KC-1353: Add PAM recording list-by-user and download commands

[jeremy-london]

Ticket KC-1353

Summary

Implements PR-212 (get_recordings_for_users KRouter endpoint) with full download support in Commander CLI.

• pam rec lbu <username...> — List PAM session recordings for one or more users with flexible filtering, output formats (table/JSON/CSV/markdown), and optional inline download.
• pam rec dl — Download and decrypt recording files by username or specific connection UIDs.
• Parallel downloads (4 workers, respecting the KRouter 50 req/5s rate limit).
• Full AES-GCM decryption using the wire format from session-recordings-util.ts (HKDF key derivation + per-file recording secret).
• 100% test coverage — 54 unit tests covering all code paths including error cases, legacy salt fallback, and all output formats.

Files Changed

File	Change
keepercommander/commands/pam/recording_commands.py	New — full implementation of both commands + helpers
keepercommander/commands/pam/router_helper.py	Added router_get_recordings_for_users and router_download_recording
keepercommander/commands/discoveryrotation.py	Registered PAMRecordingCommand group (pam rec / pam recording)
keepercommander/proto/pam_pb2.py	Added PAMRecordingsForUsersRequest protobuf message
tests/test_pam_recording_commands.py	New — 54 tests, 100% line coverage

QA Test Guide

Prerequisites

1. Login with a PAM-enabled account that has RBI + KCM enforcements active.
2. Run sync-down to populate the vault cache (needed for record key lookup / decryption).

1. List recordings for a user (table)

pam rec lbu user@example.com

Expected: table with columns ConnUID, RecordUID, User, Type, Protocol, Started, Duration, Risk.

2. List with filters

pam rec lbu user@example.com --risks critical --types session --protocols ssh --max-count 10

Expected: only SSH session recordings with critical AI risk level.

3. Date range filter

pam rec lbu user@example.com --range-start 2026-01-01 --range-end 2026-06-30

4. JSON output (stdout)

pam rec lbu user@example.com --format json --max-count 5

Expected: JSON with recordings array and hasMore bool. Use connectionUid and recordUid values for download commands.

5. Save listing to file (format auto-detected from extension)

pam rec lbu user@example.com --output listings.csv        # CSV
pam rec lbu user@example.com --output listings.md         # Markdown table
pam rec lbu user@example.com --output listings.json       # JSON

6. List and download in one step

pam rec lbu user@example.com --risks critical --types session --max-count 5 --download-dir ./downloads

Expected: table printed, then files downloaded + decrypted into ./downloads/. Filenames are <base64url-connection-uid>.<ext>.

7. Download all file types for a specific session (by connection UID)

Get the full connection UID from --format json above, then:

pam rec dl \
  --connection-uid <connectionUid hex> \
  --record-uid <recordUid hex> \
  --output-dir ./downloads

Expected: up to 4 files per session — .ses (session), .tys (typescript), .tim (timing), .sum (AI summary). 404s are silently logged and mean that file type doesn't exist for that session (normal).

8. Download all recordings for a user (bulk)

pam rec dl --usernames user@example.com --output-dir ./downloads

9. Download with type filter

pam rec dl --usernames user@example.com --types session typescript --output-dir ./downloads

10. Multiple users or connection UIDs

pam rec lbu user1@example.com user2@example.com --format json
pam rec dl --connection-uid <uid1> <uid2> <uid3> --record-uid <recordUid> --output-dir ./downloads

Decryption verification

Decrypted .ses files are raw terminal session data (text). You can inspect them:

cat downloads/<filename>.ses | head -100

The .sum file contains the AI-generated session summary as JSON.

Test Results (live against dev)

All 8 test scenarios run against jlondon+keeperai@keepersecurity.com on dev:

• Listed hundreds of recordings with correct timestamps, risk levels, and protocols
• Filtered by risk=critical, type=session, protocol=ssh
• Downloaded and decrypted .ses (62,724 bytes), .tys, .tim, .sum files
• All 4 file types decrypted correctly end-to-end

Unit tests: 54/54 passing, 100% line coverage