@lamalibre/create-lamaste 4.0.0 → 4.2.0

package/vendor/serverd/src/routes/management/plugins.js

@@ -8,6 +8,7 @@ import {
   getPluginCapabilities,
 } from '../../lib/plugins.js';
 import { setPluginCapabilities, loadAgentRegistry } from '../../lib/mtls.js';
+import { listPluginOidcClients, rotatePluginOidcClientSecret } from '../../lib/plugin-oidc.js';
 import {
   readPushInstallConfig,
   readPushInstallSessions,
@@ -31,6 +32,14 @@ const PluginNameParamSchema = z.object({
     .regex(/^[a-z0-9-]+$/, 'Plugin name must contain only lowercase letters, numbers, and hyphens'),
 });
 
+const OidcClientIdParamSchema = z.object({
+  clientId: z
+    .string()
+    .min(1)
+    .max(100)
+    .regex(/^[a-z0-9][a-z0-9-]*$/, 'Client id must be lowercase letters, numbers and hyphens'),
+});
+
 const InstallBodySchema = z.object({
   packageName: z
     .string()
@@ -188,10 +197,12 @@ export default async function pluginRoutes(fastify, _opts) {
       const body = InstallBodySchema.parse(request.body);
 
       try {
-        const plugin = await installPlugin(body.packageName, request.log);
+        // `oidcClients` carries the secrets of confidential OIDC clients this
+        // install created — shown once, never stored in the registry row.
+        const { oidcClients, ...plugin } = await installPlugin(body.packageName, request.log);
         // Refresh in-memory capability list so new plugin caps are valid immediately
         setPluginCapabilities(await getPluginCapabilities());
-        return { ok: true, plugin };
+        return { ok: true, plugin, oidcClients };
       } catch (err) {
         const statusCode = err.statusCode || 500;
         return reply.code(statusCode).send({
@@ -273,6 +284,58 @@ export default async function pluginRoutes(fastify, _opts) {
     },
   );
 
+  // ------------------------------------------------------------------
+  // GET /plugins/:name/oidc-clients — the OIDC clients a plugin declares
+  //
+  // Metadata only: a confidential client's secret is shown by the install
+  // or enable response that created it, and by rotate-secret — never here.
+  // ------------------------------------------------------------------
+  fastify.get(
+    '/plugins/:name/oidc-clients',
+    {
+      preHandler: fastify.requireRole(['admin']),
+    },
+    async (request, reply) => {
+      const params = PluginNameParamSchema.parse(request.params);
+      const registry = await readPlugins();
+      if (!registry.plugins.some((p) => p.name === params.name)) {
+        return reply.code(404).send({ error: `Plugin "${params.name}" not found` });
+      }
+      return { clients: await listPluginOidcClients(params.name) };
+    },
+  );
+
+  // ------------------------------------------------------------------
+  // POST /plugins/:name/oidc-clients/:clientId/rotate-secret
+  //
+  // Replaces a confidential client's secret in the store and in Authelia.
+  // The new secret is in the response and nowhere else.
+  // ------------------------------------------------------------------
+  fastify.post(
+    '/plugins/:name/oidc-clients/:clientId/rotate-secret',
+    {
+      preHandler: fastify.requireRole(['admin']),
+      config: { rateLimit: { max: 10, timeWindow: '1 minute' } },
+    },
+    async (request, reply) => {
+      const params = PluginNameParamSchema.parse(request.params);
+      const { clientId } = OidcClientIdParamSchema.parse(request.params);
+      const registry = await readPlugins();
+      if (!registry.plugins.some((p) => p.name === params.name)) {
+        return reply.code(404).send({ error: `Plugin "${params.name}" not found` });
+      }
+      try {
+        const rotated = await rotatePluginOidcClientSecret(params.name, clientId, request.log);
+        return { ok: true, ...rotated };
+      } catch (err) {
+        const statusCode = err.statusCode || 500;
+        return reply.code(statusCode).send({
+          error: err.message || 'Failed to rotate the client secret',
+        });
+      }
+    },
+  );
+
   // ===========================================================================
   // Push install routes
   // ===========================================================================

package/vendor/serverd/src/routes/management/registry-credential.js

@@ -0,0 +1,170 @@
+/**
+ * Admin management of the panel's registry (Feria) service credential.
+ *
+ *   GET    /api/registry-credential   what is configured — never a token
+ *   PUT    /api/registry-credential   store a credential after verifying the
+ *                                     whole chain against the registry
+ *                                     (admin scope required)
+ *   DELETE /api/registry-credential   remove it
+ *
+ * `auth.kind` is `token` (a pasted long-lived Feria token) or `oidc` (the
+ * panel's own `lamaste-server` client on Authelia: client-credentials grant,
+ * Feria login). For `oidc` the client is written to Authelia before the
+ * chain is verified; if verification fails it is removed again, and the
+ * error says what Feria's `auth.json` needs.
+ *
+ * With a credential in place, agents obtain short-lived read tokens through
+ * `GET /api/agents/me/registry-credential` for plugin installs.
+ */
+
+import { z } from 'zod';
+import {
+  LAMASTE_SERVER_OIDC_CLIENT_ID,
+  RegistryCredentialError,
+  summariseRegistryCredential,
+} from '@lamalibre/lamaste/server';
+
+import {
+  clearRegistryCredentialConfig,
+  readRegistryCredentialConfig,
+  verifyRegistryCredential,
+  writeRegistryCredentialConfig,
+} from '../../lib/registry-credential.js';
+import { syncOidcClients } from '../../lib/plugin-oidc.js';
+
+const FeriaTokenSchema = z
+  .string()
+  .min(20)
+  .max(512)
+  .regex(/^feria_[A-Za-z0-9_-]+$/, 'token must be a Feria registry token');
+
+const AuthSchema = z.discriminatedUnion('kind', [
+  z.object({ kind: z.literal('token'), token: FeriaTokenSchema }),
+  z.object({ kind: z.literal('oidc') }),
+]);
+
+const PutSchema = z
+  .object({
+    registryUrl: z.string().url(),
+    scope: z
+      .string()
+      .regex(/^@[a-z0-9][a-z0-9-]*$/)
+      .optional(),
+    auth: AuthSchema.optional(),
+    /** The first release's shape — a token at the top level. */
+    token: FeriaTokenSchema.optional(),
+  })
+  .superRefine((body, ctx) => {
+    if (!body.auth && !body.token) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['auth'],
+        message: 'auth is required: { kind: "token", token } or { kind: "oidc" }',
+      });
+    }
+  });
+
+/** The stored `auth` for a request body. */
+function authOf(body) {
+  if (body.auth?.kind === 'oidc') return { kind: 'oidc', clientId: LAMASTE_SERVER_OIDC_CLIENT_ID };
+  if (body.auth?.kind === 'token') return { kind: 'token', token: body.auth.token };
+  return { kind: 'token', token: body.token };
+}
+
+export default async function registryCredentialRoutes(fastify) {
+  fastify.get(
+    '/registry-credential',
+    { preHandler: fastify.requireRole(['admin']), config: { rateLimit: {} } },
+    async () => {
+      const config = await readRegistryCredentialConfig();
+      if (!config) return { configured: false };
+      return { configured: true, ...summariseRegistryCredential(config) };
+    },
+  );
+
+  fastify.put(
+    '/registry-credential',
+    {
+      preHandler: fastify.requireRole(['admin']),
+      config: { rateLimit: { max: 10, timeWindow: '1 minute' } },
+    },
+    async (request, reply) => {
+      const body = PutSchema.parse(request.body);
+      const auth = authOf(body);
+      const candidate = { registryUrl: body.registryUrl, auth };
+
+      // The panel's own client must exist in Authelia (with a secret in the
+      // store) before the chain can be exercised.
+      if (auth.kind === 'oidc') {
+        try {
+          const synced = await syncOidcClients(request.log, {
+            registryAuth: { registryUrl: body.registryUrl },
+          });
+          if (!synced) {
+            return reply.code(503).send({ error: 'Complete onboarding (set a domain) first' });
+          }
+        } catch (err) {
+          return reply.code(500).send({
+            error: `Could not register the ${LAMASTE_SERVER_OIDC_CLIENT_ID} client in Authelia: ${err.message}`,
+          });
+        }
+      }
+
+      let verified;
+      try {
+        verified = await verifyRegistryCredential(candidate);
+      } catch (err) {
+        if (auth.kind === 'oidc') {
+          // Leave Authelia as the stored credential says — the candidate is
+          // not kept.
+          await syncOidcClients(request.log).catch((syncErr) =>
+            request.log.warn({ err: syncErr.message }, 'Failed to roll back the OIDC client'),
+          );
+        }
+        const status = err instanceof RegistryCredentialError ? err.statusCode : 502;
+        return reply.code(status).send({ error: err.message });
+      }
+
+      const config = {
+        provider: 'feria',
+        registryUrl: body.registryUrl,
+        scope: body.scope ?? '@lamalibre',
+        auth,
+        owner: verified.owner,
+        configuredAt: new Date().toISOString(),
+      };
+      await writeRegistryCredentialConfig(config);
+      // The stored credential now decides whether Authelia carries the client.
+      await syncOidcClients(request.log).catch((err) =>
+        request.log.warn(
+          { err: err.message },
+          'Failed to sync OIDC clients after credential change',
+        ),
+      );
+      request.log.info(
+        { registryUrl: body.registryUrl, owner: verified.owner, auth: auth.kind },
+        'Registry credential configured',
+      );
+      return { configured: true, ...summariseRegistryCredential(config) };
+    },
+  );
+
+  fastify.delete(
+    '/registry-credential',
+    { preHandler: fastify.requireRole(['admin']), config: { rateLimit: {} } },
+    async (request) => {
+      const removed = await clearRegistryCredentialConfig();
+      if (removed) {
+        request.log.info('Registry credential removed');
+        // Removes the lamaste-server client and its secret if it was in use.
+        await syncOidcClients(request.log).catch((err) =>
+          request.log.warn(
+            { err: err.message },
+            'Failed to sync OIDC clients after credential removal',
+          ),
+        );
+      }
+      return { configured: false, removed };
+    },
+  );
+}

package/vendor/serverd/src/routes/management/storage.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { isAgentHostedPlugin } from '@lamalibre/lamaste';
 import {
   registerStorageServer,
   removeStorageServer,
@@ -118,12 +119,19 @@ export default async function storageRoutes(fastify, _opts) {
 
       // Validate plugin exists in registry
       const registry = await readPlugins();
-      const pluginExists = registry.plugins.some((p) => p.name === body.pluginName);
-      if (!pluginExists) {
+      const plugin = registry.plugins.find((p) => p.name === body.pluginName);
+      if (!plugin) {
         return reply.code(404).send({
           error: `Plugin "${body.pluginName}" not found in registry`,
         });
       }
+      // A binding is handed to the plugin's server code when the panel
+      // mounts it; an agent-hosted plugin has none to receive it.
+      if (isAgentHostedPlugin(plugin)) {
+        return reply.code(400).send({
+          error: `Plugin "${body.pluginName}" is agent-hosted — storage binds to server-hosted plugins only`,
+        });
+      }
 
       try {
         const binding = await bindPluginStorage(body.pluginName, body.storageServerId);

package/vendor/serverd/src/routes/management/users.js

@@ -9,6 +9,7 @@ import {
   writeTotpToDatabase,
 } from '../../lib/authelia.js';
 import { removeGrantsForUser } from '../../lib/user-access.js';
+import { revokeUserRegistryTokens } from '../../lib/registry-credential.js';
 import { bumpUserEpoch } from '../../lib/config.js';
 import { gatekeeperRequest } from '../../lib/gatekeeper-client.js';
 
@@ -156,6 +157,7 @@ export default async function usersRoutes(fastify, _opts) {
       }
 
       const user = usersData.users[username];
+      const groupsBefore = Array.isArray(user.groups) ? [...user.groups] : [];
 
       if (body.displayname !== undefined) {
         user.displayname = body.displayname;
@@ -188,6 +190,23 @@ export default async function usersRoutes(fastify, _opts) {
         request.log.warn(err, 'Failed to reload Authelia after user update');
       }
 
+      // Registry scopes are granted at login from feria-* groups; losing a
+      // group must not leave a valid token behind. Best effort — the user
+      // update itself is already done.
+      const warnings = [];
+      if (body.groups !== undefined) {
+        try {
+          await revokeUserRegistryTokens(
+            username,
+            { before: groupsBefore, after: user.groups || [] },
+            request.log,
+          );
+        } catch (err) {
+          request.log.warn({ username, err: err.message }, 'Failed to revoke registry tokens');
+          warnings.push(`registry tokens were not revoked: ${err.message}`);
+        }
+      }
+
       return {
         ok: true,
         user: {
@@ -196,6 +215,7 @@ export default async function usersRoutes(fastify, _opts) {
           email: user.email,
           groups: user.groups || [],
         },
+        ...(warnings.length > 0 ? { warnings } : {}),
       };
     },
   );
@@ -252,6 +272,17 @@ export default async function usersRoutes(fastify, _opts) {
       // ---------------------------------------------------------------
       const warnings = [];
 
+      // 0. Registry (Feria) tokens the user holds — their groups are gone.
+      try {
+        await revokeUserRegistryTokens(username, { deleted: true }, request.log);
+      } catch (err) {
+        request.log.warn(
+          { username, err: err.message },
+          'Cascade: registry token revocation failed',
+        );
+        warnings.push(`registry tokens were not revoked: ${err.message}`);
+      }
+
       // 1. Legacy user-plugin-access.json grants (pre-gatekeeper migration)
       try {
         const removed = await removeGrantsForUser(username, request.log);

package/vendor/serverd/src/routes/management.js

@@ -14,6 +14,7 @@ import identityRoutes from './management/identity.js';
 import storageRoutes from './management/storage.js';
 import gatekeeperProxyRoutes from './management/gatekeeper-proxy.js';
 import agentsRoutes from './management/agents.js';
+import registryCredentialRoutes from './management/registry-credential.js';
 
 export default async function managementRoutes(fastify, _opts) {
   fastify.addHook('onRequest', managementOnly());
@@ -33,4 +34,5 @@ export default async function managementRoutes(fastify, _opts) {
   await fastify.register(storageRoutes);
   await fastify.register(gatekeeperProxyRoutes);
   await fastify.register(agentsRoutes);
+  await fastify.register(registryCredentialRoutes);
 }