webgate 0.2.2__tar.gz → 0.3.1__tar.gz

{webgate-0.2.2 → webgate-0.3.1}/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## v0.3.1 (2026-04-15)
+
+### Fixed
+
+- **PostgreSQL actually works in Docker now.** v0.3.0 advertised PostgreSQL support but two bugs prevented it from working:
+  1. `asyncpg` was an optional extra (`webgate[postgres]`), so the official Docker image (and `pip install webgate`) didn't have the driver. Now bundled by default.
+  2. Lightweight migrations ran inside the same transaction as `create_all`. PostgreSQL aborts the entire transaction on any error (even when caught), so the first "column already exists" error rolled back table creation on subsequent runs. Each migration now uses its own transaction.
+
+Verified end-to-end against a real `postgres:16-alpine` container: tables created, login works, server creation and persistence across restarts confirmed.
+
+---
+
+## v0.3.0 (2026-04-15)
+
+### Features
+
+- **SSH jump host / bastion** -- per-server `jump_via_id` field. Webgate opens a tunneled SSH connection through the bastion using `asyncssh`'s `tunnel=` parameter. Works for both the terminal WebSocket and the SFTP browser. Solves the common "internal servers reachable only through one public bastion" scenario.
+- **SSH command snippets** -- per-user library of named commands. Click a snippet button in the terminal toolbar to send the command (with Enter) to the active session. Right-click to delete, `+` to create.
+- **PostgreSQL support** -- install with `pip install 'webgate[postgres]'` and set `WEBGATE_DB_URL=postgresql+asyncpg://...`. SQLite remains the default. Lightweight migrations are now dialect-aware.
+
+### Details
+
+- New `Server.jump_via_id` (FK to `servers.id`, nullable) + `resolve_jump_creds()` helper
+- New `Snippet` model + REST CRUD at `/api/snippets`
+- Frontend: dropdown to pick a jump host in the Add/Edit Server modal; `↺` badge in the server card when a jump is configured
+- Frontend: snippet toolbar in the terminal tab (hidden when there are no snippets)
+- Demo seed pre-populates `bastion` + `internal-app` (jump-host pair) and 4 example snippets
+
+---
+
 ## v0.2.2 (2026-04-15)
 
 ### Features

{webgate-0.2.2 → webgate-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: webgate
-Version: 0.2.2
+Version: 0.3.1
 Summary: Self-hosted web application for remote server management via SSH terminal and SFTP file browser
 Project-URL: Homepage, https://github.com/kalexnolasco/webgate
 Project-URL: Documentation, https://kalexnolasco.github.io/webgate/
@@ -27,6 +27,7 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.11
 Requires-Dist: aiofiles>=24.1.0
 Requires-Dist: aiosqlite>=0.21.0
+Requires-Dist: asyncpg>=0.30.0
 Requires-Dist: asyncssh>=2.18.0
 Requires-Dist: bcrypt>=4.2.0
 Requires-Dist: cryptography>=44.0.0
@@ -452,6 +453,24 @@ All settings are configurable via environment variables with the `WEBGATE_` pref
 | `WEBGATE_ALLOWED_ORIGINS` | `*` | CORS origins (comma-separated) |
 | `WEBGATE_ROOT_PATH` | `` (empty) | URL prefix when served behind a reverse proxy at a sub-path (e.g. `/webgate`) |
 | `WEBGATE_DEMO_MODE` | `false` | Read-only public demo: blocks all writes, seeds a `demo`/`demo` user and shows a banner |
+
+### PostgreSQL
+
+SQLite is the default. To use PostgreSQL, just point `WEBGATE_DB_URL` at it (the `asyncpg` driver is bundled as of v0.3.1):
+
+```bash
+export WEBGATE_DB_URL='postgresql+asyncpg://user:pass@host:5432/webgate'
+```
+
+Lightweight migrations are dialect-aware. Schema is created automatically on first start.
+
+### Jump host / bastion
+
+When adding a server, pick another server from the **Jump Via** dropdown to tunnel the SSH and SFTP connections through it. Useful when the target server is only reachable from a specific bastion. Stored as `jump_via_id` (FK to another `Server` row); `asyncssh`'s native `tunnel=` parameter does the actual chaining.
+
+### SSH command snippets
+
+Each user has a personal library of named commands. They appear as buttons in the terminal toolbar -- click to send `command + Enter`. Right-click to delete, `+` to create. Stored in the `snippets` table.
 | `WEBGATE_LOG_LEVEL` | `info` | Log level |
 | `WEBGATE_SESSION_TIMEOUT` | `3600` | SSH session timeout (seconds) |
 | `WEBGATE_MAX_UPLOAD_SIZE` | `104857600` | Max upload size (100 MB) |

{webgate-0.2.2 → webgate-0.3.1}/README.md

@@ -406,6 +406,24 @@ All settings are configurable via environment variables with the `WEBGATE_` pref
 | `WEBGATE_ALLOWED_ORIGINS` | `*` | CORS origins (comma-separated) |
 | `WEBGATE_ROOT_PATH` | `` (empty) | URL prefix when served behind a reverse proxy at a sub-path (e.g. `/webgate`) |
 | `WEBGATE_DEMO_MODE` | `false` | Read-only public demo: blocks all writes, seeds a `demo`/`demo` user and shows a banner |
+
+### PostgreSQL
+
+SQLite is the default. To use PostgreSQL, just point `WEBGATE_DB_URL` at it (the `asyncpg` driver is bundled as of v0.3.1):
+
+```bash
+export WEBGATE_DB_URL='postgresql+asyncpg://user:pass@host:5432/webgate'
+```
+
+Lightweight migrations are dialect-aware. Schema is created automatically on first start.
+
+### Jump host / bastion
+
+When adding a server, pick another server from the **Jump Via** dropdown to tunnel the SSH and SFTP connections through it. Useful when the target server is only reachable from a specific bastion. Stored as `jump_via_id` (FK to another `Server` row); `asyncssh`'s native `tunnel=` parameter does the actual chaining.
+
+### SSH command snippets
+
+Each user has a personal library of named commands. They appear as buttons in the terminal toolbar -- click to send `command + Enter`. Right-click to delete, `+` to create. Stored in the `snippets` table.
 | `WEBGATE_LOG_LEVEL` | `info` | Log level |
 | `WEBGATE_SESSION_TIMEOUT` | `3600` | SSH session timeout (seconds) |
 | `WEBGATE_MAX_UPLOAD_SIZE` | `104857600` | Max upload size (100 MB) |

{webgate-0.2.2 → webgate-0.3.1}/ROADMAP.md

@@ -45,25 +45,39 @@ This document tracks the development plan for **webgate**. Items are organized b
 - [x] Drag & drop upload progress bar (XHR with progress events, percentage display)
 - [x] Folder download as ZIP (server-side zip compression, right-click context menu)
 
-## v0.3.0 -- Collaboration & Operations
+## v0.2.1 -- Reverse Proxy Sub-Path (Released 2026-04-15)
+
+- [x] Serve webgate behind a reverse proxy at any URL prefix (`WEBGATE_ROOT_PATH`)
+- [x] nginx, Apache and Traefik examples in README
+
+## v0.2.2 -- Demo Mode (Released 2026-04-15)
+
+- [x] `WEBGATE_DEMO_MODE` middleware blocks writes for public read-only deployments
+- [x] `Dockerfile.demo` (webgate + sshd via supervisord) and `fly.toml` for one-command Fly.io deploys
+- [x] Live demo at https://webgate-demo.fly.dev/
+
+## v0.3.0 -- Operations Pack (Released 2026-04-15)
+
+- [x] **SSH jump host / bastion** (per-server `jump_via_id`, asyncssh tunneling)
+- [x] **SSH command snippets** (per-user library, terminal toolbar, click to send)
+- [x] **PostgreSQL support** (`pip install 'webgate[postgres]'`, dialect-aware migrations)
+- [x] Two-factor authentication (TOTP) -- already in v0.2.x
+- [x] API key authentication -- already in v0.2.x
+
+## v0.3.x -- Planned
 
 | Feature | Priority | Description |
 |---------|----------|-------------|
 | Shared terminal sessions | High | Multiple users can watch/interact with the same SSH session in real time |
 | Session recording & playback | High | Record terminal sessions for audit trail and training; replay in browser |
-| SSH command snippets | Medium | Save and execute common commands per server or globally; share across team |
 | Webhook notifications | Medium | Fire webhooks on events: user login, SSH connect, file upload, server added |
-| Two-factor authentication (TOTP) | High | Optional TOTP (Google Authenticator, Authy) for user accounts |
 | LDAP / Active Directory | Medium | Authenticate users against corporate LDAP/AD; auto-map groups |
-| API key authentication | Low | Generate API keys for programmatic access (automation, scripts, CI/CD) |
 
 ## v0.4.0 -- Enterprise & Scale
 
 | Feature | Priority | Description |
 |---------|----------|-------------|
-| PostgreSQL support | High | Test, document, and CI-verify PostgreSQL as alternative to SQLite |
 | Multi-instance deployment | Medium | Multiple webgate instances sharing a single database (stateless workers behind LB) |
-| SSH jump host / bastion | High | Connect through a bastion/jump host to reach servers not directly reachable |
 | Custom branding | Low | Configurable logo, application name, and color scheme |
 | Backup/restore UI | Medium | Export/import full application state (users, servers, audit log) from admin panel |
 | Internationalization (i18n) | Low | Multi-language support for the UI (starting with English and Spanish) |

{webgate-0.2.2 → webgate-0.3.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "webgate"
-version = "0.2.2"
+version = "0.3.1"
 description = "Self-hosted web application for remote server management via SSH terminal and SFTP file browser"
 readme = "README.md"
 license = "MIT"
@@ -40,6 +40,7 @@ dependencies = [
     "slowapi>=0.1.9",
     "pyotp>=2.9.0",
     "qrcode[pil]>=8.2",
+    "asyncpg>=0.30.0",
 ]
 
 [project.urls]

{webgate-0.2.2 → webgate-0.3.1}/src/webgate/app.py

@@ -18,6 +18,7 @@ from webgate.files.pool import sftp_pool
 from webgate.files.routes import router as files_router
 from webgate.servers.monitor import server_monitor
 from webgate.servers.routes import router as servers_router
+from webgate.snippets.routes import router as snippets_router
 from webgate.terminal.routes import router as terminal_router
 
 
@@ -89,6 +90,7 @@ def create_app() -> FastAPI:
     app.include_router(servers_router)
     app.include_router(terminal_router)
     app.include_router(files_router)
+    app.include_router(snippets_router)
 
     app.mount("/", StaticFiles(directory=str(settings.static_dir), html=True), name="static")
 

webgate-0.3.1/src/webgate/db/engine.py

@@ -0,0 +1,67 @@
+import logging
+from collections.abc import AsyncGenerator
+
+from sqlalchemy import MetaData, text
+from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
+from sqlalchemy.orm import DeclarativeBase
+
+from webgate.config import settings
+
+logger = logging.getLogger(__name__)
+
+engine = create_async_engine(settings.db_url, echo=False)
+async_session_factory = async_sessionmaker(engine, expire_on_commit=False)
+
+convention = {
+    "ix": "ix_%(column_0_label)s",
+    "uq": "uq_%(table_name)s_%(column_0_name)s",
+    "ck": "ck_%(table_name)s_%(constraint_name)s",
+    "fk": "fk_%(table_name)s_%(column_0_name)s_%(referred_table_name)s",
+    "pk": "pk_%(table_name)s",
+}
+
+
+class Base(DeclarativeBase):
+    metadata = MetaData(naming_convention=convention)
+
+
+async def get_session() -> AsyncGenerator[AsyncSession]:
+    async with async_session_factory() as session:
+        yield session
+
+
+# (table, column, sqlite_def, postgres_def)
+_MIGRATIONS: list[tuple[str, str, str, str]] = [
+    ("servers", "sftp_read_only", "BOOLEAN DEFAULT 0", "BOOLEAN DEFAULT FALSE"),
+    ("users", "totp_secret", "VARCHAR(255) DEFAULT ''", "VARCHAR(255) DEFAULT ''"),
+    ("users", "totp_enabled", "BOOLEAN DEFAULT 0", "BOOLEAN DEFAULT FALSE"),
+    (
+        "servers",
+        "jump_via_id",
+        "INTEGER REFERENCES servers(id)",
+        "INTEGER REFERENCES servers(id)",
+    ),
+]
+
+
+async def init_db() -> None:
+    dialect = engine.dialect.name  # "sqlite", "postgresql", ...
+    async with engine.begin() as conn:
+        await conn.run_sync(Base.metadata.create_all)
+    # Lightweight migrations: each in its OWN transaction. PostgreSQL aborts
+    # the whole transaction on any error (even one we catch), so running
+    # multiple ALTERs in a single txn would poison create_all on a fresh DB
+    # the moment the first "column already exists" fires.
+    for table, column, sqlite_def, pg_def in _MIGRATIONS:
+        col_def = pg_def if dialect == "postgresql" else sqlite_def
+        sql = f"ALTER TABLE {table} ADD COLUMN {column} {col_def}"
+        try:
+            async with engine.begin() as conn:
+                await conn.execute(text(sql))
+                logger.info("Migration applied: %s.%s", table, column)
+        except Exception:
+            pass  # Column already exists, or table not yet present on fresh DB
+
+
+async def close_db() -> None:
+    await engine.dispose()

webgate-0.3.1/src/webgate/demo.py

@@ -0,0 +1,90 @@
+"""Demo mode seeding: pre-populates the demo user and showcase servers.
+
+Activated when WEBGATE_DEMO_MODE=true. Idempotent — safe to call on every startup.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from webgate.auth.service import create_user, get_user_by_username
+from sqlalchemy import select
+
+from webgate.servers.models import ServerCreate
+from webgate.servers.service import create_server, list_servers
+from webgate.snippets.models import Snippet
+
+logger = logging.getLogger(__name__)
+
+
+DEMO_USERNAME = "demo"
+DEMO_PASSWORD = "demo"
+
+def _bastion() -> ServerCreate:
+    return ServerCreate(
+        name="bastion",
+        hostname="127.0.0.1",
+        port=22,
+        username="demo",
+        password="demo",
+        group="demo",
+        tags=["demo", "bastion"],
+        description="Public SSH bastion. Other servers proxy through this one.",
+        sftp_read_only=True,
+    )
+
+
+def _internal(jump_via_id: int) -> ServerCreate:
+    return ServerCreate(
+        name="internal-app",
+        hostname="127.0.0.1",
+        port=22,
+        username="demo",
+        password="demo",
+        group="demo",
+        tags=["demo", "internal"],
+        description="App server reachable only via the bastion (jump-host demo).",
+        sftp_read_only=True,
+        jump_via_id=jump_via_id,
+    )
+
+
+async def seed_demo(session: AsyncSession) -> None:
+    user = await get_user_by_username(session, DEMO_USERNAME)
+    if user is None:
+        user = await create_user(session, DEMO_USERNAME, DEMO_PASSWORD, is_admin=False)
+        user.must_change_password = False
+        user.allowed_groups = json.dumps(["demo"])
+        await session.commit()
+        logger.info("Created demo user (%s/%s)", DEMO_USERNAME, DEMO_PASSWORD)
+
+    existing = await list_servers(session, user.id, is_admin=True)
+    existing_names = {s.name for s in existing}
+
+    bastion_id: int | None = next((s.id for s in existing if s.name == "bastion"), None)
+    if "bastion" not in existing_names:
+        bastion = await create_server(session, _bastion(), user.id)
+        bastion_id = bastion.id
+        logger.info("Seeded demo bastion (id=%s)", bastion_id)
+
+    if "internal-app" not in existing_names and bastion_id is not None:
+        await create_server(session, _internal(bastion_id), user.id)
+        logger.info("Seeded internal-app via bastion id=%s", bastion_id)
+
+    # Seed a few example snippets so the toolbar isn't empty
+    existing_snippets = (
+        await session.execute(select(Snippet).where(Snippet.user_id == user.id))
+    ).scalars().all()
+    if not existing_snippets:
+        for name, cmd, desc in [
+            ("ls -lah", "ls -lah", "List files (long, human sizes, hidden)"),
+            ("disk usage", "df -h", "Mounted filesystems with sizes"),
+            ("top procs", "ps aux --sort=-%mem | head", "Top memory-consuming processes"),
+            ("uptime", "uptime && uname -a", "Uptime + kernel info"),
+        ]:
+            session.add(Snippet(name=name, command=cmd, description=desc, user_id=user.id))
+        await session.commit()
+        logger.info("Seeded %d demo snippets", 4)

{webgate-0.2.2 → webgate-0.3.1}/src/webgate/files/pool.py

@@ -25,6 +25,7 @@ class _PoolEntry:
     client: SFTPClient
     last_used: float = field(default_factory=time.monotonic)
     in_use: int = 0
+    jump_conn: asyncssh.SSHClientConnection | None = None
 
 
 class SFTPPool:
@@ -63,6 +64,7 @@ class SFTPPool:
         username: str,
         password: str | None = None,
         private_key: str | None = None,
+        jump_kwargs: dict[str, object] | None = None,
     ) -> SFTPClient:
         key = self._key(server_id)
         if key not in self._locks:
@@ -96,10 +98,15 @@ class SFTPPool:
             elif password:
                 kwargs["password"] = password
 
+            jump_conn: asyncssh.SSHClientConnection | None = None
+            if jump_kwargs:
+                jump_conn = await asyncssh.connect(**jump_kwargs)  # type: ignore[arg-type]
+                kwargs["tunnel"] = jump_conn
+
             conn = await asyncssh.connect(**kwargs)  # type: ignore[arg-type]
             client = SFTPClient(conn)
             await client.connect()
-            entry = _PoolEntry(conn=conn, client=client, in_use=1)
+            entry = _PoolEntry(conn=conn, client=client, in_use=1, jump_conn=jump_conn)
             self._pool[key] = entry
             logger.info("SFTP pool: new connection to %s:%s (server_id=%s)", hostname, port, server_id)
             return client
@@ -120,6 +127,11 @@ class SFTPPool:
             entry.conn.close()
         except Exception:
             pass
+        if entry.jump_conn is not None:
+            try:
+                entry.jump_conn.close()
+            except Exception:
+                pass
 
     async def _cleanup_loop(self) -> None:
         while True:

{webgate-0.2.2 → webgate-0.3.1}/src/webgate/files/routes.py

@@ -25,7 +25,7 @@ from webgate.files.models import (
 from webgate.files.pool import sftp_pool
 from webgate.files.sftp_service import SFTPClient, validate_path
 from webgate.servers.models import Server
-from webgate.servers.service import get_server, get_server_credentials
+from webgate.servers.service import get_server, get_server_credentials, resolve_jump_creds
 
 router = APIRouter(prefix="/api/files", tags=["files"])
 
@@ -88,6 +88,7 @@ async def _sftp(
     allowed_paths = _get_allowed_paths(server)
     read_only = server.sftp_read_only
     password, private_key = get_server_credentials(server)
+    jump_kwargs = await resolve_jump_creds(session, server)
     try:
         client = await sftp_pool.acquire(
             server_id,
@@ -96,6 +97,7 @@ async def _sftp(
             username=server.username,
             password=password,
             private_key=private_key,
+            jump_kwargs=jump_kwargs,
         )
         yield client, allowed_paths, read_only
     finally:

{webgate-0.2.2 → webgate-0.3.1}/src/webgate/servers/models.py

@@ -25,6 +25,9 @@ class Server(Base):
     sftp_enabled: Mapped[bool] = mapped_column(Boolean, default=True)
     sftp_allowed_paths: Mapped[str] = mapped_column(Text, default="[]")  # JSON array of paths
     sftp_read_only: Mapped[bool] = mapped_column(Boolean, default=False)
+    jump_via_id: Mapped[int | None] = mapped_column(
+        Integer, ForeignKey("servers.id"), nullable=True
+    )
     last_connected_at: Mapped[datetime | None] = mapped_column(DateTime, nullable=True)
     created_at: Mapped[datetime] = mapped_column(DateTime, server_default=func.now())
     user_id: Mapped[int] = mapped_column(Integer, ForeignKey("users.id"))
@@ -45,6 +48,7 @@ class ServerCreate(BaseModel):
     sftp_enabled: bool = True
     sftp_allowed_paths: list[str] = []
     sftp_read_only: bool = False
+    jump_via_id: int | None = None
 
 
 class ServerUpdate(BaseModel):
@@ -62,6 +66,7 @@ class ServerUpdate(BaseModel):
     sftp_enabled: bool | None = None
     sftp_allowed_paths: list[str] | None = None
     sftp_read_only: bool | None = None
+    jump_via_id: int | None = None
 
 
 class ServerOut(BaseModel):
@@ -78,6 +83,7 @@ class ServerOut(BaseModel):
     sftp_enabled: bool
     sftp_allowed_paths: list[str]
     sftp_read_only: bool
+    jump_via_id: int | None = None
     last_connected_at: datetime | None
     created_at: datetime
 

{webgate-0.2.2 → webgate-0.3.1}/src/webgate/servers/routes.py

@@ -154,7 +154,7 @@ async def test_connectivity(
     server = await get_server(session, server_id, current_user.id, **_user_kwargs(current_user))
     if not server:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Server not found")
-    success, message = await test_server_connectivity(server)
+    success, message = await test_server_connectivity(server, session)
     if success:
         await update_last_connected(session, server)
     return {"success": success, "message": message}

{webgate-0.2.2 → webgate-0.3.1}/src/webgate/servers/service.py

@@ -53,6 +53,7 @@ def server_to_out(server: Server) -> ServerOut:
         sftp_enabled=server.sftp_enabled,
         sftp_allowed_paths=_paths_from_json(server.sftp_allowed_paths),
         sftp_read_only=server.sftp_read_only,
+        jump_via_id=server.jump_via_id,
         last_connected_at=server.last_connected_at,
         created_at=server.created_at,
     )
@@ -125,6 +126,7 @@ async def create_server(session: AsyncSession, data: ServerCreate, user_id: int)
         sftp_enabled=data.sftp_enabled,
         sftp_allowed_paths=_tags_to_json(data.sftp_allowed_paths),
         sftp_read_only=data.sftp_read_only,
+        jump_via_id=data.jump_via_id,
         user_id=user_id,
     )
     session.add(server)
@@ -166,6 +168,8 @@ async def update_server(
         server.sftp_allowed_paths = _tags_to_json(data.sftp_allowed_paths)
     if data.sftp_read_only is not None:
         server.sftp_read_only = data.sftp_read_only
+    if data.jump_via_id is not None:
+        server.jump_via_id = data.jump_via_id or None  # 0 means "clear"
     await session.commit()
     await session.refresh(server)
     return server
@@ -176,7 +180,9 @@ async def delete_server(session: AsyncSession, server: Server) -> None:
     await session.commit()
 
 
-async def test_server_connectivity(server: Server) -> tuple[bool, str]:
+async def test_server_connectivity(
+    server: Server, session: AsyncSession | None = None
+) -> tuple[bool, str]:
     password = decrypt_value(server.encrypted_password) if server.encrypted_password else None
     private_key_str = (
         decrypt_value(server.encrypted_private_key) if server.encrypted_private_key else None
@@ -193,12 +199,25 @@ async def test_server_connectivity(server: Server) -> tuple[bool, str]:
     elif password:
         kwargs["password"] = password
 
+    jump_conn = None
+    if session is not None:
+        jump_kwargs = await resolve_jump_creds(session, server)
+        if jump_kwargs:
+            try:
+                jump_conn = await asyncssh.connect(**jump_kwargs)  # type: ignore[arg-type]
+                kwargs["tunnel"] = jump_conn
+            except Exception as e:
+                return False, f"Jump host failed: {e}"
+
     try:
         conn = await asyncssh.connect(**kwargs)  # type: ignore[arg-type]
         conn.close()
-        return True, "Connection successful"
+        return True, "Connection successful" + (" (via jump host)" if jump_conn else "")
     except Exception as e:
         return False, str(e)
+    finally:
+        if jump_conn is not None:
+            jump_conn.close()
 
 
 async def update_last_connected(session: AsyncSession, server: Server) -> None:
@@ -219,6 +238,35 @@ async def list_groups(
     return [row[0] for row in result.all()]
 
 
+async def resolve_jump_creds(
+    session: AsyncSession, server: Server
+) -> dict[str, object] | None:
+    """If `server` has a jump_via_id, return connect kwargs for the bastion.
+
+    Returns None when no jump host is configured. Cycles are silently broken
+    (server pointing to itself, or to its own jump, etc.) by following at most
+    one hop.
+    """
+    if server.jump_via_id is None or server.jump_via_id == server.id:
+        return None
+    stmt = select(Server).where(Server.id == server.jump_via_id)
+    jump = (await session.execute(stmt)).scalar_one_or_none()
+    if jump is None:
+        return None
+    password, private_key = get_server_credentials(jump)
+    kwargs: dict[str, object] = {
+        "host": jump.hostname,
+        "port": jump.port,
+        "username": jump.username,
+        "known_hosts": None,
+    }
+    if private_key:
+        kwargs["client_keys"] = [asyncssh.import_private_key(private_key)]
+    elif password:
+        kwargs["password"] = password
+    return kwargs
+
+
 def get_server_credentials(server: Server) -> tuple[str | None, str | None]:
     password = decrypt_value(server.encrypted_password) if server.encrypted_password else None
     private_key = (

webgate-0.3.1/src/webgate/snippets/models.py

@@ -0,0 +1,34 @@
+from datetime import datetime
+
+from pydantic import BaseModel
+from sqlalchemy import DateTime, ForeignKey, Integer, String, Text, func
+from sqlalchemy.orm import Mapped, mapped_column
+
+from webgate.db.engine import Base
+
+
+class Snippet(Base):
+    __tablename__ = "snippets"
+
+    id: Mapped[int] = mapped_column(primary_key=True, autoincrement=True)
+    name: Mapped[str] = mapped_column(String(255))
+    command: Mapped[str] = mapped_column(Text)
+    description: Mapped[str] = mapped_column(Text, default="")
+    user_id: Mapped[int] = mapped_column(Integer, ForeignKey("users.id"))
+    created_at: Mapped[datetime] = mapped_column(DateTime, server_default=func.now())
+
+
+class SnippetCreate(BaseModel):
+    name: str
+    command: str
+    description: str = ""
+
+
+class SnippetOut(BaseModel):
+    id: int
+    name: str
+    command: str
+    description: str
+    created_at: datetime
+
+    model_config = {"from_attributes": True}

webgate-0.3.1/src/webgate/snippets/routes.py

@@ -0,0 +1,45 @@
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from webgate.auth.models import UserOut
+from webgate.auth.routes import get_current_user
+from webgate.db.engine import get_session
+from webgate.snippets.models import Snippet, SnippetCreate, SnippetOut
+
+router = APIRouter(prefix="/api/snippets", tags=["snippets"])
+
+SessionDep = Annotated[AsyncSession, Depends(get_session)]
+CurrentUserDep = Annotated[UserOut, Depends(get_current_user)]
+
+
+@router.get("", response_model=list[SnippetOut])
+async def list_snippets(session: SessionDep, user: CurrentUserDep) -> list[Snippet]:
+    stmt = select(Snippet).where(Snippet.user_id == user.id).order_by(Snippet.name)
+    result = await session.execute(stmt)
+    return list(result.scalars().all())
+
+
+@router.post("", response_model=SnippetOut, status_code=status.HTTP_201_CREATED)
+async def create_snippet(
+    body: SnippetCreate, session: SessionDep, user: CurrentUserDep
+) -> Snippet:
+    snippet = Snippet(
+        name=body.name, command=body.command, description=body.description, user_id=user.id
+    )
+    session.add(snippet)
+    await session.commit()
+    await session.refresh(snippet)
+    return snippet
+
+
+@router.delete("/{snippet_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_snippet(snippet_id: int, session: SessionDep, user: CurrentUserDep) -> None:
+    stmt = select(Snippet).where(Snippet.id == snippet_id, Snippet.user_id == user.id)
+    snippet = (await session.execute(stmt)).scalar_one_or_none()
+    if snippet is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Snippet not found")
+    await session.delete(snippet)
+    await session.commit()