Tiago Silva 05419f28b6 support where RBAC on application session recordings (#69630) ...

* support `where` RBAC on application session recordings

application session recordings are backed by AppSessionChunk events, but
those events were never wired into the session recording RBAC path, so
`where` clauses on `kind: session` rules could not match them.

Fixes https://github.com/gravitational/teleport/issues/67775

Signed-off-by: Tiago Silva <[email protected]>

* fix unit test

* handle feedback

---------

Signed-off-by: Tiago Silva <[email protected]>

2026-08-13 14:29:20 +00:00

..

accessgraph/apiclient

access-review[1]: Add core logic for tctl access-review command (#68283)

2026-07-15 23:39:45 +00:00

accesslists

Validate access list name length on creation (#69008)

2026-08-04 17:17:23 +00:00

accessmonitoring

Add configurable automatic review resolution reasons (#69169)

2026-08-05 20:51:57 +00:00

agentless

Add scope support to OpenSSH nodes (#64819)

2026-05-19 18:41:29 +00:00

appresource

appresource: Add path tokenizer and validator (#68795)

2026-08-07 22:31:37 +00:00

asciitable

tsh request search, add support for --format flag (#62015)

2025-12-09 14:49:29 +00:00

auth

MWI: issuance: Add UsageApp support to IssueScopedBotCerts (#69449)

2026-08-13 08:56:17 +00:00

authz

Remove app auth config (#69528)

2026-08-11 16:01:44 +00:00

automaticupgrades

chore: Bump golangci-lint to v2.7.2 (#62066)

2025-12-09 17:59:21 +00:00

autoupdate

Sign managed updates Linux tarballs with cosign (#68053)

2026-08-07 20:05:42 +00:00

aws

[AWSIC] Tightened filter validation and application (#67234)

2026-06-19 03:48:01 +00:00

backend

Remove Firestore key migration (#69590)

2026-08-12 21:24:08 +00:00

benchmark

Properly escape resource names in predicate expressions (#67227)

2026-05-29 13:38:48 +00:00

boundkeypair

Deprecate recording of join metadata into bot instance record (#69571)

2026-08-13 08:15:04 +00:00

bpf

support disk events on Linux kernel 7.0+ by conditionally hooking do_file_open (#67650)

2026-06-24 18:07:01 +00:00

cache

Remove client invocations/backend implementations of deprecated GetTokens RPC (#69576)

2026-08-12 15:33:29 +00:00

cgroup

use the audit login session ID to track sessions when using Enhanced Sesssion Recording (#63050)

2026-02-19 18:20:18 +00:00

client

kube: reuse one MFA ceremony across tsh proxy kube issuances (2/4) (#68522)

2026-08-11 18:34:30 +00:00

cloud

Integrate Windows VM discovery in to Azure watcher (#68807)

2026-08-11 09:21:25 +00:00

componentfeatures

types: add ResourcePrincipalSet to unified resources protos and types (#68879)

2026-08-06 23:44:07 +00:00

config

Stop honoring teleport.cache.enabled (#69439)

2026-08-12 02:12:37 +00:00

configurators

EC2 Auto Discover: add new required permission account:ListRegions (#61967)

2025-12-04 09:40:10 +00:00

connectmycomputer

Updated Teleport codebase to AGPL3 license (#35259)

2023-12-01 17:48:14 +00:00

cryptosuites

Add AppClient CA (#66273)

2026-04-30 19:05:23 +00:00

darwin

Update Go version to v1.26.4 (#67476)

2026-06-08 14:28:40 +00:00

decision

Add Scope Namespacing support for SSH Servers (Nodes) (#69213)

2026-08-07 22:49:04 +00:00

defaults

Add Linux desktop support (#65841)

2026-07-09 07:41:47 +00:00

desktop

Add Linux desktop support (#65841)

2026-07-09 07:41:47 +00:00

devicetpm

chore: Bump go-attestation to v0.6.0 (#61294)

2025-11-12 20:37:19 +00:00

devicetrust

Add missing members to events.OSType (#69058)

2026-07-27 15:30:40 +00:00

events

support where RBAC on application session recordings (#69630)

2026-08-13 14:29:20 +00:00

expression

Add set conversion helper for generic_oidc predicate expressions (#68699)

2026-07-22 21:03:16 +00:00

fipscheck

fips: Switch to Go-native FIPS140 builds from boring crypto (#66690)

2026-05-20 00:42:41 +00:00

fixtures

Add fixture for SAML connector without role-mapping (#69412)

2026-08-06 12:22:13 +00:00

gcp

Port gcp join method to new join service (#61205)

2025-11-18 00:46:04 +00:00

hardwarekey

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

healthcheck

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

httplib

Restore Stripe CSP for stripe-managed tenants (#68824)

2026-07-31 16:27:51 +00:00

integrations

[5] Add UploadHandler replay-object storage for beam traffic replay (#68676)

2026-07-30 10:48:22 +00:00

inventory

Implement tctl observability (#67904)

2026-08-12 22:23:22 +00:00

itertools

prepare scoped roles/assignments for namespacing (#68457)

2026-07-16 17:41:49 +00:00

join

Deprecate recording of join metadata into bot instance record (#69571)

2026-08-13 08:15:04 +00:00

jwt

Update Go version to v1.26.4 (#67476)

2026-06-08 14:28:40 +00:00

kube

Clean up stale doc comments in kube roundtrip (#68532)

2026-08-05 21:27:28 +00:00

labels

Introduce logtest package (#56741)

2025-07-15 18:11:10 +00:00

limiter

Make rejected accepts retryable in lib/limiter (#66928)

2026-06-22 19:05:20 +00:00

linux

Apply remaining modernize changes. (#56037)

2025-06-25 21:25:29 +00:00

loginrule

feat: JSONPath interpolation for Login Rules (OIDC) (#56598)

2025-08-05 18:41:26 +00:00

loglimit

Fix bug in the log limiter (#63568)

2026-02-06 14:35:13 +00:00

mobile/verify/enroll

lib/client/proxy/insecure: Add support for api/client.ALPNConnUpgradePing (#69355)

2026-08-07 07:00:29 +00:00

modules

Use split Identity Security entitlements (#68944)

2026-07-31 09:02:59 +00:00

msgraph

msgraphtest: monkeypatch user and group delta endpoint (#67980)

2026-06-22 14:08:00 +00:00

multiplexer

chore: Update k8s modules to v0.36.2 (#68645)

2026-07-15 19:01:47 +00:00

observability

[fix] Use provided registry in metrics.RegisterCollectors (#64919)

2026-03-24 14:17:20 +00:00

oidc

Caching OIDC validator improvements (#67913)

2026-06-26 02:57:09 +00:00

okta

Okta: Don't allow creating user_group Access Request in RO (#55420)

2025-06-10 11:09:04 +00:00

openssh

Stop using text/template and html/template to enable DCE (#65401)

2026-04-22 15:54:43 +00:00

player

Deflake TestPlayerError (#68132)

2026-06-29 14:39:57 +00:00

plugin

Okta: Remove plugin validation (moved to e) (#64648)

2026-08-03 17:56:40 +00:00

plugins

proto PluginSyncFilter to filter input type converter (#62187)

2025-12-19 06:27:17 +00:00

proxy

Add Scope Namespacing support for SSH Servers (Nodes) (#69213)

2026-08-07 22:49:04 +00:00

puttyhosts

Stop using text/template and html/template to enable DCE (#65401)

2026-04-22 15:54:43 +00:00

relaypeer

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

relaytransport

session-helper: submodule preparation and dependencies of lib/srv/reexec.go (#65145)

2026-04-01 12:34:10 +00:00

relaytunnel

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

release

Clean up some utils (#57423)

2025-08-01 18:42:18 +00:00

resourceusage

Convert lib/resourceusage to use slog (#50311)

2024-12-17 13:30:33 +00:00

resumption

Set Teleport version in SSH clients (#65004)

2026-04-07 18:06:00 +00:00

reversetunnel

Fix race condition in TestAgentPoolConnectionCount (#68889)

2026-07-22 18:32:18 +00:00

reversetunnelclient

Add Linux desktop support (#65841)

2026-07-09 07:41:47 +00:00

saml

Stop using text/template and html/template to enable DCE (#65401)

2026-04-22 15:54:43 +00:00

scopes

Add Scope Namespacing support for SSH Servers (Nodes) (#69213)

2026-08-07 22:49:04 +00:00

secret

Fix log messages and tsh command description (#61037)

2025-11-05 15:31:30 +00:00

secretsscanner

[2] Migration to the Opaque API (#67384)

2026-06-08 13:21:41 +00:00

service

Implement tctl observability (#67904)

2026-08-12 22:23:22 +00:00

services

support where RBAC on application session recordings (#69630)

2026-08-13 14:29:20 +00:00

session

Improve error message for terminal size unmarshalling (#62775)

2026-01-13 11:35:05 +00:00

srv

support where RBAC on application session recordings (#69630)

2026-08-13 14:29:20 +00:00

sshagent

Allow concurrent connections to forwarded SSH agents (#67116)

2026-06-01 08:56:52 +00:00

sshca

[Access Requests] Tolerate unknown constraint kinds when decoding ResourceAccessIDs (#68785)

2026-07-31 21:08:00 +00:00

sshutils

mask setuid/setgid/sticky bits when transferring files via SFTP (#67784)

2026-08-05 20:13:41 +00:00

subca

Add spiffe-tls to supported CA overrides and create mapper func. (#69296)

2026-08-07 17:04:05 +00:00

system

Convert lib/system to use slog (#50300)

2024-12-17 13:27:21 +00:00

systemd

Add join failure handling for ec2 using readyz health check (#64296)

2026-04-20 14:59:21 +00:00

tbot

Fix failing unix domain socket test on MacOS (#69556)

2026-08-11 09:03:10 +00:00

teleterm

[vnet] Skip AAAA records when IPv6 is disabled on the host (#68666)

2026-08-10 18:12:19 +00:00

terminal

Reduce the memory usage of the session recording processor by ~80% (#60266)

2025-10-15 15:21:54 +00:00

tfgen

tfgen: support generating top-level access list scope field (#69337)

2026-08-12 19:12:01 +00:00

tlsca

[Access Requests] Tolerate unknown constraint kinds when decoding ResourceAccessIDs (#68785)

2026-07-31 21:08:00 +00:00

tlscatest

Add the tlscatest.GenerateSelfSignedCA helper (#64113)

2026-03-02 16:29:45 +00:00

tpm

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

uds

chore: Bump google.golang.org/grpc/cmd/protoc-gen-go-grpc to v1.5.0 (#44739)

2024-07-29 15:05:34 +00:00

ui

Align label sorting in Connect with what Web UI does (#48086)

2024-10-30 09:54:28 +00:00

usagereporter

MWI: Bot Scope Namespacing (#68253)

2026-08-06 09:55:16 +00:00

usertasks

discovery: include Azure identity in subscription failure UserTasks (#69056)

2026-08-12 11:57:22 +00:00

utils

[vnet] Reduce netstack data-path allocations (#67950)

2026-07-24 19:21:57 +00:00

versioncontrol

session-helper: submodule preparation and dependencies of lib/srv/reexec.go (#65145)

2026-04-01 12:34:10 +00:00

vnet

[vnet] Skip rewriting /etc/resolver files when DNS config is unchanged on macOS (#68746)

2026-08-11 17:21:55 +00:00

watcher

Adjust log level on some noisy entries (#61076)

2025-11-06 21:03:31 +00:00

web

Remove client invocations/backend implementations of deprecated GetTokens RPC (#69576)

2026-08-12 15:33:29 +00:00

windowsexec

Convert lib/windowsexec to use slog (#50307)

2024-12-17 04:47:52 +00:00

windowsservice

Connect: gracefully handle VNet service and app version mismatch (#64438)

2026-03-19 07:45:58 +00:00

winpki

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00