WebSSH 2.0 security assurance and interface

[bifrost0x]

Summary

• add account-bound step-up confirmation for local password, LDAP, OIDC, passkeys, and TOTP without asking federated users for an unrelated local password
• add optional administrator-controlled authentication feature gates while keeping deployment configuration as the hard capability boundary
• harden factor enrollment, recovery, OIDC reauthentication, parallel browser tabs, and single-use action/target grants
• preserve active browser, SSH, and tmux sessions after rule changes while clearly warning administrators about possible future lockout
• redesign the workspace, authentication pages, Security Center, and Admin Center with responsive, theme-compatible information architecture
• separate connection tabs from the Files, Commands, Diagnostics, and Notes context workspace while retaining every existing management and SSH/SFTP flow
• bind embedded SFTP and diagnostics to the active SSH session, including split layouts, unavailable-session states, and an expandable diagnostics overlay
• restore a resizable desktop context panel, default it open on wide screens, and keep it closed by default on compact tablet and mobile layouts
• add configurable disconnect behavior while keeping live tmux and persistent candidates reconnectable
• add actionable, fail-closed SSH host-key error handling without exposing Paramiko internals
• improve authentication-page branding, responsive scaling, navigation prominence, footer visibility, translations, and safe UI defaults
• retain the previous close-confirmation behavior for existing users while using the requested disabled default for newly created accounts
• document configuration and migration behavior for existing Docker and homelab installations

Security and compatibility properties

• step-up intents are persistent, hashed, short-lived, session-bound, action-bound, target-bound, and single-use
• OIDC reauthentication validates issuer, subject, user, freshness, and configured assurance claims
• LDAP secrets remain server-side and LDAP confirmation performs a fresh directory lookup and bind
• factor setup and recovery flows prevent last-factor lockout and isolate concurrent browser tabs
• authentication capability remains fail-closed when OIDC or LDAP is not configured at deployment level
• policy changes warn administrators about future lockout without force-closing active sessions
• schema and configuration changes are additive; explicit stored preferences always win
• the additive settings-default generation preserves legacy close confirmation for existing accounts and applies the new default only to new accounts
• session tools preserve authentication, ownership, host-key, network-policy, transfer, and SFTP contracts from main

Validation

• broad local Python 3.14 run: 1,806 passed and 33 skipped; two stale cache-version and responsive-breakpoint assertions were corrected, then the affected modules passed 45/45
• broad local Python 3.11 run: 1,806 passed and 33 skipped; the same corrected modules passed 45/45
• final migration and session-lifecycle review gates: 69 passed on Python 3.14 and 69 passed on Python 3.11
• 283 JavaScript unit tests passed
• 79 Playwright browser tests passed
• ESLint passed
• 10 vendored frontend assets verified
• requirements lock check passed
• disposable OpenSSH/Paramiko integration: 27 passed
• Python 3.14 production container image built successfully from the final commit
• independent security and regression re-review found no remaining Critical or Important findings
• local WebSSH, OpenLDAP, and Keycloak preview services remain available; the existing data volume was preserved

The full CI matrix on the current PR head remains the authoritative final gate.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 659e446644

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".