@lamalibre/create-lamaste 4.0.0 → 4.1.0

package/vendor/server/src/commands/plugins.js

@@ -7,6 +7,12 @@
  *   enable <name>        Enable a plugin
  *   disable <name>       Disable a plugin
  *   uninstall <name>     Remove a plugin (must be disabled first)
+ *   oidc-clients <name>  The OIDC clients a plugin declares on Authelia
+ *   rotate-secret <name> <clientId>
+ *                        New secret for a confidential OIDC client (shown once)
+ *
+ * The OIDC subcommands go through the running panel: writing a client to
+ * Authelia is the panel's job.
  */
 
 import chalk from 'chalk';
@@ -20,6 +26,7 @@ import {
 } from '@lamalibre/lamaste/server';
 import { STATE_DIR, PANEL_SERVICE } from '../config.js';
 import { exec } from '../exec.js';
+import { panelRequest } from '../panel-api.js';
 import { createLogger } from '../logger.js';
 import { emit, emitStep, emitError, emitComplete, emitLog } from '../ndjson.js';
 
@@ -47,6 +54,10 @@ export async function runPlugins(args, { json }) {
       return disablePluginCmd(args[1], { json });
     case 'uninstall':
       return uninstallPluginCmd(args[1], { json });
+    case 'oidc-clients':
+      return oidcClientsCmd(args[1], { json });
+    case 'rotate-secret':
+      return rotateSecretCmd(args[1], args[2], { json });
     default:
       printPluginUsage();
       process.exit(sub ? 1 : 0);
@@ -65,6 +76,9 @@ ${b('Subcommands:')}
   ${c('enable <name>')}        Enable a plugin
   ${c('disable <name>')}       Disable a plugin
   ${c('uninstall <name>')}     Remove a disabled plugin
+  ${c('oidc-clients <name>')}  OIDC clients the plugin declares on Authelia (no secrets)
+  ${c('rotate-secret <name> <clientId>')}
+                       Replace a confidential client's secret — printed once
 `);
 }
 
@@ -252,6 +266,79 @@ async function uninstallPluginCmd(name, { json }) {
   }
 }
 
+/**
+ * @param {string | undefined} name
+ * @param {{ json: boolean }} options
+ */
+async function oidcClientsCmd(name, { json }) {
+  if (!name) {
+    const msg = 'Usage: lamaste-server plugins oidc-clients <name>';
+    if (json) emitError(msg);
+    else console.error(`\n  ${msg}\n`);
+    process.exit(1);
+  }
+  const result = await panelRequest('GET', `/api/plugins/${encodeURIComponent(name)}/oidc-clients`);
+  if (json) {
+    emit(result);
+    return;
+  }
+  const clients = result.clients ?? [];
+  if (clients.length === 0) {
+    console.log(`\n  Plugin ${chalk.cyan(name)} declares no OIDC clients.\n`);
+    return;
+  }
+  const b = chalk.bold;
+  const d = chalk.dim;
+  console.log('');
+  console.log(b(`  OIDC clients of ${name}`));
+  console.log(d('  ' + '\u2500'.repeat(40)));
+  for (const c of clients) {
+    const kind = c.confidential ? chalk.yellow('confidential') : chalk.green('public');
+    const served = c.enabled ? '' : d(' (plugin disabled — not served)');
+    console.log(`  ${chalk.cyan(c.id)}  ${kind}${served}`);
+    console.log(`    grants:   ${c.grantTypes.join(', ')}`);
+    console.log(`    scopes:   ${c.scopes.join(', ')}`);
+    if (c.audience.length > 0) console.log(`    audience: ${c.audience.join(', ')}`);
+    if (c.accessTokenClaims.length > 0) {
+      console.log(`    claims:   ${c.accessTokenClaims.join(', ')} (in access tokens)`);
+    }
+    if (c.confidential) {
+      console.log(
+        `    secret:   created ${c.secretCreatedAt ?? d('(not yet)')}${
+          c.secretRotatedAt ? `, rotated ${c.secretRotatedAt}` : ''
+        }`,
+      );
+    }
+  }
+  console.log('');
+}
+
+/**
+ * @param {string | undefined} name
+ * @param {string | undefined} clientId
+ * @param {{ json: boolean }} options
+ */
+async function rotateSecretCmd(name, clientId, { json }) {
+  if (!name || !clientId) {
+    const msg = 'Usage: lamaste-server plugins rotate-secret <name> <clientId>';
+    if (json) emitError(msg);
+    else console.error(`\n  ${msg}\n`);
+    process.exit(1);
+  }
+  const result = await panelRequest(
+    'POST',
+    `/api/plugins/${encodeURIComponent(name)}/oidc-clients/${encodeURIComponent(clientId)}/rotate-secret`,
+  );
+  if (json) {
+    emit(result);
+    return;
+  }
+  console.log(
+    `\n  ${chalk.green('✓')} Secret of ${chalk.cyan(clientId)} rotated at ${result.rotatedAt}`,
+  );
+  console.log(`  ${chalk.bold('New secret (shown once):')} ${result.secret}\n`);
+}
+
 const MUTATING = new Set(['install', 'enable', 'disable', 'uninstall']);
 
 /** Set on the child run as lamaste: the root parent restarts the panel. */

package/vendor/server/src/commands/registry-credential.js

@@ -0,0 +1,142 @@
+/**
+ * lamaste-server registry-credential — the panel's service credential on the
+ * Lamalibre npm registry (Feria), used to broker short-lived install tokens
+ * for agents.
+ *
+ *   registry-credential show
+ *   registry-credential set --url <registry> --oidc
+ *       The panel authenticates as its own `lamaste-server` OIDC client on
+ *       the relay's Authelia (client-credentials grant, Feria login). Nothing
+ *       to paste; Feria's auth.json must trust the relay as a rules issuer.
+ *   registry-credential set --url <registry> [--token-stdin]
+ *       A long-lived Feria token, read from LAMASTE_REGISTRY_TOKEN or from
+ *       stdin with --token-stdin. Never accepted as a command-line argument.
+ *   registry-credential clear
+ */
+
+import chalk from 'chalk';
+import { panelRequest } from '../panel-api.js';
+import { emit } from '../ndjson.js';
+
+/**
+ * @param {string[]} args
+ * @param {{ json: boolean }} options
+ */
+export async function runRegistryCredential(args, { json }) {
+  const sub = args[0];
+  switch (sub) {
+    case 'show':
+      return show({ json });
+    case 'set':
+      return set(args.slice(1), { json });
+    case 'clear':
+      return clear({ json });
+    default:
+      process.stderr.write(
+        `Usage: lamaste-server registry-credential <show | set --url <registry> (--oidc | --token-stdin) | clear>\n`,
+      );
+      process.exit(1);
+  }
+}
+
+async function show({ json }) {
+  const result = await panelRequest('GET', '/api/registry-credential');
+  if (json) {
+    emit(result);
+    return;
+  }
+  if (!result.configured) {
+    console.log(chalk.dim('No registry credential configured.'));
+    return;
+  }
+  console.log(`${chalk.bold('Registry:')}   ${result.registryUrl}`);
+  console.log(`${chalk.bold('Scope:')}      ${result.scope}`);
+  console.log(
+    `${chalk.bold('Auth:')}       ${
+      result.auth === 'oidc'
+        ? `Authelia OIDC client ${result.clientId} (client credentials)`
+        : 'long-lived registry token'
+    }`,
+  );
+  console.log(`${chalk.bold('Owner:')}      ${result.owner ?? chalk.dim('(unknown)')}`);
+  console.log(`${chalk.bold('Configured:')} ${result.configuredAt}`);
+}
+
+async function set(args, { json }) {
+  let url;
+  let tokenFromStdin = false;
+  let oidc = false;
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === '--url') {
+      url = args[++i];
+    } else if (arg.startsWith('--url=')) {
+      url = arg.slice('--url='.length);
+    } else if (arg === '--token-stdin') {
+      tokenFromStdin = true;
+    } else if (arg === '--oidc') {
+      oidc = true;
+    } else if (arg === '--token' || arg.startsWith('--token=')) {
+      throw new Error(
+        'The token is never accepted on the command line — set LAMASTE_REGISTRY_TOKEN or use --token-stdin',
+      );
+    } else {
+      throw new Error(`Unknown argument: ${arg}`);
+    }
+  }
+  if (!url) throw new Error('registry-credential set: --url <registry> is required');
+  if (oidc && tokenFromStdin) {
+    throw new Error('registry-credential set: choose --oidc or --token-stdin, not both');
+  }
+
+  let auth;
+  if (oidc) {
+    auth = { kind: 'oidc' };
+  } else {
+    let token = tokenFromStdin ? (await readStdin()).trim() : process.env.LAMASTE_REGISTRY_TOKEN;
+    if (!token) {
+      throw new Error(
+        'No token: use --oidc, set LAMASTE_REGISTRY_TOKEN, or pipe a token in with --token-stdin (e.g. from `feria-server token bootstrap`)',
+      );
+    }
+    token = token.trim();
+    auth = { kind: 'token', token };
+  }
+
+  const result = await panelRequest('PUT', '/api/registry-credential', {
+    registryUrl: url,
+    auth,
+  });
+  if (result.error) throw new Error(result.error);
+  if (json) {
+    emit(result);
+    return;
+  }
+  console.log(
+    `${chalk.green('✓')} Registry credential configured for ${result.registryUrl} as ${result.owner ?? '(unknown)'}` +
+      (result.auth === 'oidc' ? ` (Authelia client ${result.clientId})` : ''),
+  );
+}
+
+async function clear({ json }) {
+  const result = await panelRequest('DELETE', '/api/registry-credential');
+  if (json) {
+    emit(result);
+    return;
+  }
+  console.log(
+    result.removed
+      ? `${chalk.green('✓')} Registry credential removed`
+      : chalk.dim('Nothing to remove.'),
+  );
+}
+
+function readStdin() {
+  return new Promise((resolve, reject) => {
+    let data = '';
+    process.stdin.setEncoding('utf-8');
+    process.stdin.on('data', (chunk) => (data += chunk));
+    process.stdin.on('end', () => resolve(data));
+    process.stdin.on('error', reject);
+  });
+}

package/vendor/server/src/panel-api.js

@@ -13,15 +13,90 @@ import { PKI_DIR } from './config.js';
 
 const PANEL_URL = 'https://127.0.0.1:9292';
 
+/**
+ * The curl argument vector for one panel request. Pure, exported for tests.
+ *
+ * The JSON content type and the body travel together: a `Content-Type:
+ * application/json` header on a body-less DELETE made Fastify answer 400
+ * ("Body cannot be empty when content-type is set"), so `registry-credential
+ * clear`, `tunnels delete` and `sites delete` never reached their routes.
+ *
+ * @param {{ method: string, path: string, body?: Record<string, unknown> | null, p12Path: string, configPath: string }} request
+ * @returns {string[]}
+ */
+export function buildPanelCurlArgs({ method, path, body = null, p12Path, configPath }) {
+  const args = [
+    '-K',
+    configPath,
+    '--cert-type',
+    'P12',
+    '--cert',
+    p12Path,
+    '-k', // Server uses self-signed cert on localhost
+    '-s', // Silent
+    '-S', // Show errors
+    '-X',
+    method,
+    '-H',
+    'Accept: application/json',
+  ];
+  if (body !== null && body !== undefined) {
+    args.push('-H', 'Content-Type: application/json', '-d', JSON.stringify(body));
+  }
+  // Append the HTTP status on its own line so an error response is not
+  // mistaken for a result — the panel answers errors with a JSON body.
+  args.push('-w', '\n%{http_code}', `${PANEL_URL}${path}`);
+  return args;
+}
+
+/**
+ * Split curl's output (`<payload>\n<status>`) and turn a non-2xx status
+ * into an error carrying the panel's `error` (and `details`). Pure,
+ * exported for tests.
+ *
+ * @param {string} stdout
+ * @param {string} method
+ * @param {string} path
+ * @returns {Record<string, unknown>}
+ */
+export function parsePanelResponse(stdout, method, path) {
+  const split = stdout.lastIndexOf('\n');
+  const payload = stdout.slice(0, split).trim();
+  const status = Number(stdout.slice(split + 1).trim());
+  let parsed = {};
+  if (payload) {
+    try {
+      parsed = JSON.parse(payload);
+    } catch {
+      parsed = { error: payload };
+    }
+  }
+
+  // Anything but a 2xx is an error: 4xx/5xx from the panel, a 3xx curl did
+  // not follow, or 0 when curl reported no status at all.
+  if (!Number.isInteger(status) || status < 200 || status >= 300) {
+    const reason = [parsed.error, parsed.details].filter(Boolean).join(': ');
+    const err = new Error(
+      `${method} ${path} failed (HTTP ${status})${reason ? `: ${reason}` : ''}`,
+    );
+    err.statusCode = status;
+    throw err;
+  }
+
+  return parsed;
+}
+
 /**
  * Make an authenticated API request to the local panel server.
  *
  * Uses curl with the admin client certificate (mTLS) and a temporary
- * config file for the P12 password (never in process args).
+ * config file for the P12 password (never in process args). Resolves with
+ * the JSON body; rejects with an Error (`statusCode`, the panel's `error`
+ * in the message) for any non-2xx answer.
  *
  * @param {string} method
  * @param {string} path  e.g. '/api/tunnels'
- * @param {Record<string, unknown> | null} [body]
+ * @param {Record<string, unknown> | null} [body]  sent as JSON when given
  * @returns {Promise<Record<string, unknown>>}
  */
 export async function panelRequest(method, path, body = null) {
@@ -42,43 +117,13 @@ export async function panelRequest(method, path, body = null) {
   try {
     await writeFile(tmpConfigPath, `--pass "${p12Password}"\n`, { mode: 0o600 });
 
-    const curlArgs = [
-      '-K',
-      tmpConfigPath,
-      '--cert-type',
-      'P12',
-      '--cert',
-      p12Path,
-      '-k', // Server uses self-signed cert on localhost
-      '-s', // Silent
-      '-S', // Show errors
-      '-X',
-      method,
-      '-H',
-      'Content-Type: application/json',
-    ];
-
-    if (body) {
-      curlArgs.push('-d', JSON.stringify(body));
-    }
-
-    // Append the HTTP status on its own line so an error response is not
-    // mistaken for a result — the panel answers errors with a JSON body.
-    curlArgs.push('-w', '\n%{http_code}', `${PANEL_URL}${path}`);
-
-    const { stdout } = await execa('curl', curlArgs, { timeout: 30000 });
-
-    const split = stdout.lastIndexOf('\n');
-    const payload = stdout.slice(0, split).trim();
-    const status = Number(stdout.slice(split + 1).trim());
-    const parsed = payload ? JSON.parse(payload) : {};
-
-    if (!Number.isInteger(status) || status >= 400) {
-      const reason = [parsed.error, parsed.details].filter(Boolean).join(': ');
-      throw new Error(`${method} ${path} failed (HTTP ${status})${reason ? `: ${reason}` : ''}`);
-    }
+    const { stdout } = await execa(
+      'curl',
+      buildPanelCurlArgs({ method, path, body, p12Path, configPath: tmpConfigPath }),
+      { timeout: 30000 },
+    );
 
-    return parsed;
+    return parsePanelResponse(stdout, method, path);
   } finally {
     await unlink(tmpConfigPath).catch(() => {});
   }

package/vendor/serverd/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/lamaste-serverd",
-  "version": "4.0.0",
+  "version": "4.1.0",
   "description": "Lamaste server daemon — REST API and plugin host",
   "license": "SEE LICENSE IN LICENSE.md",
   "publishConfig": {
@@ -8,6 +8,9 @@
   },
   "type": "module",
   "main": "src/index.js",
+  "files": [
+    "src"
+  ],
   "scripts": {
     "dev": "node --watch src/index.js | pino-pretty",
     "build": "echo 'No build step for lamaste-serverd'",
@@ -26,7 +29,7 @@
     "@fastify/rate-limit": "^10.3.0",
     "@fastify/static": "^9.1.1",
     "@fastify/websocket": "^11.0.0",
-    "@lamalibre/lamaste": "^4.0.0",
+    "@lamalibre/lamaste": "^4.1.0",
     "bcryptjs": "^3.0.3",
     "execa": "^9.6.1",
     "fastify": "^5.8.4",

package/vendor/serverd/src/index.js

@@ -28,6 +28,7 @@ import userAccessSessionMiddleware from './middleware/user-access-session.js';
 import { getPluginCapabilities } from './lib/plugins.js';
 import { setPluginCapabilities } from './lib/mtls.js';
 import { startChiselReconciler } from './lib/chisel-reconcile.js';
+import { syncOidcClients } from './lib/plugin-oidc.js';
 import {
   loadTicketScopeCapabilities,
   checkInstanceLiveness,
@@ -76,6 +77,16 @@ async function start() {
   // it can.
   startChiselReconciler(server.log);
 
+  // Bring Authelia's OIDC clients (plugin manifests, the panel's own
+  // registry client) and the client-secret store in line with persisted
+  // state. Best effort: a failure is logged and the next lifecycle change
+  // retries. Only once onboarding has written Authelia's configuration.
+  if (config.onboarding.status === 'COMPLETED') {
+    syncOidcClients(server.log).catch((err) => {
+      server.log.warn({ err: err.message }, 'Startup OIDC client sync failed');
+    });
+  }
+
   // --- Plugins ---
   const ipOrigin = `https://${config.ip}:9292`;
   await server.register(cors, {

package/vendor/serverd/src/lib/authelia.js

@@ -18,6 +18,7 @@ import {
   reloadAuthelia as reloadAutheliaCore,
   isAutheliaRunning as isAutheliaRunningCore,
   updateAutheliaAccessControl,
+  updateAutheliaOidcProvider,
   createUserFromInvitation as createUserFromInvitationCore,
   base32Encode,
   base32Decode,
@@ -73,6 +74,16 @@ export function updateAccessControl(sites) {
   return updateAutheliaAccessControl(sites, execa);
 }
 
+/**
+ * Make Authelia's OIDC provider serve exactly these clients.
+ * @param {string} domain
+ * @param {import('@lamalibre/lamaste/server').AutheliaOidcClient[]} clients
+ * @param {import('@lamalibre/lamaste/server').OidcProviderOptions} [options]
+ */
+export function updateOidcProvider(domain, clients, options = {}) {
+  return updateAutheliaOidcProvider(domain, clients, execa, options);
+}
+
 export function createUserFromInvitation(username, email, groups, hashedPassword) {
   return createUserFromInvitationCore(username, email, groups, hashedPassword, execa);
 }