@lamalibre/create-lamaste 4.0.0

package/vendor/serverd/src/middleware/user-access-session.js

@@ -0,0 +1,52 @@
+import fp from 'fastify-plugin';
+import { getConfig } from '../lib/config.js';
+import {
+  REFRESH_THRESHOLD,
+  validateUserSession,
+  refreshUserSession,
+} from '../lib/user-access-session.js';
+
+/**
+ * Fastify plugin that validates user-access session tokens from the
+ * Authorization: Bearer header. Sets request.userAccessUsername on success.
+ *
+ * Refreshed tokens are returned via X-User-Session response header so the
+ * desktop client can update its stored token.
+ */
+async function userAccessSessionPlugin(fastify, _opts) {
+  fastify.addHook('onRequest', async (request, reply) => {
+    const config = getConfig();
+    const sessionSecret = config.sessionSecret;
+
+    if (!sessionSecret) {
+      return reply.code(401).send({ error: 'user_session_required' });
+    }
+
+    // Extract Bearer token from Authorization header
+    const authHeader = request.headers.authorization;
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+      return reply.code(401).send({ error: 'user_session_required' });
+    }
+
+    const tokenValue = authHeader.slice(7);
+    const result = validateUserSession(tokenValue, sessionSecret, {
+      userEpochs: config.userEpochs ?? {},
+    });
+
+    if (!result.valid) {
+      return reply.code(401).send({ error: 'user_session_required' });
+    }
+
+    // Set username on request for downstream route handlers
+    request.userAccessUsername = result.payload.username;
+
+    // Throttle refresh: only re-sign if lastActivity is stale (>60s)
+    const now = Math.floor(Date.now() / 1000);
+    if (now - result.payload.lastActivity >= REFRESH_THRESHOLD) {
+      const refreshed = refreshUserSession(result.payload, sessionSecret);
+      reply.header('X-User-Session', refreshed.value);
+    }
+  });
+}
+
+export default fp(userAccessSessionPlugin, { name: 'user-access-session' });

package/vendor/serverd/src/routes/enrollment.js

@@ -0,0 +1,120 @@
+import { z } from 'zod';
+import { validateAndConsumeToken, lookupToken } from '../lib/enrollment.js';
+import { signCSR } from '../lib/csr-signing.js';
+import { fingerprintCertPem } from '../lib/mtls.js';
+
+const EnrollBodySchema = z.object({
+  token: z.string().min(1, 'Enrollment token is required'),
+  csr: z
+    .string()
+    .min(1, 'CSR is required')
+    .refine((v) => v.includes('BEGIN CERTIFICATE REQUEST'), {
+      message: 'CSR must be PEM-encoded',
+    }),
+});
+
+const LookupBodySchema = z.object({
+  token: z.string().min(1, 'Enrollment token is required'),
+});
+
+/**
+ * Public enrollment routes (no mTLS required).
+ *
+ * The agent doesn't have a cert yet — the one-time token (single-use,
+ * 10-minute expiry) is the sole authentication gate.
+ */
+export default async function enrollmentRoutes(fastify, _opts) {
+  // ------------------------------------------------------------------
+  // POST /lookup — return the expected label for a token without
+  // consuming it. Required because the panel's CSR signing wrapper no
+  // longer overrides the CSR subject — the agent must build a CSR with
+  // the correct CN before submitting it for signing.
+  // ------------------------------------------------------------------
+  fastify.post('/lookup', async (request, reply) => {
+    const body = LookupBodySchema.parse(request.body);
+
+    try {
+      const result = await lookupToken(body.token);
+      return { ok: true, label: result.label, type: result.type };
+    } catch (err) {
+      const statusCode = err.statusCode || 401;
+      return reply.code(statusCode).send({
+        error: err.message || 'Invalid enrollment token',
+      });
+    }
+  });
+
+  // ------------------------------------------------------------------
+  // POST / — enroll an agent using a one-time token + CSR
+  // ------------------------------------------------------------------
+  fastify.post('/', async (request, reply) => {
+    const body = EnrollBodySchema.parse(request.body);
+
+    let tokenData;
+    try {
+      tokenData = await validateAndConsumeToken(body.token);
+    } catch (err) {
+      const statusCode = err.statusCode || 401;
+      return reply.code(statusCode).send({
+        error: err.message || 'Invalid enrollment token',
+      });
+    }
+
+    try {
+      // Build opts for delegated enrollments
+      const signOpts =
+        tokenData.type === 'delegated'
+          ? { type: /** @type {const} */ ('delegated'), delegatedBy: tokenData.delegatedBy }
+          : undefined;
+
+      const result = await signCSR(
+        body.csr,
+        tokenData.label,
+        tokenData.capabilities,
+        tokenData.allowedSites,
+        request.log,
+        signOpts,
+      );
+
+      // Audit: enrollment is the moment a fresh agent cert enters circulation.
+      // The token holder is the de facto principal — there is no client cert at
+      // this point. Token type ('p12'/'delegated') and delegating label
+      // (when present) capture the chain of trust.
+      request.log.info(
+        {
+          admin:
+            tokenData.type === 'delegated'
+              ? `agent:${tokenData.delegatedBy ?? 'unknown'}`
+              : 'enrollment-token',
+          issuedFor: tokenData.type === 'delegated' ? result.label : `agent:${result.label}`,
+          mode: tokenData.type === 'delegated' ? 'delegated' : 'hardware-bound',
+          newSerial: result.serial,
+          fingerprintSha256: result.certPem ? fingerprintCertPem(result.certPem) : null,
+        },
+        'mTLS certificate issued (agent enrollment)',
+      );
+
+      return {
+        ok: true,
+        cert: result.certPem,
+        caCert: result.caCertPem,
+        label: result.label,
+        serial: result.serial,
+        expiresAt: result.expiresAt,
+      };
+    } catch (err) {
+      request.log.error(
+        {
+          err,
+          issuedFor: tokenData.type === 'delegated' ? tokenData.label : `agent:${tokenData.label}`,
+          mode: tokenData.type === 'delegated' ? 'delegated' : 'hardware-bound',
+        },
+        'Enrollment CSR signing failed',
+      );
+      const statusCode = err.statusCode || 500;
+      // Only pass through client error messages (4xx); hide internal details for 5xx
+      const message = statusCode < 500 ? err.message : 'Enrollment failed';
+      return reply.code(statusCode).send({ error: message });
+    }
+  });
+}

package/vendor/serverd/src/routes/health.js

@@ -0,0 +1,22 @@
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+// Read version once at module load time — not on every request
+let version = '0.0.0';
+try {
+  const pkgPath = path.resolve(__dirname, '..', '..', 'package.json');
+  const pkg = JSON.parse(await readFile(pkgPath, 'utf-8'));
+  version = pkg.version || '0.0.0';
+} catch {
+  // If package.json can't be read, use fallback version
+}
+
+export default async function healthRoutes(fastify, _opts) {
+  fastify.get('/health', async (_request, _reply) => {
+    return { status: 'ok', version };
+  });
+}

package/vendor/serverd/src/routes/invite.js

@@ -0,0 +1,163 @@
+import crypto from 'node:crypto';
+import { z } from 'zod';
+import { readInvitations, writeInvitations } from '../lib/state.js';
+import {
+  createUserFromInvitation,
+  hashPassword,
+  readUsersRaw,
+  generateTotpSecret,
+  writeTotpToDatabase,
+} from '../lib/authelia.js';
+import { getConfig } from '../lib/config.js';
+
+/**
+ * Find an invitation by token using a constant-time comparison.
+ * Both the candidate and stored token are validated as 64-hex strings, so
+ * we can compare the raw byte buffers via timingSafeEqual without HMAC equalization.
+ * Iterating the full list (no early exit on match) keeps the lookup time
+ * proportional to inventory size, not which entry matched.
+ */
+function findInvitationByToken(invitations, token) {
+  const candidate = Buffer.from(token, 'hex');
+  if (candidate.length !== 32) return undefined;
+  let match;
+  for (const inv of invitations) {
+    if (typeof inv.token !== 'string' || !/^[a-f0-9]{64}$/.test(inv.token)) continue;
+    const stored = Buffer.from(inv.token, 'hex');
+    if (stored.length === candidate.length && crypto.timingSafeEqual(stored, candidate)) {
+      match = inv;
+    }
+  }
+  return match;
+}
+
+const AcceptInvitationSchema = z.object({
+  password: z.string().min(8).max(128),
+});
+
+const TokenParamSchema = z.object({ token: z.string().regex(/^[a-f0-9]{64}$/) });
+
+export default async function inviteRoutes(fastify, _opts) {
+  // GET /api/invite/:token — get invitation details (public)
+  fastify.get('/:token', async (request, reply) => {
+    const { token } = TokenParamSchema.parse(request.params);
+
+    let invitations;
+    try {
+      invitations = await readInvitations();
+    } catch (err) {
+      request.log.error(err, 'Failed to read invitations');
+      return reply.code(500).send({ error: 'Internal server error' });
+    }
+
+    const invitation = findInvitationByToken(invitations, token);
+    if (!invitation) {
+      return reply.code(404).send({ error: 'Invitation not found' });
+    }
+
+    if (invitation.used) {
+      return reply.code(410).send({ error: 'This invitation has already been used' });
+    }
+
+    if (new Date(invitation.expiresAt) < new Date()) {
+      return reply.code(410).send({ error: 'This invitation has expired' });
+    }
+
+    return {
+      username: invitation.username,
+      email: invitation.email,
+      expiresAt: invitation.expiresAt,
+    };
+  });
+
+  // POST /api/invite/:token/accept — accept invitation and set password (public)
+  fastify.post('/:token/accept', async (request, reply) => {
+    const { token } = TokenParamSchema.parse(request.params);
+    const body = AcceptInvitationSchema.parse(request.body);
+
+    let invitations;
+    try {
+      invitations = await readInvitations();
+    } catch (err) {
+      request.log.error(err, 'Failed to read invitations');
+      return reply.code(500).send({ error: 'Internal server error' });
+    }
+
+    const invitation = findInvitationByToken(invitations, token);
+    if (!invitation) {
+      return reply.code(404).send({ error: 'Invitation not found' });
+    }
+
+    if (invitation.used) {
+      return reply.code(410).send({ error: 'This invitation has already been used' });
+    }
+
+    if (new Date(invitation.expiresAt) < new Date()) {
+      return reply.code(410).send({ error: 'This invitation has expired' });
+    }
+
+    // Race condition guard: check user doesn't already exist
+    let usersData;
+    try {
+      usersData = await readUsersRaw();
+    } catch {
+      usersData = { users: {} };
+    }
+
+    if (usersData.users[invitation.username]) {
+      return reply.code(409).send({ error: 'This username already exists' });
+    }
+
+    // Hash password and create user
+    let hashedPassword;
+    try {
+      hashedPassword = await hashPassword(body.password);
+    } catch (err) {
+      request.log.error(err, 'Failed to hash password');
+      return reply.code(500).send({ error: 'Failed to process password' });
+    }
+
+    try {
+      await createUserFromInvitation(
+        invitation.username,
+        invitation.email,
+        invitation.groups,
+        hashedPassword,
+      );
+    } catch (err) {
+      request.log.error(err, 'Failed to create user from invitation');
+      return reply.code(500).send({ error: 'Failed to create user account' });
+    }
+
+    // Generate TOTP so the user can scan the QR code immediately
+    let totpUri = null;
+    try {
+      const { secret, uri } = generateTotpSecret(invitation.username);
+      await writeTotpToDatabase(invitation.username, secret);
+      totpUri = uri;
+    } catch (err) {
+      request.log.error(err, 'Failed to generate TOTP for invited user');
+      // Non-fatal: user was created, they can have admin reset TOTP later
+    }
+
+    // Mark invitation as used
+    invitation.used = true;
+    invitation.acceptedAt = new Date().toISOString();
+
+    try {
+      await writeInvitations(invitations);
+    } catch (err) {
+      request.log.warn(err, 'Failed to update invitation status (user was created)');
+    }
+
+    const config = getConfig();
+    const loginUrl = config.domain ? `https://auth.${config.domain}/` : null;
+
+    return {
+      ok: true,
+      username: invitation.username,
+      loginUrl,
+      totpUri,
+    };
+  });
+}

package/vendor/serverd/src/routes/management/agents.js

@@ -0,0 +1,182 @@
+/**
+ * Per-agent self-service routes.
+ *
+ * `/api/agents/me/*` returns information scoped to the agent identified by
+ * its mTLS client certificate (CN=agent:<label>). Admins must specify the
+ * label explicitly via separate routes — they have no implicit "me" agent.
+ */
+
+import { getChiselCredential, getChiselCredentialIssuedAt } from '../../lib/chisel-users.js';
+import {
+  rotateAgentChiselCredential,
+  getAgentCapabilities,
+  getAgentAllowedSites,
+} from '../../lib/mtls.js';
+import { z } from 'zod';
+import { AGENT_LABEL_REGEX } from '@lamalibre/lamaste';
+
+/**
+ * An agent may rotate its own chisel credential at most this often. Every
+ * rotation restarts chisel (the old password must stop working), which drops
+ * every agent's tunnels for a few seconds.
+ */
+const SELF_ROTATE_MIN_INTERVAL_MS = 10 * 60 * 1000;
+
+const LabelParamSchema = z.object({
+  label: z
+    .string()
+    .min(1)
+    .max(50)
+    .regex(/^[a-z0-9-]+$/, 'Invalid agent label'),
+});
+
+export default async function agentsRoutes(fastify, _opts) {
+  // ------------------------------------------------------------------
+  // GET /agents/me/chisel-credential
+  //
+  // Returns the calling agent's chisel tunnel-server credential.
+  // Identifies the agent strictly via the mTLS cert label — never accepts
+  // a label query parameter, so a compromised agent cannot leak others'
+  // credentials.
+  // ------------------------------------------------------------------
+  fastify.get(
+    '/agents/me/chisel-credential',
+    {
+      preHandler: fastify.requireRole(['agent'], { capability: 'tunnels:read' }),
+    },
+    async (request, reply) => {
+      const label = request.certLabel;
+      if (!label) {
+        return reply.code(400).send({
+          error: 'Agent label could not be determined from client certificate',
+        });
+      }
+      const credential = await getChiselCredential(label);
+      if (!credential) {
+        return reply.code(404).send({
+          error: 'No chisel credential found for this agent',
+          hint:
+            'Ask an admin to run `lamaste-server chisel rotate-credential --label ' +
+            label +
+            '` to provision a credential.',
+        });
+      }
+      return credential;
+    },
+  );
+
+  // ------------------------------------------------------------------
+  // POST /agents/me/chisel-credential/rotate
+  //
+  // Replaces the calling agent's chisel credential and returns the new one.
+  // An upgraded agent calls this once: versions before the credential moved
+  // into a 0600 environment file exposed it in process arguments and a
+  // world-readable unit file. Identity comes strictly from the mTLS cert.
+  // ------------------------------------------------------------------
+  fastify.post(
+    '/agents/me/chisel-credential/rotate',
+    {
+      preHandler: fastify.requireRole(['agent'], { capability: 'tunnels:read' }),
+    },
+    async (request, reply) => {
+      const label = request.certLabel;
+      if (!label) {
+        return reply.code(400).send({
+          error: 'Agent label could not be determined from client certificate',
+        });
+      }
+      if (!AGENT_LABEL_REGEX.test(label)) {
+        return reply
+          .code(400)
+          .send({ error: 'Plugin-agents do not use chisel tunnel credentials' });
+      }
+      const issuedAt = await getChiselCredentialIssuedAt(label);
+      if (issuedAt && Date.now() - Date.parse(issuedAt) < SELF_ROTATE_MIN_INTERVAL_MS) {
+        return reply.code(429).send({
+          error: 'The chisel credential was issued less than 10 minutes ago',
+          issuedAt,
+        });
+      }
+      try {
+        const result = await rotateAgentChiselCredential(label, request.log);
+        return {
+          user: result.user,
+          password: result.password,
+          createdAt: result.createdAt,
+        };
+      } catch (err) {
+        const status = err.statusCode || 500;
+        return reply.code(status).send({
+          error: err.message || 'Failed to rotate chisel credential',
+        });
+      }
+    },
+  );
+
+  // ------------------------------------------------------------------
+  // GET /agents/me/capabilities
+  //
+  // Returns the calling agent's capabilities and allowedSites. Used by the
+  // agent daemon (lamaste-agentd) to enforce per-route capability checks
+  // when a non-admin mTLS cert calls its REST API.
+  //
+  // Cert identity is taken strictly from `request.certLabel` (set by the
+  // mtls middleware from the cert CN). No body/query inputs — a compromised
+  // agent cannot ask for another agent's capabilities.
+  //
+  // Admin callers need an explicit label since they have no implicit "me"
+  // agent — they get an empty payload (admins are unconstrained).
+  // ------------------------------------------------------------------
+  fastify.get(
+    '/agents/me/capabilities',
+    {
+      preHandler: fastify.requireRole(['admin', 'agent']),
+    },
+    async (request, reply) => {
+      // Admin has no "me" agent — return empty (admin is master, no caps needed)
+      if (request.certRole === 'admin') {
+        return { capabilities: [], allowedSites: [], role: 'admin' };
+      }
+      const label = request.certLabel;
+      if (!label) {
+        return reply.code(400).send({
+          error: 'Agent label could not be determined from client certificate',
+        });
+      }
+      // Re-fetch from registry rather than reusing request.certCapabilities.
+      // The mtls middleware filters caps against currently-valid ones, but
+      // an explicit registry read here is the canonical source — keeps this
+      // endpoint robust to middleware changes.
+      const capabilities = await getAgentCapabilities(label);
+      const allowedSites = await getAgentAllowedSites(label);
+      return { capabilities, allowedSites, role: request.certRole };
+    },
+  );
+
+  // ------------------------------------------------------------------
+  // POST /agents/:label/chisel-credential/rotate (admin only)
+  //
+  // Mints a new chisel password for the named agent and writes the
+  // updated authfile. Triggers a chisel restart. Returns the new
+  // credential so the admin can hand it off out-of-band — but the
+  // expected flow is for the agent to re-fetch via the /me endpoint.
+  // ------------------------------------------------------------------
+  fastify.post(
+    '/agents/:label/chisel-credential/rotate',
+    {
+      preHandler: fastify.requireRole(['admin']),
+    },
+    async (request, reply) => {
+      const params = LabelParamSchema.parse(request.params);
+      try {
+        const result = await rotateAgentChiselCredential(params.label, request.log);
+        return result;
+      } catch (err) {
+        const status = err.statusCode || 500;
+        return reply.code(status).send({
+          error: err.message || 'Failed to rotate chisel credential',
+        });
+      }
+    },
+  );
+}