@lamalibre/create-lamaste 4.1.0 → 4.2.0

package/vendor/server-ui/dist/index.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Lamaste</title>
-    <script type="module" crossorigin src="/assets/index-B0nWuUyL.js"></script>
+    <script type="module" crossorigin src="/assets/index-B5Wp8lu-.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-BqWWFlTU.css">
   </head>
   <body style="background-color: #09090b">

package/vendor/serverd/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/lamaste-serverd",
-  "version": "4.1.0",
+  "version": "4.2.0",
   "description": "Lamaste server daemon — REST API and plugin host",
   "license": "SEE LICENSE IN LICENSE.md",
   "publishConfig": {
@@ -29,7 +29,7 @@
     "@fastify/rate-limit": "^10.3.0",
     "@fastify/static": "^9.1.1",
     "@fastify/websocket": "^11.0.0",
-    "@lamalibre/lamaste": "^4.1.0",
+    "@lamalibre/lamaste": "^4.2.0",
     "bcryptjs": "^3.0.3",
     "execa": "^9.6.1",
     "fastify": "^5.8.4",

package/vendor/serverd/src/lib/migrations/state/0005_plugin_hosting.sql

@@ -0,0 +1,3 @@
+-- Where a plugin's code runs (manifest `hosting`, 4.2). Rows written before
+-- the column existed are server plugins.
+ALTER TABLE plugins ADD COLUMN hosting TEXT NOT NULL DEFAULT 'server';

package/vendor/serverd/src/lib/plugin-oidc.js

@@ -3,9 +3,11 @@
  *
  * Two sources declare clients on the relay's Authelia:
  *
- * - every installed server plugin may declare them in its manifest
- *   (`oidcClients`, see the core `ManifestSchema`); only the clients of
- *   enabled plugins are served;
+ * - every installed plugin may declare them in its manifest (`oidcClients`,
+ *   see the core `ManifestSchema`); only the clients of enabled plugins are
+ *   served. Hosting does not matter: an agent-hosted plugin (`hosting:
+ *   "agent"`, never imported by the panel) registers its clients exactly as
+ *   a server plugin does — the manifest is all this reads;
  * - the panel itself declares the confidential `lamaste-server` client
  *   when the registry credential uses `auth.kind: 'oidc'`.
  *
@@ -94,6 +96,30 @@ async function collectAllClients(overrides = {}) {
   return [...(await collectPluginOidcClients()), ...lamasteOwnClient(registryAuth)];
 }
 
+/**
+ * What Authelia should serve and which secrets the store should hold, from
+ * the stored state: every installed plugin's clients (an installed plugin
+ * keeps its confidential-client secret while disabled), the clients of
+ * enabled plugins served, and the panel's own scopes when its client is.
+ * Pure with respect to Authelia — nothing is written.
+ *
+ * @param {{ registryAuth?: { registryUrl: string } | null }} [overrides] see collectAllClients
+ * @returns {Promise<{
+ *   confidential: Array<{ id: string, plugin: string }>,
+ *   served: Array<import('@lamalibre/lamaste/server').AutheliaOidcClient>,
+ *   scopes: Record<string, { claims: readonly string[] }>,
+ * }>}
+ */
+export async function planOidcClients(overrides = {}) {
+  const all = await collectAllClients(overrides);
+  const served = all.filter((c) => c.enabled).map(({ enabled: _enabled, ...client }) => client);
+  return {
+    confidential: all.filter((c) => c.confidential).map((c) => ({ id: c.id, plugin: c.plugin })),
+    served,
+    scopes: served.some((c) => c.plugin === 'lamaste') ? LAMASTE_REGISTRY_OIDC_SCOPES : {},
+  };
+}
+
 /**
  * Sync Authelia's OIDC clients and the secret store with the plugins and
  * the registry credential. Returns what was done, or `null` when the panel
@@ -115,11 +141,8 @@ export async function syncOidcClients(logger, overrides = {}) {
     return null;
   }
 
-  const all = await collectAllClients(overrides);
-  const reconciled = await reconcileOidcClientSecrets(
-    STATE_DIR,
-    all.filter((c) => c.confidential).map((c) => ({ id: c.id, plugin: c.plugin })),
-  );
+  const { confidential, served, scopes } = await planOidcClients(overrides);
+  const reconciled = await reconcileOidcClientSecrets(STATE_DIR, confidential);
   if (reconciled.created.length > 0 || reconciled.removed.length > 0) {
     logger.info(
       { created: reconciled.created.map((c) => c.id), removed: reconciled.removed },
@@ -127,8 +150,6 @@ export async function syncOidcClients(logger, overrides = {}) {
     );
   }
 
-  const served = all.filter((c) => c.enabled).map(({ enabled: _enabled, ...client }) => client);
-  const scopes = served.some((c) => c.plugin === 'lamaste') ? LAMASTE_REGISTRY_OIDC_SCOPES : {};
   const result = await updateOidcProvider(domain, served, {
     secretDigests: reconciled.digests,
     scopes,
@@ -199,12 +220,8 @@ export async function rotatePluginOidcClientSecret(pluginName, clientId, logger)
   const digests = await readOidcClientSecretDigests(STATE_DIR);
   if (client.enabled) {
     const domain = getConfig().domain;
-    const all = await collectAllClients();
-    const served = all.filter((c) => c.enabled).map(({ enabled: _enabled, ...c }) => c);
-    await updateOidcProvider(domain, served, {
-      secretDigests: digests,
-      scopes: served.some((c) => c.plugin === 'lamaste') ? LAMASTE_REGISTRY_OIDC_SCOPES : {},
-    });
+    const { served, scopes } = await planOidcClients();
+    await updateOidcProvider(domain, served, { secretDigests: digests, scopes });
   }
   logger.info({ plugin: pluginName, clientId }, 'OIDC client secret rotated');
   return {

package/vendor/serverd/src/lib/plugins.js

@@ -14,6 +14,7 @@ import path from 'node:path';
 import { z } from 'zod';
 import { execa } from 'execa';
 import {
+  DEFAULT_PLUGIN_HOSTING,
   RESERVED_API_PREFIXES,
   RESERVED_NAV_LABELS,
   derivePluginRoute,
@@ -60,8 +61,8 @@ async function getStmts() {
     insert: db.prepare(`
       INSERT INTO plugins
         (name, display_name, package_name, version, description, capabilities,
-         packages, panel, config, modes, status, installed_at, enabled_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+         packages, panel, config, modes, hosting, status, installed_at, enabled_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `),
     deleteByName: db.prepare('DELETE FROM plugins WHERE name = ?'),
     deleteAll: db.prepare('DELETE FROM plugins'),
@@ -86,7 +87,10 @@ async function getStmts() {
 // JSON-encoded TEXT in storage. They round-trip through JSON.parse/stringify
 // so callers see the same shape the JSON-backed module returned — including
 // `undefined` for optional fields (mirroring the JSON object layout where
-// missing keys are absent rather than null).
+// missing keys are absent rather than null). `hosting` is plain TEXT
+// ('server' | 'agent'; rows from before 4.2 default to 'server'): an
+// agent-hosted plugin is installed (npm, manifest) like any other, but the
+// plugin host never imports it — see `pluginHostPlugin`.
 
 function rowToPlugin(row) {
   const entry = {
@@ -94,6 +98,7 @@ function rowToPlugin(row) {
     packageName: row.package_name,
     version: row.version,
     capabilities: row.capabilities ? JSON.parse(row.capabilities) : [],
+    hosting: row.hosting,
     status: row.status,
     installedAt: row.installed_at,
   };
@@ -155,6 +160,7 @@ export async function writePlugins(data) {
         nullableJson(p.panel),
         nullableJson(p.config),
         nullableJson(p.modes),
+        p.hosting ?? DEFAULT_PLUGIN_HOSTING,
         p.status,
         p.installedAt,
         nullableString(p.enabledAt),
@@ -359,6 +365,7 @@ export function installPlugin(packageName, logger) {
       panel: manifest.panel,
       config: manifest.config,
       modes: manifest.modes,
+      hosting: manifest.hosting,
       status: 'disabled',
       installedAt: new Date().toISOString(),
     };
@@ -376,6 +383,7 @@ export function installPlugin(packageName, logger) {
         nullableJson(entry.panel),
         nullableJson(entry.config),
         nullableJson(entry.modes),
+        entry.hosting,
         entry.status,
         entry.installedAt,
         null,

package/vendor/serverd/src/routes/management/storage.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { isAgentHostedPlugin } from '@lamalibre/lamaste';
 import {
   registerStorageServer,
   removeStorageServer,
@@ -118,12 +119,19 @@ export default async function storageRoutes(fastify, _opts) {
 
       // Validate plugin exists in registry
       const registry = await readPlugins();
-      const pluginExists = registry.plugins.some((p) => p.name === body.pluginName);
-      if (!pluginExists) {
+      const plugin = registry.plugins.find((p) => p.name === body.pluginName);
+      if (!plugin) {
         return reply.code(404).send({
           error: `Plugin "${body.pluginName}" not found in registry`,
         });
       }
+      // A binding is handed to the plugin's server code when the panel
+      // mounts it; an agent-hosted plugin has none to receive it.
+      if (isAgentHostedPlugin(plugin)) {
+        return reply.code(400).send({
+          error: `Plugin "${body.pluginName}" is agent-hosted — storage binds to server-hosted plugins only`,
+        });
+      }
 
       try {
         const binding = await bindPluginStorage(body.pluginName, body.storageServerId);