Bump sso-manager-node to v1.8.1, proxy to v1.6.0 (#110)

Host modal standardization (tabs onto app.modal, footer, linkable URL) plus
two DOM-rebuild-timing autocomplete-datalist bugs fixed in both apps.

.github/workflows/lint.yml

@@ -2,7 +2,9 @@ name: Lint
 
 # theta-env has no app code of its own to unit-test (it orchestrates the
 # proxy/sso-manager-node submodules) -- this checks the one thing that can
-# actually break silently: setup.sh and bootstrap.js.
+# actually break silently: setup.sh and bootstrap.js, plus a static
+# consistency check on the config bootstrap.js generates for jump-host
+# (test/check_jump_ldap_tls.js).
 on:
   pull_request:
     branches:
@@ -39,3 +41,6 @@ jobs:
 
       - name: Syntax check
         run: node --check bootstrap/bootstrap.js
+
+      - name: Jump-host LDAP config consistency
+        run: node test/check_jump_ldap_tls.js

CHANGELOG.md

@@ -10,6 +10,89 @@ for what changed inside the apps it composes.
 
 ## [Unreleased]
 
+## [1.17.0] - 2026-07-28
+
+### Added
+- **proxy's host modal now has a footer (created/updated-by/on metadata) and a linkable `/hosts/{host}` URL**, migrated onto the same shared `app.modal` component as sso-manager-node's resource modal — continuing the entity-modal standardization across the stack.
+
+### Fixed
+- **proxy: the Let's-Encrypt challenge-type/wildcard-matching visibility logic could stop reacting to the hostname field after the first Add/Edit host**, and **the SSO allow-list autocomplete could go empty starting on the second Add/Edit** — both were DOM-rebuild timing bugs in the same class as the resource-modal fixes already shipped.
+- **sso-manager-node: the resource modal's "Associated LDAP Groups" autocomplete went empty after the first Add/Edit** — same DOM-rebuild timing bug, now fixed.
+
+### Bumped
+- sso-manager-node -> [v1.8.1](https://github.com/theta42/sso-manager-node/releases/tag/v1.8.1)
+- proxy -> [v1.6.0](https://github.com/theta42/proxy/releases/tag/v1.6.0)
+
+## [1.16.0] - 2026-07-28
+
+### Added
+- **"Quick Jump" copy-to-clipboard section on the jump-host dashboard** — one-click-copy SSH commands (interactive-picker mode, plus a per-host `uid_-_target` grammar-mode command) instead of having to remember/reconstruct the format by hand.
+
+### Fixed
+- **jump-host audit records for a failed downstream connection only ever said `upstream-unreachable`**, with no way to tell a network-layer failure from an auth failure — the real error (ECONNREFUSED, ETIMEDOUT, an ssh2 auth-failure message, etc.) is now captured and shown as a tooltip on the audit table's fail badge.
+
+### Bumped
+- jump-host -> [v1.9.0](https://github.com/theta42/jump-host/releases/tag/v1.9.0)
+
+## [1.15.0] - 2026-07-28
+
+### Fixed
+- **sso-manager's Directory data (every site/host/service/oauth-client resource and their relationships/LDAP-group associations) had no persistent volume** — `@simpleworkjs/orm` fell back to `./config/inventory.sqlite` (relative to the app's `/app` cwd) whenever `conf.orm` wasn't set, which sits in the container's ephemeral writable layer, not any mounted volume. Every container recreate (`docker compose up --build`, `down`/`up`, an image rebuild) silently wiped the entire Directory Management page. `setup.sh`'s generated `sso-secrets.js` (and the example template) now set `orm: { dialect: 'sqlite', storage: '/data/inventory.sqlite' }`, co-locating it with the already-persisted `sso-data` volume (where Redis lives). **Existing deployments**: this repo doesn't rewrite an operator's existing `config/sso-secrets.js` (re-running `setup.sh` leaves it untouched by design) — add the `orm` block above manually, and copy the container's current `/app/config/inventory.sqlite` to `/data/inventory.sqlite` *before* recreating the container, or the existing Directory data will be lost on the next recreate instead of migrated.
+
+### Bumped
+- sso-manager-node -> [v1.8.0](https://github.com/theta42/sso-manager-node/releases/tag/v1.8.0)
+
+## [1.14.0] - 2026-07-28
+
+### Fixed
+- **jump-host's Redis had zero persistence** (`--save '' --appendonly no`, no data-dir volume) — every container rebuild/recreation (including a `setup.sh` re-run) silently wiped all sessions, in-flight OAuth logins, and any admin-created API token. This is the root cause of the reported "re-running setup.sh breaks OAuth with jump" — the jump-host container gets recreated, and any token or in-flight login vanished with it, while proxy was unaffected because its Redis was already persisted. Now jump-host's Redis persists (AOF + periodic RDB) to `/data`, mounted as a new named volume, `jump-redis-data`. Verified live: minted a PAT, force-recreated the container, confirmed the same PAT still authenticated afterward.
+
+### Changed
+- `docker-compose.yml`: added the `jump-redis-data` volume, mounted at `/data` on the `jump-host` service.
+
+### Bumped
+- jump-host -> [v1.8.1](https://github.com/theta42/jump-host/releases/tag/v1.8.1)
+
+## [1.13.0] - 2026-07-28
+
+### Fixed
+Found via feedback on a fresh install:
+- **jump-host's OAuth client had no parent in the Directory.** `seedDirectory()` only ever linked the proxy's OAuth client; jump-host's own (minted by `provisionJumpHost`) was created but never passed through, so it never got a `ResourceEdge`. Existing deployments self-heal on the next `setup.sh` run.
+- **TUI-mode SSH connections (bare `ssh user@host`) could drop** with "PTY allocation request failed" / "shell request failed" — a session-listener race in jump-host, same class of bug `runGrammar` already had a fix for.
+- **Every form submit briefly showed literal HTML** instead of a loading spinner, across all three apps.
+- **`POST /api/user/` and `PUT /api/user/password` had no success message** — a green notification with nothing in it right after adding a user.
+- **The login page gave no explanation for why the user landed there** when redirected mid-OAuth-flow.
+
+### Changed
+- **Directory: tree view is now the only view; clicking a resource's name opens its detail modal.**
+
+### Bumped
+- sso-manager-node -> [v1.7.0](https://github.com/theta42/sso-manager-node/releases/tag/v1.7.0)
+- proxy -> [v1.5.3](https://github.com/theta42/proxy/releases/tag/v1.5.3)
+- jump-host -> [v1.8.0](https://github.com/theta42/jump-host/releases/tag/v1.8.0)
+
+No `setup.sh` or compose change. Also confirmed (no fix needed): the Let's Encrypt ACME account key persists correctly across container rebuilds — `lua-resty-auto-ssl`'s Redis storage adapter writes through the bundled Redis, which is started with `--appendonly yes` into `/data`, mapped to the persisted `proxy-data` volume. Only an explicit `docker-compose down -v` / volume removal would lose it (which is also what's required, and expected, on a domain change).
+
+## [1.12.0] - 2026-07-28
+
+### Bumped
+- sso-manager-node -> [v1.6.3](https://github.com/theta42/sso-manager-node/releases/tag/v1.6.3) — fixes the root cause of a real "lost user" report: `routes/group.js` never invalidated the User cache on membership changes, so an account added to the `app_sso_service_account` marker group (which hides accounts from the Users page's People tab) could look like it had vanished for up to 5 minutes — and, separately, could be added to that group with no warning at all. Both fixed; see the linked release for detail.
+
+No `setup.sh` or compose change.
+
+## [1.11.0] - 2026-07-28
+
+### Added
+- **`test/check_jump_ldap_tls.js`**, wired into the `Lint` workflow: a static consistency check on the jump-secrets.js template `bootstrap.js` generates, so the `ldap://` + `tlsOptions` mistake that broke every SSH login in 1.10.0 fails CI before it ever reaches a real deployment again.
+- **A static "no native `alert()`/`confirm()`/`prompt()`" check** is now part of all three apps' own test suites (they block all further browser events on the page — see 1.9.0/1.10.0's release notes).
+
+### Bumped
+- sso-manager-node -> [v1.6.2](https://github.com/theta42/sso-manager-node/releases/tag/v1.6.2) — fixes `DELETE /api/oauth/client/:id` (`client.remove is not a function`, a genuine 500 masked by tests that never checked the response status), plus the regression test above.
+- proxy -> [v1.5.2](https://github.com/theta42/proxy/releases/tag/v1.5.2) — the regression test above.
+- jump-host -> [v1.7.1](https://github.com/theta42/jump-host/releases/tag/v1.7.1) — the regression test above.
+
+No `setup.sh` or compose change.
+
 ## [1.10.0] - 2026-07-27
 
 ### Fixed

bootstrap/bootstrap.js

@@ -334,7 +334,7 @@ const HOST_FACTS = {
 	kernel: process.env.STACK_HOST_KERNEL || '',
 };
 
-async function seedDirectory(token, clientId) {
+async function seedDirectory(token, clientId, jumpClientId) {
 	let resources = ((await dirGet(token, 'resources')).results) || [];
 
 	// Create a resource unless its slug (or a legacy alternate from an earlier
@@ -420,9 +420,10 @@ async function seedDirectory(token, clientId) {
 	});
 
 	// Optional SSH jump host service.
+	let jumpSvc = null;
 	if (/^(1|true|yes)$/i.test(process.env.CFG_JUMP_HOST_ENABLED || '')) {
 		const jumpHost = process.env.CFG_JUMP_HOST || (DOMAIN ? `jump.${DOMAIN}` : '');
-		await ensure('service', 'SSH Jump Host', 'jump-host', host.id, {
+		jumpSvc = await ensure('service', 'SSH Jump Host', 'jump-host', host.id, {
 			address: jumpHost ? `https://${jumpHost}` : '',
 			port: 3002,
 			gitRepo: 'https://github.com/theta42/jump-host',
@@ -430,19 +431,21 @@ async function seedDirectory(token, clientId) {
 		});
 	}
 
-	// Link the proxy's OAuth client (Resource-backed since sso-manager 1.3.0)
-	// under its service, if it appears in the directory and isn't linked yet.
-	if (clientId) {
-		const oauthRes = resources.find((r) => r.id === clientId);
-		if (oauthRes) {
-			const edges = ((await dirGet(token, 'edges')).results) || [];
-			const linked = edges.some((e) => e.childId === clientId);
-			if (!linked) {
-				await dirPost(token, 'edges', { parentId: psvc.id, childId: clientId, relation: 'oauth' });
-				log(`  directory: linked OAuth client under 'proxy'`);
-			}
+	// Link an OAuth client (Resource-backed since sso-manager 1.3.0) under its
+	// owning service, if it appears in the directory and isn't linked yet.
+	async function linkOauthClient(id, parent, label) {
+		if (!id || !parent) return;
+		const oauthRes = resources.find((r) => r.id === id);
+		if (!oauthRes) return;
+		const edges = ((await dirGet(token, 'edges')).results) || [];
+		const linked = edges.some((e) => e.childId === id);
+		if (!linked) {
+			await dirPost(token, 'edges', { parentId: parent.id, childId: id, relation: 'oauth' });
+			log(`  directory: linked OAuth client under '${label}'`);
 		}
 	}
+	await linkOauthClient(clientId, psvc, 'proxy');
+	await linkOauthClient(jumpClientId, jumpSvc, 'jump-host');
 }
 
 // Write the OAuth client creds back into /config/proxy-secrets.js so the proxy
@@ -582,10 +585,17 @@ module.exports = {
 	fs.writeFileSync(JUMP_SECRETS, body, { mode: 0o600 });
 }
 
+// Returns the jump host's OAuth client id (so seedDirectory can link it under
+// the SSH Jump Host service), whether or not this run actually wrote a fresh
+// jump-secrets.js -- otherwise re-runs on an already-configured deployment
+// never get a chance to self-heal a missing directory link (see the "no
+// parent" bug this was written for).
 async function provisionJumpHost(token) {
 	if (jumpFileComplete()) {
 		log('Jump host: /config/jump-secrets.js already has API token + OIDC client — keeping.');
-		return;
+		const clients = await listClients(token);
+		const existing = clients.find((c) => c.name === JUMP_CLIENT_NAME);
+		return existing ? existing.client_id : null;
 	}
 	const apiToken = await mintApiToken(token, JUMP_TOKEN_NAME);
 
@@ -607,6 +617,7 @@ async function provisionJumpHost(token) {
 	writeJumpSecrets(apiToken, oidc, localAdminPass);
 	log(`Jump host: wrote /config/jump-secrets.js (API token + OAuth client ${oidc.id}).`);
 	log(`Jump host: local admin 'jumpadmin' password: ${localAdminPass}`);
+	return oidc.id;
 }
 
 (async function main() {
@@ -654,9 +665,10 @@ async function provisionJumpHost(token) {
 
 		// Provision the jump host (mint token + write config) when enabled.
 		// Warn-only — never fail the whole bring-up over the optional service.
+		let jumpClientId = null;
 		if (JUMP_ENABLED) {
 			try {
-				await provisionJumpHost(token);
+				jumpClientId = await provisionJumpHost(token);
 				out('JUMP_HOST_CONFIGURED', '1');
 			} catch (e) {
 				log(`WARNING: jump host provisioning failed (${e.message || e}) — continuing`);
@@ -667,7 +679,7 @@ async function provisionJumpHost(token) {
 		// fails the bootstrap — warn and continue.
 		try {
 			log('Seeding directory resources...');
-			await seedDirectory(token, resolvedClientId);
+			await seedDirectory(token, resolvedClientId, jumpClientId);
 		} catch (e) {
 			log(`WARNING: directory seed failed (${e.message || e}) — continuing`);
 		}

config.example/sso-secrets.js.example

@@ -30,6 +30,16 @@ module.exports = {
 		jwtSecret: 'CHANGE-ME',                 // signs all tokens — keep secret
 		token_lifetime: { access_token: 3600, refresh_token: 2592000 },
 	},
+	// Without this, @simpleworkjs/orm falls back to './config/inventory.sqlite'
+	// (relative to the app's /app cwd) -- inside the container's ephemeral
+	// layer, not any mounted volume, so every Resource/site/host/service/oauth
+	// row (the whole Directory Management page) would be silently wiped on
+	// every container recreate. /data is already a persisted volume (Redis
+	// lives there too), so this just co-locates the sqlite file with it.
+	orm: {
+		dialect: 'sqlite',
+		storage: '/data/inventory.sqlite',
+	},
 
 	// ── Orchestrator-only (ignored by the app; read by setup.sh + bootstrap) ──
 	stack: {

docker-compose.yml

@@ -187,6 +187,7 @@ services:
     volumes:
       - ./config:/config:ro         # jump-secrets.js (written by ensure_config/bootstrap)
       - jump-data:/var/lib/jump-host  # generated host keys persist here
+      - jump-redis-data:/data         # Redis (sessions, OAuth state, API tokens) persists here
 
 networks:
   theta-net:
@@ -199,4 +200,5 @@ volumes:
   proxy-data:
   proxy-cache:
   proxy-logs:
-  jump-data:
+  jump-data:
+  jump-redis-data:

setup.sh

@@ -292,6 +292,16 @@ module.exports = {
 		jwtSecret: $(js_str "$CFG_JWT_SECRET"),
 		token_lifetime: { access_token: 3600, refresh_token: 2592000 },
 	},
+	// Without this, @simpleworkjs/orm falls back to './config/inventory.sqlite'
+	// relative to the app's /app cwd -- inside the container's ephemeral layer,
+	// not any mounted volume -- so every Resource/site/host/service/oauth row
+	// (the whole Directory Management page) would be silently wiped on every
+	// container recreate. /data is already a persisted volume (Redis lives
+	// there too), so this just co-locates the sqlite file with it.
+	orm: {
+		dialect: 'sqlite',
+		storage: '/data/inventory.sqlite',
+	},
 
 	// ── Orchestrator-only (ignored by the app) ───────────────────────────────
 	stack: {

test/check_jump_ldap_tls.js

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+'use strict';
+
+// Regression guard for bootstrap.js's generated jump-secrets.js template:
+// its ldap block must use ldaps:// (implicit TLS, :636), never ldap:// (:389),
+// as long as tlsOptions is set alongside it.
+//
+// ldapts treats a non-empty tlsOptions as "use implicit TLS" regardless of URL
+// scheme, and jump-host's LDAP client always sets tlsOptions -- so ldap://
+// + tlsOptions opens a raw TLS handshake against a port serving plaintext
+// LDAP. The server silently drops the connection before any LDAP message
+// parses, and every operation (getUser, checkPassword, ...) then fails
+// identically -- indistinguishable from a wrong password. This shipped once
+// (every SSH login to jump-host failed, for any account, any password) before
+// being root-caused against a real deployment. Static, not a require()+exec
+// of bootstrap.js, because bootstrap.js is a self-running provisioning script
+// with real side effects (LDAP writes, API calls), not a library.
+
+const fs = require('fs');
+const path = require('path');
+
+const BOOTSTRAP_PATH = path.join(__dirname, '..', 'bootstrap', 'bootstrap.js');
+const src = fs.readFileSync(BOOTSTRAP_PATH, 'utf8');
+
+// Isolate the generated jump-secrets.js template (the backtick string
+// assigned to `body` inside writeJumpSecrets) rather than scanning the whole
+// file, so this only ever looks at what's actually written to the deployed
+// config -- not, say, a comment or an unrelated ldap:// URL elsewhere.
+// bootstrap.js's own source has literal backslash-t escape sequences inside
+// the backtick string (they only become real tabs when the template
+// literal is actually evaluated) -- so these patterns match `\t` as two
+// literal characters, not a real tab byte.
+const bodyMatch = /const body = `([\s\S]*?)`;\n\tfs\.writeFileSync\(JUMP_SECRETS/.exec(src);
+if (!bodyMatch) {
+	console.error('check_jump_ldap_tls: could not locate the jump-secrets.js template in bootstrap.js — did writeJumpSecrets change shape?');
+	process.exit(1);
+}
+const template = bodyMatch[1];
+
+// Bounded by the next top-level key (sso:) rather than the ldap block's own
+// closing brace, which is more robust to exactly how it's indented/escaped.
+const ldapBlockMatch = /ldap:\s*\{([\s\S]*?)\\tsso:\s*\{/.exec(template);
+if (!ldapBlockMatch) {
+	console.error('check_jump_ldap_tls: could not find the ldap: {...} block in the jump-secrets.js template.');
+	process.exit(1);
+}
+const ldapBlock = ldapBlockMatch[1];
+
+const hasTlsOptions = /tlsOptions\s*:/.test(ldapBlock);
+const urlMatch = /url:\s*'([^']+)'/.exec(ldapBlock);
+const url = urlMatch ? urlMatch[1] : null;
+
+if (!url) {
+	console.error('check_jump_ldap_tls: no url found in the ldap block.');
+	process.exit(1);
+}
+
+if (hasTlsOptions && !url.startsWith('ldaps://')) {
+	console.error(
+		`check_jump_ldap_tls: jump-secrets.js template sets tlsOptions but url is "${url}" (not ldaps://). ` +
+		'This is the exact bug that broke every SSH login to jump-host -- see the comment above this check.'
+	);
+	process.exit(1);
+}
+
+console.log(`check_jump_ldap_tls: OK (url=${url}, tlsOptions=${hasTlsOptions})`);