KC-1353: Add PAM recording list-by-user and download commands

docker-entrypoint.sh

@@ -159,38 +159,31 @@ process_ksm_config() {
 # DEVICE SETUP AND AUTHENTICATION FUNCTIONS
 # =============================================================================
 
-# Setup device registration and persistent login
+# Setup device registration and persistent login.
+# All three steps run in a single Commander process so login + vault sync
+# only happens once instead of three times.
 setup_device() {
     local user="$1"
     local password="$2"
     local server="$3"
-
-    # Step 1: Register device
-    log "Registering device..."
-    if ! python3 keeper.py --user "${user}" --password "${password}" \
-        --server "${server}" this-device register; then
-        log "ERROR: Device registration failed"
-        exit 1
-    fi
-
-    # Step 2: Enable persistent login
-    log "Enabling persistent login..."
-    if ! python3 keeper.py --user "${user}" --password "${password}" \
-        --server "${server}" this-device persistent-login on; then
-        log "ERROR: Persistent login setup failed"
-        exit 1
-    fi
 
-    # Step 3: Set timeout
-    log "Setting device logout timeout to 30 Days..."
+    log "Running device setup (register, persistent login, timeout)..."
+    local setup_script
+    setup_script=$(mktemp /tmp/keeper_setup_XXXXXX.cmd)
+    cat > "${setup_script}" <<CMDS
+this-device register
+this-device persistent-login on
+this-device timeout ${DEVICE_TIMEOUT}
+CMDS
+
     if ! python3 keeper.py --user "${user}" --password "${password}" \
-        --server "${server}" this-device timeout "${DEVICE_TIMEOUT}" \
-        > /dev/null; then
-        log "ERROR: Timeout setup failed"
+        --server "${server}" "${setup_script}"; then
+        log "ERROR: Device setup failed"
+        rm -f "${setup_script}"
         exit 1
     fi
-    
-    log "Device Logout Timeout set successfully"
+
+    rm -f "${setup_script}"
     log "Device setup completed successfully"
 }
 

keepercommander/commands/discoveryrotation.py

@@ -17,8 +17,8 @@
 import re
 import time
 from datetime import datetime
+from typing import Dict, Optional, Any, Set, List
 from urllib.parse import urlparse, urlunparse
-from typing import Optional, List
 
 import requests
 from keeper_secrets_manager_core.utils import url_safe_str_to_bytes
@@ -29,6 +29,7 @@
 from .folder import FolderMoveCommand
 from .ksm import KSMCommand
 from .pam import gateway_helper, router_helper
+from .pam.recording_commands import PAMGetRecordingsForUsersCommand, PAMDownloadRecordingsCommand
 from .pam.config_facades import PamConfigurationRecordFacade
 from .pam.config_helper import configuration_controller_get, \
     pam_configurations_get_all, pam_configuration_remove, \
@@ -93,6 +94,7 @@
 from .pam_saas.config import PAMActionSaasConfigCommand
 from .pam_saas.update import PAMActionSaasUpdateCommand
 from .tunnel_and_connections import PAMTunnelCommand, PAMConnectionCommand, PAMRbiCommand, PAMSplitCommand
+from .pam.cnapp_commands import PAMCnappCommand
 from .universalsecretsync import (
     PAMUniversalSyncConfigCommand,
     PAMUniversalSyncRunCommand
@@ -287,8 +289,11 @@ def __init__(self):
         self.register_command('workflow', PAMWorkflowCommand(), 'Manage PAM Workflows', 'w')
         self.register_command('access', PAMPrivilegedAccessCommand(),
                               'Manage privileged cloud access operations', 'ac')
+        self.register_command('cnapp', PAMCnappCommand(),
+                              'Manage Cloud-Native Application Protection Platform integration', 'cn')
         self.register_command('universal-sync-config', PAMUniversalSyncConfigCommand(), 'Manage Universal Sync Configurations', 'usc')
         self.register_command('universal-sync-run', PAMUniversalSyncRunCommand(), 'Run Universal Sync', 'usr')
+        self.register_command('recording', PAMRecordingCommand(), 'Manage PAM Session Recordings', 'rec')
 
 
 class PAMGatewayCommand(GroupCommand):
@@ -328,6 +333,17 @@ def __init__(self):
         self.default_verb = 'list'
 
 
+class PAMRecordingCommand(GroupCommand):
+
+    def __init__(self):
+        super(PAMRecordingCommand, self).__init__()
+        self.register_command('list-by-user', PAMGetRecordingsForUsersCommand(),
+                              'List session recordings for one or more users', 'lbu')
+        self.register_command('download', PAMDownloadRecordingsCommand(),
+                              'Download recording files to a local directory', 'dl')
+        self.default_verb = 'list-by-user'
+
+
 class PAMDiscoveryCommand(GroupCommand):
 
     def __init__(self):

keepercommander/commands/nested_share_folder/helpers.py

@@ -309,12 +309,13 @@ def walk(fuid):
 # Expiration parsing
 # ═══════════════════════════════════════════════════════════════════════════
 
-def validate_share_expiration_timestamp(expiration_ms, cmd_name):
+def validate_share_expiration_timestamp(expiration_ms, cmd_name, *, now_ms=None):
     """Reject finite expirations that are less than one minute."""
     if expiration_ms is None or expiration_ms == -1:
         return
-    min_allowed = int(datetime.datetime.now(timezone.utc).timestamp() * 1000) + MIN_SHARE_EXPIRATION_MS
-    if expiration_ms < min_allowed:
+    if now_ms is None:
+        now_ms = int(datetime.datetime.now(timezone.utc).timestamp() * 1000)
+    if expiration_ms < now_ms + MIN_SHARE_EXPIRATION_MS:
         raise CommandError(
             cmd_name,
             'Share expiration must be at least 1 minute.',