@lamalibre/create-lamaste 4.0.0

package/vendor/serverd/src/lib/session.js

@@ -0,0 +1,151 @@
+import crypto from 'node:crypto';
+import { getConfig, updateConfig } from './config.js';
+
+const SESSION_MAX_AGE = 12 * 60 * 60; // 12 hours in seconds
+const INACTIVITY_TIMEOUT = 2 * 60 * 60; // 2 hours in seconds
+const COOKIE_NAME = 'lamaste_2fa_session';
+const REFRESH_THRESHOLD = 60; // Only re-sign if lastActivity is older than 60s
+
+/**
+ * Standard cookie attributes for the 2FA session cookie.
+ * Used by the middleware (refresh), routes (set/clear), and exported for consistency.
+ */
+const COOKIE_OPTIONS = Object.freeze({
+  httpOnly: true,
+  secure: true,
+  sameSite: 'strict',
+  path: '/',
+});
+
+export { COOKIE_NAME, SESSION_MAX_AGE, COOKIE_OPTIONS, REFRESH_THRESHOLD };
+
+/**
+ * HMAC-sign a base64url payload string.
+ *
+ * @param {string} payloadB64 - Base64url-encoded payload
+ * @param {string} secretHex - Hex-encoded secret
+ * @returns {string} Base64url-encoded HMAC signature
+ */
+function signPayload(payloadB64, secretHex) {
+  return crypto
+    .createHmac('sha256', Buffer.from(secretHex, 'hex'))
+    .update(payloadB64)
+    .digest('base64url');
+}
+
+/**
+ * Create a signed session cookie value.
+ *
+ * @param {string} sessionSecret - Hex-encoded session secret
+ * @param {string} [certSerial] - Certificate serial number to bind session to
+ * @returns {{ value: string, maxAge: number }}
+ */
+export function createSessionCookie(sessionSecret, certSerial) {
+  const now = Math.floor(Date.now() / 1000);
+  const payload = {
+    iat: now,
+    exp: now + SESSION_MAX_AGE,
+    lastActivity: now,
+    ...(certSerial && { certSerial }),
+  };
+  const payloadB64 = Buffer.from(JSON.stringify(payload)).toString('base64url');
+  const sig = signPayload(payloadB64, sessionSecret);
+
+  return {
+    value: `${payloadB64}.${sig}`,
+    maxAge: SESSION_MAX_AGE,
+  };
+}
+
+/**
+ * Validate a session cookie value.
+ *
+ * @param {string} cookieValue - The cookie value (payload.sig)
+ * @param {string} sessionSecret - Hex-encoded session secret
+ * @param {string} [certSerial] - Certificate serial to verify against (if bound)
+ * @returns {{ valid: boolean, payload?: object, reason?: string }}
+ */
+export function validateSession(cookieValue, sessionSecret, certSerial) {
+  if (!cookieValue || typeof cookieValue !== 'string') {
+    return { valid: false, reason: 'missing' };
+  }
+
+  const dotIndex = cookieValue.indexOf('.');
+  if (dotIndex === -1) {
+    return { valid: false, reason: 'malformed' };
+  }
+
+  const payloadB64 = cookieValue.slice(0, dotIndex);
+  const sig = cookieValue.slice(dotIndex + 1);
+
+  const expectedSig = signPayload(payloadB64, sessionSecret);
+
+  // Timing-safe comparison
+  const sigBuf = Buffer.from(sig);
+  const expectedBuf = Buffer.from(expectedSig);
+  if (sigBuf.length !== expectedBuf.length || !crypto.timingSafeEqual(sigBuf, expectedBuf)) {
+    return { valid: false, reason: 'invalid_signature' };
+  }
+
+  let payload;
+  try {
+    payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString());
+  } catch {
+    return { valid: false, reason: 'parse_error' };
+  }
+
+  const now = Math.floor(Date.now() / 1000);
+
+  if (payload.exp && now > payload.exp) {
+    return { valid: false, reason: 'expired' };
+  }
+
+  if (payload.lastActivity && now - payload.lastActivity > INACTIVITY_TIMEOUT) {
+    return { valid: false, reason: 'inactive' };
+  }
+
+  // Verify certificate binding if present in session
+  if (payload.certSerial && certSerial && payload.certSerial !== certSerial) {
+    return { valid: false, reason: 'cert_mismatch' };
+  }
+
+  return { valid: true, payload };
+}
+
+/**
+ * Refresh a session by updating lastActivity and re-signing.
+ *
+ * @param {object} payload - The existing session payload
+ * @param {string} sessionSecret - Hex-encoded session secret
+ * @returns {{ value: string, maxAge: number }}
+ */
+export function refreshSession(payload, sessionSecret) {
+  const now = Math.floor(Date.now() / 1000);
+  const updated = { ...payload, lastActivity: now };
+  const payloadB64 = Buffer.from(JSON.stringify(updated)).toString('base64url');
+  const sig = signPayload(payloadB64, sessionSecret);
+
+  // Remaining time until absolute expiry
+  const remaining = Math.max(0, updated.exp - now);
+
+  return {
+    value: `${payloadB64}.${sig}`,
+    maxAge: remaining,
+  };
+}
+
+/**
+ * Ensure a sessionSecret exists in the config. If not, generate and persist one.
+ *
+ * @returns {Promise<string>} The session secret (hex)
+ */
+export async function ensureSessionSecret() {
+  const config = getConfig();
+  if (config.sessionSecret) {
+    return config.sessionSecret;
+  }
+
+  const secret = crypto.randomBytes(32).toString('hex');
+  await updateConfig({ sessionSecret: secret });
+  return secret;
+}

package/vendor/serverd/src/lib/state-db.js

@@ -0,0 +1,130 @@
+// Foundation for SQLite-backed state in lamaste-serverd. Owns the singleton
+// DB handle, PRAGMA tuning, file-permission tightening, and the forward-only
+// numbered-migrations runner. Domain modules consume this via `getStateDb()`
+// and never instantiate `DatabaseSync` themselves.
+
+import { chmod, readdir, readFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+const DATA_DIR_ENV = 'LAMALIBRE_LAMASTE_DATA_DIR';
+const DEFAULT_DATA_DIR = '/etc/lamalibre/lamaste';
+const STATE_DB_FILENAME = 'state.db';
+const STATE_MIGRATIONS_DIR = path.join(__dirname, 'migrations', 'state');
+
+const MIGRATION_FILENAME_RE = /^\d{4}_[a-z0-9_]+\.sql$/;
+
+let dbPromise = null;
+
+/**
+ * Returns the singleton `state.db` handle for lamaste-serverd. Lazy-opens on
+ * first call; subsequent calls return the cached handle. Safe to call
+ * concurrently from multiple modules at startup — the open is wrapped in a
+ * promise singleton so only one open ever races.
+ */
+export async function getStateDb() {
+  if (!dbPromise) {
+    const dataDir = process.env[DATA_DIR_ENV] || DEFAULT_DATA_DIR;
+    dbPromise = openManagedDb({
+      path: path.join(dataDir, STATE_DB_FILENAME),
+      migrationsDir: STATE_MIGRATIONS_DIR,
+    });
+  }
+  return dbPromise;
+}
+
+/**
+ * Apply every pending migration in `migrationsDir` against `db`. Idempotent —
+ * the second call is a no-op once `schema_migrations` has caught up. Each
+ * migration runs inside `BEGIN IMMEDIATE` … `COMMIT`; a failure rolls the
+ * statement back and rethrows with the migration filename in the message.
+ */
+export async function ensureMigrations(db, migrationsDir) {
+  db.exec(`CREATE TABLE IF NOT EXISTS schema_migrations (
+    id         INTEGER PRIMARY KEY,
+    name       TEXT NOT NULL UNIQUE,
+    applied_at TEXT NOT NULL
+  )`);
+
+  const applied = new Set(
+    db
+      .prepare('SELECT name FROM schema_migrations')
+      .all()
+      .map((r) => r.name),
+  );
+
+  let entries;
+  try {
+    entries = await readdir(migrationsDir);
+  } catch (err) {
+    if (err.code === 'ENOENT') return;
+    throw err;
+  }
+
+  const files = entries.filter((f) => MIGRATION_FILENAME_RE.test(f)).sort();
+
+  for (const file of files) {
+    if (applied.has(file)) continue;
+    const sql = await readFile(path.join(migrationsDir, file), 'utf-8');
+    const id = Number(file.slice(0, 4));
+
+    db.exec('BEGIN IMMEDIATE');
+    try {
+      db.exec(sql);
+      db.prepare('INSERT INTO schema_migrations (id, name, applied_at) VALUES (?, ?, ?)').run(
+        id,
+        file,
+        new Date().toISOString(),
+      );
+      db.exec('COMMIT');
+    } catch (err) {
+      db.exec('ROLLBACK');
+      throw new Error(`Migration ${file} failed: ${err.message}`);
+    }
+  }
+}
+
+/**
+ * Open `path`, apply PRAGMAs, tighten file modes, and run any pending
+ * migrations from `migrationsDir`. Single source of truth for DB lifecycle —
+ * `getStateDb()` is a thin wrapper that supplies serverd's path/migrations.
+ *
+ * `node:sqlite` is dynamically imported so `boot.js`'s `process.on('warning')`
+ * filter (installed during user-code evaluation) catches the
+ * ExperimentalWarning. A static import would emit it during ESM link.
+ */
+async function openManagedDb({ path: dbPath, migrationsDir }) {
+  const { DatabaseSync } = await import('node:sqlite');
+  const db = new DatabaseSync(dbPath);
+
+  // PRAGMA order matters: journal_mode must be set before any write that
+  // would lock the rollback journal. cache_size = -2048 caps the page cache
+  // at 2 MiB (negative = KiB). synchronous = NORMAL is safe with WAL and
+  // skips the per-commit fsync.
+  db.exec(`
+    PRAGMA journal_mode = WAL;
+    PRAGMA synchronous = NORMAL;
+    PRAGMA foreign_keys = ON;
+    PRAGMA cache_size = -2048;
+    PRAGMA temp_store = MEMORY;
+    PRAGMA busy_timeout = 5000;
+  `);
+
+  // 0o600 on the DB plus its WAL/SHM sidecars (which appear lazily on first
+  // write — guard with existsSync). Best-effort: a failure here is logged by
+  // the caller's surrounding context, not fatal.
+  try {
+    await chmod(dbPath, 0o600);
+    if (existsSync(`${dbPath}-wal`)) await chmod(`${dbPath}-wal`, 0o600);
+    if (existsSync(`${dbPath}-shm`)) await chmod(`${dbPath}-shm`, 0o600);
+  } catch {
+    // best-effort
+  }
+
+  await ensureMigrations(db, migrationsDir);
+
+  return db;
+}

package/vendor/serverd/src/lib/state.js

@@ -0,0 +1,140 @@
+import { readFile, writeFile, rename, open } from 'node:fs/promises';
+import path from 'node:path';
+
+const STATE_DIR = process.env.LAMALIBRE_LAMASTE_STATE_DIR || '/etc/lamalibre/lamaste';
+
+function tunnelsPath() {
+  return path.join(STATE_DIR, 'tunnels.json');
+}
+
+/**
+ * Read the tunnels array from tunnels.json.
+ * Returns an empty array if the file does not exist.
+ */
+export async function readTunnels() {
+  try {
+    const raw = await readFile(tunnelsPath(), 'utf-8');
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) {
+      return [];
+    }
+    return parsed;
+  } catch (err) {
+    if (err.code === 'ENOENT') {
+      return [];
+    }
+    throw new Error(`Failed to read tunnels state: ${err.message}`);
+  }
+}
+
+/**
+ * Write the tunnels array to tunnels.json atomically.
+ *
+ * 1. Write to a temp file in the same directory.
+ * 2. fsync the temp file.
+ * 3. Rename temp → tunnels.json (atomic on POSIX).
+ */
+export async function writeTunnels(tunnels) {
+  const filePath = tunnelsPath();
+  const tmpPath = `${filePath}.tmp`;
+
+  const content = JSON.stringify(tunnels, null, 2) + '\n';
+  await writeFile(tmpPath, content, { encoding: 'utf-8', mode: 0o600 });
+
+  // fsync the temp file to ensure data is flushed to disk
+  const fd = await open(tmpPath, 'r');
+  await fd.sync();
+  await fd.close();
+
+  await rename(tmpPath, filePath);
+}
+
+function sitesPath() {
+  return path.join(STATE_DIR, 'sites.json');
+}
+
+/**
+ * Read the sites array from sites.json.
+ * Returns an empty array if the file does not exist.
+ */
+export async function readSites() {
+  try {
+    const raw = await readFile(sitesPath(), 'utf-8');
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) {
+      return [];
+    }
+    return parsed;
+  } catch (err) {
+    if (err.code === 'ENOENT') {
+      return [];
+    }
+    throw new Error(`Failed to read sites state: ${err.message}`);
+  }
+}
+
+/**
+ * Write the sites array to sites.json atomically.
+ *
+ * 1. Write to a temp file in the same directory.
+ * 2. fsync the temp file.
+ * 3. Rename temp → sites.json (atomic on POSIX).
+ */
+export async function writeSites(sites) {
+  const filePath = sitesPath();
+  const tmpPath = `${filePath}.tmp`;
+
+  const content = JSON.stringify(sites, null, 2) + '\n';
+  await writeFile(tmpPath, content, { encoding: 'utf-8', mode: 0o600 });
+
+  const fd = await open(tmpPath, 'r');
+  await fd.sync();
+  await fd.close();
+
+  await rename(tmpPath, filePath);
+}
+
+function invitationsPath() {
+  return path.join(STATE_DIR, 'invitations.json');
+}
+
+/**
+ * Read the invitations array from invitations.json.
+ * Returns an empty array if the file does not exist.
+ */
+export async function readInvitations() {
+  try {
+    const raw = await readFile(invitationsPath(), 'utf-8');
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) {
+      return [];
+    }
+    return parsed;
+  } catch (err) {
+    if (err.code === 'ENOENT') {
+      return [];
+    }
+    throw new Error(`Failed to read invitations state: ${err.message}`);
+  }
+}
+
+/**
+ * Write the invitations array to invitations.json atomically.
+ *
+ * 1. Write to a temp file in the same directory.
+ * 2. fsync the temp file.
+ * 3. Rename temp → invitations.json (atomic on POSIX).
+ */
+export async function writeInvitations(invitations) {
+  const filePath = invitationsPath();
+  const tmpPath = `${filePath}.tmp`;
+
+  const content = JSON.stringify(invitations, null, 2) + '\n';
+  await writeFile(tmpPath, content, { encoding: 'utf-8', mode: 0o600 });
+
+  const fd = await open(tmpPath, 'r');
+  await fd.sync();
+  await fd.close();
+
+  await rename(tmpPath, filePath);
+}

package/vendor/serverd/src/lib/storage.js

@@ -0,0 +1,63 @@
+/**
+ * Shim — storage registry + credential encryption now lives in
+ * `@lamalibre/lamaste/server`. This file preserves the daemon-local API
+ * (no dataDir parameter) by resolving the data dir from env/config and
+ * forwarding to the core library.
+ */
+
+import {
+  encryptCredential as encryptCredentialCore,
+  decryptCredential as decryptCredentialCore,
+  registerStorageServer as registerStorageServerCore,
+  removeStorageServer as removeStorageServerCore,
+  listStorageServers as listStorageServersCore,
+  bindPluginStorage as bindPluginStorageCore,
+  unbindPluginStorage as unbindPluginStorageCore,
+  listBindings as listBindingsCore,
+  getBinding as getBindingCore,
+  getPluginStorageConfig as getPluginStorageConfigCore,
+} from '@lamalibre/lamaste/server';
+
+function dataDir() {
+  return process.env.LAMALIBRE_LAMASTE_STATE_DIR || '/etc/lamalibre/lamaste';
+}
+
+export function encryptCredential(plaintext) {
+  return encryptCredentialCore(plaintext, dataDir());
+}
+
+export function decryptCredential(packed) {
+  return decryptCredentialCore(packed, dataDir());
+}
+
+export function registerStorageServer(input) {
+  return registerStorageServerCore(dataDir(), input);
+}
+
+export function removeStorageServer(id) {
+  return removeStorageServerCore(dataDir(), id);
+}
+
+export function listStorageServers() {
+  return listStorageServersCore(dataDir());
+}
+
+export function bindPluginStorage(pluginName, storageServerId) {
+  return bindPluginStorageCore(dataDir(), pluginName, storageServerId);
+}
+
+export function unbindPluginStorage(pluginName) {
+  return unbindPluginStorageCore(dataDir(), pluginName);
+}
+
+export function listBindings() {
+  return listBindingsCore(dataDir());
+}
+
+export function getBinding(pluginName) {
+  return getBindingCore(dataDir(), pluginName);
+}
+
+export function getPluginStorageConfig(pluginName) {
+  return getPluginStorageConfigCore(dataDir(), pluginName);
+}

package/vendor/serverd/src/lib/system-stats.js

@@ -0,0 +1,58 @@
+import si from 'systeminformation';
+
+let cachedStats = null;
+let cacheTimestamp = 0;
+const CACHE_TTL_MS = 2000;
+
+/**
+ * Retrieve system stats with a 2-second cache to avoid
+ * hammering the system when multiple clients poll simultaneously.
+ */
+export async function getSystemStats(logger) {
+  const now = Date.now();
+
+  if (cachedStats && now - cacheTimestamp < CACHE_TTL_MS) {
+    return cachedStats;
+  }
+
+  try {
+    const [currentLoad, cpu, mem, fsSizes, time] = await Promise.all([
+      si.currentLoad(),
+      si.cpu(),
+      si.mem(),
+      si.fsSize(),
+      Promise.resolve(si.time()),
+    ]);
+
+    // Find root filesystem (or first available)
+    const rootFs = fsSizes.find((fs) => fs.mount === '/') || fsSizes[0] || {};
+
+    const stats = {
+      cpu: {
+        usage: Math.round(currentLoad.currentLoad * 10) / 10,
+        cores: cpu.cores,
+      },
+      memory: {
+        total: mem.total,
+        used: mem.active,
+        free: mem.available,
+      },
+      disk: {
+        total: rootFs.size || 0,
+        used: rootFs.used || 0,
+        free: (rootFs.size || 0) - (rootFs.used || 0),
+      },
+      uptime: time.uptime,
+    };
+
+    cachedStats = stats;
+    cacheTimestamp = now;
+
+    return stats;
+  } catch (err) {
+    if (logger) {
+      logger.error({ err }, 'Failed to retrieve system stats');
+    }
+    throw new Error('Failed to retrieve system stats');
+  }
+}