8ec9a65279
Bump version to 0.2.0
...
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-07 16:14:56 +11:00
2f0a41d52b
Fix db.rs formatting (cargo fmt)
...
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-07 16:04:16 +11:00
997b5f099c
Fix auth.rs formatting (cargo fmt)
...
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-07 15:52:28 +11:00
1b86b20fe6
Fix formatting (cargo fmt)
...
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-07 15:11:39 +11:00
a94b743d6c
Add user API tokens with role-based access and audit logging
...
User API tokens allow OIDC users to authenticate via bearer token for
automation and scripting. Powerusers and admins can create their own
tokens; admins can create tokens for operators. Tokens use SHA-256
hashing, optional max_role caps, optional expiry, and full audit
logging of create/revoke operations with client IPs.
- DB schema: user_api_tokens and token_audit_log tables
- Auth middleware: validates user tokens as fallback after admin keys
- API: 7 new endpoints (self-service + admin token management)
- UI: tokens.html (self-service) + admin.html token/audit sections
- Nav: Tokens link added to all pages (visible for operator+)
- Docs: API reference, security model, roles/access control updated
- Background cleanup: expired tokens + 90-day audit log retention
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-07 15:02:54 +11:00
065367451b
Add Default derive for InstructionParser (clippy fix)
...
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-07 14:21:40 +11:00
a2bbce73ee
Add guacd parser fuzz harness and document fuzzing findings
...
libFuzzer+ASan+UBSan harness for guac_parser_append() — the C state
machine that parses all Guacamole wire-format input in guacd. 3.2M
iterations found no memory corruption; one non-exploitable signed
integer overflow (UBSan) in the length prefix accumulator noted in
FINDINGS.md.
Also adds FINDINGS.md for the Rust protocol parser fuzzer documenting
the UTF-8 boundary panic fix from v0.1.3.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-07 14:17:42 +11:00
1922bd9987
Add fuzz testing infrastructure and fix UTF-8 boundary panic
...
Add cargo-fuzz targets for the Guacamole protocol parser:
- protocol_parse: single instruction parsing
- protocol_stream: streaming parser with chunked input
Fix panic in Instruction::parse when a length prefix splits a multi-byte
UTF-8 character (found by fuzzer within seconds). Now returns
ParseError::Truncated instead of panicking on invalid char boundary.
Run with: cargo +nightly fuzz run protocol_parse
cargo +nightly fuzz run protocol_stream
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-07 13:39:16 +11:00
eab04ba2bd
Fix clippy type_complexity for OIDC pending flows
...
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-07 12:06:47 +11:00
4e4279dc5f
Bump version to 0.1.3 and fix formatting
...
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-07 11:40:06 +11:00
2187cfc1e4
Security hardening: 5 fixes from audit
...
- Vault TLS: replace hardcoded danger_accept_invalid_certs(true) with
configurable tls_skip_verify option (default: false)
- Share tokens: use constant-time SHA-256 hash comparison to prevent
timing side-channel attacks
- OIDC pending states: add 10-minute TTL, evict stale entries on each
login to prevent unbounded HashMap growth
- Recording path traversal: add canonical path validation as defense-
in-depth alongside existing string checks
- Frontend XSS: escape all user-controlled data (filenames, paths) in
innerHTML via escapeHtml/escapeAttr in client.html and recordings.html
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-07 11:34:54 +11:00
32c60469e4
Merge pull request #5 from sol1/dependabot/github_actions/actions/checkout-6
...
ci: bump actions/checkout from 4 to 6
2026-02-07 11:25:24 +11:00
bf49438ae7
Merge pull request #6 from sol1/dependabot/github_actions/actions/upload-artifact-6
...
ci: bump actions/upload-artifact from 4 to 6
2026-02-07 11:25:12 +11:00
577a28dbcb
Merge pull request #7 from sol1/dependabot/github_actions/actions/download-artifact-7
...
ci: bump actions/download-artifact from 4 to 7
2026-02-07 11:25:00 +11:00
177dbda605
Merge pull request #14 from sol1/dependabot/cargo/rcgen-0.14.7
...
deps: bump rcgen from 0.13.2 to 0.14.7
2026-02-07 11:24:00 +11:00
d61dfc2072
Merge pull request #15 from sol1/dependabot/cargo/ipnetwork-0.21.1
...
deps: bump ipnetwork from 0.20.0 to 0.21.1
2026-02-07 11:23:48 +11:00
284b4eef66
Merge pull request #10 from sol1/dependabot/cargo/clap-4.5.57
...
deps: bump clap from 4.5.56 to 4.5.57
2026-02-07 11:23:42 +11:00
8fe8d8afa2
Merge pull request #4 from sol1/dependabot/github_actions/actions/cache-5
...
ci: bump actions/cache from 4 to 5
2026-02-07 11:23:09 +11:00
6771e18640
Merge main into dependabot/cargo/rcgen-0.14.7
...
Resolve conflict: keep axum-server 0.8 (from main) and rcgen 0.14 (from this branch).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-07 11:15:15 +11:00
1569fe234e
ci: bump actions/checkout from 4 to 6
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v4...v6 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-07 00:13:39 +00:00
868c5ef2c9
ci: bump actions/upload-artifact from 4 to 6
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4 to 6.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v6 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-07 00:13:38 +00:00
c40fca09a7
ci: bump actions/cache from 4 to 5
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4 to 5.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/v4...v5 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-07 00:13:37 +00:00
468bb8d342
ci: bump actions/download-artifact from 4 to 7
...
Bumps [actions/download-artifact](https://github.com/actions/download-artifact ) from 4 to 7.
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/v4...v7 )
---
updated-dependencies:
- dependency-name: actions/download-artifact
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-07 00:13:36 +00:00
ccb3d168d3
deps: bump clap from 4.5.56 to 4.5.57
...
Bumps [clap](https://github.com/clap-rs/clap ) from 4.5.56 to 4.5.57.
- [Release notes](https://github.com/clap-rs/clap/releases )
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md )
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.5.56...clap_complete-v4.5.57 )
---
updated-dependencies:
- dependency-name: clap
dependency-version: 4.5.57
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-07 00:13:26 +00:00
9000f33596
deps: bump ipnetwork from 0.20.0 to 0.21.1
...
Bumps [ipnetwork](https://github.com/achanda/ipnetwork ) from 0.20.0 to 0.21.1.
- [Release notes](https://github.com/achanda/ipnetwork/releases )
- [Changelog](https://github.com/achanda/ipnetwork/blob/master/CHANGELOG.md )
- [Commits](https://github.com/achanda/ipnetwork/compare/v0.20.0...v0.21.1 )
---
updated-dependencies:
- dependency-name: ipnetwork
dependency-version: 0.21.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-07 00:13:22 +00:00
556ec5a5e0
Merge pull request #17 from sol1/dependabot/cargo/rusqlite-0.38.0
...
deps: bump rusqlite from 0.32.1 to 0.38.0
2026-02-07 11:12:35 +11:00
d47c2f2e1f
Merge pull request #16 from sol1/dependabot/cargo/pulldown-cmark-0.13.0
...
deps: bump pulldown-cmark from 0.12.2 to 0.13.0
2026-02-07 11:12:29 +11:00
34ae15db72
Merge pull request #13 from sol1/dependabot/cargo/axum-server-0.8.0
...
deps: bump axum-server from 0.7.3 to 0.8.0
2026-02-07 11:12:24 +11:00
f6b6948af2
Merge pull request #11 from sol1/dependabot/cargo/tower-cookies-0.11.0
...
deps: bump tower-cookies from 0.10.0 to 0.11.0
2026-02-07 11:12:17 +11:00
e616afba08
Merge pull request #8 from sol1/dependabot/cargo/toml-0.9.11spec-1.1.0
...
deps: bump toml from 0.8.23 to 0.9.11+spec-1.1.0
2026-02-07 11:11:59 +11:00
2874396941
Fix rcgen 0.14 API: key_pair renamed to signing_key
...
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-07 11:06:46 +11:00
b2b843481c
deps: bump pulldown-cmark from 0.12.2 to 0.13.0
...
Bumps [pulldown-cmark](https://github.com/raphlinus/pulldown-cmark ) from 0.12.2 to 0.13.0.
- [Release notes](https://github.com/raphlinus/pulldown-cmark/releases )
- [Commits](https://github.com/raphlinus/pulldown-cmark/compare/v0.12.2...v0.13.0 )
---
updated-dependencies:
- dependency-name: pulldown-cmark
dependency-version: 0.13.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-06 23:42:02 +00:00
e8b0491d8e
deps: bump rcgen from 0.13.2 to 0.14.7
...
Bumps [rcgen](https://github.com/rustls/rcgen ) from 0.13.2 to 0.14.7.
- [Release notes](https://github.com/rustls/rcgen/releases )
- [Commits](https://github.com/rustls/rcgen/compare/v0.13.2...v0.14.7 )
---
updated-dependencies:
- dependency-name: rcgen
dependency-version: 0.14.7
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-06 23:42:00 +00:00
b2b77ac7de
deps: bump rusqlite from 0.32.1 to 0.38.0
...
Bumps [rusqlite](https://github.com/rusqlite/rusqlite ) from 0.32.1 to 0.38.0.
- [Release notes](https://github.com/rusqlite/rusqlite/releases )
- [Changelog](https://github.com/rusqlite/rusqlite/blob/master/Changelog.md )
- [Commits](https://github.com/rusqlite/rusqlite/compare/v0.32.1...v0.38.0 )
---
updated-dependencies:
- dependency-name: rusqlite
dependency-version: 0.38.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-06 23:41:59 +00:00
38f196db19
deps: bump tower-cookies from 0.10.0 to 0.11.0
...
Bumps [tower-cookies](https://github.com/imbolc/tower-cookies ) from 0.10.0 to 0.11.0.
- [Release notes](https://github.com/imbolc/tower-cookies/releases )
- [Commits](https://github.com/imbolc/tower-cookies/compare/v0.10.0...v0.11.0 )
---
updated-dependencies:
- dependency-name: tower-cookies
dependency-version: 0.11.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-06 23:41:58 +00:00
a55d22ec0c
deps: bump toml from 0.8.23 to 0.9.11+spec-1.1.0
...
Bumps [toml](https://github.com/toml-rs/toml ) from 0.8.23 to 0.9.11+spec-1.1.0.
- [Commits](https://github.com/toml-rs/toml/compare/toml-v0.8.23...toml-v0.9.11 )
---
updated-dependencies:
- dependency-name: toml
dependency-version: 0.9.11+spec-1.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-06 23:41:54 +00:00
d2cc38936a
deps: bump axum-server from 0.7.3 to 0.8.0
...
Bumps [axum-server](https://github.com/programatik29/axum-server ) from 0.7.3 to 0.8.0.
- [Release notes](https://github.com/programatik29/axum-server/releases )
- [Changelog](https://github.com/programatik29/axum-server/blob/master/CHANGELOG.md )
- [Commits](https://github.com/programatik29/axum-server/compare/v0.7.3...v0.8.0 )
---
updated-dependencies:
- dependency-name: axum-server
dependency-version: 0.8.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-06 23:41:49 +00:00
7e170e699c
Bump version to 0.1.2
...
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-07 10:41:26 +11:00
466ffd2d44
Upgrade openidconnect v3 -> v4, remove JumpCloud references
...
- openidconnect 3.5.0 -> 4.0.1 (oauth2 4 -> 5)
- Eliminates duplicate reqwest/hyper/http dependency chains
- 386 -> 355 crate dependencies
- Resolves rustls-pemfile 1.0.4 unmaintained warning
- HTTP client now uses stateful reqwest::Client (no-redirect policy)
- exchange_code returns Result for EndpointMaybeSet token URLs
- Remove JumpCloud from provider examples, prefer Authentik
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-07 10:39:24 +11:00
05f39d3d1f
Patch dependency vulnerabilities, update Rust to 1.93
...
- bytes 1.11.0 -> 1.11.1 (integer overflow fix)
- time 0.3.41 -> 0.3.47 (stack exhaustion DoS fix)
- Ignore RUSTSEC-2023-0071 (rsa timing attack, no fix available)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-07 10:08:08 +11:00
fead6bbd9b
Add supply chain security: Dependabot, cargo audit in CI
...
- Enable Dependabot for weekly Cargo and GitHub Actions updates
- Add cargo audit step to CI pipeline
- Patch bytes 1.11.0 -> 1.11.1 (integer overflow fix)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-07 10:03:18 +11:00
292db1fa55
Update OIDC docs to prefer Authentik, add setup guide
...
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-07 09:52:23 +11:00
5484cc82ae
Bump version to 0.1.1
...
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-07 09:37:13 +11:00
6bf8383e88
fixes bugs #1 #2 and #3 .
2026-02-07 09:32:05 +11:00
439eab21ee
Update Docker references to sol1/rustguac on Docker Hub
...
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-06 15:15:02 +11:00
67101e27ce
Initial public release
...
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-06 14:38:53 +11:00
Dave Kempe