Devices list prefers display_name over hostname; writing only note left the operator-assigned name invisible after managed enrollment approve.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Expose pending LAN and managed enrollment requests in the UX 3.5 notification center, synchronize badges through authenticated panel events with polling fallback, and refresh the registrations view automatically. Also include the pending relay transport fixes already present in the working tree.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Combine LAN + managed enrollment in /api/registrations/count so the sidebar badge works on all pages. Backfill orphan rejected_device_* IP from peers when available.
Refs #351
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Store unattended presets AES-256-GCM in org_peer_credentials (main DB),
admin Set/Clear in Organizations Address Book, runtime inject into
GET /api/ab and Web Remote connect-password auto-fill. Secrets never
persist in shared AB JSON.
Refs #367
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
LAN/IP bundles can use plaintext HTTP/WS like RustDesk while session crypto stays on the protocol layer; enrollment no longer treats a second same-request proof check as a nonce replay.
- Updated session control mechanisms to ensure proper handling of remote input and clipboard operations.
- Introduced session authorization checks to validate operator permissions before starting desktop sessions.
- Improved input injection logic to prevent unauthorized access during active sessions.
- Added new capabilities for managing session flags and controls, ensuring a more robust and secure desktop experience.
- Enhanced error handling and logging for better traceability of session-related actions.
- Added functionality for safely consolidating legacy auth.db into the selected SQLite database, with options for dry runs and rollbacks.
- Introduced command-line flags for SQLite auth consolidation, including backup directory and rollback options.
- Enhanced admin interface security by requiring a password when the admin port is enabled, preventing unauthorized access.
- Updated related tests to ensure proper handling of admin password requirements and relay authorization logic.
Approved/Rejected filters were empty for Go enrollments because decisions were discarded; reject also left an irreversible lock with no Devices → Banned row when the peer did not exist yet.
- Added support for various remote control features in the Support Agent, including file transfer, in-session chat, remote audio, and control actions (lock/restart).
- Introduced capability flags for incoming session features, allowing for more granular control over permissions.
- Updated documentation to reflect the new Support Agent functionalities and connection resilience improvements, including fallback mechanisms for API endpoints.
- Enhanced the build process with optional branding sealing and improved error handling for Docker configurations.
Restrict GET /api/ab peers/tags to device-group scope and migrate upgraded
SQLite users tables off the pre-Phase-52 role CHECK so console sync works.
Refs #342.
Replace the hardcoded 40-char MeshID placeholder with a persisted per-group SHA-384 id so MeshAgent no longer fails with bad size on panel-downloaded .msh files.
Guest /ws upgrades must pass Go access-link validation; RustDesk OIDC auth-query rejects omitted id/uuid when pending has them; bump tar and golang.org/x/text for audit/govulncheck.
Never-logged-in Go SQLite users no longer break ListUsers/delete/demote (500), so panel userSync can mirror instead of restoring phantom accounts on restart.
Require TRUSTED_PROXIES before honoring X-Forwarded headers, and deliver async PunchHole/RelayResponse via ip:port wsPunchConns so shared-NAT peers do not get the wrong signed PK.
Temporary opaque links give guests a minimal Web Remote UI for selected devices only, without Console inventory or add-any-ID paths. Also fix mesh_share desktop tunnel auth for unauthenticated guests.
- Added functionality to bind RustDesk client logins to BetterDesk accounts, allowing for inventory and audit tracking of devices.
- Introduced new database methods to retrieve active client sessions by client ID or UUID.
- Updated client session handling to ensure ownership is applied even if the peer row is created after login.
- Enhanced tests to cover new session binding logic and ensure correct behavior for both existing and late-appearing peers.
Updated the OIDC callback handler to retrieve the configuration from the database instead of the provider. This change enhances the flexibility of the OIDC setup.
After Keycloak/IdP callback on the Go API port, the browser now lands on the
Node panel session endpoint instead of hitting Go auth middleware. Adds Panel
URL setting, return-url preservation, login error UX, and docs.
Fixes#242. Replace 24h JWT-only client tokens with configurable DB sessions (default 7 days, sliding renewal up to 30 days) and panel settings under Authentication -> RustDesk clients.
- Updated billing contract structure to support multiple target types (organization, device group, folder, device).
- Refactored API handlers to accommodate new billing contract model, including creation, deletion, and listing functionalities.
- Enhanced database interactions for billing contracts, ensuring backward compatibility with legacy billing_org_contracts.
- Added new billing statistics endpoint to provide insights on active sessions and expiring contracts.
- Improved error handling and validation in billing package management.
Add folder/direct-device/strategy assignment from User Management, clearer Pro vs Remote Operator labeling, optional restricted device scope mode, and Go/Node scope parity.
Add Pro-style strategy assign API (devices, users, device groups) on Go server and Node legacy/panel routes, plus panel UI to assign targets from the Devices strategies manager.
Accept RustDesk 1.4.7 empty-PK ID changes on the Go signal server, cascade panel DB rows on client/panel renames, and align Node panel with live events, strategies UI, org address book editor, and device-group accessible API payload.
Mesh .ashx endpoints use protocol-level auth, not API JWT; exclude them from authMiddleware so agents can complete the WebSocket handshake. Persist device_type, linked_peer_id, and display_name in SQLite UpsertPeer for mesh_agent inventory. Add meshagent_dev_remote tests for local Windows dev interop validation.
Remove internal LAN IP, SSH user, and developer paths from docs and examples; move deploy runbook to gitignored docs/private with a public template; drop Cursor debug logging leftovers; add CI checks to prevent regression.
Co-authored-by: Cursor <cursoragent@cursor.com>
Share provider-bound password authentication between panel and POST /api/login so directory users can sign in to the native client with the same AD credentials as the web console.
Ship mesh layer as default-on with updater/installer MESH_ENABLED=Y injection,
Settings groups/recordings UI, device power and filter UX, relay multiplexing,
WoL wake fallback, mesh RBAC permissions, and REST automation docs.
Extend MeshCentral compat with share grants, session recording (.mcrec),
TCP/UDP port relay (p=14), device power API, panel settings and device menu
actions, view-only guest remote access, and i18n across all locales.
Enhanced localization files for multiple languages, introducing new entries related to command execution, terminal access, and file management within the MeshAgent onboarding process. This update improves user experience by providing comprehensive support for diverse languages and ensuring consistent messaging across the application.
Added a compatibility layer for MeshCentral, including a native Go implementation of key endpoints and a unified inventory for mesh agents. Enhanced the UI with new actions for mesh agents, such as terminal access and file management. Updated localization for mesh features and introduced new styles for mesh terminal overlays. Integrated interop testing for simulated and live MeshAgent connections.
Restore agent-client to git and wire agentClientBuildWorker for Tauri builds
(deb/rpm/AppImage/MSI) with branding and Go sidecar staging. Add TLS gate,
settings lock, policy sync, preflight UI, CDAP registry, and Generator
product_type split (agent-client vs support-agent vs rdclient).
Batch peer lookups for address book and scoped RustDesk lists, sweep stale billing pending relays, fix simultaneous relay pairing race, and add signal→relay compat test coverage.
Batch peer status writes, skip heartbeat rate limits for known peers, CDAP session cleanup on disconnect, relay WS conn limits, Postgres query timeouts, org login throttling, and CI with go test -race.
Implemented the orgSharedAddressBookEnabledFromValue function to determine the status of the shared address book based on input values and error conditions. Added unit tests to validate the new functionality, covering various scenarios including database errors and different input values.
UNITRONIX