@lamalibre/create-lamaste 4.0.0

package/vendor/serverd/src/lib/push-install.js

@@ -0,0 +1,390 @@
+import { readFile, writeFile, rename, open } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import path from 'node:path';
+import { loadAgentRegistry, saveAgentRegistry, withRegistryLock } from './mtls.js';
+import { isIpAllowed } from './ip-utils.js';
+
+const STATE_DIR = process.env.LAMALIBRE_LAMASTE_STATE_DIR || '/etc/lamalibre/lamaste';
+
+// Promise-chain mutex to serialize push install modifications
+let pushInstallLock = Promise.resolve();
+function withPushInstallLock(fn) {
+  const prev = pushInstallLock;
+  let resolve;
+  pushInstallLock = new Promise((r) => {
+    resolve = r;
+  });
+  return prev.then(fn).finally(resolve);
+}
+
+// --- Push install config ---
+
+function pushInstallConfigPath() {
+  return path.join(STATE_DIR, 'push-install-config.json');
+}
+
+const DEFAULT_POLICY = {
+  id: 'default',
+  name: 'Default',
+  description: 'Standard push install policy',
+  allowedIps: [],
+  deniedIps: [],
+  allowedPlugins: [],
+  allowedActions: ['install', 'update', 'check-prerequisites'],
+};
+
+const DEFAULT_PUSH_INSTALL_CONFIG = {
+  enabled: false,
+  policies: [structuredClone(DEFAULT_POLICY)],
+  defaultPolicy: 'default',
+};
+
+/**
+ * Read push install configuration from disk.
+ * Returns defaults if the file does not exist.
+ */
+export async function readPushInstallConfig() {
+  try {
+    const raw = await readFile(pushInstallConfigPath(), 'utf-8');
+    const parsed = JSON.parse(raw);
+
+    return {
+      enabled: parsed.enabled ?? false,
+      policies: Array.isArray(parsed.policies)
+        ? parsed.policies
+        : [structuredClone(DEFAULT_POLICY)],
+      defaultPolicy: parsed.defaultPolicy || 'default',
+    };
+  } catch (err) {
+    if (err.code === 'ENOENT') {
+      return structuredClone(DEFAULT_PUSH_INSTALL_CONFIG);
+    }
+    throw new Error(`Failed to read push install config: ${err.message}`);
+  }
+}
+
+/**
+ * Write push install configuration to disk atomically.
+ */
+export async function writePushInstallConfig(config) {
+  const filePath = pushInstallConfigPath();
+  const tmpPath = `${filePath}.tmp`;
+
+  const content = JSON.stringify(config, null, 2) + '\n';
+  await writeFile(tmpPath, content, { encoding: 'utf-8', mode: 0o600 });
+
+  const fd = await open(tmpPath, 'r');
+  await fd.sync();
+  await fd.close();
+
+  await rename(tmpPath, filePath);
+}
+
+// --- Push install sessions audit log ---
+
+function pushInstallSessionsPath() {
+  return path.join(STATE_DIR, 'push-install-sessions.json');
+}
+
+/**
+ * Read the push install sessions audit log.
+ */
+export async function readPushInstallSessions() {
+  try {
+    const raw = await readFile(pushInstallSessionsPath(), 'utf-8');
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed) ? parsed : [];
+  } catch (err) {
+    if (err.code === 'ENOENT') {
+      return [];
+    }
+    throw new Error(`Failed to read push install sessions: ${err.message}`);
+  }
+}
+
+/**
+ * Write the push install sessions audit log atomically.
+ */
+async function writePushInstallSessions(sessions) {
+  const filePath = pushInstallSessionsPath();
+  const tmpPath = `${filePath}.tmp`;
+
+  const content = JSON.stringify(sessions, null, 2) + '\n';
+  await writeFile(tmpPath, content, { encoding: 'utf-8', mode: 0o600 });
+
+  const fd = await open(tmpPath, 'r');
+  await fd.sync();
+  await fd.close();
+
+  await rename(tmpPath, filePath);
+}
+
+/**
+ * Add a session entry to the push install audit log.
+ * Wrapped in withPushInstallLock to prevent concurrent read-modify-write races.
+ */
+export function logPushInstallSession(entry) {
+  return withPushInstallLock(async () => {
+    const sessions = await readPushInstallSessions();
+    sessions.push({
+      id: randomUUID(),
+      ...entry,
+      timestamp: new Date().toISOString(),
+    });
+    // Keep last 500 entries
+    if (sessions.length > 500) {
+      sessions.splice(0, sessions.length - 500);
+    }
+    await writePushInstallSessions(sessions);
+    return sessions[sessions.length - 1];
+  });
+}
+
+/**
+ * Atomically update push install configuration fields.
+ * Serialized through the lock to prevent lost updates.
+ *
+ * @param {{ enabled?: boolean, defaultPolicy?: string }} updates
+ * @returns {Promise<object>} The updated config
+ */
+export function updatePushInstallConfigFields(updates) {
+  return withPushInstallLock(async () => {
+    const config = await readPushInstallConfig();
+
+    if (updates.enabled !== undefined) {
+      config.enabled = updates.enabled;
+    }
+
+    if (updates.defaultPolicy !== undefined) {
+      const policy = config.policies.find((p) => p.id === updates.defaultPolicy);
+      if (!policy) {
+        throw Object.assign(new Error(`Policy "${updates.defaultPolicy}" not found`), {
+          statusCode: 400,
+        });
+      }
+      config.defaultPolicy = updates.defaultPolicy;
+    }
+
+    await writePushInstallConfig(config);
+    return config;
+  });
+}
+
+// --- Policy CRUD ---
+
+/**
+ * Slugify a policy name to generate an ID.
+ */
+function slugifyPolicyName(name) {
+  return name
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-|-$/g, '');
+}
+
+/**
+ * Create a new push install policy.
+ */
+export function createPushInstallPolicy(policyData) {
+  return withPushInstallLock(async () => {
+    const config = await readPushInstallConfig();
+    const id = policyData.id || slugifyPolicyName(policyData.name);
+
+    if (!id) {
+      throw Object.assign(new Error('Policy name cannot be empty'), { statusCode: 400 });
+    }
+
+    const existing = config.policies.find((p) => p.id === id);
+    if (existing) {
+      throw Object.assign(new Error(`Policy "${id}" already exists`), { statusCode: 409 });
+    }
+
+    const policy = {
+      ...structuredClone(DEFAULT_POLICY),
+      ...policyData,
+      id,
+    };
+
+    config.policies.push(policy);
+    await writePushInstallConfig(config);
+
+    return policy;
+  });
+}
+
+/**
+ * Update an existing push install policy.
+ */
+export function updatePushInstallPolicy(id, updates) {
+  return withPushInstallLock(async () => {
+    const config = await readPushInstallConfig();
+    const policy = config.policies.find((p) => p.id === id);
+
+    if (!policy) {
+      throw Object.assign(new Error(`Policy "${id}" not found`), { statusCode: 404 });
+    }
+
+    // Apply updates (only defined fields)
+    if (updates.name !== undefined) policy.name = updates.name;
+    if (updates.description !== undefined) policy.description = updates.description;
+    if (updates.allowedIps !== undefined) policy.allowedIps = updates.allowedIps;
+    if (updates.deniedIps !== undefined) policy.deniedIps = updates.deniedIps;
+    if (updates.allowedPlugins !== undefined) policy.allowedPlugins = updates.allowedPlugins;
+    if (updates.allowedActions !== undefined) policy.allowedActions = updates.allowedActions;
+
+    await writePushInstallConfig(config);
+    return policy;
+  });
+}
+
+/**
+ * Delete a push install policy.
+ */
+export function deletePushInstallPolicy(id) {
+  return withPushInstallLock(async () => {
+    const config = await readPushInstallConfig();
+
+    if (id === 'default') {
+      throw Object.assign(new Error('Cannot delete the default policy'), { statusCode: 400 });
+    }
+
+    const index = config.policies.findIndex((p) => p.id === id);
+    if (index === -1) {
+      throw Object.assign(new Error(`Policy "${id}" not found`), { statusCode: 404 });
+    }
+
+    config.policies.splice(index, 1);
+
+    // If defaultPolicy was the deleted one, reset to 'default'
+    if (config.defaultPolicy === id) {
+      config.defaultPolicy = 'default';
+    }
+
+    await writePushInstallConfig(config);
+    return { ok: true, id };
+  });
+}
+
+// --- Agent push install access management ---
+
+/**
+ * Enable push install access for an agent certificate.
+ * Sets `pushInstallEnabledUntil` and `pushInstallPolicy` on the agent registry entry.
+ *
+ * @param {string} label - Agent label
+ * @param {number} durationMinutes - Session window length in minutes
+ * @param {string} [policyId] - Policy ID to assign (defaults to config's defaultPolicy)
+ */
+export async function enableAgentPushInstall(label, durationMinutes, policyId) {
+  // Read push-install config under its own lock
+  const config = await withPushInstallLock(() => readPushInstallConfig());
+
+  if (!config.enabled) {
+    throw Object.assign(new Error('Push install is not enabled globally'), { statusCode: 400 });
+  }
+
+  // Resolve which policy to assign
+  const resolvedPolicyId = policyId || config.defaultPolicy;
+  const policy = config.policies.find((p) => p.id === resolvedPolicyId);
+  if (!policy) {
+    throw Object.assign(new Error(`Policy "${resolvedPolicyId}" not found`), { statusCode: 404 });
+  }
+
+  // Modify agent registry under the registry lock (shared with mtls.js)
+  return withRegistryLock(async () => {
+    const registry = await loadAgentRegistry();
+    const agent = registry.agents.find((a) => a.label === label && !a.revoked);
+
+    if (!agent) {
+      throw Object.assign(new Error(`Agent certificate "${label}" not found`), { statusCode: 404 });
+    }
+
+    const until = new Date(Date.now() + durationMinutes * 60 * 1000);
+    agent.pushInstallEnabledUntil = until.toISOString();
+    agent.pushInstallPolicy = resolvedPolicyId;
+    await saveAgentRegistry(registry);
+
+    return {
+      ok: true,
+      label,
+      pushInstallEnabledUntil: agent.pushInstallEnabledUntil,
+      pushInstallPolicy: agent.pushInstallPolicy,
+    };
+  });
+}
+
+/**
+ * Disable push install access for an agent certificate.
+ */
+export async function disableAgentPushInstall(label) {
+  // Modify agent registry under the registry lock (shared with mtls.js)
+  return withRegistryLock(async () => {
+    const registry = await loadAgentRegistry();
+    const agent = registry.agents.find((a) => a.label === label && !a.revoked);
+
+    if (!agent) {
+      throw Object.assign(new Error(`Agent certificate "${label}" not found`), { statusCode: 404 });
+    }
+
+    delete agent.pushInstallEnabledUntil;
+    delete agent.pushInstallPolicy;
+    await saveAgentRegistry(registry);
+
+    return { ok: true, label };
+  });
+}
+
+/**
+ * Run the 5-gate auth check for push install access to an agent.
+ *
+ * 1. Global push install enabled
+ * 2. Agent cert exists and is not revoked
+ * 3. Agent pushInstallEnabledUntil is in the future
+ * 4. Source IP passes the agent's assigned policy allow/deny lists
+ * 5. (Caller is admin — enforced by route preHandler, not checked here)
+ *
+ * @param {string} label - Agent label
+ * @param {string} sourceIp - Requesting client's IP address
+ * @returns {Promise<{ ok: true, agent: object, config: object, policy: object } | { ok: false, error: string, statusCode: number }>}
+ */
+export async function validatePushInstallAccess(label, sourceIp) {
+  // Gate 1: Global push install enabled
+  const config = await readPushInstallConfig();
+  if (!config.enabled) {
+    return { ok: false, error: 'Push install is not enabled globally', statusCode: 400 };
+  }
+
+  // Gate 2: Agent cert exists and is not revoked
+  const registry = await loadAgentRegistry();
+  const agent = registry.agents.find((a) => a.label === label && !a.revoked);
+  if (!agent) {
+    return { ok: false, error: `Agent certificate "${label}" not found`, statusCode: 404 };
+  }
+
+  // Gate 3: Agent pushInstallEnabledUntil is in the future
+  if (!agent.pushInstallEnabledUntil || new Date(agent.pushInstallEnabledUntil) <= new Date()) {
+    return {
+      ok: false,
+      error: `Push install access not enabled for agent "${label}"`,
+      statusCode: 403,
+    };
+  }
+
+  // Resolve the agent's assigned policy
+  const policyId = agent.pushInstallPolicy || config.defaultPolicy;
+  const policy = config.policies.find((p) => p.id === policyId);
+  if (!policy) {
+    return {
+      ok: false,
+      error: `Policy "${policyId}" not found in push install configuration`,
+      statusCode: 500,
+    };
+  }
+
+  // Gate 4: Source IP passes the policy's allow/deny lists
+  if (!isIpAllowed(sourceIp, policy.allowedIps, policy.deniedIps)) {
+    return { ok: false, error: 'Source IP is not allowed', statusCode: 403 };
+  }
+
+  return { ok: true, agent, config, policy };
+}

package/vendor/serverd/src/lib/revocation.js

@@ -0,0 +1,112 @@
+/**
+ * Certificate revocation list (CRL) management.
+ *
+ * Backed by SQLite (`state.db`, table `revoked_certs`) per
+ * docs/decisions/sqlite-migration.md §3d. The companion `agents` table
+ * created by `0004_agents.sql` is owned by `lib/mtls.js`.
+ *
+ * Hot path: the mTLS middleware calls `isRevoked(serial)` on every
+ * authenticated request — a single indexed `SELECT serial FROM revoked_certs`
+ * materialising the `Set<serial>` the caller expects. No in-memory cache.
+ */
+import { getStateDb } from './state-db.js';
+
+// --- SQLite prepared-statement bundle (lazy init) ---
+
+let stmts = null;
+
+async function getStmts() {
+  if (stmts) return stmts;
+
+  const db = await getStateDb();
+
+  stmts = {
+    db,
+
+    selectAll: db.prepare('SELECT * FROM revoked_certs'),
+    selectSerials: db.prepare('SELECT serial FROM revoked_certs'),
+    selectBySerial: db.prepare('SELECT serial FROM revoked_certs WHERE serial = ?'),
+    insert: db.prepare('INSERT INTO revoked_certs (serial, label, revoked_at) VALUES (?, ?, ?)'),
+    deleteBySerial: db.prepare('DELETE FROM revoked_certs WHERE serial = ?'),
+
+    begin: db.prepare('BEGIN IMMEDIATE'),
+    commit: db.prepare('COMMIT'),
+    rollback: db.prepare('ROLLBACK'),
+  };
+
+  return stmts;
+}
+
+/**
+ * Load the revocation list and return a Set of revoked serial numbers.
+ *
+ * The Set<serial> shape is what the mTLS middleware's hot-path lookup
+ * expects.
+ *
+ * @returns {Promise<Set<string>>} Set of revoked certificate serial numbers.
+ */
+export async function loadRevocationList() {
+  const s = await getStmts();
+  const rows = s.selectSerials.all();
+  return new Set(rows.map((r) => r.serial));
+}
+
+/**
+ * Add a certificate serial to the revocation list.
+ *
+ * Duplicate serials are silently skipped (idempotent). The check runs with
+ * a SELECT inside the BEGIN IMMEDIATE so concurrent callers cannot race
+ * past it.
+ *
+ * @param {string} serial - The certificate serial number to revoke.
+ * @param {string} label - A human-readable label for the revoked certificate.
+ */
+export async function addToRevocationList(serial, label) {
+  const s = await getStmts();
+  const revokedAt = new Date().toISOString();
+
+  s.begin.run();
+  try {
+    const existing = s.selectBySerial.get(serial);
+    if (!existing) {
+      s.insert.run(serial, label, revokedAt);
+    }
+    s.commit.run();
+  } catch (err) {
+    s.rollback.run();
+    throw err;
+  }
+}
+
+/**
+ * Remove a certificate serial from the revocation list.
+ *
+ * @param {string} serial - The certificate serial number to un-revoke.
+ */
+export async function removeFromRevocationList(serial) {
+  const s = await getStmts();
+
+  s.begin.run();
+  try {
+    s.deleteBySerial.run(serial);
+    s.commit.run();
+  } catch (err) {
+    s.rollback.run();
+    throw err;
+  }
+}
+
+/**
+ * Check if a certificate serial is in the revocation list.
+ *
+ * Hot-path call from the mTLS middleware on every authenticated request.
+ * Uses an indexed primary-key lookup — O(log N) on the SQLite B-tree.
+ *
+ * @param {string} serial - The certificate serial number to check.
+ * @returns {Promise<boolean>} True if the serial is revoked.
+ */
+export async function isRevoked(serial) {
+  const s = await getStmts();
+  const row = s.selectBySerial.get(serial);
+  return row !== undefined;
+}

package/vendor/serverd/src/lib/services.js

@@ -0,0 +1,131 @@
+import { execa } from 'execa';
+
+export const ALLOWED_SERVICES = ['nginx', 'chisel', 'authelia', 'lamalibre-lamaste-serverd'];
+
+const ALLOWED_ACTIONS = ['start', 'stop', 'restart', 'reload'];
+
+/** Services whose unit supports `reload` (and has a sudoers rule for it). */
+const RELOADABLE_SERVICES = ['nginx', 'authelia'];
+
+/**
+ * Format a duration in milliseconds to a human-readable string like "2d 5h 30m".
+ */
+function formatDuration(ms) {
+  if (ms <= 0) return '0s';
+
+  const seconds = Math.floor(ms / 1000);
+  const days = Math.floor(seconds / 86400);
+  const hours = Math.floor((seconds % 86400) / 3600);
+  const minutes = Math.floor((seconds % 3600) / 60);
+  const secs = seconds % 60;
+
+  const parts = [];
+  if (days > 0) parts.push(`${days}d`);
+  if (hours > 0) parts.push(`${hours}h`);
+  if (minutes > 0) parts.push(`${minutes}m`);
+  if (parts.length === 0) parts.push(`${secs}s`);
+
+  return parts.join(' ');
+}
+
+/**
+ * Query the status and uptime of a single service.
+ */
+async function getServiceStatus(name) {
+  try {
+    const { stdout: statusOut } = await execa('systemctl', ['is-active', name]);
+    const status = statusOut.trim();
+
+    let uptime = null;
+    if (status === 'active') {
+      try {
+        const { stdout: timestampOut } = await execa('systemctl', [
+          'show',
+          name,
+          '--property=ActiveEnterTimestamp',
+        ]);
+        // Output looks like: ActiveEnterTimestamp=Thu 2024-03-14 10:30:45 UTC
+        const match = timestampOut.match(/=(.+)$/);
+        if (match && match[1]) {
+          const activeEnter = new Date(match[1]);
+          if (!Number.isNaN(activeEnter.getTime())) {
+            uptime = formatDuration(Date.now() - activeEnter.getTime());
+          }
+        }
+      } catch {
+        // If we can't get uptime, that's not fatal
+      }
+    }
+
+    return { name, status, uptime };
+  } catch {
+    // Service not installed or systemctl failed for this service
+    // Check the exit code to distinguish inactive vs failed vs unknown
+    try {
+      const { stdout } = await execa('systemctl', ['is-active', name], {
+        reject: false,
+      });
+      const status = stdout.trim();
+      if (status === 'inactive' || status === 'failed') {
+        return { name, status, uptime: null };
+      }
+    } catch {
+      // Fall through to unknown
+    }
+    return { name, status: 'unknown', uptime: null };
+  }
+}
+
+/**
+ * Retrieve status and uptime of all managed services in parallel.
+ */
+export async function getAllServiceStatuses() {
+  const results = await Promise.all(ALLOWED_SERVICES.map(getServiceStatus));
+  return results;
+}
+
+/**
+ * Validate a service name against the allowlist.
+ */
+export function isAllowedService(name) {
+  return ALLOWED_SERVICES.includes(name);
+}
+
+/**
+ * Validate an action against the allowlist.
+ */
+export function isAllowedAction(action) {
+  return ALLOWED_ACTIONS.includes(action);
+}
+
+/**
+ * Execute a systemctl action on a managed service.
+ * Returns { ok: true, name, action } on success.
+ * Throws with a descriptive error on failure.
+ */
+export async function executeServiceAction(name, action) {
+  // Safety: cannot stop the panel from the UI
+  if (name === 'lamalibre-lamaste-serverd' && action === 'stop') {
+    const err = new Error(
+      'Cannot stop the panel service from the UI — it would terminate this session',
+    );
+    err.statusCode = 400;
+    throw err;
+  }
+  if (action === 'reload' && !RELOADABLE_SERVICES.includes(name)) {
+    const err = new Error(`${name} does not support reload — use restart`);
+    err.statusCode = 400;
+    throw err;
+  }
+
+  try {
+    await execa('sudo', ['systemctl', action, name], { timeout: 30_000 });
+    return { ok: true, name, action };
+  } catch (err) {
+    const details = err.stderr || err.message;
+    const error = new Error(`Failed to ${action} ${name}`);
+    error.statusCode = 500;
+    error.details = details;
+    throw error;
+  }
+}