"Load more" in the recordings search TUI (and --resume-token) failed with
"start_time is required" after the latest access graph update.
Follow-up pages were sent with only the batch_token, relying on the
proto comment that claimed all other filter fields are ignored
once batch_token is set. That contract is wrong: the server validates
and applies start_time/end_time and every other filter on each request,
and the access graph re-checks that the checkpoint falls
within the requested time range.
The batch token is intentionally only a cursor and does not carry the full
search state - encoding every filter into the token would let it grow to
very large sizes. So the original request must be replayed with the
batch_token set on each page. Build the request once and have the fetcher
clone it and attach the token for the initial page, resume, and load-more,
fixing both the TUI and --resume-token.
Also surface the fetch error back to the user: a failed "load more" now
opens a popup with a red header and the server message rendered as code,
instead of silently swallowing the error behind a "(retry)" label.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Add types and API for Okta assignment target status
* Add status fields to resource output
* Validate args for RecordStatus
* Update tests for RecordStatus errors
* Tidy up
* Remove tctl changes to put in separate PR
* Add iOS and iPadOS as new OSType values
* lib/msgraph: Add `Model` field back to `ManagedDevice`
We need it to differentiate between iPhones and iPads in e/lib/intune.
* Add device_type to JamfInventoryEntry
* Use a separate block for computer types
* Add godoc and examples for `ManagedDevice.Model`
* Add os_types to SyncInventoryStart
* Add ui interaction event protos
* make grpc
* Add userEventService method
* Fix signature
* Fix username field
it would have been logging the hash of ""
* Convert DeleteProxy RPC from HTTP to gRPC
* Use `t.Context()`
* Add more greppable TODO
* Fix usage of deprecated rpc
* Upsert RPC
* Use wrapper message for UpsertResponse
* gofmt
* Simplify godoc
* Update response message
* Update method names on public api client
* fix tests
* Introduce UpsertProxyWithoutServer
* Edoardo comments
* separate
* Change to UpsertProxyServer RPC handler
* Add scope support to OpenSSH certificate generation
simplify scopes open ssh connection
Add DeviceVerified and isBot in the signer
tweak signer to be lazily referenced
revert adding login to client
Pass in targetServer to the OpenSSHCertRequest instead - use CheckAccessToSSHServer to check if scoped role has access
Respond to pr review
Changed signature of DialHost to use a struct before it gets too big
Changed requestedHostLogin to login and targetnodescope to targetserverscope
fix build
Update auth_with_roles.go
Update split_access_checker.go
Update agentless.go
Update auth.go
fix test
Update authservice.pb.go
move cert gen
alias auth proto instead and update the test error expectation
rename goproto go googleproto for better readability - address pr feedback
Update integration_test.go
test
fix build
revert merge conflict for applyTraits
Switch to using pinning package to marshal/unmarshal
* respond to PR review
* updated the need for a agents to upsert node
* revert permissions.go change for upserting node
Update auth_with_roles.go
* set gogo proto options to false for openSSHCertRequest so that we can import teleport.scoped.v1.Pin
Update authservice.pb.go
* Add node ID check in upsertNode
* fix test structure
Update auth_with_roles_test.go
* Add disconnect expired cert and lock mode for scoped role
Update IAC docs
* respond to code review
Add a scoped authorizer in the forwarder_test
fix up proto comments
Update forwarder.go
* fix forwarder setting nil disconnectExpiredCert
* Update validate lock to accept empty string - will be treated as best_effort down the line
add comment
Prior to this change, users who manually register dynamic desktops
using the same labels that the LDAP reconciler uses could trick
the reconciler into managing desktops that it shouldn't own.
Additionally, the LDAP reconciler would pull all desktops from
the backend, including the dynamically registered ones. Since
these dynamic desktops aren't found in LDAP, the reconciler
woudl think they are stale and incorrectly delete them.
Use a new status field (because changing teleport.dev/origin is unsafe)
in order to indicate desktops managed by LDAP. This ensures that
the LDAP reconciler operates only on LDAP-managed hosts.
* Add protos
* implement validation and matching support
* generated integrations stuff
* De Morgan, and his faithful followers, have once again defeated me in battle
* Udpate tests in lib/kube/token
* Extend join_kubernetes_test.go
* Fix missing param
* Extend validation tests
* Fix minor nits
* qF1001: CoUld aPpLY de MORgan'S LaW (stAticCHEck)
* Add session event to enhanced summaries for desktop + other recording type events
* Add more comments to proto
* Fix proto numbers
* Handle deprecation in recording TUI
* Change 'EndOfFile' property to int64 from uint32
* Plumb the new int64 'EndOfFile' field through the rest of the backend and client
* Switch 'size' field of truncate requests to uint64 instead of int64
* Update everything downstream of the new uint64 'size' field
* Update lib/srv/desktop/tdp/protocol/tdpb/translate.go
Co-authored-by: Przemko Robakowski <przemko.robakowski@goteleport.com>
---------
Co-authored-by: Przemko Robakowski <przemko.robakowski@goteleport.com>
* Fix headless login when in-band MFA is required.
* Set HeadlessAuthenticationID in headless cert and allow bypass of in-band MFA if set.
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
* Update proto to fix test.
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
* Delete useless assert.
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
---------
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
* Add audit event for environment profile
* Enforce that new event codes are registered in the web audit UI
Add TestEventCodesInWebTypes, a Go test that cross-checks every code defined in lib/events/codes.go against the eventCodes map in web/packages/teleport/src/services/audit/types.ts. Without an entry there, events appear as "Unknown" in the audit log UI.
A knownMissing set exempts 14 pre-existing gaps that predate the test; those should be fixed in follow-up PRs and removed from the list.
* Add web audit UI entries for environment profile update event
* Add beam list sorting
* ACL for beams
* Add `BeamServiceClient` to api client
* Use correct expires field for sorting
* Use case-insensitive sorting for user/owner
* Fix service client comment
* Refactor index selection
* Refactor backend sort validation
* Use enums for sort field and order
* Handle nil spec.expires at key creation
* Encode uft8-unsafe page tokens
* Fix tests naming
* Apply filters in backend `IterateBeams`
* Rename `ListBeamsRequestOptions.GetFilterOwners`
* Fix yield
* Tweak len access
* Always base32 encode page tokens
* Use bytestring type
* Don't use `IterateBeams` in `ListBeams`
`pageSize` was not propagated to the lister
* Add missing error checks
* Revert unnecessary comment change
* Make `IterateBeams` backwards compatible with teleport.e
* Make `ListBeams` backwards compatible with teleport.e
* Don't lower user name for cache index keys
* Godoc for MakeBeamFilterFunc
* Deny user acl for beams without entitlement
* Comment sorting validation in backend
* Encode page token only when required
* Remove upper bound on page size
* Decode page tokens in IterateBeams
* Remove redundant database configuration references
This:
1. Adds documentation for the mysql_server_version field of proxy_service
to the general config reference and improves formatting for a couple
of fields there.
2. Removes database config/resource references that are redundant due to
being covered by auto-generated docs or the more centralized teleport
config docs.
* Update docs redirects
* Update internal links pointing to deleted pages
* Update DatabaseSpecV3.Protocol comment with allowed database protocol types
- This PR is removing the old `db` resource reference.
- The new `db` resource reference is generated from the DatabaseV3
protobuf type.
- The old `db` resource reference defined the allowed values of the
protocol field, whereas this information is not in the `DatabaseV3` type.
- docs/pages/identity-security/session-summaries.mdx links to the `db`
resource reference, using it as a source of information on which values
are allowed for the protocol field.
Therefore, we must update the DatabaseV3 protobuf type with information
on which values are allowed for the protocol field.
* Add metadata/thumbnail generation for desktop recordings
* Rename isPTYSession to metadataParamsForSessionEnd
* go mod tidy
* Disable the processor if RDP decoder is not available
* Reuse png.Encoder and buffer instead of creating new per screenshot
* Add clarifying comment about returning nil, nil when no decoder
* Add Windows desktop end events
* Set the session start time from end event if we don't already have it
* Break import cycle by extracting MFA JSON types to lib/client/mfatypes
* pnpm format
* go mod tidy all
* Remove flakey test that's covered through other paths
* Use a different interval for desktop sessions, make frames smaller than thumbnail
* Set correct flags when resuming mid-upload
* go.sum
* Handle desktop events in session post processor
* Add a semaphore to desktop recording processing
* Populate metadata from end event if start event not present
* Formatting
* Pass session start time to the metadata processor
* Reduce image sizes in tests
* feat: add entra plugin sync interval proto
* SyncIntervals custom JSON marshaller, defaults and test
* review:
- avoid mutating plugin spec and backfill default at service level
- fix test msg typo
- provide example of PluginSyncInterval.MarshalJSON
* refactor: update intervals proto type to be of string
* Add test helper for authenticating user
* Add `CreateDelegationSession` RPC
* Add `tsh delegation create-session` command
* Apply login state before checking resource access
* Set max TTL on delegation sessions
* Make `TestBuildCreateDelegationSessionRequest` table-driven
* Prevent sub-delegation for now
* Pass `allowReuse = false` when performing MFA ceremony
* Fix test error message assertion
* Honor the `DisallowReissue` flag
* Use `ttl` variable instead of calling `GetTtl`
* docs: add reference for workload-cluster
* docs: add workload clusters guide
* fix(docs): add words to ignore
* feat(build.assets): use resource-ref-generator
* fix(docs): clarify replacing account and arn
* docs(zta/wc): add How it works and clarify child cluster
* docs(zta/wc): make feature availability callout a warning
* docs(zta/wc): move IAM callout to paragraph
* docs(zta/wc): indent snippets
* docs(zta/wc): split up Go example
* docs(zta/wc): update example ARN to use assumed-role
* docs(refs/wc): update example to use assumed-role
* fix typo
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* docs(zta/wc): fix snippet indent
* docs(zta/wc): move wc Go to examples dir
* fix(examples/wc): uppercase log messages
* refactor(examples/wc): rename to timeoutCtx
* fix(examples/wc): log os.RemoveAll error
* fix(examples/wc): use fmt.Printf instead for actual output
* refactor(examples/wc): move replaceable values to vars block
* refactor(examples/wc): use ticker instead of timer
* docs(zta/wc): reword example usage
* fix(docs/wc): update example name
* fix(docs/zta/wc): fix cd command
* docs(zta/wc): clarify address
* fix(examples/wc): add license header
* refactor(examples/wc): move wc name to a var
* fix(api/proto/wc): improve godoc for bot.name
* docs(zta/wc): use company-organization as name
* fix(examples/wc): use deffered func to delete wc
* refactor(examples/wc): use consistent import naming
* refactor(examples/wc): avoid panics
* fix(examples/wc): fix log message
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Adds a `SearchMode` enum to session search protos, allowing clients to choose the search mode that best fits their keywords.
Some searches perform better with embeddings only, while others work better with strict keyword matching. This change lets clients opt into their preferred search method, while keeping hybrid search as the default.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* feat: add VNetDNSName to DatabaseStatusV3 and implement hashing logic
* fix: fixed tests and linter errors
* refactor: to improve readability
* test: added unit test to test the auth server
* chore: updating based on PR feedback to set dns name during db server creation
* chore: minor test updates and refactor based on pr feedback
Kevin