@lamalibre/create-lamaste 4.0.0

package/vendor/serverd/src/routes/management/gatekeeper-proxy.js

@@ -0,0 +1,160 @@
+/**
+ * Proxy routes for Gatekeeper API.
+ *
+ * These routes forward requests from lamaste-serverd's mTLS-protected
+ * /api/gatekeeper/* path to the Gatekeeper service on 127.0.0.1:9294.
+ * This allows the desktop app (and web panel) to reach Gatekeeper on
+ * remote servers through the existing mTLS tunnel — no additional port
+ * forwarding needed.
+ *
+ * Admin-only (lamaste-serverd's mTLS + roleGuard protect these routes).
+ */
+
+import { gatekeeperRequest } from '../../lib/gatekeeper-client.js';
+
+export default async function gatekeeperProxyRoutes(fastify, _opts) {
+  // All gatekeeper management routes are admin-only
+  fastify.addHook('preHandler', fastify.requireRole(['admin']));
+
+  /**
+   * Forward to gatekeeper via the shared client (which reads the secret
+   * from either `gatekeeper-secret.json` or the legacy plain-text file).
+   * Normalises the response to the proxy's historical shape.
+   */
+  const proxy = async (method, gatekeeperPath, body) => {
+    const result = await gatekeeperRequest(method, gatekeeperPath, body);
+    if (result.ok) {
+      return { statusCode: result.statusCode, data: result.data };
+    }
+    return {
+      statusCode: result.statusCode,
+      data: { error: result.error },
+    };
+  };
+
+  // --- Groups ---
+
+  fastify.get('/gatekeeper/groups', async (_request, reply) => {
+    const { statusCode, data } = await proxy('GET', '/api/groups');
+    return reply.code(statusCode).send(data);
+  });
+
+  fastify.post('/gatekeeper/groups', async (request, reply) => {
+    const { statusCode, data } = await proxy('POST', '/api/groups', request.body);
+    return reply.code(statusCode).send(data);
+  });
+
+  fastify.get('/gatekeeper/groups/:name', async (request, reply) => {
+    const { name } = request.params;
+    const { statusCode, data } = await proxy('GET', `/api/groups/${encodeURIComponent(name)}`);
+    return reply.code(statusCode).send(data);
+  });
+
+  fastify.patch('/gatekeeper/groups/:name', async (request, reply) => {
+    const { name } = request.params;
+    const { statusCode, data } = await proxy(
+      'PATCH',
+      `/api/groups/${encodeURIComponent(name)}`,
+      request.body,
+    );
+    return reply.code(statusCode).send(data);
+  });
+
+  fastify.delete('/gatekeeper/groups/:name', async (request, reply) => {
+    const { name } = request.params;
+    const { statusCode, data } = await proxy('DELETE', `/api/groups/${encodeURIComponent(name)}`);
+    return reply.code(statusCode).send(data);
+  });
+
+  fastify.post('/gatekeeper/groups/:name/members', async (request, reply) => {
+    const { name } = request.params;
+    const { statusCode, data } = await proxy(
+      'POST',
+      `/api/groups/${encodeURIComponent(name)}/members`,
+      request.body,
+    );
+    return reply.code(statusCode).send(data);
+  });
+
+  fastify.delete('/gatekeeper/groups/:name/members/:username', async (request, reply) => {
+    const { name, username } = request.params;
+    const { statusCode, data } = await proxy(
+      'DELETE',
+      `/api/groups/${encodeURIComponent(name)}/members/${encodeURIComponent(username)}`,
+    );
+    return reply.code(statusCode).send(data);
+  });
+
+  // --- Grants ---
+
+  fastify.get('/gatekeeper/grants', async (request, reply) => {
+    const qs = new URLSearchParams(request.query).toString();
+    const grantPath = qs ? `/api/grants?${qs}` : '/api/grants';
+    const { statusCode, data } = await proxy('GET', grantPath);
+    return reply.code(statusCode).send(data);
+  });
+
+  fastify.post('/gatekeeper/grants', async (request, reply) => {
+    const { statusCode, data } = await proxy('POST', '/api/grants', request.body);
+    return reply.code(statusCode).send(data);
+  });
+
+  fastify.get('/gatekeeper/grants/:grantId', async (request, reply) => {
+    const { grantId } = request.params;
+    const { statusCode, data } = await proxy('GET', `/api/grants/${encodeURIComponent(grantId)}`);
+    return reply.code(statusCode).send(data);
+  });
+
+  fastify.delete('/gatekeeper/grants/:grantId', async (request, reply) => {
+    const { grantId } = request.params;
+    const { statusCode, data } = await proxy(
+      'DELETE',
+      `/api/grants/${encodeURIComponent(grantId)}`,
+    );
+    return reply.code(statusCode).send(data);
+  });
+
+  // Bulk-revoke every grant for a principal. Forwarded to gatekeeper as
+  // DELETE /api/grants?principalType=...&principalId=...
+  fastify.delete('/gatekeeper/grants', async (request, reply) => {
+    const qs = new URLSearchParams(request.query).toString();
+    const grantPath = qs ? `/api/grants?${qs}` : '/api/grants';
+    const { statusCode, data } = await proxy('DELETE', grantPath);
+    return reply.code(statusCode).send(data);
+  });
+
+  // --- Diagnostics / Settings / Cache ---
+
+  fastify.get('/gatekeeper/access/check', async (request, reply) => {
+    const qs = new URLSearchParams(request.query).toString();
+    const { statusCode, data } = await proxy('GET', `/api/access/check?${qs}`);
+    return reply.code(statusCode).send(data);
+  });
+
+  fastify.post('/gatekeeper/cache/bust', async (_request, reply) => {
+    const { statusCode, data } = await proxy('POST', '/api/cache/bust');
+    return reply.code(statusCode).send(data);
+  });
+
+  fastify.get('/gatekeeper/settings', async (_request, reply) => {
+    const { statusCode, data } = await proxy('GET', '/api/settings');
+    return reply.code(statusCode).send(data);
+  });
+
+  fastify.patch('/gatekeeper/settings', async (request, reply) => {
+    const { statusCode, data } = await proxy('PATCH', '/api/settings', request.body);
+    return reply.code(statusCode).send(data);
+  });
+
+  fastify.get('/gatekeeper/access-log', async (request, reply) => {
+    const qs = new URLSearchParams(request.query).toString();
+    const logPath = qs ? `/api/access-log?${qs}` : '/api/access-log';
+    const { statusCode, data } = await proxy('GET', logPath);
+    return reply.code(statusCode).send(data);
+  });
+
+  fastify.delete('/gatekeeper/access-log', async (_request, reply) => {
+    const { statusCode, data } = await proxy('DELETE', '/api/access-log');
+    return reply.code(statusCode).send(data);
+  });
+}

package/vendor/serverd/src/routes/management/identity.js

@@ -0,0 +1,107 @@
+import { z } from 'zod';
+import { readUsers } from '../../lib/authelia.js';
+
+const UsernameParamSchema = z.object({
+  username: z
+    .string()
+    .min(1)
+    .max(100)
+    .regex(/^[a-zA-Z0-9_.-]+$/),
+});
+
+/**
+ * Extract a single string value from a header that may be string, string[], or undefined.
+ *
+ * @param {string | string[] | undefined} value
+ * @returns {string | undefined}
+ */
+function headerValue(value) {
+  if (Array.isArray(value)) return value[0];
+  return value;
+}
+
+export default async function identityRoutes(fastify, _opts) {
+  // GET /api/identity/self — Returns caller's identity from Authelia headers.
+  // Only meaningful behind an Authelia-protected vhost. On the mTLS panel vhost,
+  // nginx strips Remote-* headers so this will return 400.
+  fastify.get(
+    '/identity/self',
+    { preHandler: fastify.requireRole(['admin']) },
+    async (request, reply) => {
+      const user = headerValue(request.headers['remote-user']);
+      if (!user) {
+        return reply.code(400).send({
+          error:
+            'Identity headers not present — this endpoint requires an Authelia-protected vhost',
+        });
+      }
+
+      const groupsRaw = headerValue(request.headers['remote-groups']) || '';
+      const groups = groupsRaw
+        .split(',')
+        .map((g) => g.trim())
+        .filter(Boolean);
+      const name = headerValue(request.headers['remote-name']) || '';
+      const email = headerValue(request.headers['remote-email']) || '';
+
+      return { username: user, displayName: name, email, groups };
+    },
+  );
+
+  // GET /api/identity/users — List Authelia users
+  fastify.get(
+    '/identity/users',
+    { preHandler: fastify.requireRole(['admin', 'agent'], { capability: 'identity:query' }) },
+    async (request, reply) => {
+      try {
+        const users = await readUsers();
+        return { users };
+      } catch (err) {
+        request.log.error({ err }, 'Failed to read Authelia users');
+        return reply.code(500).send({ error: 'Failed to read users' });
+      }
+    },
+  );
+
+  // GET /api/identity/users/:username — Single user metadata
+  fastify.get(
+    '/identity/users/:username',
+    { preHandler: fastify.requireRole(['admin', 'agent'], { capability: 'identity:query' }) },
+    async (request, reply) => {
+      const { username } = UsernameParamSchema.parse(request.params);
+      try {
+        const users = await readUsers();
+        const user = users.find((u) => u.username === username);
+        if (!user) {
+          return reply.code(404).send({ error: 'User not found' });
+        }
+        return { user };
+      } catch (err) {
+        request.log.error({ err }, 'Failed to read Authelia users');
+        return reply.code(500).send({ error: 'Failed to read users' });
+      }
+    },
+  );
+
+  // GET /api/identity/groups — List all groups
+  fastify.get(
+    '/identity/groups',
+    { preHandler: fastify.requireRole(['admin', 'agent'], { capability: 'identity:query' }) },
+    async (request, reply) => {
+      try {
+        const users = await readUsers();
+        /** @type {Set<string>} */
+        const groupSet = new Set();
+        for (const u of users) {
+          for (const g of u.groups) {
+            groupSet.add(g);
+          }
+        }
+        return { groups: [...groupSet].sort() };
+      } catch (err) {
+        request.log.error({ err }, 'Failed to read Authelia users');
+        return reply.code(500).send({ error: 'Failed to read groups' });
+      }
+    },
+  );
+}

package/vendor/serverd/src/routes/management/invitations.js

@@ -0,0 +1,166 @@
+import crypto from 'node:crypto';
+import { z } from 'zod';
+import { readInvitations, writeInvitations } from '../../lib/state.js';
+import { readUsersRaw } from '../../lib/authelia.js';
+import { getConfig } from '../../lib/config.js';
+
+const IdParamSchema = z.object({ id: z.string().uuid() });
+
+const CreateInvitationSchema = z.object({
+  username: z
+    .string()
+    .min(2)
+    .max(32)
+    .regex(
+      // Same rule as the users API. A leading "-" would read as a flag to
+      // Authelia's CLI when a TOTP secret is stored for the user.
+      /^[a-z0-9][a-z0-9_-]*$/,
+      'Username must start with a lowercase letter or digit and may contain underscores or hyphens',
+    ),
+  email: z.string().email(),
+  groups: z.array(z.string()).optional().default([]),
+  expiresInDays: z.number().int().min(1).max(30).optional().default(7),
+});
+
+export default async function invitationRoutes(fastify, _opts) {
+  // GET /api/invitations — list all invitations
+  fastify.get(
+    '/invitations',
+    {
+      preHandler: fastify.requireRole(['admin']),
+    },
+    async (request, reply) => {
+      try {
+        const invitations = await readInvitations();
+        const now = new Date();
+        const enriched = invitations.map((inv) => ({
+          ...inv,
+          token: undefined,
+          status: inv.used ? 'accepted' : new Date(inv.expiresAt) < now ? 'expired' : 'pending',
+        }));
+        return { invitations: enriched };
+      } catch (err) {
+        request.log.error(err, 'Failed to read invitations');
+        return reply.code(500).send({ error: 'Failed to read invitations' });
+      }
+    },
+  );
+
+  // POST /api/invitations — create a new invitation
+  fastify.post(
+    '/invitations',
+    {
+      preHandler: fastify.requireRole(['admin']),
+    },
+    async (request, reply) => {
+      const body = CreateInvitationSchema.parse(request.body);
+
+      // Check username doesn't already exist in Authelia
+      let usersData;
+      try {
+        usersData = await readUsersRaw();
+      } catch {
+        usersData = { users: {} };
+      }
+
+      if (usersData.users[body.username]) {
+        return reply.code(409).send({ error: 'Username already exists as an Authelia user' });
+      }
+
+      // Check username doesn't already have a pending invitation
+      let invitations;
+      try {
+        invitations = await readInvitations();
+      } catch (err) {
+        request.log.error(err, 'Failed to read invitations');
+        return reply.code(500).send({ error: 'Failed to read invitations' });
+      }
+
+      const now = new Date();
+      const existingPending = invitations.find(
+        (inv) => inv.username === body.username && !inv.used && new Date(inv.expiresAt) > now,
+      );
+      if (existingPending) {
+        return reply
+          .code(409)
+          .send({ error: 'A pending invitation already exists for this username' });
+      }
+
+      const config = getConfig();
+      const token = crypto.randomBytes(32).toString('hex');
+      const expiresAt = new Date(now.getTime() + body.expiresInDays * 24 * 60 * 60 * 1000);
+
+      const invitation = {
+        id: crypto.randomUUID(),
+        token,
+        username: body.username,
+        email: body.email,
+        groups: body.groups,
+        createdAt: now.toISOString(),
+        expiresAt: expiresAt.toISOString(),
+        used: false,
+        acceptedAt: null,
+      };
+
+      invitations.push(invitation);
+
+      try {
+        await writeInvitations(invitations);
+      } catch (err) {
+        request.log.error(err, 'Failed to write invitations');
+        return reply.code(500).send({ error: 'Failed to save invitation' });
+      }
+
+      const inviteUrl = config.domain ? `https://auth.${config.domain}/invite/${token}` : null;
+
+      return reply.code(201).send({
+        ok: true,
+        invitation: {
+          id: invitation.id,
+          username: invitation.username,
+          email: invitation.email,
+          groups: invitation.groups,
+          createdAt: invitation.createdAt,
+          expiresAt: invitation.expiresAt,
+        },
+        inviteUrl,
+        token,
+      });
+    },
+  );
+
+  // DELETE /api/invitations/:id — revoke an invitation
+  fastify.delete(
+    '/invitations/:id',
+    {
+      preHandler: fastify.requireRole(['admin']),
+    },
+    async (request, reply) => {
+      const { id } = IdParamSchema.parse(request.params);
+
+      let invitations;
+      try {
+        invitations = await readInvitations();
+      } catch (err) {
+        request.log.error(err, 'Failed to read invitations');
+        return reply.code(500).send({ error: 'Failed to read invitations' });
+      }
+
+      const index = invitations.findIndex((inv) => inv.id === id);
+      if (index === -1) {
+        return reply.code(404).send({ error: 'Invitation not found' });
+      }
+
+      invitations.splice(index, 1);
+
+      try {
+        await writeInvitations(invitations);
+      } catch (err) {
+        request.log.error(err, 'Failed to write invitations');
+        return reply.code(500).send({ error: 'Failed to revoke invitation' });
+      }
+
+      return { ok: true };
+    },
+  );
+}

package/vendor/serverd/src/routes/management/logs.js

@@ -0,0 +1,218 @@
+import { execa } from 'execa';
+import { ALLOWED_SERVICES } from '../../lib/services.js';
+
+// Track active journalctl processes for cleanup on server shutdown
+const activeProcesses = new Set();
+
+// Backpressure: max bytes buffered before we pause the child stdout stream
+const MAX_SEND_BUFFER_BYTES = 64 * 1024; // 64 KB
+
+export default async function logsRoutes(fastify, _opts) {
+  fastify.get(
+    '/services/:name/logs',
+    {
+      websocket: true,
+      preHandler: fastify.requireRole(['admin']),
+      // The rate-limit only applies to the HTTP upgrade handshake — once
+      // the WebSocket is established it streams freely. Empty config
+      // inherits the globally-registered limiter (100 connection attempts
+      // per minute) and satisfies CodeQL.
+      config: { rateLimit: {} },
+    },
+    (socket, request) => {
+      const { name } = request.params;
+
+      // Validate service name
+      if (!ALLOWED_SERVICES.includes(name)) {
+        socket.close(1008, 'Unknown service');
+        return;
+      }
+
+      let child = null;
+      let lineBuffer = '';
+      let sendBuffer = [];
+      let sendBufferBytes = 0;
+      let stdoutPaused = false;
+
+      try {
+        child = execa('journalctl', ['-u', name, '-f', '-n', '100', '--output=short-iso'], {
+          reject: false,
+          buffer: false,
+          stdout: 'pipe',
+          stderr: 'pipe',
+        });
+      } catch (err) {
+        request.log.error({ err }, 'Failed to spawn journalctl');
+        socket.send(
+          JSON.stringify({
+            timestamp: new Date().toISOString(),
+            message: `[Error: Failed to start log stream for ${name}]`,
+          }),
+        );
+        socket.close(1011, 'Failed to spawn journalctl');
+        return;
+      }
+
+      activeProcesses.add(child);
+
+      /**
+       * Attempt to flush buffered messages to the WebSocket.
+       * Drops oldest messages if buffer exceeds the size limit.
+       * Pauses/resumes child stdout based on buffer pressure.
+       */
+      function flushSendBuffer() {
+        while (sendBuffer.length > 0) {
+          if (socket.readyState !== 1 /* OPEN */) {
+            // Socket not open — discard everything
+            sendBuffer.length = 0;
+            sendBufferBytes = 0;
+            return;
+          }
+
+          const msg = sendBuffer[0];
+          try {
+            socket.send(msg);
+            sendBufferBytes -= msg.length;
+            sendBuffer.shift();
+          } catch {
+            // Socket may have closed mid-send
+            sendBuffer.length = 0;
+            sendBufferBytes = 0;
+            return;
+          }
+        }
+
+        // Buffer drained — resume child stdout if it was paused
+        if (stdoutPaused && child?.stdout) {
+          stdoutPaused = false;
+          child.stdout.resume();
+        }
+      }
+
+      /**
+       * Enqueue a serialized message for sending.
+       * Enforces the buffer size limit by dropping oldest messages.
+       */
+      function enqueueMessage(serialized) {
+        sendBuffer.push(serialized);
+        sendBufferBytes += serialized.length;
+
+        // Drop oldest messages while buffer exceeds the limit
+        while (sendBufferBytes > MAX_SEND_BUFFER_BYTES && sendBuffer.length > 1) {
+          const dropped = sendBuffer.shift();
+          sendBufferBytes -= dropped.length;
+        }
+
+        // Pause child stdout when buffer is full to apply backpressure
+        if (sendBufferBytes > MAX_SEND_BUFFER_BYTES && !stdoutPaused && child?.stdout) {
+          stdoutPaused = true;
+          child.stdout.pause();
+        }
+      }
+
+      // Handle WebSocket drain — buffer has been flushed by the network layer
+      socket.on('drain', () => {
+        flushSendBuffer();
+      });
+
+      // Parse and send lines from journalctl stdout
+      if (child.stdout) {
+        child.stdout.on('data', (chunk) => {
+          lineBuffer += chunk.toString();
+          const lines = lineBuffer.split('\n');
+          // Keep the last incomplete line in the buffer
+          lineBuffer = lines.pop() || '';
+
+          for (const line of lines) {
+            if (!line.trim()) continue;
+            const parsed = parseLine(line);
+            const serialized = JSON.stringify(parsed);
+
+            if (socket.readyState === 1 /* OPEN */ && sendBuffer.length === 0) {
+              // Fast path: send directly when buffer is empty and socket is open
+              try {
+                socket.send(serialized);
+              } catch {
+                // Socket closed — will be cleaned up by close event
+              }
+            } else {
+              enqueueMessage(serialized);
+            }
+          }
+
+          // Try to flush any queued messages
+          if (sendBuffer.length > 0) {
+            flushSendBuffer();
+          }
+        });
+      }
+
+      // Handle journalctl exit
+      child.then(() => {
+        activeProcesses.delete(child);
+        try {
+          if (socket.readyState === 1 /* OPEN */) {
+            socket.send(
+              JSON.stringify({
+                timestamp: new Date().toISOString(),
+                message: '[Log stream ended]',
+              }),
+            );
+            socket.close(1000, 'Log stream ended');
+          }
+        } catch {
+          // Socket may already be closed
+        }
+      });
+
+      // Clean up on WebSocket close
+      socket.on('close', () => {
+        sendBuffer.length = 0;
+        sendBufferBytes = 0;
+        if (child) {
+          activeProcesses.delete(child);
+          child.kill('SIGTERM');
+        }
+      });
+
+      // Clean up on WebSocket error
+      socket.on('error', (err) => {
+        request.log.error({ err }, 'WebSocket error for log stream');
+        sendBuffer.length = 0;
+        sendBufferBytes = 0;
+        if (child) {
+          activeProcesses.delete(child);
+          child.kill('SIGTERM');
+        }
+      });
+    },
+  );
+
+  // Clean up all journalctl processes on server shutdown
+  fastify.addHook('onClose', async () => {
+    for (const proc of activeProcesses) {
+      proc.kill('SIGTERM');
+    }
+    activeProcesses.clear();
+  });
+}
+
+/**
+ * Parse a journalctl --output=short-iso line into { timestamp, message }.
+ * Format: 2024-03-15T10:30:45+0000 hostname servicename[pid]: log message
+ */
+function parseLine(line) {
+  // ISO timestamp is at the beginning, match until first space after the ISO pattern
+  const isoMatch = line.match(/^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[^\s]*)\s+(.*)$/);
+  if (isoMatch) {
+    return {
+      timestamp: isoMatch[1],
+      message: isoMatch[2],
+    };
+  }
+
+  return {
+    timestamp: '',
+    message: line,
+  };
+}