@lamalibre/create-lamaste 4.0.0 → 4.2.0

package/vendor/server/src/commands/plugins.js

@@ -2,27 +2,33 @@
  * lamaste-server plugins — Manage server-side plugins.
  *
  * Subcommands:
- *   list                 List installed plugins with status
+ *   list                 List installed plugins with status and hosting
  *   install <package>    Install a plugin by npm package name
  *   enable <name>        Enable a plugin
  *   disable <name>       Disable a plugin
  *   uninstall <name>     Remove a plugin (must be disabled first)
+ *   oidc-clients <name>  The OIDC clients a plugin declares on Authelia
+ *   rotate-secret <name> <clientId>
+ *                        New secret for a confidential OIDC client (shown once)
+ *
+ * Every subcommand goes through the running panel (`/api/plugins/*`, admin
+ * certificate): the panel owns the plugin registry (SQLite `state.db`), runs
+ * npm as the `lamaste` account, and writes the plugins' OIDC clients to
+ * Authelia. The CLI keeps no plugin state of its own, so a plugin it installs
+ * is the plugin the panel serves. The panel must be running — a plugin that
+ * fails to load is logged and skipped by the plugin host, so the panel stays
+ * reachable to disable it.
  */
 
 import chalk from 'chalk';
 import { execa } from 'execa';
-import {
-  readPlugins,
-  installPlugin,
-  enablePlugin,
-  disablePlugin,
-  uninstallPlugin,
-} from '@lamalibre/lamaste/server';
-import { STATE_DIR, PANEL_SERVICE } from '../config.js';
-import { exec } from '../exec.js';
-import { createLogger } from '../logger.js';
+import { PANEL_SERVICE } from '../config.js';
+import { panelRequest } from '../panel-api.js';
 import { emit, emitStep, emitError, emitComplete, emitLog } from '../ndjson.js';
 
+/** npm runs inside the panel for install and uninstall (its own limit is 120 s). */
+const NPM_CALL_TIMEOUT_MS = 180_000;
+
 /**
  * @param {string[]} args  Subcommand args: ['list'] | ['install', '<pkg>'] | ...
  * @param {{ json: boolean }} options
@@ -30,12 +36,6 @@ import { emit, emitStep, emitError, emitComplete, emitLog } from '../ndjson.js';
 export async function runPlugins(args, { json }) {
   const sub = args[0];
 
-  if (MUTATING.has(sub) && process.getuid?.() === 0) {
-    await runAsLamaste(args, { json });
-    await restartPanel(json);
-    return;
-  }
-
   switch (sub) {
     case 'list':
       return listPlugins({ json });
@@ -47,6 +47,10 @@ export async function runPlugins(args, { json }) {
       return disablePluginCmd(args[1], { json });
     case 'uninstall':
       return uninstallPluginCmd(args[1], { json });
+    case 'oidc-clients':
+      return oidcClientsCmd(args[1], { json });
+    case 'rotate-secret':
+      return rotateSecretCmd(args[1], args[2], { json });
     default:
       printPluginUsage();
       process.exit(sub ? 1 : 0);
@@ -60,20 +64,25 @@ function printPluginUsage() {
 ${b('Usage:')} lamaste-server plugins <subcommand>
 
 ${b('Subcommands:')}
-  ${c('list')}                 List installed plugins with status
+  ${c('list')}                 Installed plugins: status, hosting (server or agent)
   ${c('install <package>')}    Install a plugin (e.g. @lamalibre/herd-server)
   ${c('enable <name>')}        Enable a plugin
   ${c('disable <name>')}       Disable a plugin
   ${c('uninstall <name>')}     Remove a disabled plugin
+  ${c('oidc-clients <name>')}  OIDC clients the plugin declares on Authelia (no secrets)
+  ${c('rotate-secret <name> <clientId>')}
+                       Replace a confidential client's secret — printed once
 `);
 }
 
 /**
+ * The plugins the running panel serves, from the panel itself: its registry
+ * (SQLite `state.db`) is the one the plugin host and the OIDC sync read.
+ *
  * @param {{ json: boolean }} options
  */
 async function listPlugins({ json }) {
-  const registry = await readPlugins(STATE_DIR);
-  const plugins = registry.plugins;
+  const { plugins = [] } = await panelRequest('GET', '/api/plugins');
 
   if (json) {
     emit({ plugins });
@@ -97,63 +106,95 @@ async function listPlugins({ json }) {
 
   for (const p of plugins) {
     const status = p.status === 'enabled' ? g('enabled') : r('disabled');
-    console.log(`  ${c(p.name)}  ${d(p.version)}  ${status}  ${d(p.packageName)}`);
+    const hosting = p.hosting === 'agent' ? chalk.yellow('agent-hosted') : d('server-hosted');
+    console.log(`  ${c(p.name)}  ${d(p.version)}  ${status}  ${hosting}  ${d(p.packageName)}`);
   }
   console.log('');
 }
 
+/**
+ * Print the secrets of confidential OIDC clients an install or enable created.
+ * They are shown once — the panel stores only their digests.
+ *
+ * @param {Array<{ id: string, secret: string }> | undefined} clients
+ */
+function printCreatedSecrets(clients) {
+  if (!clients || clients.length === 0) return;
+  console.log(`  ${chalk.bold('Confidential OIDC client secrets (shown once):')}`);
+  for (const c of clients) console.log(`    ${chalk.cyan(c.id)}  ${c.secret}`);
+  console.log('');
+}
+
+/**
+ * Exit with a usage or panel error, as text or NDJSON.
+ *
+ * @param {string} message
+ * @param {boolean} json
+ * @param {string} [step]  NDJSON step that failed
+ * @returns {never}
+ */
+function fail(message, json, step) {
+  if (json) {
+    if (step) emitStep(step, 'failed', message);
+    emitError(message);
+  } else {
+    console.error(`\n  ${chalk.red(message)}\n`);
+  }
+  process.exit(1);
+}
+
 /**
  * @param {string | undefined} packageName
  * @param {{ json: boolean }} options
  */
 async function installPluginCmd(packageName, { json }) {
-  if (!packageName) {
-    const msg = 'Usage: lamaste-server plugins install <package>';
-    if (json) emitError(msg);
-    else console.error(`\n  ${msg}\n`);
-    process.exit(1);
-  }
-
-  const logger = createLogger({ json });
+  if (!packageName) fail('Usage: lamaste-server plugins install <package>', json);
 
   if (json) {
     emitStep('install', 'running', `Installing ${packageName}`);
-    emitLog('info', `Fetching ${packageName} from the npm registry — this may take a moment.`);
+    emitLog('info', `The panel is fetching ${packageName} from the npm registry.`);
   } else {
     process.stderr.write(`  Installing ${chalk.cyan(packageName)}...`);
   }
 
+  let result;
   try {
-    const entry = await installPlugin({
-      packageName,
-      stateDir: STATE_DIR,
-      exec,
-      logger,
-    });
-
-    if (json) {
-      emitStep('install', 'complete');
-      emitComplete({ plugin: entry });
-    } else {
-      console.log(` ${chalk.green('ok')}`);
-      console.log(`  Plugin ${chalk.cyan(entry.name)} installed (${chalk.dim('disabled')})`);
-      console.log(
-        `  Run ${chalk.cyan(`lamaste-server plugins enable ${entry.name}`)} to activate.`,
-      );
-      console.log('');
-    }
-
-    await restartPanel(json);
+    result = await panelRequest(
+      'POST',
+      '/api/plugins/install',
+      { packageName },
+      { timeoutMs: NPM_CALL_TIMEOUT_MS },
+    );
   } catch (err) {
-    if (json) {
-      emitStep('install', 'failed', err.message);
-      emitError(err.message);
-    } else {
-      console.log(` ${chalk.red('failed')}`);
-      console.error(`  ${chalk.red(err.message)}`);
-    }
-    process.exit(1);
+    if (!json) console.log(` ${chalk.red('failed')}`);
+    fail(err.message, json, 'install');
+  }
+
+  const { plugin, oidcClients } = result;
+  if (json) {
+    emitStep('install', 'complete');
+    emitComplete({ plugin, oidcClients });
+    return;
   }
+  const hosting = plugin.hosting === 'agent' ? ', agent-hosted' : '';
+  console.log(` ${chalk.green('ok')}`);
+  console.log(`  Plugin ${chalk.cyan(plugin.name)} installed (${chalk.dim(`disabled${hosting}`)})`);
+  console.log(`  Run ${chalk.cyan(`lamaste-server plugins enable ${plugin.name}`)} to activate.`);
+  console.log('');
+  printCreatedSecrets(oidcClients);
+}
+
+/**
+ * The panel mounts a server-hosted plugin's routes at startup, so enabling or
+ * disabling one takes effect after a restart; an agent-hosted plugin has
+ * nothing mounted and its OIDC clients are already applied.
+ *
+ * @param {string} name
+ * @returns {Promise<boolean>}
+ */
+async function needsRestart(name) {
+  const { plugin } = await panelRequest('GET', `/api/plugins/${encodeURIComponent(name)}`);
+  return plugin.hosting !== 'agent';
 }
 
 /**
@@ -161,28 +202,21 @@ async function installPluginCmd(packageName, { json }) {
  * @param {{ json: boolean }} options
  */
 async function enablePluginCmd(name, { json }) {
-  if (!name) {
-    const msg = 'Usage: lamaste-server plugins enable <name>';
-    if (json) emitError(msg);
-    else console.error(`\n  ${msg}\n`);
-    process.exit(1);
-  }
-
-  const logger = createLogger({ json });
+  if (!name) fail('Usage: lamaste-server plugins enable <name>', json);
 
+  let result;
   try {
-    await enablePlugin({ name, stateDir: STATE_DIR, logger });
-    if (json) {
-      emitComplete({ name, status: 'enabled' });
-    } else {
-      console.log(`\n  Plugin ${chalk.cyan(name)} ${chalk.green('enabled')}.`);
-    }
-    await restartPanel(json);
+    result = await panelRequest('POST', `/api/plugins/${encodeURIComponent(name)}/enable`);
   } catch (err) {
-    if (json) emitError(err.message);
-    else console.error(`\n  ${chalk.red(err.message)}\n`);
-    process.exit(1);
+    fail(err.message, json);
   }
+
+  if (json) emitComplete({ name, status: 'enabled', oidcClients: result.oidcClients });
+  else {
+    console.log(`\n  Plugin ${chalk.cyan(name)} ${chalk.green('enabled')}.`);
+    printCreatedSecrets(result.oidcClients);
+  }
+  if (await needsRestart(name)) await restartPanel(json);
 }
 
 /**
@@ -190,27 +224,45 @@ async function enablePluginCmd(name, { json }) {
  * @param {{ json: boolean }} options
  */
 async function disablePluginCmd(name, { json }) {
-  if (!name) {
-    const msg = 'Usage: lamaste-server plugins disable <name>';
-    if (json) emitError(msg);
-    else console.error(`\n  ${msg}\n`);
-    process.exit(1);
+  if (!name) fail('Usage: lamaste-server plugins disable <name>', json);
+
+  try {
+    await panelRequest('POST', `/api/plugins/${encodeURIComponent(name)}/disable`);
+  } catch (err) {
+    fail(err.message, json);
   }
 
-  const logger = createLogger({ json });
+  if (json) emitComplete({ name, status: 'disabled' });
+  else console.log(`\n  Plugin ${chalk.cyan(name)} ${chalk.red('disabled')}.`);
+  if (await needsRestart(name)) await restartPanel(json);
+}
+
+/**
+ * @param {string | undefined} name
+ * @param {{ json: boolean }} options
+ */
+async function uninstallPluginCmd(name, { json }) {
+  if (!name) fail('Usage: lamaste-server plugins uninstall <name>', json);
+
+  if (json) emitStep('uninstall', 'running', `Uninstalling ${name}`);
+  else process.stderr.write(`  Uninstalling ${chalk.cyan(name)}...`);
 
   try {
-    await disablePlugin({ name, stateDir: STATE_DIR, logger });
-    if (json) {
-      emitComplete({ name, status: 'disabled' });
-    } else {
-      console.log(`\n  Plugin ${chalk.cyan(name)} ${chalk.red('disabled')}.`);
-    }
-    await restartPanel(json);
+    // The panel refuses an enabled plugin (409): nothing of it is mounted
+    // once it is disabled, so no restart follows.
+    await panelRequest('DELETE', `/api/plugins/${encodeURIComponent(name)}`, null, {
+      timeoutMs: NPM_CALL_TIMEOUT_MS,
+    });
   } catch (err) {
-    if (json) emitError(err.message);
-    else console.error(`\n  ${chalk.red(err.message)}\n`);
-    process.exit(1);
+    if (!json) console.log(` ${chalk.red('failed')}`);
+    fail(err.message, json, 'uninstall');
+  }
+
+  if (json) {
+    emitStep('uninstall', 'complete');
+    emitComplete({ name, removed: true });
+  } else {
+    console.log(` ${chalk.green('ok')}`);
   }
 }
 
@@ -218,92 +270,82 @@ async function disablePluginCmd(name, { json }) {
  * @param {string | undefined} name
  * @param {{ json: boolean }} options
  */
-async function uninstallPluginCmd(name, { json }) {
+async function oidcClientsCmd(name, { json }) {
   if (!name) {
-    const msg = 'Usage: lamaste-server plugins uninstall <name>';
+    const msg = 'Usage: lamaste-server plugins oidc-clients <name>';
     if (json) emitError(msg);
     else console.error(`\n  ${msg}\n`);
     process.exit(1);
   }
-
-  const logger = createLogger({ json });
-
-  if (json) emitStep('uninstall', 'running', `Uninstalling ${name}`);
-  else process.stderr.write(`  Uninstalling ${chalk.cyan(name)}...`);
-
-  try {
-    await uninstallPlugin({ name, stateDir: STATE_DIR, exec, logger });
-    if (json) {
-      emitStep('uninstall', 'complete');
-      emitComplete({ name, removed: true });
-    } else {
-      console.log(` ${chalk.green('ok')}`);
+  const result = await panelRequest('GET', `/api/plugins/${encodeURIComponent(name)}/oidc-clients`);
+  if (json) {
+    emit(result);
+    return;
+  }
+  const clients = result.clients ?? [];
+  if (clients.length === 0) {
+    console.log(`\n  Plugin ${chalk.cyan(name)} declares no OIDC clients.\n`);
+    return;
+  }
+  const b = chalk.bold;
+  const d = chalk.dim;
+  console.log('');
+  console.log(b(`  OIDC clients of ${name}`));
+  console.log(d('  ' + '\u2500'.repeat(40)));
+  for (const c of clients) {
+    const kind = c.confidential ? chalk.yellow('confidential') : chalk.green('public');
+    const served = c.enabled ? '' : d(' (plugin disabled — not served)');
+    console.log(`  ${chalk.cyan(c.id)}  ${kind}${served}`);
+    console.log(`    grants:   ${c.grantTypes.join(', ')}`);
+    console.log(`    scopes:   ${c.scopes.join(', ')}`);
+    if (c.audience.length > 0) console.log(`    audience: ${c.audience.join(', ')}`);
+    if (c.accessTokenClaims.length > 0) {
+      console.log(`    claims:   ${c.accessTokenClaims.join(', ')} (in access tokens)`);
     }
-    await restartPanel(json);
-  } catch (err) {
-    if (json) {
-      emitStep('uninstall', 'failed', err.message);
-      emitError(err.message);
-    } else {
-      console.log(` ${chalk.red('failed')}`);
-      console.error(`  ${chalk.red(err.message)}`);
+    if (c.confidential) {
+      console.log(
+        `    secret:   created ${c.secretCreatedAt ?? d('(not yet)')}${
+          c.secretRotatedAt ? `, rotated ${c.secretRotatedAt}` : ''
+        }`,
+      );
     }
-    process.exit(1);
   }
+  console.log('');
 }
 
-const MUTATING = new Set(['install', 'enable', 'disable', 'uninstall']);
-
-/** Set on the child run as lamaste: the root parent restarts the panel. */
-const CHILD_ENV = 'LAMALIBRE_LAMASTE_CLI_PLUGINS_CHILD';
-
 /**
- * Run a plugin subcommand as the lamaste user and wait for it.
- *
- * Plugin state (the npm tree, plugins.json, plugin data) lives in the
- * lamaste-owned state directory. Running npm or writing files there as root
- * would let whatever the panel left in that directory — a `.npmrc`, a
- * symlink — steer root. As lamaste, it can only reach what the panel could
- * already reach. Stays usable while the panel is down (disabling a plugin
- * that keeps it from starting).
- *
- * @param {string[]} args
+ * @param {string | undefined} name
+ * @param {string | undefined} clientId
  * @param {{ json: boolean }} options
  */
-async function runAsLamaste(args, { json }) {
-  const uid = Number.parseInt((await execa('id', ['-u', 'lamaste'])).stdout.trim(), 10);
-  const gid = Number.parseInt((await execa('id', ['-g', 'lamaste'])).stdout.trim(), 10);
-  const { exitCode } = await execa(
-    process.execPath,
-    [process.argv[1], 'plugins', ...args, ...(json ? ['--json'] : [])],
-    {
-      uid,
-      gid,
-      cwd: STATE_DIR,
-      stdio: 'inherit',
-      reject: false,
-      env: {
-        ...process.env,
-        [CHILD_ENV]: '1',
-        HOME: STATE_DIR,
-        USER: 'lamaste',
-        LOGNAME: 'lamaste',
-        npm_config_cache: `${STATE_DIR}/.npm`,
-      },
-      extendEnv: false,
-    },
+async function rotateSecretCmd(name, clientId, { json }) {
+  if (!name || !clientId) {
+    const msg = 'Usage: lamaste-server plugins rotate-secret <name> <clientId>';
+    if (json) emitError(msg);
+    else console.error(`\n  ${msg}\n`);
+    process.exit(1);
+  }
+  const result = await panelRequest(
+    'POST',
+    `/api/plugins/${encodeURIComponent(name)}/oidc-clients/${encodeURIComponent(clientId)}/rotate-secret`,
+  );
+  if (json) {
+    emit(result);
+    return;
+  }
+  console.log(
+    `\n  ${chalk.green('✓')} Secret of ${chalk.cyan(clientId)} rotated at ${result.rotatedAt}`,
   );
-  if (exitCode !== 0) process.exit(exitCode ?? 1);
+  console.log(`  ${chalk.bold('New secret (shown once):')} ${result.secret}\n`);
 }
 
 /**
- * Restart the panel service after plugin changes.
- * Plugin enable/disable/install/uninstall requires a panel restart to take effect.
+ * Restart the panel so it mounts (or unmounts) a server-hosted plugin's
+ * routes. Needs root, like every `lamaste-server` command that reads the
+ * admin certificate.
  * @param {boolean} json
  */
 async function restartPanel(json) {
-  // The child run as lamaste cannot; its root parent does.
-  if (process.env[CHILD_ENV] === '1') return;
   try {
     await execa('systemctl', ['restart', PANEL_SERVICE]);
     if (!json) {

package/vendor/server/src/commands/registry-credential.js

@@ -0,0 +1,142 @@
+/**
+ * lamaste-server registry-credential — the panel's service credential on the
+ * Lamalibre npm registry (Feria), used to broker short-lived install tokens
+ * for agents.
+ *
+ *   registry-credential show
+ *   registry-credential set --url <registry> --oidc
+ *       The panel authenticates as its own `lamaste-server` OIDC client on
+ *       the relay's Authelia (client-credentials grant, Feria login). Nothing
+ *       to paste; Feria's auth.json must trust the relay as a rules issuer.
+ *   registry-credential set --url <registry> [--token-stdin]
+ *       A long-lived Feria token, read from LAMASTE_REGISTRY_TOKEN or from
+ *       stdin with --token-stdin. Never accepted as a command-line argument.
+ *   registry-credential clear
+ */
+
+import chalk from 'chalk';
+import { panelRequest } from '../panel-api.js';
+import { emit } from '../ndjson.js';
+
+/**
+ * @param {string[]} args
+ * @param {{ json: boolean }} options
+ */
+export async function runRegistryCredential(args, { json }) {
+  const sub = args[0];
+  switch (sub) {
+    case 'show':
+      return show({ json });
+    case 'set':
+      return set(args.slice(1), { json });
+    case 'clear':
+      return clear({ json });
+    default:
+      process.stderr.write(
+        `Usage: lamaste-server registry-credential <show | set --url <registry> (--oidc | --token-stdin) | clear>\n`,
+      );
+      process.exit(1);
+  }
+}
+
+async function show({ json }) {
+  const result = await panelRequest('GET', '/api/registry-credential');
+  if (json) {
+    emit(result);
+    return;
+  }
+  if (!result.configured) {
+    console.log(chalk.dim('No registry credential configured.'));
+    return;
+  }
+  console.log(`${chalk.bold('Registry:')}   ${result.registryUrl}`);
+  console.log(`${chalk.bold('Scope:')}      ${result.scope}`);
+  console.log(
+    `${chalk.bold('Auth:')}       ${
+      result.auth === 'oidc'
+        ? `Authelia OIDC client ${result.clientId} (client credentials)`
+        : 'long-lived registry token'
+    }`,
+  );
+  console.log(`${chalk.bold('Owner:')}      ${result.owner ?? chalk.dim('(unknown)')}`);
+  console.log(`${chalk.bold('Configured:')} ${result.configuredAt}`);
+}
+
+async function set(args, { json }) {
+  let url;
+  let tokenFromStdin = false;
+  let oidc = false;
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === '--url') {
+      url = args[++i];
+    } else if (arg.startsWith('--url=')) {
+      url = arg.slice('--url='.length);
+    } else if (arg === '--token-stdin') {
+      tokenFromStdin = true;
+    } else if (arg === '--oidc') {
+      oidc = true;
+    } else if (arg === '--token' || arg.startsWith('--token=')) {
+      throw new Error(
+        'The token is never accepted on the command line — set LAMASTE_REGISTRY_TOKEN or use --token-stdin',
+      );
+    } else {
+      throw new Error(`Unknown argument: ${arg}`);
+    }
+  }
+  if (!url) throw new Error('registry-credential set: --url <registry> is required');
+  if (oidc && tokenFromStdin) {
+    throw new Error('registry-credential set: choose --oidc or --token-stdin, not both');
+  }
+
+  let auth;
+  if (oidc) {
+    auth = { kind: 'oidc' };
+  } else {
+    let token = tokenFromStdin ? (await readStdin()).trim() : process.env.LAMASTE_REGISTRY_TOKEN;
+    if (!token) {
+      throw new Error(
+        'No token: use --oidc, set LAMASTE_REGISTRY_TOKEN, or pipe a token in with --token-stdin (e.g. from `feria-server token bootstrap`)',
+      );
+    }
+    token = token.trim();
+    auth = { kind: 'token', token };
+  }
+
+  const result = await panelRequest('PUT', '/api/registry-credential', {
+    registryUrl: url,
+    auth,
+  });
+  if (result.error) throw new Error(result.error);
+  if (json) {
+    emit(result);
+    return;
+  }
+  console.log(
+    `${chalk.green('✓')} Registry credential configured for ${result.registryUrl} as ${result.owner ?? '(unknown)'}` +
+      (result.auth === 'oidc' ? ` (Authelia client ${result.clientId})` : ''),
+  );
+}
+
+async function clear({ json }) {
+  const result = await panelRequest('DELETE', '/api/registry-credential');
+  if (json) {
+    emit(result);
+    return;
+  }
+  console.log(
+    result.removed
+      ? `${chalk.green('✓')} Registry credential removed`
+      : chalk.dim('Nothing to remove.'),
+  );
+}
+
+function readStdin() {
+  return new Promise((resolve, reject) => {
+    let data = '';
+    process.stdin.setEncoding('utf-8');
+    process.stdin.on('data', (chunk) => (data += chunk));
+    process.stdin.on('end', () => resolve(data));
+    process.stdin.on('error', reject);
+  });
+}