@lamalibre/create-lamaste 4.0.0

package/vendor/serverd/src/routes/management/system.js

@@ -0,0 +1,201 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { readFile, writeFile, rename, open, mkdir } from 'node:fs/promises';
+import { join, dirname } from 'node:path';
+import { z } from 'zod';
+import { getSystemStats } from '../../lib/system-stats.js';
+import { getConfig } from '../../lib/config.js';
+import { setPluginCapabilities } from '../../lib/mtls.js';
+import { getPluginCapabilities } from '../../lib/plugins.js';
+import { PLUGIN_CAPABILITY_REGEX } from '@lamalibre/lamaste';
+
+const execFileAsync = promisify(execFile);
+
+/** Root helper that starts create-lamaste in a transient unit (see lamaste-priv). */
+const PRIV = '/usr/local/sbin/lamaste-priv';
+
+// Persist agent-reported capabilities so they survive server restarts
+const AGENT_CAPS_FILE = () => join(getConfig().dataDir, 'agent-plugin-caps.json');
+
+async function loadAgentReportedCaps() {
+  try {
+    const raw = await readFile(AGENT_CAPS_FILE(), 'utf-8');
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed.capabilities) ? parsed.capabilities : [];
+  } catch (err) {
+    if (err.code === 'ENOENT') return [];
+    return [];
+  }
+}
+
+async function saveAgentReportedCaps(caps) {
+  const filePath = AGENT_CAPS_FILE();
+  const tmpPath = `${filePath}.tmp`;
+  await mkdir(dirname(filePath), { recursive: true });
+  const content = JSON.stringify({ capabilities: caps }, null, 2) + '\n';
+  await writeFile(tmpPath, content, { encoding: 'utf-8', mode: 0o600 });
+  const fd = await open(tmpPath, 'r');
+  await fd.sync();
+  await fd.close();
+  await rename(tmpPath, filePath);
+}
+
+const UpdateBodySchema = z.object({
+  version: z.string().regex(/^\d+\.\d+\.\d+$/, 'Version must be semver (e.g. 1.0.43)'),
+});
+
+export default async function systemRoutes(fastify, _opts) {
+  // Load agent-reported capabilities from disk on startup
+  try {
+    const persistedCaps = await loadAgentReportedCaps();
+    if (persistedCaps.length > 0) {
+      const serverCaps = await getPluginCapabilities();
+      const merged = [...new Set([...serverCaps, ...persistedCaps])];
+      setPluginCapabilities(merged);
+      fastify.log.info(
+        { count: persistedCaps.length },
+        'Loaded persisted agent plugin capabilities',
+      );
+    }
+  } catch (err) {
+    fastify.log.warn({ err: err.message }, 'Failed to load agent-reported capabilities');
+  }
+  fastify.get(
+    '/system/stats',
+    {
+      preHandler: fastify.requireRole(['admin', 'agent'], { capability: 'system:read' }),
+    },
+    async (request, reply) => {
+      try {
+        const stats = await getSystemStats(request.log);
+        return stats;
+      } catch {
+        return reply.code(500).send({ error: 'Failed to retrieve system stats' });
+      }
+    },
+  );
+
+  // ------------------------------------------------------------------
+  // POST /system/update — trigger a panel server update
+  //
+  // The root helper `lamaste-priv self-update <version>` starts
+  // `create-lamaste@<version> --yes` (the redeploy path) in a transient
+  // systemd unit, two seconds from now. A transient unit is critical: the
+  // panel runs as the lamalibre-lamaste-serverd service, and systemd's
+  // default KillMode (control-group) kills ALL processes in the cgroup
+  // when the installer stops the service. The helper takes only the
+  // version — the panel never supplies a script for root to run.
+  //
+  // Returns 202 immediately — caller should poll /api/health until
+  // the server comes back with the new version.
+  // ------------------------------------------------------------------
+  fastify.post(
+    '/system/update',
+    {
+      preHandler: fastify.requireRole(['admin']),
+      // Moderate tier — starts a privileged update via lamaste-priv;
+      // the global 100/min default is too generous for an operation that
+      // restarts the panel daemon.
+      config: { rateLimit: { max: 30, timeWindow: '1 minute' } },
+    },
+    async (request, reply) => {
+      const body = UpdateBodySchema.parse(request.body);
+      const { version } = body;
+
+      let unitName;
+      try {
+        const { stdout } = await execFileAsync('sudo', [PRIV, 'self-update', version], {
+          timeout: 30_000,
+        });
+        unitName = stdout.trim();
+      } catch (err) {
+        request.log.error({ err, version }, 'Failed to launch update unit');
+        return reply.code(500).send({
+          error: `Could not start the update: ${err.stderr?.trim() || err.message}`,
+        });
+      }
+
+      request.log.info({ version, unit: unitName }, 'Panel update initiated via systemd-run');
+
+      return reply.code(202).send({
+        ok: true,
+        message: `Update to create-lamaste@${version} initiated. The panel will restart shortly.`,
+      });
+    },
+  );
+
+  // ------------------------------------------------------------------
+  // POST /agents/plugins/report — accept agent plugin capability report
+  //
+  // Agents report their enabled plugins during `lamaste-agent update`.
+  // The server merges the reported plugin capabilities into the valid
+  // capabilities set so they can be assigned to agents.
+  // ------------------------------------------------------------------
+
+  // Capability strings must be in the namespaced plugin form
+  // `plugin:<short-name>:<action>` (see PLUGIN_CAPABILITY_REGEX). The
+  // route-side prefix-scoping below additionally requires the `<short-name>`
+  // segment to match the reporting plugin's own derived route.
+  const PluginReportSchema = z.object({
+    plugins: z.array(
+      z.object({
+        name: z.string().regex(/^[a-z0-9-]+$/),
+        version: z.string(),
+        capabilities: z.array(z.string().regex(PLUGIN_CAPABILITY_REGEX)).default([]),
+      }),
+    ),
+  });
+
+  fastify.post(
+    '/agents/plugins/report',
+    {
+      preHandler: fastify.requireRole(['admin', 'agent']),
+    },
+    async (request, reply) => {
+      const result = PluginReportSchema.safeParse(request.body);
+      if (!result.success) {
+        return reply
+          .code(400)
+          .send({ error: 'Invalid plugin report', details: result.error.issues });
+      }
+      const { plugins } = result.data;
+
+      // Collect capabilities, scoped to the reporting plugin's namespace.
+      // Only accept caps whose `<short-name>` segment matches the plugin's
+      // own name — this stops a compromised plugin from contributing
+      // capabilities that another plugin has claimed (or from inventing new
+      // top-level namespaces; the regex above already blocks anything
+      // outside `plugin:*`).
+      const reportedCaps = new Set();
+      for (const plugin of plugins) {
+        const expectedPrefix = `plugin:${plugin.name}:`;
+        for (const cap of plugin.capabilities) {
+          if (cap.startsWith(expectedPrefix)) {
+            reportedCaps.add(cap);
+          }
+        }
+      }
+
+      if (reportedCaps.size === 0) {
+        return { ok: true, merged: 0 };
+      }
+
+      // Merge with existing server-side plugin capabilities
+      const serverCaps = await getPluginCapabilities();
+      const allPluginCaps = [...new Set([...serverCaps, ...reportedCaps])];
+      setPluginCapabilities(allPluginCaps);
+
+      // Persist agent-reported capabilities so they survive server restarts
+      const existingAgentCaps = await loadAgentReportedCaps();
+      const allAgentCaps = [...new Set([...existingAgentCaps, ...reportedCaps])];
+      await saveAgentReportedCaps(allAgentCaps);
+
+      request.log.info(
+        { agentPlugins: plugins.length, newCaps: reportedCaps.size },
+        'Agent plugin capabilities reported',
+      );
+
+      return { ok: true, merged: reportedCaps.size };
+    },
+  );
+}

package/vendor/serverd/src/routes/management/tickets.js

@@ -0,0 +1,457 @@
+import { z } from 'zod';
+import {
+  RegisterScopeSchema,
+  RegisterInstanceSchema,
+  RequestTicketSchema,
+  ValidateTicketSchema,
+  CreateSessionSchema,
+  UpdateSessionSchema,
+  AssignmentSchema,
+  TicketScopeNameSchema,
+  registerScope,
+  listScopes,
+  unregisterScope,
+  registerInstance,
+  deregisterInstance,
+  instanceHeartbeat,
+  createAssignment,
+  removeAssignment,
+  listAssignments,
+  requestTicket,
+  getTicketInbox,
+  validateTicket,
+  listTickets,
+  revokeTicket,
+  createSession,
+  sessionHeartbeat,
+  updateSession,
+  killSession,
+  listSessions,
+} from '../../lib/tickets.js';
+
+// Param validation schemas
+const HexIdSchema = z
+  .string()
+  .min(1)
+  .max(128)
+  .regex(/^[a-f0-9]+$/);
+const SessionIdSchema = z
+  .string()
+  .min(1)
+  .max(128)
+  .regex(/^[a-zA-Z0-9_-]+$/);
+// Accepts regular agent labels (e.g., "macbook-pro") and plugin-agent labels
+// (e.g., "plugin-agent:macbook-pro:raspi-sync")
+const AgentLabelSchema = z
+  .string()
+  .min(1)
+  .max(150)
+  .regex(/^[a-zA-Z0-9_:-]+$/);
+const InstanceScopeSchema = z
+  .string()
+  .min(1)
+  .max(200)
+  .regex(/^plugin:[a-z0-9-]+:[a-z0-9-]+:[a-f0-9]+$/);
+
+export default async function ticketRoutes(fastify, _opts) {
+  // -----------------------------------------------------------------------
+  // Ticket scope management (admin only)
+  // -----------------------------------------------------------------------
+
+  // POST /api/tickets/scopes — Register ticket scopes
+  fastify.post(
+    '/tickets/scopes',
+    { preHandler: fastify.requireRole(['admin']) },
+    async (request, reply) => {
+      const body = RegisterScopeSchema.parse(request.body);
+      try {
+        const result = await registerScope(body, request.log);
+        return reply.code(201).send(result);
+      } catch (err) {
+        const statusCode = err.statusCode || 500;
+        return reply.code(statusCode).send({ error: err.message });
+      }
+    },
+  );
+
+  // GET /api/tickets/scopes — List registered scopes
+  fastify.get(
+    '/tickets/scopes',
+    { preHandler: fastify.requireRole(['admin']) },
+    async (request, reply) => {
+      try {
+        const result = await listScopes();
+        return result;
+      } catch (err) {
+        const statusCode = err.statusCode || 500;
+        return reply.code(statusCode).send({ error: err.message });
+      }
+    },
+  );
+
+  // DELETE /api/tickets/scopes/:name — Unregister ticket scopes
+  fastify.delete(
+    '/tickets/scopes/:name',
+    { preHandler: fastify.requireRole(['admin']) },
+    async (request, reply) => {
+      const name = TicketScopeNameSchema.parse(request.params.name);
+      try {
+        const result = await unregisterScope(name, request.log);
+        return result;
+      } catch (err) {
+        const statusCode = err.statusCode || 500;
+        return reply.code(statusCode).send({ error: err.message });
+      }
+    },
+  );
+
+  // -----------------------------------------------------------------------
+  // Instance registration (agent, scoped)
+  // -----------------------------------------------------------------------
+
+  // POST /api/tickets/instances — Register or re-register as scope host
+  fastify.post(
+    '/tickets/instances',
+    { preHandler: fastify.requireRole(['admin', 'agent']) },
+    async (request, reply) => {
+      const body = RegisterInstanceSchema.parse(request.body);
+      try {
+        // Verify caller has the base scope capability
+        if (request.certRole === 'agent') {
+          const caps = request.certCapabilities || [];
+          if (!caps.includes(body.scope)) {
+            return reply.code(403).send({ error: 'Insufficient capability' });
+          }
+        }
+
+        const agentLabel = request.certLabel;
+        if (!agentLabel) {
+          return reply.code(400).send({ error: 'Agent label required' });
+        }
+        const result = await registerInstance(body.scope, body.transport, agentLabel, request.log);
+        return reply.code(result.isReregistration ? 200 : 201).send({
+          ok: result.ok,
+          instanceId: result.instanceId,
+          instanceScope: result.instanceScope,
+        });
+      } catch (err) {
+        const statusCode = err.statusCode || 500;
+        return reply.code(statusCode).send({ error: err.message });
+      }
+    },
+  );
+
+  // DELETE /api/tickets/instances/:instanceId — Deregister instance
+  fastify.delete(
+    '/tickets/instances/:instanceId',
+    { preHandler: fastify.requireRole(['admin', 'agent']) },
+    async (request, reply) => {
+      const instanceId = HexIdSchema.parse(request.params.instanceId);
+      try {
+        const result = await deregisterInstance(
+          instanceId,
+          request.certLabel,
+          request.certRole,
+          request.log,
+        );
+        return result;
+      } catch (err) {
+        const statusCode = err.statusCode || 500;
+        return reply.code(statusCode).send({ error: err.message });
+      }
+    },
+  );
+
+  // POST /api/tickets/instances/:instanceId/heartbeat — Instance liveness
+  fastify.post(
+    '/tickets/instances/:instanceId/heartbeat',
+    { preHandler: fastify.requireRole(['admin', 'agent']) },
+    async (request, reply) => {
+      const instanceId = HexIdSchema.parse(request.params.instanceId);
+      try {
+        const agentLabel = request.certLabel;
+        if (!agentLabel) {
+          return reply.code(400).send({ error: 'Agent label required' });
+        }
+        // Defense-in-depth: reject agents with no capabilities before acquiring
+        // the lock. The library's instanceHeartbeat verifies the specific scope.
+        if (request.certRole === 'agent') {
+          const caps = request.certCapabilities || [];
+          if (caps.length === 0) {
+            return reply.code(404).send({ error: 'Not found' });
+          }
+        }
+        const result = await instanceHeartbeat(instanceId, agentLabel);
+        return result;
+      } catch (err) {
+        const statusCode = err.statusCode || 500;
+        return reply.code(statusCode).send({ error: err.message });
+      }
+    },
+  );
+
+  // -----------------------------------------------------------------------
+  // Instance assignment (admin only)
+  // -----------------------------------------------------------------------
+
+  // POST /api/tickets/assignments — Assign agent to instance
+  fastify.post(
+    '/tickets/assignments',
+    { preHandler: fastify.requireRole(['admin']) },
+    async (request, reply) => {
+      const body = AssignmentSchema.parse(request.body);
+      try {
+        const { isExisting, ...response } = await createAssignment(
+          body.agentLabel,
+          body.instanceScope,
+          request.log,
+        );
+        return reply.code(isExisting ? 200 : 201).send(response);
+      } catch (err) {
+        const statusCode = err.statusCode || 500;
+        return reply.code(statusCode).send({ error: err.message });
+      }
+    },
+  );
+
+  // DELETE /api/tickets/assignments/:agentLabel/:instanceScope — Remove assignment
+  fastify.delete(
+    '/tickets/assignments/:agentLabel/:instanceScope',
+    { preHandler: fastify.requireRole(['admin']) },
+    async (request, reply) => {
+      const agentLabel = AgentLabelSchema.parse(request.params.agentLabel);
+      const instanceScope = InstanceScopeSchema.parse(request.params.instanceScope);
+      try {
+        const result = await removeAssignment(agentLabel, instanceScope, request.log);
+        return result;
+      } catch (err) {
+        const statusCode = err.statusCode || 500;
+        return reply.code(statusCode).send({ error: err.message });
+      }
+    },
+  );
+
+  // GET /api/tickets/assignments — List all assignments
+  fastify.get(
+    '/tickets/assignments',
+    { preHandler: fastify.requireRole(['admin']) },
+    async (request, reply) => {
+      const filters = {};
+      if (request.query.agentLabel)
+        filters.agentLabel = AgentLabelSchema.parse(request.query.agentLabel);
+      if (request.query.instanceScope)
+        filters.instanceScope = InstanceScopeSchema.parse(request.query.instanceScope);
+      try {
+        const result = await listAssignments(filters);
+        return result;
+      } catch (err) {
+        const statusCode = err.statusCode || 500;
+        return reply.code(statusCode).send({ error: err.message });
+      }
+    },
+  );
+
+  // -----------------------------------------------------------------------
+  // Ticket operations (agent, scoped)
+  // -----------------------------------------------------------------------
+
+  // POST /api/tickets — Request a ticket
+  fastify.post(
+    '/tickets',
+    { preHandler: fastify.requireRole(['admin', 'agent']) },
+    async (request, reply) => {
+      const body = RequestTicketSchema.parse(request.body);
+      try {
+        // Verify caller has the base scope capability
+        if (request.certRole === 'agent') {
+          const caps = request.certCapabilities || [];
+          if (!caps.includes(body.scope)) {
+            return reply.code(404).send({ error: 'Not found' });
+          }
+        }
+
+        const sourceLabel = request.certLabel;
+        if (!sourceLabel) {
+          return reply.code(400).send({ error: 'Agent label required' });
+        }
+        const result = await requestTicket(
+          body.scope,
+          body.instanceId,
+          body.target,
+          sourceLabel,
+          request.log,
+        );
+        return reply.code(201).send(result);
+      } catch (err) {
+        const statusCode = err.statusCode || 500;
+        return reply.code(statusCode).send({ error: err.message });
+      }
+    },
+  );
+
+  // GET /api/tickets/inbox — Retrieve pending tickets
+  fastify.get(
+    '/tickets/inbox',
+    { preHandler: fastify.requireRole(['admin', 'agent']) },
+    async (request, reply) => {
+      try {
+        const agentLabel = request.certLabel;
+        if (!agentLabel) {
+          return reply.code(400).send({ error: 'Agent label required' });
+        }
+        const result = await getTicketInbox(agentLabel);
+        return result;
+      } catch (err) {
+        const statusCode = err.statusCode || 500;
+        return reply.code(statusCode).send({ error: err.message });
+      }
+    },
+  );
+
+  // POST /api/tickets/validate — Validate a ticket
+  fastify.post(
+    '/tickets/validate',
+    { preHandler: fastify.requireRole(['admin', 'agent']) },
+    async (request, reply) => {
+      const body = ValidateTicketSchema.parse(request.body);
+      try {
+        const callerLabel = request.certLabel;
+        if (!callerLabel) {
+          return reply.code(401).send({ error: 'Invalid ticket' });
+        }
+        const result = await validateTicket(body.ticketId, callerLabel, request.log);
+        return result;
+      } catch (err) {
+        const statusCode = err.statusCode || 500;
+        return reply.code(statusCode).send({ error: err.message });
+      }
+    },
+  );
+
+  // GET /api/tickets — List active tickets (admin)
+  fastify.get(
+    '/tickets',
+    { preHandler: fastify.requireRole(['admin']) },
+    async (request, reply) => {
+      try {
+        const result = await listTickets();
+        return result;
+      } catch (err) {
+        const statusCode = err.statusCode || 500;
+        return reply.code(statusCode).send({ error: err.message });
+      }
+    },
+  );
+
+  // DELETE /api/tickets/:ticketId — Revoke a ticket (admin)
+  fastify.delete(
+    '/tickets/:ticketId',
+    { preHandler: fastify.requireRole(['admin']) },
+    async (request, reply) => {
+      const ticketId = HexIdSchema.parse(request.params.ticketId);
+      try {
+        const result = await revokeTicket(ticketId, request.log);
+        return result;
+      } catch (err) {
+        const statusCode = err.statusCode || 500;
+        return reply.code(statusCode).send({ error: err.message });
+      }
+    },
+  );
+
+  // -----------------------------------------------------------------------
+  // Session management (agent + admin)
+  // -----------------------------------------------------------------------
+
+  // POST /api/tickets/sessions — Report session creation
+  fastify.post(
+    '/tickets/sessions',
+    { preHandler: fastify.requireRole(['admin', 'agent']) },
+    async (request, reply) => {
+      const body = CreateSessionSchema.parse(request.body);
+      try {
+        const callerLabel = request.certLabel;
+        if (!callerLabel) {
+          return reply.code(400).send({ error: 'Agent label required' });
+        }
+        const result = await createSession(body.ticketId, callerLabel, request.log);
+        return reply.code(201).send(result);
+      } catch (err) {
+        const statusCode = err.statusCode || 500;
+        return reply.code(statusCode).send({ error: err.message });
+      }
+    },
+  );
+
+  // POST /api/tickets/sessions/:sessionId/heartbeat — Session heartbeat
+  fastify.post(
+    '/tickets/sessions/:sessionId/heartbeat',
+    { preHandler: fastify.requireRole(['admin', 'agent']) },
+    async (request, reply) => {
+      const sessionId = SessionIdSchema.parse(request.params.sessionId);
+      try {
+        const callerLabel = request.certLabel;
+        if (!callerLabel) {
+          return reply.code(400).send({ error: 'Agent label required' });
+        }
+        const result = await sessionHeartbeat(sessionId, callerLabel);
+        return result;
+      } catch (err) {
+        const statusCode = err.statusCode || 500;
+        return reply.code(statusCode).send({ error: err.message });
+      }
+    },
+  );
+
+  // PATCH /api/tickets/sessions/:sessionId — Update session status
+  fastify.patch(
+    '/tickets/sessions/:sessionId',
+    { preHandler: fastify.requireRole(['admin', 'agent']) },
+    async (request, reply) => {
+      const sessionId = SessionIdSchema.parse(request.params.sessionId);
+      const body = UpdateSessionSchema.parse(request.body);
+      try {
+        const callerLabel = request.certLabel;
+        if (!callerLabel) {
+          return reply.code(400).send({ error: 'Agent label required' });
+        }
+        const result = await updateSession(sessionId, body.status, callerLabel);
+        return result;
+      } catch (err) {
+        const statusCode = err.statusCode || 500;
+        return reply.code(statusCode).send({ error: err.message });
+      }
+    },
+  );
+
+  // DELETE /api/tickets/sessions/:sessionId — Admin kill session
+  fastify.delete(
+    '/tickets/sessions/:sessionId',
+    { preHandler: fastify.requireRole(['admin']) },
+    async (request, reply) => {
+      const sessionId = SessionIdSchema.parse(request.params.sessionId);
+      try {
+        const result = await killSession(sessionId, request.log);
+        return result;
+      } catch (err) {
+        const statusCode = err.statusCode || 500;
+        return reply.code(statusCode).send({ error: err.message });
+      }
+    },
+  );
+
+  // GET /api/tickets/sessions — List active sessions (admin)
+  fastify.get(
+    '/tickets/sessions',
+    { preHandler: fastify.requireRole(['admin']) },
+    async (request, reply) => {
+      try {
+        const result = await listSessions();
+        return result;
+      } catch (err) {
+        const statusCode = err.statusCode || 500;
+        return reply.code(statusCode).send({ error: err.message });
+      }
+    },
+  );
+}