@lamalibre/create-lamaste 4.0.0

package/vendor/gatekeeper/dist/server/routes/grants.js

@@ -0,0 +1,112 @@
+import { z } from 'zod';
+import { createGrant, listGrants, getGrant, revokeGrant, removeGrantsByPrincipal, } from '../../lib/grants.js';
+const CreateGrantSchema = z.object({
+    principalType: z.enum(['user', 'group']),
+    principalId: z.string().min(1).max(100),
+    resourceType: z.string().min(1).max(100),
+    resourceId: z.string().min(1).max(500),
+    context: z.record(z.unknown()).optional().default({}),
+});
+export async function grantRoutes(fastify) {
+    // POST /api/grants — create grant
+    fastify.post('/grants', async (request, reply) => {
+        let body;
+        try {
+            body = CreateGrantSchema.parse(request.body);
+        }
+        catch (err) {
+            return reply
+                .code(400)
+                .send({ error: 'Invalid request body', details: err.errors });
+        }
+        try {
+            const grant = await createGrant(body);
+            return reply.code(201).send({ ok: true, grant });
+        }
+        catch (err) {
+            const e = err;
+            return reply.code(e.statusCode ?? 500).send({ error: e.message });
+        }
+    });
+    // GET /api/grants — list grants (with optional query filters)
+    fastify.get('/grants', async (request, reply) => {
+        const query = request.query;
+        const filter = {};
+        if (query.principalType === 'user' || query.principalType === 'group') {
+            filter.principalType = query.principalType;
+        }
+        if (query.principalId) {
+            filter.principalId = query.principalId;
+        }
+        if (query.resourceType) {
+            filter.resourceType = query.resourceType;
+        }
+        if (query.resourceId) {
+            filter.resourceId = query.resourceId;
+        }
+        if (query.used === 'true' || query.used === 'false') {
+            filter.used = query.used === 'true';
+        }
+        try {
+            const grants = await listGrants(Object.keys(filter).length > 0 ? filter : undefined);
+            return { grants };
+        }
+        catch (err) {
+            return reply.code(500).send({ error: err.message });
+        }
+    });
+    // GET /api/grants/:grantId — get grant
+    fastify.get('/grants/:grantId', async (request, reply) => {
+        const { grantId } = request.params;
+        try {
+            const grant = await getGrant(grantId);
+            if (!grant) {
+                return reply.code(404).send({ error: 'Grant not found' });
+            }
+            return { grant };
+        }
+        catch (err) {
+            return reply.code(500).send({ error: err.message });
+        }
+    });
+    // DELETE /api/grants/:grantId — revoke grant
+    fastify.delete('/grants/:grantId', async (request, reply) => {
+        const { grantId } = request.params;
+        try {
+            const grant = await revokeGrant(grantId);
+            return { ok: true, grant };
+        }
+        catch (err) {
+            const e = err;
+            return reply.code(e.statusCode ?? 500).send({ error: e.message });
+        }
+    });
+    // DELETE /api/grants?principalType=user&principalId=<x> —
+    // bulk-revoke every grant belonging to a principal. Used by the panel
+    // server to cascade Authelia user deletions across gatekeeper grants
+    // (and could be used for group hard-deletes in the future).
+    fastify.delete('/grants', async (request, reply) => {
+        const query = request.query;
+        const principalType = query.principalType;
+        const principalId = query.principalId;
+        if (principalType !== 'user' && principalType !== 'group') {
+            return reply.code(400).send({
+                error: 'principalType query parameter must be "user" or "group"',
+            });
+        }
+        if (!principalId || principalId.length === 0 || principalId.length > 100) {
+            return reply.code(400).send({
+                error: 'principalId query parameter is required (1-100 chars)',
+            });
+        }
+        try {
+            const removed = await removeGrantsByPrincipal(principalType, principalId);
+            return { ok: true, removed };
+        }
+        catch (err) {
+            const e = err;
+            return reply.code(e.statusCode ?? 500).send({ error: e.message });
+        }
+    });
+}
+//# sourceMappingURL=grants.js.map

package/vendor/gatekeeper/dist/server/routes/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../../src/server/routes/grants.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAG7B,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAwB;IACxD,kCAAkC;IAClC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC7E,IAAI,IAAuC,CAAC;QAC5C,IAAI,CAAC;YACH,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAG,GAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;YACtC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAAsC,CAAC;YACjD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,8DAA8D;IAC9D,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2C,CAAC;QAElE,MAAM,MAAM,GAAgB,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,aAAa,KAAK,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;YACrE,MAAkC,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;QAC1E,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACrB,MAAkC,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACtE,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACtB,MAAkC,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACxE,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACpB,MAAkC,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACpE,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACnD,MAAkC,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC;QACnE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACrF,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,uCAAuC;IACvC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrF,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAA6B,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6CAA6C;IAC7C,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACxF,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAA6B,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YACzC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAAsC,CAAC;YACjD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0DAA0D;IAC1D,sEAAsE;IACtE,qEAAqE;IACrE,4DAA4D;IAC5D,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC/E,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2C,CAAC;QAClE,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;QAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QAEtC,IAAI,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,yDAAyD;aACjE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACzE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,uDAAuD;aAC/D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;YAC1E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAAsC,CAAC;YACjD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/vendor/gatekeeper/dist/server/routes/groups.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from 'fastify';
+export declare function groupRoutes(fastify: FastifyInstance): Promise<void>;
+//# sourceMappingURL=groups.d.ts.map

package/vendor/gatekeeper/dist/server/routes/groups.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"groups.d.ts","sourceRoot":"","sources":["../../../src/server/routes/groups.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAoC7E,wBAAsB,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAoHzE"}

package/vendor/gatekeeper/dist/server/routes/groups.js

@@ -0,0 +1,139 @@
+import { z } from 'zod';
+import { createGroup, listGroups, getGroup, updateGroup, deleteGroup, addMembers, removeMembers, } from '../../lib/groups.js';
+const CreateGroupSchema = z.object({
+    name: z
+        .string()
+        .min(2)
+        .max(63)
+        .regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/),
+    description: z.string().max(500).optional().default(''),
+    createdBy: z.string().max(100).optional(),
+});
+const UpdateGroupSchema = z.object({
+    name: z
+        .string()
+        .min(2)
+        .max(63)
+        .regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/)
+        .optional(),
+    description: z.string().max(500).optional(),
+});
+const AddMembersSchema = z.object({
+    usernames: z.array(z.string().min(1).max(100)).min(1).max(50),
+});
+export async function groupRoutes(fastify) {
+    // POST /api/groups — create group
+    fastify.post('/groups', async (request, reply) => {
+        let body;
+        try {
+            body = CreateGroupSchema.parse(request.body);
+        }
+        catch (err) {
+            return reply
+                .code(400)
+                .send({ error: 'Invalid request body', details: err.errors });
+        }
+        try {
+            const group = await createGroup(body.name, {
+                description: body.description,
+                createdBy: body.createdBy,
+            });
+            return reply.code(201).send({ ok: true, group });
+        }
+        catch (err) {
+            const e = err;
+            return reply.code(e.statusCode ?? 500).send({ error: e.message });
+        }
+    });
+    // GET /api/groups — list all groups
+    fastify.get('/groups', async (_request, reply) => {
+        try {
+            const groups = await listGroups();
+            return { groups };
+        }
+        catch (err) {
+            return reply.code(500).send({ error: err.message });
+        }
+    });
+    // GET /api/groups/:name — get group
+    fastify.get('/groups/:name', async (request, reply) => {
+        const { name } = request.params;
+        try {
+            const group = await getGroup(name);
+            if (!group) {
+                return reply.code(404).send({ error: `Group "${name}" not found` });
+            }
+            return { group };
+        }
+        catch (err) {
+            return reply.code(500).send({ error: err.message });
+        }
+    });
+    // PATCH /api/groups/:name — update group
+    fastify.patch('/groups/:name', async (request, reply) => {
+        const { name } = request.params;
+        let body;
+        try {
+            body = UpdateGroupSchema.parse(request.body);
+        }
+        catch (err) {
+            return reply
+                .code(400)
+                .send({ error: 'Invalid request body', details: err.errors });
+        }
+        try {
+            const group = await updateGroup(name, body);
+            return { ok: true, group };
+        }
+        catch (err) {
+            const e = err;
+            return reply.code(e.statusCode ?? 500).send({ error: e.message });
+        }
+    });
+    // DELETE /api/groups/:name — delete group + auto-revoke grants
+    fastify.delete('/groups/:name', async (request, reply) => {
+        const { name } = request.params;
+        try {
+            const result = await deleteGroup(name);
+            return { ok: true, deletedGrants: result.deletedGrants };
+        }
+        catch (err) {
+            const e = err;
+            return reply.code(e.statusCode ?? 500).send({ error: e.message });
+        }
+    });
+    // POST /api/groups/:name/members — add members
+    fastify.post('/groups/:name/members', async (request, reply) => {
+        const { name } = request.params;
+        let body;
+        try {
+            body = AddMembersSchema.parse(request.body);
+        }
+        catch (err) {
+            return reply
+                .code(400)
+                .send({ error: 'Invalid request body', details: err.errors });
+        }
+        try {
+            const group = await addMembers(name, body.usernames);
+            return { ok: true, group };
+        }
+        catch (err) {
+            const e = err;
+            return reply.code(e.statusCode ?? 500).send({ error: e.message });
+        }
+    });
+    // DELETE /api/groups/:name/members/:username — remove member
+    fastify.delete('/groups/:name/members/:username', async (request, reply) => {
+        const { name, username } = request.params;
+        try {
+            const group = await removeMembers(name, [username]);
+            return { ok: true, group };
+        }
+        catch (err) {
+            const e = err;
+            return reply.code(e.statusCode ?? 500).send({ error: e.message });
+        }
+    });
+}
+//# sourceMappingURL=groups.js.map

package/vendor/gatekeeper/dist/server/routes/groups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groups.js","sourceRoot":"","sources":["../../../src/server/routes/groups.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,GACd,MAAM,qBAAqB,CAAC;AAE7B,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,KAAK,CAAC,iCAAiC,CAAC;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,KAAK,CAAC,iCAAiC,CAAC;SACxC,QAAQ,EAAE;IACb,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAC9D,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAwB;IACxD,kCAAkC;IAClC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC7E,IAAI,IAAuC,CAAC;QAC5C,IAAI,CAAC;YACH,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAG,GAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE;gBACzC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAAsC,CAAC;YACjD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,oCAAoC;IACpC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,QAAwB,EAAE,KAAmB,EAAE,EAAE;QAC7E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,oCAAoC;IACpC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAClF,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAA0B,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,IAAI,aAAa,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,yCAAyC;IACzC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACpF,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAA0B,CAAC;QACpD,IAAI,IAAuC,CAAC;QAC5C,IAAI,CAAC;YACH,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAG,GAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAAsC,CAAC;YACjD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAC/D,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrF,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAA0B,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;YACvC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAAsC,CAAC;YACjD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,+CAA+C;IAC/C,OAAO,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC3F,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAA0B,CAAC;QACpD,IAAI,IAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAG,GAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAAsC,CAAC;YACjD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6DAA6D;IAC7D,OAAO,CAAC,MAAM,CACZ,iCAAiC,EACjC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAA4C,CAAC;QAChF,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAAsC,CAAC;YACjD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/vendor/gatekeeper/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@lamalibre/lamaste-gatekeeper",
+  "version": "4.0.0",
+  "description": "Authorization layer for Lamaste — groups, grants, and tunnel access control",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./server": {
+      "types": "./dist/server/index.d.ts",
+      "import": "./dist/server/index.js"
+    },
+    "./cli": {
+      "types": "./dist/cli/index.d.ts",
+      "import": "./dist/cli/index.js"
+    }
+  },
+  "bin": {
+    "lamaste-gatekeeper": "dist/cli/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json && cp -R src/lib/migrations dist/lib/migrations"
+  },
+  "engines": {
+    "node": ">=22.5.0 <25.0.0"
+  },
+  "dependencies": {
+    "@fastify/rate-limit": "^10.3.0",
+    "@lamalibre/lamaste": "*",
+    "fastify": "^5.3.3",
+    "undici": "^7.8.0",
+    "zod": "^3.24.4"
+  },
+  "devDependencies": {
+    "@types/node": "^22.15.18",
+    "typescript": "^5.8.3"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/lamalibre/lamaste.git",
+    "directory": "packages/sdks/gatekeeper"
+  },
+  "license": "SEE LICENSE IN LICENSE.md"
+}

package/vendor/server/bin/lamaste-server.js

@@ -0,0 +1,204 @@
+#!/usr/bin/env node
+
+/**
+ * lamaste-server — Server operations CLI for Lamaste.
+ *
+ * Provides administrative commands for managing a Lamaste server installation.
+ * All commands operate on /etc/lamalibre/lamaste/ and require root access on the server.
+ *
+ * Global flags:
+ *   --json    Output NDJSON for automation / desktop app integration
+ *
+ * Commands:
+ *   status        Server health, uptime, resource usage
+ *   logs          View server log output (journalctl)
+ *   restart       Restart panel server (and optionally gatekeeper)
+ *   plugins       Manage server-side plugins
+ *   tunnels       Manage tunnels
+ *   sites         Manage static sites
+ *   certs         Certificate status and renewal
+ *   reset-admin   Emergency admin authentication reset
+ *   uninstall     Full server teardown
+ */
+
+import chalk from 'chalk';
+
+/**
+ * Extract the --json global flag from argv.
+ * @param {string[]} rawArgs
+ * @returns {{ json: boolean, args: string[] }}
+ */
+function extractGlobalFlags(rawArgs) {
+  let json = false;
+  const filtered = [];
+  for (const arg of rawArgs) {
+    if (arg === '--json') {
+      json = true;
+    } else {
+      filtered.push(arg);
+    }
+  }
+  return { json, args: filtered };
+}
+
+function printHelp() {
+  const b = chalk.bold;
+  const c = chalk.cyan;
+  const d = chalk.dim;
+
+  console.log(`
+${b('lamaste-server')} — server operations CLI for Lamaste
+
+${b('USAGE')}
+
+  ${c('lamaste-server')} ${d('[--json] <command> [args]')}
+
+${b('COMMANDS')}
+
+  ${c('status')}          Server health, uptime, services, certificate status
+  ${c('logs')}            View server log output (journalctl wrapper)
+  ${c('restart')}         Restart panel server and optionally gatekeeper
+  ${c('plugins')}         Manage server-side plugins (list, install, enable, disable, uninstall)
+  ${c('tunnels')}         Manage tunnels (list, create, delete, toggle)
+  ${c('sites')}           Manage static sites (list, create, delete)
+  ${c('certs')}           Certificate status, renewal, and agent cert listing
+  ${c('reset-admin')}     Emergency admin reset (reverts to P12, clears 2FA)
+  ${c('chisel')}          Manage chisel tunnel-server credentials (rotate-credential)
+  ${c('uninstall')}       Full server teardown (requires confirmation)
+
+${b('GLOBAL FLAGS')}
+
+  ${c('--json')}          Output NDJSON for automation and desktop app integration
+
+${b('EXAMPLES')}
+
+  ${d('# Check server status')}
+  ${c('lamaste-server status')}
+
+  ${d('# View recent panel logs')}
+  ${c('lamaste-server logs --lines 100')}
+
+  ${d('# Follow logs in real time')}
+  ${c('lamaste-server logs --follow')}
+
+  ${d('# Restart the panel server')}
+  ${c('lamaste-server restart')}
+
+  ${d('# Restart both panel and gatekeeper')}
+  ${c('lamaste-server restart --all')}
+
+  ${d('# List installed plugins')}
+  ${c('lamaste-server plugins list')}
+
+  ${d('# Install a plugin')}
+  ${c('lamaste-server plugins install @lamalibre/herd-server')}
+
+  ${d('# List tunnels')}
+  ${c('lamaste-server tunnels list')}
+
+  ${d('# Create a tunnel')}
+  ${c('lamaste-server tunnels create --subdomain myapp --port 3000')}
+
+  ${d('# Check certificate status')}
+  ${c('lamaste-server certs status')}
+
+  ${d('# Emergency admin reset (run as root on server)')}
+  ${d('# The new P12 password is written to /etc/lamalibre/lamaste/pki/.p12-password (mode 0600).')}
+  ${d('# In TTY mode the password also prints to STDERR so you can redirect stdout safely.')}
+  ${d('# Optional: --password-file <path> writes the password to a custom location too.')}
+  ${c('sudo lamaste-server reset-admin')}
+
+  ${d('# Full server removal')}
+  ${c('sudo lamaste-server uninstall')}
+`);
+  process.exit(0);
+}
+
+async function main() {
+  const rawArgs = process.argv.slice(2);
+  const { json, args } = extractGlobalFlags(rawArgs);
+  const command = args[0];
+
+  if (!command || command === '--help' || command === '-h') {
+    printHelp();
+  }
+
+  switch (command) {
+    case 'status': {
+      const { runStatus } = await import('../src/commands/status.js');
+      await runStatus({ json });
+      break;
+    }
+    case 'logs': {
+      const { runLogs } = await import('../src/commands/logs.js');
+      await runLogs(args.slice(1), { json });
+      break;
+    }
+    case 'restart': {
+      const { runRestart } = await import('../src/commands/restart.js');
+      await runRestart(args.slice(1), { json });
+      break;
+    }
+    case 'plugins': {
+      const { runPlugins } = await import('../src/commands/plugins.js');
+      await runPlugins(args.slice(1), { json });
+      break;
+    }
+    case 'tunnels': {
+      const { runTunnels } = await import('../src/commands/tunnels.js');
+      await runTunnels(args.slice(1), { json });
+      break;
+    }
+    case 'sites': {
+      const { runSites } = await import('../src/commands/sites.js');
+      await runSites(args.slice(1), { json });
+      break;
+    }
+    case 'certs': {
+      const { runCerts } = await import('../src/commands/certs.js');
+      await runCerts(args.slice(1), { json });
+      break;
+    }
+    case 'reset-admin': {
+      const { runResetAdmin } = await import('../src/commands/reset-admin.js');
+      const subArgs = args.slice(1);
+      const pwIdx = subArgs.indexOf('--password-file');
+      let passwordFile;
+      if (pwIdx !== -1) {
+        passwordFile = subArgs[pwIdx + 1];
+        if (!passwordFile) {
+          console.error(`\n  Error: --password-file requires a path argument.\n`);
+          process.exit(1);
+        }
+      }
+      await runResetAdmin({ json, passwordFile });
+      break;
+    }
+    case 'chisel': {
+      const { runChisel } = await import('../src/commands/chisel.js');
+      await runChisel(args.slice(1), { json });
+      break;
+    }
+    case 'uninstall': {
+      const { runUninstall } = await import('../src/commands/uninstall.js');
+      await runUninstall(args.slice(1), { json });
+      break;
+    }
+    default:
+      if (json) {
+        process.stdout.write(
+          JSON.stringify({ event: 'error', message: `Unknown command: ${command}` }) + '\n',
+        );
+      } else {
+        console.error(`\n  Unknown command: ${chalk.red(command)}`);
+        console.error(`  Run ${chalk.cyan('lamaste-server --help')} for usage.\n`);
+      }
+      process.exit(1);
+  }
+}
+
+main().catch((err) => {
+  const msg = err instanceof Error ? err.message : String(err);
+  process.stderr.write(`\n  Fatal error: ${msg}\n\n`);
+  process.exit(1);
+});

package/vendor/server/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "@lamalibre/lamaste-server",
+  "version": "4.0.0",
+  "description": "Server operations CLI for Lamaste",
+  "type": "module",
+  "license": "SEE LICENSE IN LICENSE.md",
+  "author": "Code Lama Software",
+  "bin": {
+    "lamaste-server": "bin/lamaste-server.js"
+  },
+  "files": [
+    "bin",
+    "src"
+  ],
+  "scripts": {
+    "lint": "echo 'No lint configured'"
+  },
+  "dependencies": {
+    "@lamalibre/lamaste": "^4.0.0",
+    "chalk": "^5.3.0",
+    "execa": "^9.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/lamalibre/lamaste.git",
+    "directory": "packages/server/cli"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  }
+}