* Add a dedicated login e2e test
* Remove authenticated setup tests from summary
* Change Roles assertion to a header assertion
* pnpm format
* Avoid collisions during report merging
* Use global setup to avoid authentication tests appearing in report
* Add browser name back to auth state file
* Make the default export nicer
* Surface non-test errors and fix stat tally in runner report
* Generate auth state via global setup for browse/codegen
* Report flaky test details and name failing tests
* Persist trace attachments for --test-results
* Make signup test retry-safe and tolerate login rate limit
* pnpm format
* Skip global setup when there are no bootstrapped users
* Make darktheme test retry-safe and tolerate login rate limit
* feat: updated side panel to be expanded for beams
* chore: updating tests to make it more readable as par suggestion
* chore: updated to use userpreference state to validate expand state
* chore: removed dead code definining unused nav categories
* chore: refactor nav item ordering logic for better readability
* chore: udpated default sticky mode value instead of updating user pref
* Add GetDisplay helper to API user type
* refactor: Simplify display retrieval functions in user_display.go
* refactor: Enhance user display retrieval logic with structured sources
* refactor: Replace firstNonEmptyValueDifferentFromUsername with cmp.Or for improved value handling
* refactor: Add first name and last name traits
Relocates client.ParseLabelSpec to lib/utils/parse. This results in
a net 5MB reduction in the weight of lib/config. This may not
have a correlation in binary size since lib/client is heavily consumed
by other packages.
```bash
$ goda cut './lib/config:all' | rg '^github.com/gravitational/teleport/lib/client\b|^ID'
github.com/gravitational/teleport/lib/client InDegree=1 Cut.PackageCount=75 Cut.AllFiles.Size=5.3MB Cut.Go.Lines=129512
```
Replace the functions in the scopes package to infer if scoped features
are enabled with a concrete struct that is injected to consumers. This
permits tests to toggle scopes features without having to specify environment
variables.
As an empty challenge is never legal, this patch tightens the `devicetrust`
signer and verifier to explicitly reject them.
Changelog: Tightened signature handling in Device Trust
* Support selectively rendering check icon for resources
* Support smaller tabs
* Add optional left content to FilterPanel
* Update resource items story
* Address review
Adds the first user-facing Access Graph tctl command, listing security
detections with filters and a time window.
Talks to Access Graph through the web proxy and relies on the backend's typed
501/credential errors (see access-graph#1998) instead of a pre-emptive
features.json probe, so the CLI stays stateless.
* Add test for session setup failure paths.
* Fix session cleanup in failure paths.
* Fix lint.
* Fix exec party not added to session.
* Use defered close.
* Drop enterprise test modules.
* Use InDelta to avoid InEpsilon hack.
* Add ui interaction event protos
* make grpc
* Add userEventService method
* Fix signature
* Fix username field
it would have been logging the hash of ""
It was observed in cloud that proxies will hang on deletion if they lose
connection to auth prior to being terminated. This will cause pods to
hang until the termination grace period is hit which can be quite long
in some cases. Testing this in cloud allowed disconnected proxies to
exit quickly when terminated.
Adds a new function, RangeKubernetesServersWithName, to the cache and
presence APIs that returns an iterator over Kubernetes servers
matching a given cluster name.
Replaces the full scan in IsMFARequiredRequest_KubernetesCluster, which
fetched all Kubernetes servers and filtered in-memory, with a range scan
over a secondary index keyed by cluster name.
* Fix `userpreferences.Update` panic on nil request
* Recover from panic in gRPC middleware, add logging for stream handlers
* Use `trace.Errorf` to log stack trace, skip logging the actual panic
* Make panic recovery interceptor the last interceptor
* Replace incorrect `require.Errorf` usage with `require.ErrorContains`
* Use grpc getters instead of direct field access
* Allow IAM Join by specific Organizational Units
* fix for account not found scenario
* move checks to write paths instead of checkandsetdefaults
* fix cache
This is purely mechanical change to inject the build type as a
depency instead of relying on modules.GetModules().BuildType().
In addition to contributing to https://github.com/gravitational/teleport/issues/62799
this also serves as a prerequisite to future work that will provide
a user supplied build type that is not based on the modules to
retrieve the correct image.
Prevent access requests in APPROVED, DENIED, or PROMOTED states from
being updated through SetAccessRequestState, including same-state
updates that could otherwise mutate resolution metadata.
* fix(aws-sync): fix data race and wrong fallback in EC2 fetcher
Fix two bugs in the Access Graph AWS sync EC2 fetcher:
1. Data race in fetchAWSEC2Instances: goroutines were appending directly
to the shared `hosts` slice instead of accumulating into a per-goroutine
`lHosts` local slice and flushing it through the mutex-protected
collectHosts helper. This caused a data race when multiple regions were
fetched concurrently.
2. Incorrect fallback in fetchInstanceProfiles: on a pagination error the
function was returning append(profiles, existing...), mixing partial
new results with the previous sync's data. The correct behaviour is to
return only the previous sync's profiles unchanged.
Add tests covering both cases with multiple regions, verifiable with -race.
Fixes https://github.com/gravitational/pressure-washing/issues/265
Fixes https://github.com/gravitational/pressure-washing/issues/186
Signed-off-by: Tiago Silva <[email protected]>
* Apply suggestions from code review
Co-authored-by: Zac Bergquist <[email protected]>
---------
Signed-off-by: Tiago Silva <[email protected]>
Co-authored-by: Zac Bergquist <[email protected]>
* Avoid falling back to system CA when cert cannot be read
* Add test
* Fix flaky test
* Ensure cert is trusted by verifier
* Add explicit comment for non-nil `ClientCAs`
* Apply `pnpx codemod run pnpm-v10-to-v11`
* Remove `eslint` hoisting, it's in the root package.json anyway
* `pnpm install`
* Bump Node.js to 24.15
* Bump pnpm to 11.1.1
* Update pnpm to 11.3.0
* Update `electron` to 42.2.0, `electron-builder` to 26.11.1
* Update `node-abi` to 4.31.0
* Override `yauzl` to workaround Electron not being installed on Node.js 24.16
* Update Node.js to 24.16
* Bump Playwright to 1.60.0
* Convert DeleteProxy RPC from HTTP to gRPC
* Use `t.Context()`
* Add more greppable TODO
* Fix usage of deprecated rpc
* Upsert RPC
* Use wrapper message for UpsertResponse
* gofmt
* Simplify godoc
* Update response message
* Update method names on public api client
* fix tests
* Introduce UpsertProxyWithoutServer
* Edoardo comments
* separate
* Change to UpsertProxyServer RPC handler
* tctl: add YAML parity for structured output commands
* Add WriteProto Go Doc comment
* Make output format flag visible in evaluate-db-access command
* Make output format flag visible in evaluate SSH command
* remove x509 override dry-run format flag
* refactor: simplify error messages for unknown output formats
* refactor: replace printJSON with utils.WriteJSON and WriteJSONArray
Ryan Clark