A page tab left open past COOKIE_MAX_AGE and then reloaded hit
require_user/require_admin raising before the route body ever ran,
so there was nowhere to catch it and show something friendlier - the
browser just rendered {"detail": "Unauthorized"}. A global exception
handler now redirects GET page loads (never /api/* calls, whose JS
callers parse and handle the JSON error themselves, and never
POST/PUT/DELETE, so a failed login or CSRF check still reports its
own error instead of silently bouncing) with a 401/403 back to /.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The admin password field is gone from both the create-user and
edit-user forms. Three flows now generate a password and mail it
instead of letting an admin type one:
- create_user(): password generated, welcome email sent
(login/password/portal link) right after the row commits
- new POST /api/admin/users/{id}/reset-password: generates a new
password, saves it, emails it - the only way a password changes now
- assign_rdp_slot(): sending a user their first grant on a pilot
(not every later tweak of an existing grant's expiry - guarded by
an is_new_grant check) sends a short "you have pilot access" email,
no credentials since the account already exists
If an email fails to send, the plaintext password comes back in the
API response as a one-time fallback so the admin isn't locked out of
handing it over by hand - the frontend only shows it then, never on
a successful send.
Added two small helpers (_build_light_email, _credentials_table) so
these three new templates share the light-theme card shell instead
of re-typing it; the existing access-approval emails keep their own
inline copies untouched.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Admin Pilots tab:
- list and create/edit form merged into one - "+ Добавить пилота" at
the top of the list clears the form into create mode, clicking a
pilot switches it into edit mode (title, Delete button and icon
box toggle accordingly) instead of keeping two separate stacked
forms
- each list row gets an inline on/off toggle (⏻/▶) to flip active
without opening the form
- categories and the login/password hint field removed from the
pilot form per earlier feedback - not applicable to pilots
Access model: assigning a pilot's RDP slot to a user is now the
single action that grants them the pilot - it creates/updates their
UserServiceAccess row (with the optional expiry typed right next to
the assign dropdown) in the same call, and unassigning revokes it.
Previously slot assignment and the ACL grant were two separate steps
an admin could forget to pair up, leaving a user "granted" with no
working slot or a slot with no visible access.
Consequently: pilots are no longer listed in the Users tab's ACL
grid at all - the Pilots tab is now the only place pilot access is
managed. set_acl() was fixed to never touch pilot grants regardless
of what's posted (it used to free a user's pilot slot whenever it
saw a pilot id missing from service_ids - which happens on every
save now that the grid never includes pilots, so saving any other
product's ACL would have silently stripped every pilot grant).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Admin: moved pilot management out of the RDP tab into its own
"Pilots" tab - dedicated list, create/edit form and slot table with
a per-slot user-assign dropdown (always on, no more is_pilot
checkbox toggling the RDP tab's slot table between two modes). The
RDP tab goes back to exactly its pre-pilots shape.
Dashboard: a granted pilot no longer sits inside the "Ваши сервисы"
grid - it gets its own <details> section above it, open by default
whenever the user has at least one pilot (and simply absent when
they have none, rather than showing empty and collapsed).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
New Service.is_pilot flag - a pilot is a Service (type RDP) that:
- is excluded from /api/public/services-by-category and
/api/request-more-access (admin-granted only, no self-service)
- still shows as a locked card on the dashboard for users without
access (Доступно по запросу section), but with a По приглашению
badge instead of the self-request button/flow
- gets its own non-clickable teaser row on the public /login page
(logos only, informational)
RdpSlot.assigned_user_id (nullable) - pilot slots are bound to one
specific user instead of being drawn from the shared pool; regular
RDP services are unaffected (field stays NULL, same pool behaviour
as before). The /go/ allocator branches on service.is_pilot to pick
the caller's assigned slot instead of any free one. Slots release
automatically (cleanup_loop) when the owning grant is revoked or
expires, and immediately on manual ACL revoke.
UserServiceAccess.expires_at (nullable) - per-grant access window,
used by pilots so their access can be shorter than the account's own
expires_at; NULL (unchanged default) means "follow the account".
has_access() and the dashboard's granted/locked split both honour it.
Admin UI: "Это пилот" checkbox on the RDP service form, an
assign-user dropdown on a pilot's slot table (replaces the
occupied-by column), and a per-pilot expiry date field in the user
ACL grid.
Schema is applied via the existing ensure_schema_compatibility()
idempotent ALTER TABLE pattern (no alembic in this project) - no
manual migration step needed, it runs at container startup.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Outlook desktop (Word rendering engine) does not support data: URI
images at all - the logo in approval/rejection emails was silently
dropped there. Fix:
- app/static/logo-email.png: logo asset, attached as an inline MIME
part with Content-ID instead of base64-embedded in <img src>
- app/main.py _send_email(): builds a multipart/related message and
attaches the logo as cid:mont_logo whenever html_body references it
- all 6 client-facing access emails (approve/reject x 3 call sites):
switched from dark gradient theme to a light theme (solid white
card, dark text) - Outlook does not support CSS gradients either,
so the old dark card + light text would have rendered as invisible
light text on a default white background on top of the missing logo
- footer contact address: mont@mont.ru -> RGalyaviev@mont.ru
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- app/main.py: raise products_raw[:20] cap to [:200] in /api/request-access
and /api/request-more-access - was silently truncating access requests
with more than 20 selected products
- accumulated bundles/product-page WIP (config, models, runtime, templates)
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
After status/ready=true, do HEAD request to the iframe URL itself.
If it returns 5xx, keep polling. This prevents Bad Gateway appearing
in the iframe when container is technically registered but not yet serving.
Session view page was loading the iframe immediately on load, causing
Bad Gateway if the container was still starting. Now polls /status
until ready, then sets iframe src.
route_ready returned True on 502 Bad Gateway, causing premature redirect
before the container was actually serving. Now only accepts < 500 responses.
Spinner removed from wait page per user request.
- Store request origin domain in PendingAccessRequest.portal_url
- Use per-request portal URL in approval/rejection emails
- Embed logo as base64 so it displays without external image loading
- Fix 'Предоставлен доступ к продуктам' text color to match body color
- Switch Telegram polling to 30-second interval with single-worker flock fix
Previously connect_rdp_slot was only called when creating a new session.
If the API container restarted, existing sessions had should_be_connected=false
and xfreerdp never started. Now connect is triggered on every /go/<slug> visit
when an RDP session already exists.
Replaces always-on xfreerdp with on-demand model (load 12 to under 1 at idle).
- rdp-proxy/manager.py: HTTP server port 7001 managing xfreerdp lifecycle
- rdp-proxy/entrypoint.sh: starts Xvfb+x11vnc+websockify+manager, no auto-connect
- rdp-proxy/Dockerfile: adds python3, copies manager.py, exposes 7001
- runtime.py: connect_rdp_slot and disconnect_rdp_slot via manager HTTP API
- terminate_session_record: disconnect instead of container restart
- main.py: calls connect_rdp_slot in background thread on session create
- maintenance.py: cleanup_loop disconnects on expire, run_maintenance_service
includes RDP slot init, maintenance_runner fixed to import maintenance
Safari (iPadOS/iOS) blocks SameSite=Strict cookies on the initial
top-level navigation when it considers the request cross-site (links
from messengers, email, QR codes). The CSRF cookie was therefore never
set on first visit, and the subsequent login POST failed with 403
"CSRF failed".
Switch the CSRF cookie to SameSite=Lax — this is the OWASP recommended
default and matches industry practice. The auth (session) cookie keeps
SameSite=Strict, since it is only issued after a successful first-party
login POST and needs the stricter binding.
ruslan