@lamalibre/create-lamaste 4.0.0

package/vendor/serverd/src/routes/management/users.js

@@ -0,0 +1,377 @@
+import { z } from 'zod';
+import {
+  readUsers,
+  readUsersRaw,
+  writeUsers,
+  reloadAuthelia,
+  hashPassword,
+  generateTotpSecret,
+  writeTotpToDatabase,
+} from '../../lib/authelia.js';
+import { removeGrantsForUser } from '../../lib/user-access.js';
+import { bumpUserEpoch } from '../../lib/config.js';
+import { gatekeeperRequest } from '../../lib/gatekeeper-client.js';
+
+const CreateUserSchema = z.object({
+  username: z
+    .string()
+    .min(2)
+    .max(32)
+    .regex(
+      /^[a-z0-9][a-z0-9_-]*$/,
+      'Username must start with a lowercase letter or digit and may contain underscores or hyphens',
+    ),
+  displayname: z.string().min(1).max(100),
+  email: z.string().email(),
+  password: z.string().min(8).max(128),
+  groups: z.array(z.string()).optional().default([]),
+});
+
+const UsernameParamSchema = z.object({
+  username: z
+    .string()
+    .min(2)
+    .max(32)
+    .regex(/^[a-z0-9][a-z0-9_-]*$/, 'Invalid username format'),
+});
+
+const UpdateUserSchema = z
+  .object({
+    displayname: z.string().min(1).max(100).optional(),
+    email: z.string().email().optional(),
+    password: z.string().min(8).max(128).optional(),
+    groups: z.array(z.string()).optional(),
+  })
+  .refine((data) => Object.keys(data).length > 0, {
+    message: 'At least one field must be provided',
+  });
+
+export default async function usersRoutes(fastify, _opts) {
+  // GET /api/users — list all users (no sensitive fields)
+  fastify.get(
+    '/users',
+    {
+      preHandler: fastify.requireRole(['admin']),
+    },
+    async (request, reply) => {
+      try {
+        const users = await readUsers();
+        const sorted = users.sort((a, b) => a.username.localeCompare(b.username));
+        return { users: sorted };
+      } catch (err) {
+        request.log.error(err, 'Failed to read user database');
+        return reply.code(500).send({ error: 'Failed to read user database' });
+      }
+    },
+  );
+
+  // POST /api/users — create a new user
+  fastify.post(
+    '/users',
+    {
+      preHandler: fastify.requireRole(['admin']),
+      // Strict tier — user creation hashes a fresh password and provisions
+      // an identity. Brute-forcing this surface is cheap if uncapped.
+      config: { rateLimit: { max: 5, timeWindow: '1 minute' } },
+    },
+    async (request, reply) => {
+      const body = CreateUserSchema.parse(request.body);
+
+      let usersData;
+      try {
+        usersData = await readUsersRaw();
+      } catch (err) {
+        request.log.error(err, 'Failed to read user database');
+        return reply.code(500).send({ error: 'Failed to read user database' });
+      }
+
+      if (usersData.users[body.username]) {
+        return reply.code(409).send({ error: 'Username already exists' });
+      }
+
+      let hash;
+      try {
+        hash = await hashPassword(body.password);
+      } catch (err) {
+        request.log.error(err, 'Failed to hash password');
+        return reply.code(500).send({ error: 'Failed to hash password' });
+      }
+
+      usersData.users[body.username] = {
+        displayname: body.displayname,
+        email: body.email,
+        password: hash,
+        groups: body.groups,
+      };
+
+      try {
+        await writeUsers(usersData);
+      } catch (err) {
+        request.log.error(err, 'Failed to update user database');
+        return reply.code(500).send({ error: 'Failed to update user database' });
+      }
+
+      try {
+        await reloadAuthelia();
+      } catch (err) {
+        request.log.warn(err, 'Failed to reload Authelia after user creation');
+      }
+
+      return reply.code(201).send({
+        ok: true,
+        user: {
+          username: body.username,
+          displayname: body.displayname,
+          email: body.email,
+          groups: body.groups,
+        },
+      });
+    },
+  );
+
+  // PUT /api/users/:username — update a user
+  fastify.put(
+    '/users/:username',
+    {
+      preHandler: fastify.requireRole(['admin']),
+      // Strict tier — body may include a fresh password that we re-hash;
+      // treat as auth-adjacent and bound to the same 5/min ceiling as
+      // creation.
+      config: { rateLimit: { max: 5, timeWindow: '1 minute' } },
+    },
+    async (request, reply) => {
+      const { username } = UsernameParamSchema.parse(request.params);
+      const body = UpdateUserSchema.parse(request.body);
+
+      let usersData;
+      try {
+        usersData = await readUsersRaw();
+      } catch (err) {
+        request.log.error(err, 'Failed to read user database');
+        return reply.code(500).send({ error: 'Failed to read user database' });
+      }
+
+      if (!usersData.users[username]) {
+        return reply.code(404).send({ error: 'User not found' });
+      }
+
+      const user = usersData.users[username];
+
+      if (body.displayname !== undefined) {
+        user.displayname = body.displayname;
+      }
+      if (body.email !== undefined) {
+        user.email = body.email;
+      }
+      if (body.groups !== undefined) {
+        user.groups = body.groups;
+      }
+      if (body.password !== undefined) {
+        try {
+          user.password = await hashPassword(body.password);
+        } catch (err) {
+          request.log.error(err, 'Failed to hash password');
+          return reply.code(500).send({ error: 'Failed to hash password' });
+        }
+      }
+
+      try {
+        await writeUsers(usersData);
+      } catch (err) {
+        request.log.error(err, 'Failed to update user database');
+        return reply.code(500).send({ error: 'Failed to update user database' });
+      }
+
+      try {
+        await reloadAuthelia();
+      } catch (err) {
+        request.log.warn(err, 'Failed to reload Authelia after user update');
+      }
+
+      return {
+        ok: true,
+        user: {
+          username,
+          displayname: user.displayname,
+          email: user.email,
+          groups: user.groups || [],
+        },
+      };
+    },
+  );
+
+  // DELETE /api/users/:username — delete a user
+  fastify.delete(
+    '/users/:username',
+    {
+      preHandler: fastify.requireRole(['admin']),
+      // Moderate tier — destructive management write; the cascade also
+      // fires off gatekeeper/cleanup work, so we cap concurrency to avoid
+      // hammering downstream services.
+      config: { rateLimit: { max: 30, timeWindow: '1 minute' } },
+    },
+    async (request, reply) => {
+      const { username } = UsernameParamSchema.parse(request.params);
+
+      let usersData;
+      try {
+        usersData = await readUsersRaw();
+      } catch (err) {
+        request.log.error(err, 'Failed to read user database');
+        return reply.code(500).send({ error: 'Failed to read user database' });
+      }
+
+      if (!usersData.users[username]) {
+        return reply.code(404).send({ error: 'User not found' });
+      }
+
+      const userCount = Object.keys(usersData.users).length;
+      if (userCount <= 1) {
+        return reply.code(400).send({ error: 'Cannot delete the last user' });
+      }
+
+      delete usersData.users[username];
+
+      try {
+        await writeUsers(usersData);
+      } catch (err) {
+        request.log.error(err, 'Failed to update user database');
+        return reply.code(500).send({ error: 'Failed to update user database' });
+      }
+
+      try {
+        await reloadAuthelia();
+      } catch (err) {
+        request.log.warn(err, 'Failed to reload Authelia after user deletion');
+      }
+
+      // ---------------------------------------------------------------
+      // Cascade cleanup. The user is already gone from users.yml; from
+      // here on we never roll back. Failures collect into `warnings` so
+      // the admin sees a partial-success response and can investigate.
+      // ---------------------------------------------------------------
+      const warnings = [];
+
+      // 1. Legacy user-plugin-access.json grants (pre-gatekeeper migration)
+      try {
+        const removed = await removeGrantsForUser(username, request.log);
+        if (removed > 0) {
+          request.log.info(
+            { username, removed },
+            'Cascade: removed legacy user-plugin-access grants',
+          );
+        }
+      } catch (err) {
+        request.log.warn(
+          { err, username },
+          'Cascade: failed to remove legacy user-plugin-access grants',
+        );
+        warnings.push({
+          step: 'user-plugin-access',
+          message: `Failed to remove legacy grants: ${err.message}`,
+        });
+      }
+
+      // 2. Gatekeeper grants — single bulk-delete keyed by principal
+      try {
+        const result = await gatekeeperRequest(
+          'DELETE',
+          `/api/grants?principalType=user&principalId=${encodeURIComponent(username)}`,
+        );
+        if (result.ok) {
+          const removed =
+            result.data && typeof result.data === 'object' && 'removed' in result.data
+              ? result.data.removed
+              : 0;
+          if (removed > 0) {
+            request.log.info(
+              { username, removed },
+              'Cascade: removed gatekeeper grants for deleted user',
+            );
+          }
+        } else if (result.reason === 'unreachable' || result.reason === 'no-secret') {
+          request.log.warn(
+            { username, reason: result.reason },
+            'Cascade: gatekeeper unreachable — grants for deleted user remain in access-grants.json',
+          );
+          warnings.push({
+            step: 'gatekeeper',
+            message:
+              'Gatekeeper service was unreachable. Re-run grant cleanup once it is back online — grants for this user may still exist in access-grants.json.',
+          });
+        } else {
+          request.log.warn(
+            { username, statusCode: result.statusCode, error: result.error },
+            'Cascade: gatekeeper returned an error',
+          );
+          warnings.push({
+            step: 'gatekeeper',
+            message: `Gatekeeper returned HTTP ${result.statusCode}: ${result.error}`,
+          });
+        }
+      } catch (err) {
+        request.log.warn({ err, username }, 'Cascade: unexpected failure calling gatekeeper');
+        warnings.push({
+          step: 'gatekeeper',
+          message: `Unexpected failure: ${err.message}`,
+        });
+      }
+
+      // 3. Live user-access sessions — bump per-user epoch in panel.json so
+      //    middleware rejects every session token with iat < epoch.
+      try {
+        const epoch = await bumpUserEpoch(username);
+        request.log.info({ username, epoch }, 'Cascade: bumped user-access session epoch');
+      } catch (err) {
+        request.log.warn(
+          { err, username },
+          'Cascade: failed to bump user-access session epoch — old session tokens may still validate',
+        );
+        warnings.push({
+          step: 'session-epoch',
+          message: `Failed to invalidate live sessions: ${err.message}. Old session tokens for this username may still validate until their natural expiry.`,
+        });
+      }
+
+      const response = { ok: true };
+      if (warnings.length > 0) {
+        response.warnings = warnings;
+      }
+      return response;
+    },
+  );
+
+  // POST /api/users/:username/reset-totp — generate a new TOTP secret
+  fastify.post(
+    '/users/:username/reset-totp',
+    {
+      preHandler: fastify.requireRole(['admin']),
+    },
+    async (request, reply) => {
+      const { username } = UsernameParamSchema.parse(request.params);
+
+      let usersData;
+      try {
+        usersData = await readUsersRaw();
+      } catch (err) {
+        request.log.error(err, 'Failed to read user database');
+        return reply.code(500).send({ error: 'Failed to read user database' });
+      }
+
+      if (!usersData.users[username]) {
+        return reply.code(404).send({ error: 'User not found' });
+      }
+
+      const { secret, uri } = generateTotpSecret(username);
+
+      try {
+        await writeTotpToDatabase(username, secret);
+      } catch (err) {
+        request.log.error(err, 'Failed to write TOTP to Authelia database');
+        return reply.code(500).send({ error: 'Failed to write TOTP configuration' });
+      }
+
+      return { ok: true, totpUri: uri };
+    },
+  );
+}

package/vendor/serverd/src/routes/management.js

@@ -0,0 +1,36 @@
+import { managementOnly } from '../middleware/onboarding-guard.js';
+import systemRoutes from './management/system.js';
+import servicesRoutes from './management/services.js';
+import logsRoutes from './management/logs.js';
+import usersRoutes from './management/users.js';
+import certsRoutes from './management/certs.js';
+import tunnelRoutes from './management/tunnels.js';
+import sitesRoutes from './management/sites.js';
+import invitationRoutes from './management/invitations.js';
+import pluginRoutes from './management/plugins.js';
+import settingsRoutes from './management/settings.js';
+import ticketRoutes from './management/tickets.js';
+import identityRoutes from './management/identity.js';
+import storageRoutes from './management/storage.js';
+import gatekeeperProxyRoutes from './management/gatekeeper-proxy.js';
+import agentsRoutes from './management/agents.js';
+
+export default async function managementRoutes(fastify, _opts) {
+  fastify.addHook('onRequest', managementOnly());
+
+  await fastify.register(tunnelRoutes);
+  await fastify.register(sitesRoutes);
+  await fastify.register(systemRoutes);
+  await fastify.register(servicesRoutes);
+  await fastify.register(logsRoutes);
+  await fastify.register(usersRoutes);
+  await fastify.register(certsRoutes);
+  await fastify.register(invitationRoutes);
+  await fastify.register(pluginRoutes);
+  await fastify.register(settingsRoutes);
+  await fastify.register(ticketRoutes);
+  await fastify.register(identityRoutes);
+  await fastify.register(storageRoutes);
+  await fastify.register(gatekeeperProxyRoutes);
+  await fastify.register(agentsRoutes);
+}

package/vendor/serverd/src/routes/onboarding/dns.js

@@ -0,0 +1,101 @@
+import dns from 'node:dns/promises';
+import { CORE_SUBDOMAINS } from '@lamalibre/lamaste';
+import { getConfig, updateConfig } from '../../lib/config.js';
+
+/**
+ * Resolve A records for a hostname, returning an empty array on expected DNS errors.
+ */
+async function resolveA(hostname) {
+  try {
+    return await dns.resolve4(hostname);
+  } catch (err) {
+    if (err.code === 'ENOTFOUND' || err.code === 'ENODATA' || err.code === 'ETIMEOUT') {
+      return [];
+    }
+    throw err;
+  }
+}
+
+/**
+ * Build a human-readable diagnostic message for the DNS verification result.
+ */
+function buildMessage({ domain, expectedIp, records, wildcardOk, apexOk }) {
+  const failing = records.filter((r) => !r.ok);
+  if (failing.length > 0) {
+    const details = failing
+      .map((r) =>
+        r.resolvedIps.length > 0
+          ? `${r.name} resolves to ${r.resolvedIps.join(', ')}`
+          : `${r.name} does not resolve`,
+      )
+      .join('; ');
+    return `${details}. Point ${failing.map((r) => r.name).join(', ')} (or a wildcard *.${domain}) at ${expectedIp}. DNS propagation can take up to 48 hours, but usually completes within minutes.`;
+  }
+
+  const notes = [];
+  if (!wildcardOk) {
+    notes.push(
+      'Wildcard DNS is not configured — you will need to add individual subdomain records for each tunnel.',
+    );
+  }
+  if (!apexOk) {
+    notes.push(
+      `${domain} itself does not point to this server — that is only needed to serve a site on it.`,
+    );
+  }
+  return ['DNS is correctly configured. panel, auth and tunnel resolve to your server.', ...notes]
+    .join(' ')
+    .trim();
+}
+
+export default async function dnsRoute(fastify, _opts) {
+  fastify.post('/verify-dns', async (request, reply) => {
+    const config = getConfig();
+    const { status } = config.onboarding;
+
+    if (status !== 'DOMAIN_SET' && status !== 'DNS_READY') {
+      return reply.code(409).send({
+        error: 'Domain must be set before DNS verification',
+        onboardingStatus: status,
+      });
+    }
+
+    const { domain, ip: expectedIp } = config;
+
+    // Onboarding issues certificates for the core subdomains only, so those
+    // are the names that must resolve here. The apex is reported but not
+    // required: it may still belong to another host until a site is put on it.
+    const coreNames = CORE_SUBDOMAINS.map((sub) => `${sub}.${domain}`);
+    const [coreResolved, apexResolvedIps, wildcardResolvedIps] = await Promise.all([
+      Promise.all(coreNames.map((name) => resolveA(name))),
+      resolveA(domain),
+      resolveA(`test-lamaste-check.${domain}`),
+    ]);
+
+    const records = coreNames.map((name, i) => {
+      const resolvedIps = coreResolved[i] ?? [];
+      return { name, resolvedIps, ok: resolvedIps.includes(expectedIp) };
+    });
+    const ok = records.every((r) => r.ok);
+    const apexOk = apexResolvedIps.includes(expectedIp);
+    const wildcardOk = wildcardResolvedIps.includes(expectedIp);
+
+    if (ok) {
+      await updateConfig({ onboarding: { status: 'DNS_READY' } });
+    }
+
+    const message = buildMessage({ domain, expectedIp, records, wildcardOk, apexOk });
+
+    return {
+      ok,
+      domain,
+      expectedIp,
+      records,
+      apexOk,
+      apexResolvedIps,
+      wildcardOk,
+      wildcardResolvedIps,
+      message,
+    };
+  });
+}

package/vendor/serverd/src/routes/onboarding/domain.js

@@ -0,0 +1,42 @@
+import { z } from 'zod';
+import { LETSENCRYPT_EMAIL_REGEX } from '@lamalibre/lamaste';
+import { getConfig, updateConfig } from '../../lib/config.js';
+
+const DomainSchema = z.object({
+  domain: z
+    .string()
+    .min(1)
+    .regex(/^(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/)
+    .describe('Fully qualified domain name'),
+  email: z
+    .string()
+    .regex(
+      LETSENCRYPT_EMAIL_REGEX,
+      'Enter an email address that starts with a letter or digit, e.g. admin@example.com',
+    )
+    .describe("Email for Let's Encrypt registration"),
+});
+
+export default async function domainRoute(fastify, _opts) {
+  fastify.post('/domain', async (request, reply) => {
+    const body = DomainSchema.parse(request.body);
+
+    const config = getConfig();
+    const { status } = config.onboarding;
+
+    if (status !== 'FRESH' && status !== 'DOMAIN_SET') {
+      return reply.code(409).send({
+        error: 'Cannot change domain in current state',
+        onboardingStatus: status,
+      });
+    }
+
+    await updateConfig({
+      domain: body.domain,
+      email: body.email,
+      onboarding: { status: 'DOMAIN_SET' },
+    });
+
+    return { ok: true, domain: body.domain, email: body.email };
+  });
+}

package/vendor/serverd/src/routes/onboarding/index.js

@@ -0,0 +1,18 @@
+import { onboardingOnly } from '../../middleware/onboarding-guard.js';
+import statusRoute from './status.js';
+import domainRoute from './domain.js';
+import dnsRoute from './dns.js';
+import provisionRoute from './provision.js';
+
+export default async function onboardingRoutes(fastify, _opts) {
+  // Status endpoint is always accessible — no guard
+  await fastify.register(statusRoute);
+
+  // All other onboarding routes are guarded: return 410 after onboarding completes
+  await fastify.register(async function guarded(app) {
+    app.addHook('onRequest', onboardingOnly());
+    await app.register(domainRoute);
+    await app.register(dnsRoute);
+    await app.register(provisionRoute);
+  });
+}