Package app connections to applications over a reverse tunnel and forwards HTTP requests to them.

CheckResourceUpsert checks if the resource can be created or updated, depending on the http method.

ConstructSSHResponse creates a special SSH response for SSH login method that encodes everything using the client's secret key.

CreateResource is a helper function for POST requests from the UI to create a new resource.

ExtractResourceAndValidate extracts resource information from given string and validates basic fields.

NewHandler returns a new instance of web proxy handler.

NewServer constructs a [Server] from the provided [ServerConfig].

NewTerminal creates a web-based terminal based on WebSockets and returns a new TerminalHandler.

NewTerminalStream creates a stream that manages reading and writing data over the provided [websocket.Conn].

NewXForwardedForMiddleware is an HTTP middleware that overwrites client source address if X-Forwarded-For is set.

OK is a response that indicates request was successful.

ParseSSORequestParams extracts the SSO request parameters from an http.Request, returning them in an SSORequestParams struct.

RedirectURLWithError adds an err query parameter to the given redirect URL with the given errReply message and returns the new URL.

SetClock sets the clock on a handler.

SetSessionStreamPollPeriod sets polling period for session streams.

SSOSetWebSessionAndRedirectURL validates the CSRF token in the response against that in the request, validates that the callback URL in the response can be parsed, and sets a session cookie with the username and session name from the response.

UpdateResource is a helper function for PUT requests from the UI to update an existing resource.

OIDCJWKWURI is the relative path where the OIDC IdP JWKS is located.

SNISuffix is the server name suffix used during SNI to specify the target desktop to connect to.

SSOLoginFailureMessage is a generic error message to avoid disclosing sensitive SSO failure messages.

AssistUserPreferencesResponse is the JSON response for the assist user preferences.

AuthParams are used to construct redirect URL containing auth information back to tsh login.

ClusterUserPreferencesResponse is the JSON response for the user's cluster preferences.

CommandHandlerConfig is the configuration for the command handler.

CommandRequest is a request to execute a command on all nodes that match the query.

Config represents web handler configuration parameters.

CreateSessionReq is a request to create session from username, password and second factor token.

CreateSessionResponse returns OAuth compabible data about access token: https://tools.ietf.org/html/rfc6749.

Envelope is used to wrap and transend and receive messages between the web client and proxy.

Handler is HTTP web proxy handler.

Server serves the web api.

ServerConfig provides dependencies required to create a [Server].

SessionContext is a context associated with a user's web session.

SSHSessionLatencyStats contain latency measurements for both legs of an ssh connection established via the Web UI.

SSOCallbackResponse holds the parameters for validating and executing an SSO callback URL.

SSORequestParams holds parameters parsed out of a HTTP request initiating an SSO login.

TerminalHandler connects together an SSH session with a web-based terminal via a web socket.

TerminalHandlerConfig contains the configuration options necessary to correctly set up the TerminalHandler.

TerminalRequest describes a request to create a web-based terminal to a remote SSH server.

TerminalStream manages the [websocket.Conn] to the web UI for a terminal session.

UserPreferencesResponse is the JSON response for the user preferences.

WSStream handles web socket communication with the frontend.

AuthProvider is a subset of the full Auth API.

ClusterClientProvider is an interface for a type which can provide authenticated clients to remote clusters.

SessionController restricts creation of sessions based on cluster session control configuration(locks, connection limits, etc).

WSConn is a gorilla/websocket minimal interface used by our web implementation.

ClusterClientHandler is an authenticated handler which can get a client for any remote cluster.

ClusterHandler is a authenticated handler that is called for some existing remote cluster.

ConnectionHandler defines a function for serving incoming connections.

ContextHandler is a handler called with the auth context, what means it is authenticated and ready to work.

HandlerOption is a functional argument - an option that can be passed to NewHandler function.

PresenceChecker is a function that executes an mfa prompt to enforce that a user is present.

ProvisionTokenHandler is a authenticated handler that is called for some existing Token.

SessionControllerFunc type is an adapter to allow the use of ordinary functions a [SessionController].

WSHandlerFunc specifies a handler that processes received a specific [Envelope] received via a web socket.