webgate 2.5.0__tar.gz → 2.6.0__tar.gz

{webgate-2.5.0 → webgate-2.6.0}/CHANGELOG.md

@@ -1,5 +1,50 @@
 # Changelog
 
+## v2.6.0 (2026-09-16) — rotating the secret key no longer breaks everything
+
+### Fixed
+
+- **A changed `WEBGATE_SECRET_KEY` made webgate fall over instead of explaining
+  itself.** v2.2.0 refuses the shipped default, which asks every existing install to
+  set a real one; doing that leaves rows encrypted under the old key. `decrypt_value`
+  raised a bare Fernet error from twelve call sites and none of them caught it. The
+  status monitor died on its first sweep and froze every server's dot; opening a
+  terminal failed the WebSocket **upgrade**, so the browser got a 500 with nothing in
+  it. Found on the public demo, by walking into it.
+
+  An unreadable credential is now its own error, naming the server, why it happened
+  and what to do. The monitor marks that one server offline and carries on, the
+  terminal answers with an error frame, SFTP returns 502, and a connection test
+  reports it.
+
+- **The demo banner covered the top of the interface.** It was `position: fixed` with
+  nothing making room for it, so the app bar sat underneath. It is in flow now, which
+  also holds when it wraps to two lines on a narrow screen. Only visible with
+  `WEBGATE_DEMO_MODE=true`, which is why no test caught it.
+
+- **Diagrams that did not show.** Nine style directives set a pale fill and left the
+  label to the theme, so on GitHub's dark background they were light text on a light
+  box. All 21 diagrams in the repository now render, and every label is readable on
+  both grounds — checked with the Mermaid version GitHub actually uses, in a browser,
+  one diagram per page.
+
+### Added
+
+- **The pinned host key is visible.** The fingerprint has been in the API since
+  v2.0.0 and nothing showed it. Servers carry a shield when a key is pinned, the edit
+  form shows the fingerprint, and an admin can clear it there — with the consequence
+  spelled out, since accepting a new key is the one moment the protection is stood
+  down.
+- **A cap on concurrent SSH sessions per account** (**Admin → Settings → Security**,
+  0 for none). There was nothing stopping a looping tab from opening sessions until
+  the worker ran out. Checked before the SSH connection is made, and counted per
+  worker — which the setting says, because a gateway behind a load balancer allows
+  that many on each.
+
+333 tests.
+
+---
+
 ## v2.5.0 (2026-09-16) — browser tests
 
 The audit gap in v2.4.0 was reported by a person using the interface, and no test in

{webgate-2.5.0 → webgate-2.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: webgate
-Version: 2.5.0
+Version: 2.6.0
 Summary: Self-hosted web application for remote server management via SSH terminal and SFTP file browser
 Project-URL: Homepage, https://github.com/kalexnolasco/webgate
 Project-URL: Documentation, https://kalexnolasco.github.io/webgate/
@@ -126,9 +126,9 @@ flowchart TB
     GW -. "SSH :22" .-> APP2
     GW -. "SSH :22" .-> WORKER
     GW -. "SSH :22" .-> REDIS
-    style internet fill:#e8f0fe,stroke:#4a90d9
-    style firewall fill:#fff3e0,stroke:#ff9800
-    style internal fill:#f0f9e8,stroke:#5cb85c
+    style internet fill:none,stroke:#4a90d9,stroke-width:2px
+    style firewall fill:none,stroke:#ff9800,stroke-width:2px
+    style internal fill:none,stroke:#5cb85c,stroke-width:2px
     style GW fill:#ffcc02,stroke:#e6a800,color:#333
     style YOU fill:#4a90d9,stroke:#2a6cb5,color:#fff
 ```
@@ -160,9 +160,9 @@ flowchart TB
     WG -- "SSH/SFTP" --> APP1
     WG -- "SSH/SFTP" --> WORKER
     WG -- "SSH/SFTP" --> REDIS
-    style internet fill:#e8f0fe,stroke:#4a90d9
-    style firewall fill:#fff3e0,stroke:#ff9800
-    style internal fill:#f0f9e8,stroke:#5cb85c
+    style internet fill:none,stroke:#4a90d9,stroke-width:2px
+    style firewall fill:none,stroke:#ff9800,stroke-width:2px
+    style internal fill:none,stroke:#5cb85c,stroke-width:2px
     style WG fill:#5cb85c,stroke:#449d44,color:#fff
     style ENG1 fill:#4a90d9,stroke:#2a6cb5,color:#fff
     style ENG2 fill:#4a90d9,stroke:#2a6cb5,color:#fff
@@ -355,7 +355,7 @@ flowchart LR
     style B fill:#4a90d9,stroke:#2a6cb5,color:#fff
     style WG fill:#5cb85c,stroke:#449d44,color:#fff
     style BAST fill:#ffcc02,stroke:#e6a800,color:#333
-    style INT fill:#fff3e0,stroke:#ff9800
+    style INT fill:#b25e00,stroke:#ff9800,color:#fff
 ```
 
 ### Shared terminal session
@@ -407,7 +407,7 @@ flowchart LR
         L1["alice ∈ cn=devs"]
         L2["alice ∈ cn=admins"]
     end
-    subgraph "Group mapping<br/>(Admin → Settings → LDAP)"
+    subgraph MAP["Group mapping<br/>Admin &rarr; Settings &rarr; LDAP"]
         M["{<br/>  &quot;devs&quot;: &quot;production&quot;,<br/>  &quot;sre&quot;: &quot;all&quot;<br/>}"]
     end
     subgraph User
@@ -650,9 +650,9 @@ flowchart LR
     W3 -. watches .-> LEASE
     style LB fill:#ffcc02,stroke:#e6a800,color:#333
     style W1 fill:#5cb85c,stroke:#449d44,color:#fff
-    style W2 fill:#e8f0fe,stroke:#4a90d9
-    style W3 fill:#e8f0fe,stroke:#4a90d9
-    style PG fill:#fff3e0,stroke:#ff9800
+    style W2 fill:#2a6cb5,stroke:#4a90d9,color:#fff
+    style W3 fill:#2a6cb5,stroke:#4a90d9,color:#fff
+    style PG fill:#b25e00,stroke:#ff9800,color:#fff
 ```
 
 Reference stack:

{webgate-2.5.0 → webgate-2.6.0}/README.md

@@ -77,9 +77,9 @@ flowchart TB
     GW -. "SSH :22" .-> APP2
     GW -. "SSH :22" .-> WORKER
     GW -. "SSH :22" .-> REDIS
-    style internet fill:#e8f0fe,stroke:#4a90d9
-    style firewall fill:#fff3e0,stroke:#ff9800
-    style internal fill:#f0f9e8,stroke:#5cb85c
+    style internet fill:none,stroke:#4a90d9,stroke-width:2px
+    style firewall fill:none,stroke:#ff9800,stroke-width:2px
+    style internal fill:none,stroke:#5cb85c,stroke-width:2px
     style GW fill:#ffcc02,stroke:#e6a800,color:#333
     style YOU fill:#4a90d9,stroke:#2a6cb5,color:#fff
 ```
@@ -111,9 +111,9 @@ flowchart TB
     WG -- "SSH/SFTP" --> APP1
     WG -- "SSH/SFTP" --> WORKER
     WG -- "SSH/SFTP" --> REDIS
-    style internet fill:#e8f0fe,stroke:#4a90d9
-    style firewall fill:#fff3e0,stroke:#ff9800
-    style internal fill:#f0f9e8,stroke:#5cb85c
+    style internet fill:none,stroke:#4a90d9,stroke-width:2px
+    style firewall fill:none,stroke:#ff9800,stroke-width:2px
+    style internal fill:none,stroke:#5cb85c,stroke-width:2px
     style WG fill:#5cb85c,stroke:#449d44,color:#fff
     style ENG1 fill:#4a90d9,stroke:#2a6cb5,color:#fff
     style ENG2 fill:#4a90d9,stroke:#2a6cb5,color:#fff
@@ -306,7 +306,7 @@ flowchart LR
     style B fill:#4a90d9,stroke:#2a6cb5,color:#fff
     style WG fill:#5cb85c,stroke:#449d44,color:#fff
     style BAST fill:#ffcc02,stroke:#e6a800,color:#333
-    style INT fill:#fff3e0,stroke:#ff9800
+    style INT fill:#b25e00,stroke:#ff9800,color:#fff
 ```
 
 ### Shared terminal session
@@ -358,7 +358,7 @@ flowchart LR
         L1["alice ∈ cn=devs"]
         L2["alice ∈ cn=admins"]
     end
-    subgraph "Group mapping<br/>(Admin → Settings → LDAP)"
+    subgraph MAP["Group mapping<br/>Admin &rarr; Settings &rarr; LDAP"]
         M["{<br/>  &quot;devs&quot;: &quot;production&quot;,<br/>  &quot;sre&quot;: &quot;all&quot;<br/>}"]
     end
     subgraph User
@@ -601,9 +601,9 @@ flowchart LR
     W3 -. watches .-> LEASE
     style LB fill:#ffcc02,stroke:#e6a800,color:#333
     style W1 fill:#5cb85c,stroke:#449d44,color:#fff
-    style W2 fill:#e8f0fe,stroke:#4a90d9
-    style W3 fill:#e8f0fe,stroke:#4a90d9
-    style PG fill:#fff3e0,stroke:#ff9800
+    style W2 fill:#2a6cb5,stroke:#4a90d9,color:#fff
+    style W3 fill:#2a6cb5,stroke:#4a90d9,color:#fff
+    style PG fill:#b25e00,stroke:#ff9800,color:#fff
 ```
 
 Reference stack:

{webgate-2.5.0 → webgate-2.6.0}/ROADMAP.md

@@ -90,6 +90,12 @@ Tracks the development plan for **webgate**. Items are organized by release.
 - [x] **The documentation screenshots are taken by those tests**, so they cannot drift from the shipped interface
 - [x] **CI runs them on every push**, and uploads what they captured
 
+### v2.6.0 — Key rotation, host key UI, session cap (2026-09-16)
+- [x] **A changed secret key is handled** — it used to kill the monitor and fail the terminal's WebSocket upgrade with a bare 500
+- [x] **The pinned host key fingerprint is visible and clearable** from the Site Manager
+- [x] **A per-account cap on concurrent SSH sessions**
+- [x] **The demo banner no longer covers the interface**, and every diagram in the repository renders legibly on both GitHub grounds
+
 ---
 
 ## Planned
@@ -97,8 +103,6 @@ Tracks the development plan for **webgate**. Items are organized by release.
 ### v2.1.x — Next
 | Feature | Priority | Description |
 |---------|----------|-------------|
-| Per-user concurrent-session limit | Medium | Nothing caps how many SSH sessions one account may hold open |
-| Host key fingerprint in the UI | Medium | The API exposes it and can clear it; the Site Manager does not show it yet |
 | Internationalization (i18n) | Low | UI translations starting with English / Spanish |
 
 ### Later

webgate-2.6.0/VERSION

@@ -0,0 +1 @@
+2.6.0

{webgate-2.5.0 → webgate-2.6.0}/docs/LOCAL_TESTING.md

@@ -55,7 +55,7 @@ flowchart LR
     B -- SSH tunnel --> I
     style WG fill:#5cb85c,stroke:#449d44,color:#fff
     style B fill:#ffcc02,stroke:#e6a800,color:#333
-    style I fill:#fff3e0,stroke:#ff9800
+    style I fill:#b25e00,stroke:#ff9800,color:#fff
 ```
 
 `webgate` and `ssh-internal` share **no network**, so reaching `ssh-internal` is only possible via the bastion.

{webgate-2.5.0 → webgate-2.6.0}/docs/changelog.md

@@ -1,5 +1,50 @@
 # Changelog
 
+## v2.6.0 (2026-09-16) — rotating the secret key no longer breaks everything
+
+### Fixed
+
+- **A changed `WEBGATE_SECRET_KEY` made webgate fall over instead of explaining
+  itself.** v2.2.0 refuses the shipped default, which asks every existing install to
+  set a real one; doing that leaves rows encrypted under the old key. `decrypt_value`
+  raised a bare Fernet error from twelve call sites and none of them caught it. The
+  status monitor died on its first sweep and froze every server's dot; opening a
+  terminal failed the WebSocket **upgrade**, so the browser got a 500 with nothing in
+  it. Found on the public demo, by walking into it.
+
+  An unreadable credential is now its own error, naming the server, why it happened
+  and what to do. The monitor marks that one server offline and carries on, the
+  terminal answers with an error frame, SFTP returns 502, and a connection test
+  reports it.
+
+- **The demo banner covered the top of the interface.** It was `position: fixed` with
+  nothing making room for it, so the app bar sat underneath. It is in flow now, which
+  also holds when it wraps to two lines on a narrow screen. Only visible with
+  `WEBGATE_DEMO_MODE=true`, which is why no test caught it.
+
+- **Diagrams that did not show.** Nine style directives set a pale fill and left the
+  label to the theme, so on GitHub's dark background they were light text on a light
+  box. All 21 diagrams in the repository now render, and every label is readable on
+  both grounds — checked with the Mermaid version GitHub actually uses, in a browser,
+  one diagram per page.
+
+### Added
+
+- **The pinned host key is visible.** The fingerprint has been in the API since
+  v2.0.0 and nothing showed it. Servers carry a shield when a key is pinned, the edit
+  form shows the fingerprint, and an admin can clear it there — with the consequence
+  spelled out, since accepting a new key is the one moment the protection is stood
+  down.
+- **A cap on concurrent SSH sessions per account** (**Admin → Settings → Security**,
+  0 for none). There was nothing stopping a looping tab from opening sessions until
+  the worker ran out. Checked before the SSH connection is made, and counted per
+  worker — which the setting says, because a gateway behind a load balancer allows
+  that many on each.
+
+333 tests.
+
+---
+
 ## v2.5.0 (2026-09-16) — browser tests
 
 The audit gap in v2.4.0 was reported by a person using the interface, and no test in

{webgate-2.5.0 → webgate-2.6.0}/docs/guide/users.md

@@ -42,8 +42,8 @@ flowchart LR
     BOB -->|sees| S3
 
     style ADMIN fill:#5cb85c,stroke:#449d44,color:#fff
-    style ALICE fill:#e8f0fe,stroke:#4a90d9
-    style BOB fill:#fff3e0,stroke:#ff9800
+    style ALICE fill:#2a6cb5,stroke:#4a90d9,color:#fff
+    style BOB fill:#b25e00,stroke:#ff9800,color:#fff
 ```
 
 ## Editing Groups

{webgate-2.5.0 → webgate-2.6.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "webgate"
-version = "2.5.0"
+version = "2.6.0"
 description = "Self-hosted web application for remote server management via SSH terminal and SFTP file browser"
 readme = "README.md"
 license = "MIT"

{webgate-2.5.0 → webgate-2.6.0}/src/webgate/config.py

@@ -61,6 +61,7 @@ class Settings(BaseSettings):
     disable_monitor: bool = False  # Skip leader election; never run server monitor
     log_level: str = "info"
     session_timeout: int = 3600
+    max_sessions_per_user: int = 0  # 0 = no cap
     max_upload_size: int = 104857600  # 100MB
     first_run: bool = True
 

{webgate-2.5.0 → webgate-2.6.0}/src/webgate/files/routes.py

@@ -29,6 +29,7 @@ from webgate.files.models import (
 )
 from webgate.files.pool import sftp_pool
 from webgate.files.sftp_service import SFTPClient, validate_path
+from webgate.servers.crypto import CredentialUnreadable
 from webgate.servers.hostkeys import remember, translate
 from webgate.servers.models import Server
 from webgate.servers.service import get_server, get_server_credentials, resolve_jump_creds
@@ -111,7 +112,10 @@ async def _sftp(
         )
     allowed_paths = _get_allowed_paths(server)
     read_only = server.sftp_read_only
-    password, private_key = get_server_credentials(server)
+    try:
+        password, private_key = get_server_credentials(server)
+    except CredentialUnreadable as exc:
+        raise HTTPException(status_code=status.HTTP_502_BAD_GATEWAY, detail=str(exc)) from exc
     jump_kwargs = await resolve_jump_creds(session, server)
     try:
         client = await sftp_pool.acquire(

{webgate-2.5.0 → webgate-2.6.0}/src/webgate/runtime_config/registry.py

@@ -154,6 +154,23 @@ SPECS: tuple[Spec, ...] = (
         minimum=0,
         maximum=86400,
     ),
+    Spec(
+        key="max_sessions_per_user",
+        section="Security",
+        label="Concurrent SSH sessions per user",
+        help=(
+            "How many terminals one account may hold open on a single worker. 0 means "
+            "no limit. Counted per worker, so a gateway behind a load balancer allows "
+            "this many on each."
+        ),
+        kind="int",
+        minimum=0,
+        maximum=200,
+        warning=(
+            "0 means nothing stops a looping browser tab from opening SSH sessions "
+            "until the worker runs out."
+        ),
+    ),
     Spec(
         key="max_upload_size",
         section="Security",

webgate-2.6.0/src/webgate/servers/crypto.py

@@ -0,0 +1,47 @@
+import base64
+import hashlib
+
+from cryptography.fernet import Fernet, InvalidToken
+
+from webgate.config import settings
+
+
+def _derive_key(secret: str) -> bytes:
+    digest = hashlib.sha256(secret.encode()).digest()
+    return base64.urlsafe_b64encode(digest)
+
+
+def get_fernet() -> Fernet:
+    return Fernet(_derive_key(settings.secret_key))
+
+
+def encrypt_value(value: str) -> str:
+    if not value:
+        return ""
+    return get_fernet().encrypt(value.encode()).decode()
+
+
+class CredentialUnreadable(Exception):
+    """Stored credentials will not decrypt with the key this process is using.
+
+    Almost always means WEBGATE_SECRET_KEY changed after the row was written --
+    which is exactly what upgrading from the shipped default asks an operator to do.
+    Raised as itself rather than as a Fernet error so every caller can say something
+    useful instead of returning a 500.
+    """
+
+    def __init__(self, what: str = "These credentials") -> None:
+        super().__init__(
+            f"{what} cannot be decrypted with the current WEBGATE_SECRET_KEY. The key "
+            f"changed after they were saved. Restore a backup taken before the change, "
+            f"or re-enter the credentials."
+        )
+
+
+def decrypt_value(token: str, what: str = "These credentials") -> str:
+    if not token:
+        return ""
+    try:
+        return get_fernet().decrypt(token.encode()).decode()
+    except InvalidToken as exc:
+        raise CredentialUnreadable(what) from exc

{webgate-2.5.0 → webgate-2.6.0}/src/webgate/servers/monitor.py

@@ -26,7 +26,7 @@ from sqlalchemy import select, text
 from webgate.config import settings
 from webgate.db.engine import async_session_factory, engine
 from webgate.runtime_config import store as runtime
-from webgate.servers.crypto import decrypt_value
+from webgate.servers.crypto import CredentialUnreadable, decrypt_value
 from webgate.servers.hostkeys import known_hosts_for
 from webgate.servers.models import Server
 
@@ -232,17 +232,28 @@ class ServerMonitor:
         await asyncio.gather(*[_check_one(s) for s in servers])
 
     async def _check_server(self, server: Server) -> ServerStatus:
-        password = decrypt_value(server.encrypted_password) if server.encrypted_password else None
-        private_key_str = (
-            decrypt_value(server.encrypted_private_key) if server.encrypted_private_key else None
-        )
+        now = datetime.now(UTC)
+        try:
+            password = (
+                decrypt_value(server.encrypted_password, server.name)
+                if server.encrypted_password
+                else None
+            )
+            private_key_str = (
+                decrypt_value(server.encrypted_private_key, server.name)
+                if server.encrypted_private_key
+                else None
+            )
+        except CredentialUnreadable as exc:
+            # Reported against this server, not raised: the sweep has other hosts to
+            # check, and the operator needs to know which one is unreadable.
+            return ServerStatus(online=False, last_checked=now, error=str(exc))
         kwargs: dict[str, object] = {
             "host": server.hostname,
             "port": server.port,
             "username": server.username,
             "known_hosts": known_hosts_for(getattr(server, "host_key", "") or ""),
         }
-        now = datetime.now(UTC)
         start = time.monotonic()
         try:
             # Parsing the key belongs inside the try. An unreadable key row raised out

{webgate-2.5.0 → webgate-2.6.0}/src/webgate/servers/service.py

@@ -8,7 +8,7 @@ import asyncssh
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from webgate.servers.crypto import decrypt_value, encrypt_value
+from webgate.servers.crypto import CredentialUnreadable, decrypt_value, encrypt_value
 from webgate.servers.hostkeys import describe, known_hosts_for, remember, translate
 from webgate.servers.models import Server, ServerCreate, ServerOut, ServerUpdate
 
@@ -189,10 +189,19 @@ async def delete_server(session: AsyncSession, server: Server) -> None:
 async def test_server_connectivity(
     server: Server, session: AsyncSession | None = None
 ) -> tuple[bool, str]:
-    password = decrypt_value(server.encrypted_password) if server.encrypted_password else None
-    private_key_str = (
-        decrypt_value(server.encrypted_private_key) if server.encrypted_private_key else None
-    )
+    try:
+        password = (
+            decrypt_value(server.encrypted_password, server.name)
+            if server.encrypted_password
+            else None
+        )
+        private_key_str = (
+            decrypt_value(server.encrypted_private_key, server.name)
+            if server.encrypted_private_key
+            else None
+        )
+    except CredentialUnreadable as exc:
+        return False, str(exc)
 
     kwargs: dict[str, object] = {
         "host": server.hostname,
@@ -289,8 +298,13 @@ async def resolve_jump_creds(session: AsyncSession, server: Server) -> dict[str,
 
 
 def get_server_credentials(server: Server) -> tuple[str | None, str | None]:
-    password = decrypt_value(server.encrypted_password) if server.encrypted_password else None
+    """Raises CredentialUnreadable when the secret key no longer matches the rows."""
+    password = (
+        decrypt_value(server.encrypted_password, server.name) if server.encrypted_password else None
+    )
     private_key = (
-        decrypt_value(server.encrypted_private_key) if server.encrypted_private_key else None
+        decrypt_value(server.encrypted_private_key, server.name)
+        if server.encrypted_private_key
+        else None
     )
     return password, private_key

{webgate-2.5.0 → webgate-2.6.0}/src/webgate/static/index.html

@@ -309,7 +309,9 @@
         .cm-editor .cm-scroller { overflow: auto; }
 
         /* Demo banner */
-        .fz-demo-banner { position: fixed; top: 0; left: 0; right: 0; z-index: 200; background: var(--bg-secondary); border-bottom: 1px solid var(--border); color: var(--text-secondary); text-align: center; font-size: 12px; padding: 6px 12px; display: flex; align-items: center; justify-content: center; gap: 8px; flex-wrap: wrap; }
+        .fz-demo-banner { flex: none; z-index: 200; background: var(--bg-secondary); border-bottom: 1px solid var(--border); color: var(--text-secondary); text-align: center; font-size: 12px; padding: 6px 12px; display: flex; align-items: center; justify-content: center; gap: 8px; flex-wrap: wrap; }
+        .fz-root { height: 100vh; display: flex; flex-direction: column; }
+        .fz-app-shell { flex: 1; min-height: 0; display: flex; flex-direction: column; }
         .fz-demo-banner strong { color: var(--text-primary); font-weight: 600; }
         .fz-demo-banner code { background: var(--btn-bg); border: 1px solid var(--border); padding: 1px 5px; border-radius: var(--radius-sm); font-family: var(--mono); font-size: 11px; color: var(--text-primary); }
         .fz-demo-banner a { color: var(--accent); text-decoration: underline; text-underline-offset: 2px; }
@@ -360,6 +362,12 @@
         .fz-audit-filters { display: flex; flex-wrap: wrap; gap: 8px; align-items: center; padding: 10px 14px; border-bottom: 1px solid var(--border); }
         .fz-audit-filters input, .fz-audit-filters select { margin: 0; }
         .fz-audit-empty { padding: 28px 16px; text-align: center; color: var(--text-muted); font-size: 13px; }
+        .fz-srv-badge.pinned { color: var(--accent); }
+        .fz-hostkey { margin-top: 14px; padding-top: 12px; border-top: 1px solid var(--border); }
+        .fz-hostkey-head { display: flex; align-items: center; gap: 8px; font-size: 13px; font-weight: 600; margin-bottom: 8px; }
+        .fz-hostkey-head svg { color: var(--accent); }
+        .fz-hostkey-head button { margin-left: auto; }
+        .fz-hostkey-fp { display: block; font-family: var(--mono); font-size: 11px; word-break: break-all; padding: 7px 9px; background: var(--bg-tertiary); border: 1px solid var(--border); border-radius: 4px; }
         .fz-modal-footer { border-top: 1px solid var(--border); padding: 12px 16px; display: flex; justify-content: flex-end; gap: 8px; position: sticky; bottom: 0; background: var(--modal-bg); }
         .fz-row-2col { display: grid; grid-template-columns: 1fr 1fr; gap: 12px; }
         .fz-table { width: 100%; border-collapse: collapse; font-size: 12px; }
@@ -488,7 +496,7 @@ window._showToastImpl = function(message, type) {
 <g id="i-play"><path d="M7 4.5 19 12 7 19.5V4.5Z"/></g>
 <g id="i-save"><path d="M5 3h11l4 4v14H5V3Z"/><path d="M8.5 3v6h7V3M8.5 21v-7h7v7"/></g>
 </defs></svg>
-<div x-data="app()" x-cloak @keydown.window="handleKeyboard($event)">
+<div x-data="app()" x-cloak class="fz-root" @keydown.window="handleKeyboard($event)">
 
 <!-- Demo banner (shown when WEBGATE_DEMO_MODE=true) -->
 <div x-show="demoMode" class="fz-demo-banner">
@@ -539,7 +547,7 @@ window._showToastImpl = function(message, type) {
 </div>
 
 <!-- ======================== MAIN APP ======================== -->
-<div :style="token ? 'height:100vh;display:flex;flex-direction:column' : 'display:none'">
+<div class="fz-app-shell" :style="token ? '' : 'display:none'">
 
     <!-- ---- App bar ---- -->
     <header class="fz-appbar">
@@ -744,6 +752,10 @@ window._showToastImpl = function(message, type) {
                                             <svg class="fz-icon fz-icon-sm" viewBox="0 0 24 24"><use href="#i-jump"/></svg>
                                         </span>
                                         <span x-show="srv.sftp_enabled && srv.sftp_read_only" class="fz-srv-badge ro" title="SFTP is read-only">RO</span>
+                                        <span x-show="srv.host_key_fingerprint" class="fz-srv-badge pinned"
+                                              :title="'Host key pinned: ' + srv.host_key_fingerprint">
+                                            <svg class="fz-icon fz-icon-sm" viewBox="0 0 24 24"><use href="#i-shield"/></svg>
+                                        </span>
                                     </div>
                                     <div class="fz-srv-actions">
                                         <button @click.stop="openServerTerminal(srv)" class="fz-btn fz-btn-primary" :disabled="srv.ssh_enabled===false" :title="srv.ssh_enabled===false ? 'SSH is disabled for this server' : 'Open SSH terminal'">SSH</button>
@@ -1713,10 +1725,31 @@ window._showToastImpl = function(message, type) {
                         <input type="checkbox" x-model="serverForm.sftp_read_only" style="width:auto;accent-color:var(--warning)"> SFTP Read-Only (browse &amp; download only)
                     </label>
                     <label x-show="agentAvailable" style="display:flex;align-items:center;gap:8px;margin-top:12px">
-                        <input type="checkbox" x-model="serverForm.agent_enabled" style="width:auto;accent-color:var(--info)"> Allow the diagnostic agent</label>
-                                    <label style="display:flex;align-items:center;gap:8px;font-size:13px">
-                                        <input type="checkbox" x-model="serverForm.record_sessions" style="width:auto;accent-color:var(--info)"> Record SSH sessions
+                        <input type="checkbox" x-model="serverForm.agent_enabled" style="width:auto;accent-color:var(--info)"> Allow the diagnostic agent
+                    </label>
+                    <label style="display:flex;align-items:center;gap:8px;margin-top:8px;font-size:13px">
+                        <input type="checkbox" x-model="serverForm.record_sessions" style="width:auto;accent-color:var(--info)"> Record SSH sessions
                     </label>
+
+                    <div x-show="editingServerId" class="fz-hostkey">
+                        <div class="fz-hostkey-head">
+                            <svg class="fz-icon fz-icon-sm" viewBox="0 0 24 24"><use href="#i-shield"/></svg>
+                            <span>Host key</span>
+                            <button x-show="hostKeyOf(editingServerId) && currentUser?.is_admin" type="button"
+                                    @click="clearHostKey(editingServerId)"
+                                    class="fz-btn fz-btn-ghost fz-btn-sm">Clear pinned key</button>
+                        </div>
+                        <code x-show="hostKeyOf(editingServerId)" x-text="hostKeyOf(editingServerId)" class="fz-hostkey-fp"></code>
+                        <div class="hint" x-show="hostKeyOf(editingServerId)">
+                            Recorded the first time this server was reached. A connection is refused if the
+                            key changes, so clear it only when you know why it changed &mdash; a rebuild, a
+                            rotation &mdash; and confirm the new one out of band.
+                        </div>
+                        <div class="hint" x-show="!hostKeyOf(editingServerId)">
+                            Nothing pinned yet. The next connection records the key this server presents,
+                            and every connection after that is checked against it.
+                        </div>
+                    </div>
                     <div x-show="!agentAvailable" class="hint" style="margin-top:12px">
                         The AI agent is not set up on this gateway.
                         <a href="#" @click.prevent="showServerModal=false;openAgentSettings()" style="color:var(--accent)">Configure it in Admin &rarr; AI agent</a>
@@ -3079,6 +3112,29 @@ function app() {
         },
         async loadStatuses() { try { this.serverStatuses = await this.apiCall('/api/servers/status'); } catch {} },
         async loadGroups() { try { this.groups = await this.apiCall('/api/servers/groups'); } catch {} },
+        hostKeyOf(serverId) {
+            return (this.servers.find(s => s.id === serverId) || {}).host_key_fingerprint || '';
+        },
+        async clearHostKey(serverId) {
+            const srv = this.servers.find(s => s.id === serverId);
+            if (!srv) return;
+            // Spelled out, because accepting a new key is the one moment the protection
+            // is deliberately stood down.
+            const ok = confirm(
+                `Forget the pinned host key for ${srv.name}?\n\n` +
+                `${srv.host_key_fingerprint}\n\n` +
+                `The next connection will record whatever key the server presents and trust it. ` +
+                `Do this only if you know why the key changed and have confirmed the new one ` +
+                `some other way.`
+            );
+            if (!ok) return;
+            try {
+                const res = await this.apiCall(`/api/servers/${serverId}/host-key`, { method: 'DELETE' });
+                await this.loadServers();
+                this.showToast(`Forgot ${res.cleared || 'the pinned key'}`, 'success');
+                this.log('status', `Cleared the host key for ${srv.name}`);
+            } catch (e) { this.showToast(e.message || 'Could not clear the key', 'error'); }
+        },
         resetServerForm() { this.editingServerId = null; this.serverForm = { name: '', hostname: '', port: 22, username: '', auth_method: 'password', password: '', private_key: '', keyFileName: '', group: '', tagsStr: '', description: '', ssh_enabled: true, sftp_enabled: true, sftp_read_only: false, agent_enabled: false, record_sessions: false, sftp_allowed_paths_str: '', jump_via_id: null }; },
         loadKeyFile(event) {
             const file = event.target.files?.[0]; if (!file) return;

{webgate-2.5.0 → webgate-2.6.0}/src/webgate/terminal/routes.py

@@ -16,6 +16,7 @@ from webgate.db.engine import async_session_factory as _session_factory
 from webgate.recordings.models import Recording
 from webgate.recordings.recorder import CastRecorder
 from webgate.runtime_config import store as runtime
+from webgate.servers.crypto import CredentialUnreadable
 from webgate.servers.service import (
     get_server,
     get_server_credentials,
@@ -140,7 +141,14 @@ async def ws_terminal_server(ws: WebSocket, server_id: int) -> None:
             await ws.close(code=4003, reason="SSH is disabled for this server")
             return
 
-        password, private_key = get_server_credentials(server)
+        try:
+            password, private_key = get_server_credentials(server)
+        except CredentialUnreadable as exc:
+            # Raising here fails the WebSocket upgrade itself, so the browser sees a
+            # bare 500 with nothing to act on.
+            await ws.send_json({"type": "error", "message": str(exc)})
+            await ws.close(code=1011)
+            return
         jump_kwargs = await resolve_jump_creds(session, server)
 
         await ws.accept()

{webgate-2.5.0 → webgate-2.6.0}/src/webgate/terminal/shared.py

@@ -114,6 +114,16 @@ class SharedSessionManager:
             self._by_token.pop(sess.share_token, None)
         return sess
 
+    def count_for(self, username: str) -> int:
+        """Live sessions this account owns on this worker.
+
+        Per worker, not per fleet: sessions are held in memory beside the PTY they
+        belong to, and the failure this guards against -- one account exhausting a
+        worker -- is per worker too. With N workers a cap of M allows up to N*M in
+        total, which the setting's help text says out loud.
+        """
+        return sum(1 for s in self._by_id.values() if s.owner_username == username and not s.closed)
+
     def get_by_id(self, session_id: str) -> SharedSession | None:
         return self._by_id.get(session_id)