webgate 0.4.0__tar.gz → 0.4.2__tar.gz

{webgate-0.4.0 → webgate-0.4.2}/CHANGELOG.md

@@ -1,5 +1,71 @@
 # Changelog
 
+## v0.4.2 (2026-04-15)
+
+### Features
+
+- **LDAP / Active Directory authentication** -- enable with `WEBGATE_LDAP_ENABLED=true` and login flow falls back to LDAP after the local user table. On a successful LDAP bind the user is auto-provisioned (or refreshed) in the local DB, with `allowed_groups` derived from LDAP group memberships and admin status from a configurable list of admin groups.
+
+### Configuration
+
+| Env var | Description |
+|---|---|
+| `WEBGATE_LDAP_ENABLED` | `true` to enable LDAP login |
+| `WEBGATE_LDAP_URL` | `ldap://host:389` or `ldaps://host:636` |
+| `WEBGATE_LDAP_BIND_DN` | service account DN, e.g. `cn=admin,dc=example,dc=com` |
+| `WEBGATE_LDAP_BIND_PASSWORD` | service account password |
+| `WEBGATE_LDAP_USER_BASE` | e.g. `ou=people,dc=example,dc=com` |
+| `WEBGATE_LDAP_USER_FILTER` | default `(uid={username})` (AD: `(sAMAccountName={username})`) |
+| `WEBGATE_LDAP_GROUP_BASE` | e.g. `ou=groups,dc=example,dc=com` (empty = no group lookup) |
+| `WEBGATE_LDAP_GROUP_FILTER` | default `(member={dn})` (AD nested: `(member:1.2.840.113556.1.4.1941:={dn})`) |
+| `WEBGATE_LDAP_GROUP_MAP` | JSON `{"ldap-cn":"webgate-group"}` |
+| `WEBGATE_LDAP_ADMIN_GROUPS` | JSON list of LDAP CNs that grant admin |
+
+### Details
+
+- Search-then-bind flow: bind as service account, search by username, re-bind as the user with their password
+- LDAP filter values are properly escaped (RFC 4515)
+- All `ldap3` calls run in `asyncio.to_thread` to avoid blocking the event loop
+- Local accounts (admin, API keys, 2FA) keep working as before -- LDAP is only consulted after a local-credential miss
+- Re-login refreshes admin status and group mapping from LDAP every time
+
+### Verified
+
+End-to-end against `osixia/openldap` with an `alice` user in groups `devs` and `admins`:
+
+- `alice / alicepass` → 200, JWT issued, `/api/auth/me` returns `is_admin=true`, `allowed_groups=["all","production"]` (mapped from LDAP CNs)
+- `alice / WRONG` → 401 Invalid credentials
+- `admin / admin` (local fallback) → still works
+
+---
+
+## v0.4.1 (2026-04-15)
+
+### Features
+
+- **SSH session recording** -- when `WEBGATE_RECORD_SESSIONS=true`, every SSH terminal session is captured to an asciinema cast v2 file under `WEBGATE_RECORDINGS_DIR` (default `./recordings`). Both owner-only and shared sessions are recorded. A new `recordings` table tracks file path, server, user, start/end, duration and size.
+- **Built-in web replay** -- `📹 Recordings` button (top toolbar) opens a list with **▶ Play** / **DL** / **Del** actions. Play opens an asciinema-player tab that streams the cast directly from the API. Non-admins see only their own recordings; admins see everyone's.
+- **Compliance-grade audit trail** -- the recording captures the full PTY output that every participant saw, including pasted commands and environment, in a portable, replayable, vendor-independent format (you can also `asciinema play file.cast` locally).
+
+### Details
+
+- New `WEBGATE_RECORD_SESSIONS` and `WEBGATE_RECORDINGS_DIR` settings (both off / `./recordings` by default)
+- New `Recording` model + REST CRUD at `/api/recordings`
+- New `webgate.recordings.recorder.CastRecorder` writes asciinema cast v2 (JSON Lines) line-buffered, very low overhead
+- Hook in `SharedSession.broadcast` -- recorder receives the same byte stream as every WS client
+- Player endpoint accepts a `?token=` query param (Authorization header isn't available when opening a tab)
+
+### Verified
+
+End-to-end against a real container with `WEBGATE_RECORD_SESSIONS=true`:
+
+- Open SSH, run `echo HELLO_RECORDED` + `uname -n`, disconnect
+- DB row populated: `started_at`, `ended_at`, `duration_s=3.0`, `size_bytes=1142`
+- File on disk: valid asciinema v2 cast, captures welcome banner + commands + responses
+- Open `/api/recordings/{id}/play?token=...` in browser → asciinema-player loads, hit Play → terminal replays the captured commands
+
+---
+
 ## v0.4.0 (2026-04-15)
 
 ### Features