0.9.0

Automation, identity and device policies.

New

• Device policies (strategies) — push client settings to devices from the console: permissions, security and password rules, capture options. Assign to a device, a user or a device group; the most specific assignment wins. Optionally enforced, so a local change is reverted on the next heartbeat. Without enforcement a policy is a default the user can change back.
• Single sign-on (OIDC) — Keycloak, Authentik, Entra ID, Okta, Google Workspace or any OpenID Connect provider, for the console and for the stock RustDesk client (no client patch or custom build). Authorization-code flow with PKCE, verified ID tokens, just-in-time account creation with optional approval, and an email-domain allowlist.
• Two-factor authentication — TOTP with single-use recovery codes, optionally required for all users or administrators only, with an administrator reset and a break-glass CLI command.
• Delegated administration — roles with a permission matrix over each console area. Grant someone the Users screen without handing them the whole console.
• Automation API — scoped bearer tokens and REST endpoints for users, devices, groups, address books and audit logs, plus the RustDesk client's --assign flag for unattended deployment.
• Email — SMTP settings with a test send, user invitations, self-service password reset, and an optional emailed code when signing in from a new browser.
• My Account — every user can now edit their own profile, change their password and manage their second factor.
• Device approval gate — optionally hold newly seen devices as Pending until an operator approves them.
• Alarm and console audit logs, log retention with nightly pruning, and per-address sign-in rate limiting that raises an alarm on brute force and password spraying.

Notes

• Upgrading is a normal migration — run php artisan migrate (the Docker image does it on start). Every new control defaults to off, so an upgrade changes no behaviour until you turn something on.
• API tokens that use --assign --strategy_name must be recreated. Assigning a policy now requires strategy: rw on the token as well as device: rw; a token without it gets a 403, and an unknown policy name now gets a 404 instead of being silently ignored. Tokens cannot be edited, so issue a replacement and revoke the old one. Before this release the flag was accepted and did nothing.
• Documentation for the new features is in the wiki.

docker pull marcpope/cortendesk:0.9.0
docker pull ghcr.io/marcpope/cortendesk:0.9.0