Merge pull request #100 from theta42/release/1.10.0

Bump jump-host to v1.7.0; release notes for the ldaps:// fix

CHANGELOG.md

@@ -10,6 +10,87 @@ for what changed inside the apps it composes.
 
 ## [Unreleased]
 
+## [1.10.0] - 2026-07-27
+
+### Fixed
+- **`bootstrap/bootstrap.js`'s jump-secrets.js template now points jump-host at `ldaps://sso-manager:636`**, not `ldap://sso-manager:389`. The plain-port URL combined with jump-host's `tlsOptions` made `ldapts` attempt implicit TLS against a port serving plaintext LDAP — slapd dropped every connection before any LDAP message parsed, so SSH password login failed for every account, with any password, indistinguishable from a wrong credential. Root-caused by standing up a local jump-host, editing its config, and calling `getUser`/`checkPassword` directly inside the container. **Existing deployments must edit `./config/jump-secrets.js` themselves** (this template only affects fresh bootstraps) — see theta42/theta-env#99. Companion defensive fix: [simpleworkjs/ldap v1.0.2](https://github.com/simpleworkjs/ldap/releases/tag/v1.0.2) now rejects this `ldap://` + `tlsOptions` combination outright.
+
+### Bumped
+- jump-host -> [v1.7.0](https://github.com/theta42/jump-host/releases/tag/v1.7.0) — adds self-service API tokens (create/list/rotate/revoke from its dashboard); jump-host previously had none.
+
+No `setup.sh` or compose change.
+
+## [1.9.0] - 2026-07-27
+
+### Bumped
+- sso-manager-node -> [v1.6.1](https://github.com/theta42/sso-manager-node/releases/tag/v1.6.1)
+- proxy -> [v1.5.1](https://github.com/theta42/proxy/releases/tag/v1.5.1)
+
+Both apps had every native `alert()`/`confirm()` call removed, replaced by
+`@simpleworkjs/frontend`'s `app.messages.action`/`confirm`/`toast` (the
+same modules adopted in [1.8.0](#180---2026-07-27)). This was found live,
+mid browser-verification of that release: clicking sso-manager-node
+directory.ejs's "Rotate Client Secret" triggered a native `confirm()`,
+which blocks all further browser events on the page — a real hazard for
+anyone driving the app with browser automation, not just a cosmetic
+inconsistency. sso-manager-node also dropped `app.user.remove`/
+`app.oauthClient.remove` from `public/js/app.js` (dead code with a native
+`confirm()` guard and zero callers).
+
+No `setup.sh`, compose, or config change.
+
+## [1.8.0] - 2026-07-27
+
+### Bumped
+- sso-manager-node -> [v1.6.0](https://github.com/theta42/sso-manager-node/releases/tag/v1.6.0)
+- proxy -> [v1.5.0](https://github.com/theta42/proxy/releases/tag/v1.5.0)
+- jump-host -> [v1.6.0](https://github.com/theta42/jump-host/releases/tag/v1.6.0)
+
+All three apps adopt the newly published `@simpleworkjs/frontend` package's
+`app.messages`, `app.modal`, and `app.validate` modules, replacing the
+vendored `app.util.actionMessage`/`actionConfirm`/`alert` in
+`public/lib/js/app-base.js` (byte-identical across all three apps) and the
+vendored `public/lib/js/val.js` (byte-identical in sso-manager-node and
+jump-host, and the same engine plus proxy-only DNS/hostname rules in proxy).
+Message content is now HTML-escaped — the ad hoc `app.util.alert()` this
+replaces had none — and `app.messages.action` falls back to a page-wide
+toast when there's no inline `.actionMessage` target on the page. proxy's
+`host`/`target`/`hostname` wildcard-DNS validation rules (mirroring
+`utils/hostname_validate.js`) move to its own `public/js/app.js`, registered
+via `$.validateSettings`, since they're proxy-specific and don't belong in
+the shared package's generic rule set (`eq`/`user`/`password`/`ip`).
+jump-host doesn't currently use any `[validate]` attributes, so its `val.js`
+swap is dedup/future-proofing rather than a behavior change.
+
+`app.api`/`app.auth`/`app.pubsub`/`app.socket` in each app's `app-base.js`
+are untouched: they're app-specific (a dual-mode callback/promise API with
+`auth-token` header injection) and not something the frontend package's
+generic `app.js` provides, so it isn't loaded.
+
+No `setup.sh`, compose, or config change.
+
+## [1.7.0] - 2026-07-27
+
+### Bumped
+- sso-manager-node -> [v1.5.1](https://github.com/theta42/sso-manager-node/releases/tag/v1.5.1)
+- jump-host -> [v1.5.0](https://github.com/theta42/jump-host/releases/tag/v1.5.0)
+
+Two production bugs fixed: `PUT /api/user/:uid` 500'd with an LDAP
+`ObjectClassViolationError` when setting `sshPublicKey` on any account
+predating the `ldapPublicKey` objectClass (notably the bootstrap admin) —
+and the exact same bug, in the shared `@simpleworkjs/ldap` package's
+`addSshKey`, was silently aborting SSH connections at jump-host's
+key-injection step for the same class of accounts. Both are fixed by
+ensuring the objectClass is present before writing the attribute. Also
+fixed: the Directory's "add resource" modal left the parent-Service
+dropdown blank when adding an OAuth Integration.
+
+Jump-host's web dashboard also gained a "Hosts you can reach" list
+(admins see "All hosts") — previously it only showed usage metrics with
+no way to see your actual access from the browser.
+
+No `setup.sh`, compose, or config change.
+
 ## [1.6.0] - 2026-07-26
 
 ### Bumped

bootstrap/bootstrap.js

@@ -527,7 +527,16 @@ function writeJumpSecrets(apiToken, oidc, localAdminPass) {
 module.exports = {
 \tname: ${JSON.stringify(sso.name || 'SSO Manager')},
 \tldap: {
-\t\turl: 'ldap://sso-manager:389',
+\t\t// ldaps:// (636), not ldap:// (389): @simpleworkjs/ldap's client always
+\t\t// sets tlsOptions (see jump-host's models/user_ldap.js), and ldapts
+\t\t// treats a non-empty tlsOptions as "use implicit TLS" regardless of the
+\t\t// URL scheme -- pointed at the plain port, that means it opens a raw TLS
+\t\t// handshake against a server expecting plaintext LDAP, which slapd just
+\t\t// drops (logged as "connection lost", no BIND ever attempted). This bit
+\t\t// jump-host silently: every SSH login failed with the generic
+\t\t// "Permission denied" for any password, because getUser()/checkPassword()
+\t\t// never even reached slapd.
+\t\turl: 'ldaps://sso-manager:636',
 \t\tbindDN: ${JSON.stringify(BIND_DN)},
 \t\tbindPassword: ${JSON.stringify(ADMIN_PASS)},
 \t\tuserBase: ${JSON.stringify(`ou=people,${BASE_DN}`)},

docker-compose.yml

@@ -36,6 +36,12 @@ services:
         # setup.sh sets this from the host, where the submodule resolves
         # correctly (git -C sso-manager-node rev-parse --short HEAD).
         GIT_COMMIT: ${SSO_GIT_COMMIT:-}
+        # Optional upstream HTTP(S) proxy for npm/apt during the build (NOT
+        # the theta42 "proxy" app). Set CFG_HTTP_PROXY in setup.env; empty by
+        # default, so this is a no-op unless configured.
+        HTTP_PROXY: ${CFG_HTTP_PROXY:-}
+        HTTPS_PROXY: ${CFG_HTTPS_PROXY:-}
+        NO_PROXY: ${CFG_NO_PROXY:-}
     container_name: sso-manager
     restart: unless-stopped
     networks: [theta-net]
@@ -58,6 +64,11 @@ services:
       - NODE_PORT=3001
       - LDAP_SERVER_ID=${LDAP_SERVER_ID:-}
       - LDAP_REPLICATION_HOSTS=${LDAP_REPLICATION_HOSTS:-}
+      # Optional upstream HTTP(S) proxy for outbound calls (SMTP, etc.) at
+      # runtime. See the build args above for the same setting during build.
+      - HTTP_PROXY=${CFG_HTTP_PROXY:-}
+      - HTTPS_PROXY=${CFG_HTTPS_PROXY:-}
+      - NO_PROXY=${CFG_NO_PROXY:-}
     volumes:
       # Operator-edited SSO secrets (sso-secrets.js). Read-WRITE so the bootstrap
       # can write the generated OAuth client creds into proxy-secrets.js. The
@@ -91,6 +102,11 @@ services:
         # setup.sh sets this from the host, where the submodule resolves
         # correctly (git -C proxy rev-parse --short HEAD).
         GIT_COMMIT: ${PROXY_GIT_COMMIT:-}
+        # Optional upstream HTTP(S) proxy for npm/apt during the build. See
+        # the sso-manager service above for details.
+        HTTP_PROXY: ${CFG_HTTP_PROXY:-}
+        HTTPS_PROXY: ${CFG_HTTPS_PROXY:-}
+        NO_PROXY: ${CFG_NO_PROXY:-}
     container_name: proxy
     restart: unless-stopped
     networks: [theta-net]
@@ -110,6 +126,11 @@ services:
       # not from env. NODE_ENV/NODE_PORT are process env the app reads directly.
       - NODE_ENV=production
       - NODE_PORT=3000
+      # Optional upstream HTTP(S) proxy for outbound calls (ACME/Let's
+      # Encrypt, DNS providers) at runtime.
+      - HTTP_PROXY=${CFG_HTTP_PROXY:-}
+      - HTTPS_PROXY=${CFG_HTTPS_PROXY:-}
+      - NO_PROXY=${CFG_NO_PROXY:-}
     volumes:
       # Operator-edited proxy secrets (proxy-secrets.js). READ-ONLY — the proxy
       # only reads it; the sso-manager bootstrap writes the OAuth creds. The
@@ -142,6 +163,11 @@ services:
       dockerfile: Dockerfile
       args:
         GIT_COMMIT: ${JUMP_GIT_COMMIT:-}
+        # Optional upstream HTTP(S) proxy for npm/apt during the build. See
+        # the sso-manager service above for details.
+        HTTP_PROXY: ${CFG_HTTP_PROXY:-}
+        HTTPS_PROXY: ${CFG_HTTPS_PROXY:-}
+        NO_PROXY: ${CFG_NO_PROXY:-}
     container_name: jump-host
     restart: unless-stopped
     networks: [theta-net]
@@ -153,6 +179,11 @@ services:
       - "${JUMP_WEB_BIND:-0.0.0.0}:${JUMP_WEB_PORT:-3002}:3002"  # web UI/API
     environment:
       - NODE_ENV=production
+      # Optional upstream HTTP(S) proxy for outbound calls (the directory API
+      # client) at runtime.
+      - HTTP_PROXY=${CFG_HTTP_PROXY:-}
+      - HTTPS_PROXY=${CFG_HTTPS_PROXY:-}
+      - NO_PROXY=${CFG_NO_PROXY:-}
     volumes:
       - ./config:/config:ro         # jump-secrets.js (written by ensure_config/bootstrap)
       - jump-data:/var/lib/jump-host  # generated host keys persist here

setup.env.example

@@ -49,6 +49,19 @@ CFG_DOMAIN=example.com
 # under an OU-style prefix). Leave unset to use the DN built from CFG_DOMAIN:
 #CFG_BASE_DN=dc=example,dc=com
 
+# ── Optional outbound HTTP(S) proxy ──────────────────────────────────────────
+# For an isolated/offline/corporate-network test host that only reaches the
+# internet through an upstream HTTP proxy — NOT the theta42 "proxy" app.
+# Wired into every service's docker build (npm/apt) AND its running container
+# (SMTP, ACME/Let's Encrypt, DNS provider calls, the jump-host directory API
+# client). Leave unset to disable (the default); CFG_HTTPS_PROXY falls back to
+# CFG_HTTP_PROXY if unset, and CFG_NO_PROXY defaults to covering the stack's
+# own internal service names so container-to-container traffic never goes
+# through the proxy.
+#CFG_HTTP_PROXY=http://proxy.example.com:3128
+#CFG_HTTPS_PROXY=http://proxy.example.com:3128
+#CFG_NO_PROXY=localhost,127.0.0.1,sso-manager,proxy,jump-host
+
 # Optional — sensible defaults if left blank:
 #CFG_ORG=SSO Manager            # app display name + outbound email org
 #CFG_ADMIN_UID=admin            # initial SSO admin username

setup.sh

@@ -165,6 +165,22 @@ export CFG_JUMP_HOST_ENABLED CFG_JUMP_HOST
 # When enabled, activate the compose profile so `up`/`ps` include the service.
 if [[ "$JUMP_ENABLED" == "1" ]]; then export COMPOSE_PROFILES="jump-host"; fi
 
+# ── Optional outbound HTTP(S) proxy for docker build + the running containers ─
+# CFG_HTTP_PROXY / CFG_HTTPS_PROXY / CFG_NO_PROXY (from ./setup.env or the
+# environment) — NOT the theta42 "proxy" app; this is an upstream HTTP proxy
+# for reaching the internet (npm/apt during image builds, and SMTP/ACME/DNS
+# provider calls at runtime), useful on isolated/offline/corporate-network
+# test hosts. Off by default. docker-compose.yml passes these through as both
+# build args (Docker also recognizes them as predefined build ARGs) and
+# container environment on every service, so one setup.env entry covers the
+# whole stack.
+export CFG_HTTP_PROXY="${CFG_HTTP_PROXY:-}"
+export CFG_HTTPS_PROXY="${CFG_HTTPS_PROXY:-${CFG_HTTP_PROXY:-}}"
+export CFG_NO_PROXY="${CFG_NO_PROXY:-localhost,127.0.0.1,sso-manager,proxy,jump-host}"
+if [[ -n "$CFG_HTTP_PROXY" ]]; then
+	info "Using HTTP proxy for docker build + containers: $CFG_HTTP_PROXY"
+fi
+
 # ── 1. Update submodules to their latest release tag, verify build contexts ───
 # Submodules track release tags (vX.Y.Z), not the tip of master -- so
 # "update" means "move to the newest tag", not "move to the newest commit".