunnel headers rewrite
+
+<VirtualHost *:443>
+    ServerName example.com
+
+    SSLEngine on
+    SSLCertificateFile    /etc/ssl/certs/example.com.crt
+    SSLCertificateKeyFile /etc/ssl/private/example.com.key
+
+    ProxyPreserveHost On
+    RequestHeader set X-Forwarded-Proto  "https"
+    RequestHeader set X-Forwarded-Prefix "/webgate"
+
+    # Redirect /webgate -> /webgate/ (trailing slash)
+    RewriteEngine On
+    RewriteRule ^/webgate$ /webgate/ [R=301,L]
+
+    # WebSocket (xterm.js terminal) -- MUST come before the HTTP ProxyPass
+    ProxyPass        /webgate/api/ws/  ws://127.0.0.1:8443/webgate/api/ws/
+    ProxyPassReverse /webgate/api/ws/  ws://127.0.0.1:8443/webgate/api/ws/
+
+    # HTTP
+    ProxyPass        /webgate/  http://127.0.0.1:8443/webgate/
+    ProxyPassReverse /webgate/  http://127.0.0.1:8443/webgate/
+</VirtualHost>
+```
+
+#### Traefik (labels)
+
+```yaml
+services:
+  webgate:
+    image: kalexnolasco/webgate:latest
+    environment:
+      WEBGATE_ROOT_PATH: "/webgate"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.webgate.rule=Host(`example.com`) && PathPrefix(`/webgate`)"
+      - "traefik.http.routers.webgate.entrypoints=websecure"
+      - "traefik.http.routers.webgate.tls=true"
+      - "traefik.http.services.webgate.loadbalancer.server.port=8443"
+```
+
+Traefik forwards the full path by default, so no extra middleware is needed. Long WebSocket timeouts can be tuned via `forwardingTimeouts` in the Traefik static config.
+
 ### Useful Commands
 
 ```bash

{webgate-0.2.0 → webgate-0.2.2}/README.md

@@ -12,6 +12,8 @@
 Self-hosted web application for remote server management via **SSH terminal** and **SFTP file browser**. A modern Python replacement combining the best of [webssh](https://github.com/huashengdun/webssh) and [filebrowser](https://github.com/filebrowser/filebrowser) into a single unified tool with a FileZilla-inspired interface.
 
 > **Documentation: [kalexnolasco.github.io/webgate](https://kalexnolasco.github.io/webgate/)**
+>
+> **🎮 Live demo: [webgate-demo.fly.dev](https://webgate-demo.fly.dev/)** — login `demo` / `demo` (read-only, resets hourly)
 
 ---
 
@@ -189,6 +191,9 @@ flowchart TB
 ### Audit Log
 ![Audit](docs/screenshots/audit.png)
 
+### Light Theme
+![Light Theme](docs/screenshots/light-theme.png)
+
 ## Quick Start
 
 ### Docker (recommended)
@@ -399,6 +404,8 @@ All settings are configurable via environment variables with the `WEBGATE_` pref
 | `WEBGATE_SECRET_KEY` | `change-me-in-production` | JWT signing + Fernet encryption key |
 | `WEBGATE_DB_URL` | `sqlite+aiosqlite:///./webgate.db` | Database URL |
 | `WEBGATE_ALLOWED_ORIGINS` | `*` | CORS origins (comma-separated) |
+| `WEBGATE_ROOT_PATH` | `` (empty) | URL prefix when served behind a reverse proxy at a sub-path (e.g. `/webgate`) |
+| `WEBGATE_DEMO_MODE` | `false` | Read-only public demo: blocks all writes, seeds a `demo`/`demo` user and shows a banner |
 | `WEBGATE_LOG_LEVEL` | `info` | Log level |
 | `WEBGATE_SESSION_TIMEOUT` | `3600` | SSH session timeout (seconds) |
 | `WEBGATE_MAX_UPLOAD_SIZE` | `104857600` | Max upload size (100 MB) |
@@ -455,6 +462,105 @@ webgate.example.com {
 }
 ```
 
+### Reverse proxy at a sub-path (e.g. `https://example.com/webgate/`)
+
+When webgate is exposed behind an existing site under a URL prefix, set `WEBGATE_ROOT_PATH` so FastAPI and the frontend both build URLs with the prefix. The frontend derives the prefix automatically from `window.location.pathname`, but `WEBGATE_ROOT_PATH` is still needed on the backend for OpenAPI URLs.
+
+**Docker Compose:**
+
+```yaml
+services:
+  webgate:
+    image: kalexnolasco/webgate:latest
+    environment:
+      WEBGATE_SECRET_KEY: "${WEBGATE_SECRET_KEY}"
+      WEBGATE_ROOT_PATH: "/webgate"
+```
+
+> **Important:** the reverse proxy must **forward the prefix unchanged** (not strip it). Webgate receives requests as `/webgate/api/...` and handles them natively — do not rewrite them to `/api/...`.
+
+#### nginx
+
+```nginx
+server {
+    listen 443 ssl http2;
+    server_name example.com;
+
+    ssl_certificate     /etc/ssl/certs/example.com.crt;
+    ssl_certificate_key /etc/ssl/private/example.com.key;
+
+    # WebSocket (xterm.js terminal) -- must come before the generic location
+    location /webgate/api/ws/ {
+        proxy_pass http://127.0.0.1:8443;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade    $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host       $host;
+        proxy_read_timeout 86400s;   # keep long-lived SSH sessions alive
+        proxy_send_timeout 86400s;
+    }
+
+    location /webgate/ {
+        proxy_pass http://127.0.0.1:8443;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-Prefix /webgate;
+        client_max_body_size 100m;       # match WEBGATE_MAX_UPLOAD_SIZE
+    }
+}
+```
+
+#### Apache 2.4
+
+```apache
+# Required modules: proxy proxy_http proxy_wstunnel headers rewrite ssl
+# sudo a2enmod proxy proxy_http proxy_wstunnel headers rewrite
+
+<VirtualHost *:443>
+    ServerName example.com
+
+    SSLEngine on
+    SSLCertificateFile    /etc/ssl/certs/example.com.crt
+    SSLCertificateKeyFile /etc/ssl/private/example.com.key
+
+    ProxyPreserveHost On
+    RequestHeader set X-Forwarded-Proto  "https"
+    RequestHeader set X-Forwarded-Prefix "/webgate"
+
+    # Redirect /webgate -> /webgate/ (trailing slash)
+    RewriteEngine On
+    RewriteRule ^/webgate$ /webgate/ [R=301,L]
+
+    # WebSocket (xterm.js terminal) -- MUST come before the HTTP ProxyPass
+    ProxyPass        /webgate/api/ws/  ws://127.0.0.1:8443/webgate/api/ws/
+    ProxyPassReverse /webgate/api/ws/  ws://127.0.0.1:8443/webgate/api/ws/
+
+    # HTTP
+    ProxyPass        /webgate/  http://127.0.0.1:8443/webgate/
+    ProxyPassReverse /webgate/  http://127.0.0.1:8443/webgate/
+</VirtualHost>
+```
+
+#### Traefik (labels)
+
+```yaml
+services:
+  webgate:
+    image: kalexnolasco/webgate:latest
+    environment:
+      WEBGATE_ROOT_PATH: "/webgate"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.webgate.rule=Host(`example.com`) && PathPrefix(`/webgate`)"
+      - "traefik.http.routers.webgate.entrypoints=websecure"
+      - "traefik.http.routers.webgate.tls=true"
+      - "traefik.http.services.webgate.loadbalancer.server.port=8443"
+```
+
+Traefik forwards the full path by default, so no extra middleware is needed. Long WebSocket timeouts can be tuned via `forwardingTimeouts` in the Traefik static config.
+
 ### Useful Commands
 
 ```bash

webgate-0.2.2/fly.toml

@@ -0,0 +1,48 @@
+# Fly.io deployment for the public webgate demo.
+# Edit `app` to your fly app name, then:
+#   flyctl launch --no-deploy --copy-config
+#   flyctl secrets set WEBGATE_SECRET_KEY=$(openssl rand -hex 32)
+#   flyctl deploy
+#
+# Free tier (1x shared-cpu, 256-512 MB) is enough for light demo traffic.
+
+app = "webgate-demo"
+primary_region = "cdg"  # Paris; closest EU region to Spain
+
+[build]
+  dockerfile = "Dockerfile.demo"
+
+[env]
+  WEBGATE_DEMO_MODE = "true"
+  WEBGATE_LOG_LEVEL = "info"
+
+[http_service]
+  internal_port = 8443
+  force_https = true
+  auto_stop_machines = "stop"     # save free-tier hours when idle
+  auto_start_machines = true
+  min_machines_running = 0
+
+  [http_service.concurrency]
+    type = "requests"
+    soft_limit = 50
+    hard_limit = 100
+
+  [[http_service.checks]]
+    interval = "30s"
+    timeout = "5s"
+    grace_period = "15s"
+    method = "get"
+    path = "/api/health"
+
+[[vm]]
+  cpu_kind = "shared"
+  cpus = 1
+  memory_mb = 512
+
+# Persistent volume so the demo seed survives restarts. The hourly reset
+# (see scripts/demo-reset.sh) wipes the DB inside the container, not the
+# whole volume, so this stays cheap.
+[mounts]
+  source = "webgate_demo_data"
+  destination = "/data"

{webgate-0.2.0 → webgate-0.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "webgate"
-version = "0.2.0"
+version = "0.2.2"
 description = "Self-hosted web application for remote server management via SSH terminal and SFTP file browser"
 readme = "README.md"
 license = "MIT"
@@ -38,6 +38,8 @@ dependencies = [
     "cryptography>=44.0.0",
     "websockets>=14.0",
     "slowapi>=0.1.9",
+    "pyotp>=2.9.0",
+    "qrcode[pil]>=8.2",
 ]
 
 [project.urls]

{webgate-0.2.0 → webgate-0.2.2}/src/webgate/app.py

@@ -1,8 +1,9 @@
 from collections.abc import AsyncGenerator
 from contextlib import asynccontextmanager
 
-from fastapi import FastAPI
+from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import JSONResponse
 from fastapi.staticfiles import StaticFiles
 from slowapi import _rate_limit_exceeded_handler
 from slowapi.errors import RateLimitExceeded
@@ -12,6 +13,7 @@ from webgate.auth.routes import router as auth_router
 from webgate.auth.service import seed_admin
 from webgate.config import settings
 from webgate.db.engine import async_session_factory, close_db, init_db
+from webgate.demo import seed_demo
 from webgate.files.pool import sftp_pool
 from webgate.files.routes import router as files_router
 from webgate.servers.monitor import server_monitor
@@ -24,6 +26,8 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None]:
     await init_db()
     async with async_session_factory() as session:
         await seed_admin(session)
+        if settings.demo_mode:
+            await seed_demo(session)
     await sftp_pool.start()
     await server_monitor.start()
     yield
@@ -33,7 +37,12 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None]:
 
 
 def create_app() -> FastAPI:
-    app = FastAPI(title="webgate", version="0.1.0", lifespan=lifespan)
+    app = FastAPI(
+        title="webgate",
+        version="0.1.0",
+        lifespan=lifespan,
+        root_path=settings.root_path,
+    )
     app.state.limiter = limiter
     app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
 
@@ -50,6 +59,32 @@ def create_app() -> FastAPI:
     async def health() -> dict[str, str]:  # pyright: ignore[reportUnusedFunction]
         return {"status": "ok"}
 
+    @app.get("/api/config")
+    async def public_config() -> dict[str, object]:  # pyright: ignore[reportUnusedFunction]
+        # Public flags consumed by the frontend before login.
+        return {"demo_mode": settings.demo_mode}
+
+    if settings.demo_mode:
+        # In demo mode block any state-changing request on /api/* except login
+        # and the WS quick-connect endpoint (no arbitrary SSH targets allowed).
+        WRITE_METHODS = {"POST", "PUT", "PATCH", "DELETE"}
+        WRITE_ALLOWLIST = {"/api/auth/login", "/api/auth/totp/verify"}
+
+        @app.middleware("http")
+        async def _demo_readonly(request: Request, call_next):  # pyright: ignore[reportUnusedFunction]
+            path = request.url.path
+            if request.method in WRITE_METHODS and path.startswith("/api/") and path not in WRITE_ALLOWLIST:
+                return JSONResponse(
+                    status_code=403,
+                    content={"detail": "Demo mode: write operations are disabled"},
+                )
+            if path.endswith("/api/ws/terminal/quick"):
+                return JSONResponse(
+                    status_code=403,
+                    content={"detail": "Demo mode: quick-connect is disabled"},
+                )
+            return await call_next(request)
+
     app.include_router(auth_router)
     app.include_router(servers_router)
     app.include_router(terminal_router)

{webgate-0.2.0 → webgate-0.2.2}/src/webgate/auth/models.py

@@ -2,7 +2,7 @@ import json
 from datetime import datetime
 
 from pydantic import BaseModel, field_validator
-from sqlalchemy import Boolean, DateTime, String, Text, func
+from sqlalchemy import Boolean, DateTime, ForeignKey, Integer, String, Text, func
 from sqlalchemy.orm import Mapped, mapped_column
 
 from webgate.db.engine import Base
@@ -17,6 +17,20 @@ class User(Base):
     is_admin: Mapped[bool] = mapped_column(Boolean, default=False)
     must_change_password: Mapped[bool] = mapped_column(Boolean, default=False)
     allowed_groups: Mapped[str] = mapped_column(Text, default="[]")  # JSON array of group names
+    totp_secret: Mapped[str] = mapped_column(String(255), default="")
+    totp_enabled: Mapped[bool] = mapped_column(Boolean, default=False)
+    created_at: Mapped[datetime] = mapped_column(DateTime, server_default=func.now())
+
+
+class ApiKey(Base):
+    __tablename__ = "api_keys"
+
+    id: Mapped[int] = mapped_column(primary_key=True, autoincrement=True)
+    user_id: Mapped[int] = mapped_column(Integer, ForeignKey("users.id"))
+    name: Mapped[str] = mapped_column(String(255))
+    key_hash: Mapped[str] = mapped_column(String(255))
+    key_prefix: Mapped[str] = mapped_column(String(10))
+    last_used_at: Mapped[datetime | None] = mapped_column(DateTime, nullable=True)
     created_at: Mapped[datetime] = mapped_column(DateTime, server_default=func.now())
 
 
@@ -28,6 +42,7 @@ class UserCreate(BaseModel):
 class UserLogin(BaseModel):
     username: str
     password: str
+    totp_code: str = ""
 
 
 class UserOut(BaseModel):
@@ -35,6 +50,7 @@ class UserOut(BaseModel):
     username: str
     is_admin: bool
     must_change_password: bool = False
+    totp_enabled: bool = False
     allowed_groups: list[str] = []
 
     model_config = {"from_attributes": True}
@@ -65,6 +81,48 @@ class ChangePassword(BaseModel):
     new_password: str
 
 
+class TotpSetupOut(BaseModel):
+    secret: str
+    qr_uri: str
+    qr_base64: str
+
+
+class TotpVerifyIn(BaseModel):
+    code: str
+
+
+class TotpStatusOut(BaseModel):
+    enabled: bool
+
+
+class LoginOut(BaseModel):
+    access_token: str = ""
+    token_type: str = "bearer"
+    requires_2fa: bool = False
+    temp_token: str = ""
+
+
 class TokenOut(BaseModel):
     access_token: str
     token_type: str = "bearer"
+
+
+class ApiKeyCreate(BaseModel):
+    name: str
+
+
+class ApiKeyOut(BaseModel):
+    id: int
+    name: str
+    key_prefix: str
+    last_used_at: datetime | None
+    created_at: datetime
+
+    model_config = {"from_attributes": True}
+
+
+class ApiKeyCreated(BaseModel):
+    id: int
+    name: str
+    key: str
+    key_prefix: str