@lamalibre/create-lamaste 4.2.0 → 4.3.0

package/vendor/gatekeeper/dist/lib/types.d.ts

@@ -153,6 +153,18 @@ export interface TunnelInfo {
     readonly fqdn: string;
     readonly accessMode: AccessMode;
     readonly enabled: boolean;
+    /**
+     * Set on a plugin tunnel (`type: 'plugin'` with an owning agent): the
+     * request goes to that agent's lamaste-agentd, which accepts the user only
+     * with a relay assertion Gatekeeper signs (see authz.ts).
+     */
+    readonly plugin?: PluginTunnelTarget | undefined;
+}
+/** Where a plugin tunnel's requests go: the agent, its daemon's port, the plugin route. */
+export interface PluginTunnelTarget {
+    readonly agentLabel: string;
+    readonly port: number;
+    readonly route: string;
 }
 /**
  * Cached Authelia session data.

package/vendor/gatekeeper/dist/lib/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/lib/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEhE;;GAEG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,aAAa,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;CAC5C;AAED,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,YAAY,CAAC;AAExD;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtD;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACtD,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACtD,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACxD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/lib/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEhE;;GAEG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,aAAa,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;CAC5C;AAED,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,YAAY,CAAC;AAExD;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtD;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAClD;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACtD,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACtD,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACxD"}

package/vendor/gatekeeper/dist/server/index.d.ts

@@ -1,5 +1,6 @@
 import '../boot.js';
 import Fastify from 'fastify';
+import type { RelaySigner } from '@lamalibre/lamaste';
 import type { TunnelInfo, GatekeeperSettings, AutheliaSession } from '../lib/types.js';
 export declare function createServer(): Promise<ReturnType<typeof Fastify>>;
 declare module 'fastify' {
@@ -8,6 +9,7 @@ declare module 'fastify' {
         getSettings(): GatekeeperSettings;
         getSessionCache(): Map<string, AutheliaSession>;
         getCacheVersion(): number;
+        getRelaySigner(): RelaySigner;
         bustCache(): void;
         updateSettings(s: GatekeeperSettings): void;
     }

package/vendor/gatekeeper/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,CAAC;AAEpB,OAAO,OAAO,MAAM,SAAS,CAAC;AAc9B,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAoHvF,wBAAsB,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,CA6IxE;AAkCD,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,UAAU,IAAI,UAAU,EAAE,CAAC;QAC3B,WAAW,IAAI,kBAAkB,CAAC;QAClC,eAAe,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAChD,eAAe,IAAI,MAAM,CAAC;QAC1B,SAAS,IAAI,IAAI,CAAC;QAClB,cAAc,CAAC,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;KAC7C;CACF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,CAAC;AAEpB,OAAO,OAAO,MAAM,SAAS,CAAC;AAW9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAStD,OAAO,KAAK,EACV,UAAU,EAEV,kBAAkB,EAClB,eAAe,EAChB,MAAM,iBAAiB,CAAC;AA4JzB,wBAAsB,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,CAkJxE;AAkCD,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,UAAU,IAAI,UAAU,EAAE,CAAC;QAC3B,WAAW,IAAI,kBAAkB,CAAC;QAClC,eAAe,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAChD,eAAe,IAAI,MAAM,CAAC;QAC1B,cAAc,IAAI,WAAW,CAAC;QAC9B,SAAS,IAAI,IAAI,CAAC;QAClB,cAAc,CAAC,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;KAC7C;CACF"}

package/vendor/gatekeeper/dist/server/index.js

@@ -5,7 +5,7 @@ import rateLimit from '@fastify/rate-limit';
 import { watch } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
-import { atomicWriteJSON } from '@lamalibre/lamaste';
+import { atomicWriteJSON, AGENT_LABEL_REGEX, createRelaySigner, RELAY_SIGNING_KEY_FILE, } from '@lamalibre/lamaste';
 import { DEFAULT_DATA_DIR, GROUPS_FILE, GRANTS_FILE, SETTINGS_FILE, GATEKEEPER_PORT, SESSION_CACHE_TTL_MS, } from '../lib/constants.js';
 import { registerCacheInvalidator } from '../lib/cache-bust.js';
 import { authzRoutes } from './routes/authz.js';
@@ -16,6 +16,14 @@ import { accessRequestRoutes } from './routes/access-request.js';
 const dataDir = process.env.LAMALIBRE_LAMASTE_DATA_DIR ?? DEFAULT_DATA_DIR;
 const tunnelsPath = path.join(dataDir, 'tunnels.json');
 const settingsPath = path.join(dataDir, SETTINGS_FILE);
+/**
+ * The relay's assertion signing key, created by the panel (never here). A
+ * plugin tunnel's user is vouched for to the agent with it; the file is
+ * re-read when it changes.
+ */
+const relaySigner = createRelaySigner(path.join(dataDir, RELAY_SIGNING_KEY_FILE), {
+    create: false,
+});
 // ---------------------------------------------------------------------------
 // In-memory caches (refreshed by file watch + TTL)
 // ---------------------------------------------------------------------------
@@ -30,17 +38,43 @@ let cacheVersion = 0;
 // ---------------------------------------------------------------------------
 // File loaders
 // ---------------------------------------------------------------------------
+/**
+ * The agent-side target of a plugin tunnel, or undefined. Only a well-formed
+ * one is returned: its fields end up in a signed assertion.
+ */
+function pluginTunnelTarget(t) {
+    const { type, agentLabel, port, pluginRoute } = t;
+    if (type !== 'plugin' ||
+        typeof agentLabel !== 'string' ||
+        !AGENT_LABEL_REGEX.test(agentLabel) ||
+        typeof port !== 'number' ||
+        !Number.isInteger(port) ||
+        port < 1 ||
+        port > 65535 ||
+        typeof pluginRoute !== 'string' ||
+        !/^[a-z0-9][a-z0-9-]{0,63}$/.test(pluginRoute)) {
+        return undefined;
+    }
+    return { agentLabel, port, route: pluginRoute };
+}
 async function loadTunnels() {
     try {
         const raw = await readFile(tunnelsPath, 'utf-8');
         const parsed = JSON.parse(raw);
         if (!Array.isArray(parsed))
             return [];
-        return parsed.map((t) => ({
-            id: String(t.id ?? ''),
-            fqdn: String(t.fqdn ?? ''),
-            accessMode: t.accessMode ?? 'restricted',
-            enabled: t.enabled !== false,
+        return (parsed
+            // An internal plugin tunnel has no hostname: nothing to authorize.
+            .filter((t) => t.exposure !== 'internal' && t.fqdn)
+            .map((t) => {
+            const plugin = pluginTunnelTarget(t);
+            return {
+                id: String(t.id ?? ''),
+                fqdn: String(t.fqdn ?? ''),
+                accessMode: t.accessMode ?? 'restricted',
+                enabled: t.enabled !== false,
+                ...(plugin ? { plugin } : {}),
+            };
         }));
     }
     catch {
@@ -112,7 +146,11 @@ function watchFile(filePath, reload, logger) {
 export async function createServer() {
     const server = Fastify({
         logger: true,
-        trustProxy: 1,
+        // Forwarding headers are honoured only from loopback: the gatekeeper
+        // listens on 127.0.0.1 and its callers (nginx, the panel proxy) are
+        // local. Trust by address, not hop count — a hop count cannot tell a
+        // proxy from a direct client spoofing X-Forwarded-*.
+        trustProxy: '127.0.0.1',
     });
     // Global rate limit. The gatekeeper binds to 127.0.0.1 and is reached
     // exclusively by nginx auth_request and the panel proxy — both are
@@ -120,7 +158,7 @@ export async function createServer() {
     // per-IP limiter would collapse them into a single bucket and either
     // be useless or punish legitimate nginx traffic. We collapse the key
     // explicitly to one shared bucket and set a high ceiling; the hot
-    // /authz/check route then overrides this with its own ceiling that
+    // authorization routes then override this with their own ceiling that
     // makes the "nginx-only" assumption explicit.
     await server.register(rateLimit, {
         max: 1000,
@@ -135,6 +173,7 @@ export async function createServer() {
     server.decorate('getSettings', () => settingsCache);
     server.decorate('getSessionCache', () => sessionCache);
     server.decorate('getCacheVersion', () => cacheVersion);
+    server.decorate('getRelaySigner', () => relaySigner);
     const bustCache = () => {
         cacheVersion++;
         sessionCache.clear();

package/vendor/gatekeeper/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,CAAC;AACpB,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,SAAS,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,aAAa,EACb,eAAe,EACf,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,gBAAgB,CAAC;AAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;AACvD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAEvD,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E,mDAAmD;AACnD,IAAI,YAAY,GAAiB,EAAE,CAAC;AAEpC,gCAAgC;AAChC,IAAI,aAAa,GAAuB,EAAE,CAAC;AAE3C,yDAAyD;AACzD,MAAM,YAAY,GAAG,IAAI,GAAG,EAA2B,CAAC;AAExD,wDAAwD;AACxD,IAAI,YAAY,GAAG,CAAC,CAAC;AAErB,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC;YACjD,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACtB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YAC1B,UAAU,EAAG,CAAC,CAAC,UAAuC,IAAI,YAAY;YACtE,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK;SAC7B,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,EAAmC,CAAC;AAE/D,SAAS,SAAS,CAChB,QAAgB,EAChB,MAA2B,EAC3B,MAAuC;IAEvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,aAAa,GAAyC,IAAI,CAAC;IAE/D,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,IAAI,aAAa;YAAE,YAAY,CAAC,aAAa,CAAC,CAAC;QAC/C,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAClB,uDAAuD;YACzD,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC,EAAE,GAAG,CAAC,CAAC;IACV,CAAC,CAAC;IAEF,IAAI,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;QACrB,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,KAAK,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE;gBAClC,IAAI,CAAC,QAAQ;oBAAE,OAAO;gBACtB,MAAM,EAAE,GAAG,QAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACnC,IAAI,EAAE;oBAAE,EAAE,EAAE,CAAC;YACf,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC;QACrB,MAAM,EAAE,IAAI;QACZ,UAAU,EAAE,CAAC;KACd,CAAC,CAAC;IAEH,sEAAsE;IACtE,mEAAmE;IACnE,iEAAiE;IACjE,qEAAqE;IACrE,qEAAqE;IACrE,kEAAkE;IAClE,mEAAmE;IACnE,8CAA8C;IAC9C,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE;QAC/B,GAAG,EAAE,IAAI;QACT,UAAU,EAAE,UAAU;QACtB,YAAY,EAAE,GAAG,EAAE,CAAC,qBAAqB;KAC1C,CAAC,CAAC;IAEH,qBAAqB;IACrB,YAAY,GAAG,MAAM,WAAW,EAAE,CAAC;IACnC,aAAa,GAAG,MAAM,YAAY,EAAE,CAAC;IAErC,8CAA8C;IAC9C,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,YAAY,EAAE,CAAC;QACf,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC;IACF,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACxC,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAqB,EAAE,EAAE;QAC1D,aAAa,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,gCAAgC;IAChC,SAAS,CACP,WAAW,EACX,KAAK,IAAI,EAAE;QACT,YAAY,GAAG,MAAM,WAAW,EAAE,CAAC;IACrC,CAAC,EACD,MAAM,CAAC,GAAG,CACX,CAAC;IAEF,kEAAkE;IAClE,0EAA0E;IAC1E,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,kEAAkE;IAClE,SAAS,CACP,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAC/B,KAAK,IAAI,EAAE;QACT,4CAA4C;QAC5C,yEAAyE;QACzE,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,EACD,MAAM,CAAC,GAAG,CACX,CAAC;IAEF,SAAS,CACP,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAC/B,KAAK,IAAI,EAAE;QACT,6DAA6D;QAC7D,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,EACD,MAAM,CAAC,GAAG,CACX,CAAC;IAEF,SAAS,CACP,YAAY,EACZ,KAAK,IAAI,EAAE;QACT,aAAa,GAAG,MAAM,YAAY,EAAE,CAAC;IACvC,CAAC,EACD,MAAM,CAAC,GAAG,CACX,CAAC;IAEF,6DAA6D;IAC7D,uEAAuE;IACvE,mEAAmE;IACnE,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAChE,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACjE,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACvD,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,yEAAyE;YACzE,oEAAoE;YACpE,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,6EAA6E;QAC7E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,SAAS,GAAG,MAAM,CAAC;gBACnB,MAAM,eAAe,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3E,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnD,MAAM,eAAe,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAE3C,qDAAqD;IACrD,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACpC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAClD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;YACpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,KAAK,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,kBAAkB;IAClB,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEtD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,KAAK,UAAU,KAAK;IAClB,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC;IAEpC,MAAM,MAAM,CAAC,MAAM,CAAC;QAClB,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,eAAe;KACtB,CAAC,CAAC;IAEH,oBAAoB;IACpB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACvD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,2CAA2C,CAAC,CAAC;QACzE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACpB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,CAAC;AACpB,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,SAAS,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,aAAa,EACb,eAAe,EACf,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,gBAAgB,CAAC;AAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;AACvD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC,EAAE;IAChF,MAAM,EAAE,KAAK;CACd,CAAC,CAAC;AAEH,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E,mDAAmD;AACnD,IAAI,YAAY,GAAiB,EAAE,CAAC;AAEpC,gCAAgC;AAChC,IAAI,aAAa,GAAuB,EAAE,CAAC;AAE3C,yDAAyD;AACzD,MAAM,YAAY,GAAG,IAAI,GAAG,EAA2B,CAAC;AAExD,wDAAwD;AACxD,IAAI,YAAY,GAAG,CAAC,CAAC;AAErB,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,kBAAkB,CAAC,CAA0B;IACpD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IAClD,IACE,IAAI,KAAK,QAAQ;QACjB,OAAO,UAAU,KAAK,QAAQ;QAC9B,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC;QACnC,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;QACvB,IAAI,GAAG,CAAC;QACR,IAAI,GAAG,KAAK;QACZ,OAAO,WAAW,KAAK,QAAQ;QAC/B,CAAC,2BAA2B,CAAC,IAAI,CAAC,WAAW,CAAC,EAC9C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,CACL,MAAM;YACJ,mEAAmE;aAClE,MAAM,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,CAAC;aAC3E,GAAG,CAAC,CAAC,CAA0B,EAAE,EAAE;YAClC,MAAM,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;YACrC,OAAO;gBACL,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;gBACtB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC1B,UAAU,EAAG,CAAC,CAAC,UAAuC,IAAI,YAAY;gBACtE,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK;gBAC5B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9B,CAAC;QACJ,CAAC,CAAC,CACL,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,EAAmC,CAAC;AAE/D,SAAS,SAAS,CAChB,QAAgB,EAChB,MAA2B,EAC3B,MAAuC;IAEvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,aAAa,GAAyC,IAAI,CAAC;IAE/D,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,IAAI,aAAa;YAAE,YAAY,CAAC,aAAa,CAAC,CAAC;QAC/C,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAClB,uDAAuD;YACzD,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC,EAAE,GAAG,CAAC,CAAC;IACV,CAAC,CAAC;IAEF,IAAI,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;QACrB,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,KAAK,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE;gBAClC,IAAI,CAAC,QAAQ;oBAAE,OAAO;gBACtB,MAAM,EAAE,GAAG,QAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACnC,IAAI,EAAE;oBAAE,EAAE,EAAE,CAAC;YACf,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC;QACrB,MAAM,EAAE,IAAI;QACZ,qEAAqE;QACrE,oEAAoE;QACpE,qEAAqE;QACrE,qDAAqD;QACrD,UAAU,EAAE,WAAW;KACxB,CAAC,CAAC;IAEH,sEAAsE;IACtE,mEAAmE;IACnE,iEAAiE;IACjE,qEAAqE;IACrE,qEAAqE;IACrE,kEAAkE;IAClE,sEAAsE;IACtE,8CAA8C;IAC9C,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE;QAC/B,GAAG,EAAE,IAAI;QACT,UAAU,EAAE,UAAU;QACtB,YAAY,EAAE,GAAG,EAAE,CAAC,qBAAqB;KAC1C,CAAC,CAAC;IAEH,qBAAqB;IACrB,YAAY,GAAG,MAAM,WAAW,EAAE,CAAC;IACnC,aAAa,GAAG,MAAM,YAAY,EAAE,CAAC;IAErC,8CAA8C;IAC9C,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,YAAY,EAAE,CAAC;QACf,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC;IACF,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACxC,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAqB,EAAE,EAAE;QAC1D,aAAa,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,gCAAgC;IAChC,SAAS,CACP,WAAW,EACX,KAAK,IAAI,EAAE;QACT,YAAY,GAAG,MAAM,WAAW,EAAE,CAAC;IACrC,CAAC,EACD,MAAM,CAAC,GAAG,CACX,CAAC;IAEF,kEAAkE;IAClE,0EAA0E;IAC1E,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,kEAAkE;IAClE,SAAS,CACP,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAC/B,KAAK,IAAI,EAAE;QACT,4CAA4C;QAC5C,yEAAyE;QACzE,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,EACD,MAAM,CAAC,GAAG,CACX,CAAC;IAEF,SAAS,CACP,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAC/B,KAAK,IAAI,EAAE;QACT,6DAA6D;QAC7D,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,EACD,MAAM,CAAC,GAAG,CACX,CAAC;IAEF,SAAS,CACP,YAAY,EACZ,KAAK,IAAI,EAAE;QACT,aAAa,GAAG,MAAM,YAAY,EAAE,CAAC;IACvC,CAAC,EACD,MAAM,CAAC,GAAG,CACX,CAAC;IAEF,6DAA6D;IAC7D,uEAAuE;IACvE,mEAAmE;IACnE,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAChE,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACjE,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACvD,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,yEAAyE;YACzE,oEAAoE;YACpE,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,6EAA6E;QAC7E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,SAAS,GAAG,MAAM,CAAC;gBACnB,MAAM,eAAe,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3E,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnD,MAAM,eAAe,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAE3C,qDAAqD;IACrD,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACpC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAClD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;YACpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,KAAK,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,kBAAkB;IAClB,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEtD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,KAAK,UAAU,KAAK;IAClB,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC;IAEpC,MAAM,MAAM,CAAC,MAAM,CAAC;QAClB,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,eAAe;KACtB,CAAC,CAAC;IAEH,oBAAoB;IACpB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACvD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,2CAA2C,CAAC,CAAC;QACzE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACpB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/vendor/gatekeeper/dist/server/routes/authz.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authz.d.ts","sourceRoot":"","sources":["../../../src/server/routes/authz.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAkI7E,wBAAsB,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA4LzE"}
+{"version":3,"file":"authz.d.ts","sourceRoot":"","sources":["../../../src/server/routes/authz.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AA0J7E,wBAAsB,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAiDzE"}

package/vendor/gatekeeper/dist/server/routes/authz.js

@@ -1,5 +1,6 @@
 import crypto from 'node:crypto';
 import { request as undiciRequest } from 'undici';
+import { RELAY_ASSERTION_HEADER, signRelayAssertion } from '@lamalibre/lamaste';
 import { AUTHELIA_VERIFY_URL, SESSION_CACHE_TTL_MS } from '../../lib/constants.js';
 import { checkAccess } from '../../lib/authz.js';
 import { buildAccessRequestPage } from '../../lib/templates.js';
@@ -88,11 +89,30 @@ function getHeader(headers, name) {
     return val;
 }
 /**
- * Look up a tunnel by its FQDN from the in-memory cache.
+ * Look up a tunnel by its FQDN from the in-memory cache. Hostnames compare
+ * case-insensitively.
  */
 function findTunnelByFqdn(tunnels, fqdn) {
-    return tunnels.find((t) => t.fqdn === fqdn);
+    const wanted = fqdn.toLowerCase();
+    return tunnels.find((t) => t.fqdn.toLowerCase() === wanted);
 }
+/** A tunnel hostname as a vhost writes it into the subrequest's path. */
+const TUNNEL_FQDN_RE = /^[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+$/;
+/**
+ * nginx is the only client of the authorization routes (Gatekeeper binds
+ * 127.0.0.1) and calls them on every protected request. Per-IP throttling
+ * would punish legitimate traffic because every caller arrives as
+ * 127.0.0.1, so the key is one bucket with an effectively-unlimited 10k/min
+ * ceiling: the rate limit is structurally present (CodeQL
+ * js/missing-rate-limiting) without breaking the hot path.
+ */
+const INTERNAL_RATE_LIMIT = {
+    rateLimit: {
+        max: 10_000,
+        timeWindow: '1 minute',
+        keyGenerator: () => 'gatekeeper-internal',
+    },
+};
 /**
  * Parse an X-Original-URL header into its hostname and host components.
  * Returns null when the value is not a parseable absolute URL.
@@ -111,160 +131,232 @@ function parseOriginalUrl(originalUrl) {
 // ---------------------------------------------------------------------------
 export async function authzRoutes(fastify) {
     /**
-     * GET /authz/check — nginx auth_request target
+     * GET /authz/tunnel/:fqdn — the nginx auth_request target of a tunnel vhost
+     *
+     * The vhost names its tunnel in the path, written into its configuration
+     * (`proxy_pass http://127.0.0.1:9294/authz/tunnel/<fqdn>;`), as the
+     * agent-panel vhost names its agent: nothing in the request can choose
+     * another tunnel. X-Original-URL — the URL Authelia is asked about, with
+     * the request's path and query — and Host carry the same hostname and must
+     * agree with it.
      *
      * Flow:
-     * 1. Read Cookie and X-Original-URL from nginx
-     * 2. Validate Authelia session (cached in memory)
-     * 3. Look up tunnel by hostname
-     * 4. Check access mode and grants
-     * 5. Return 200 (allowed), 401 (not authenticated), or 403 (not authorized)
+     * 1. Check the tunnel named, X-Original-URL and Host agree
+     * 2. Validate the Authelia session (cached in memory)
+     * 3. Check access mode and grants
+     * 4. Return 200 (allowed), 401 (not authenticated), or 403 (not authorized)
      *
      * On 403, the response body is the full access-request HTML page
      * (nginx serves this inline on the tunnel's FQDN via error_page 403 =).
      */
-    fastify.get('/authz/check', {
-        // nginx is the only client (the gatekeeper binds 127.0.0.1) and
-        // it expects one call per cache miss on every protected request.
-        // Per-IP throttling here would punish legitimate traffic because
-        // every caller arrives as 127.0.0.1. We collapse the key to a
-        // single bucket and raise the ceiling to an effectively-unlimited
-        // 10k/min so the rate-limit is structurally present (CodeQL
-        // js/missing-rate-limiting) without breaking the hot path.
-        config: {
-            rateLimit: {
-                max: 10_000,
-                timeWindow: '1 minute',
-                keyGenerator: () => 'gatekeeper-internal',
-            },
-        },
-    }, async (request, reply) => {
-        const requestId = request.id;
-        const cookie = request.headers['cookie'] ?? '';
-        const originalUrl = request.headers['x-original-url'] ?? '';
-        if (!cookie || !originalUrl) {
-            return reply.code(401).send();
-        }
-        // Parse and validate X-Original-URL before any other work.
-        // Defense-in-depth: the 127.0.0.1 bind + nginx auth_request boundary is
-        // the primary guarantee that this header is trustworthy; host matching
-        // ensures a misconfigured proxy chain cannot forge tunnel identity.
-        const parsed = parseOriginalUrl(originalUrl);
-        if (!parsed) {
-            request.log.info({ requestId, reason: 'invalid_original_url' }, 'authz denied');
-            return reply.code(401).send();
-        }
-        // Host header check: when nginx forwards the parent request's Host to the
-        // subrequest (default behavior for auth_request), the hostname portion
-        // must match the hostname parsed from X-Original-URL. Port differences
-        // are ignored — nginx often normalizes them. An absent Host header skips
-        // the check (some proxies strip it from internal subrequests).
-        const hostHeader = request.headers['host'] ?? '';
-        if (hostHeader) {
-            const hostOnly = hostHeader.split(':')[0]?.toLowerCase() ?? '';
-            if (hostOnly && hostOnly !== parsed.hostname.toLowerCase()) {
-                request.log.info({
-                    requestId,
-                    reason: 'host_header_mismatch',
-                    originalHost: parsed.hostname,
-                    hostHeader,
-                }, 'authz denied');
-                return reply.code(401).send();
-            }
-        }
-        const tunnels = fastify.getTunnels();
-        const tunnel = findTunnelByFqdn(tunnels, parsed.hostname);
-        if (!tunnel) {
-            request.log.info({ requestId, reason: 'unknown_tunnel_fqdn', fqdn: parsed.hostname }, 'authz denied');
-            return reply.code(401).send();
+    fastify.get('/authz/tunnel/:fqdn', { config: INTERNAL_RATE_LIMIT }, async (request, reply) => authorizeTunnelRequest(fastify, request, reply, request.params.fqdn));
+    /**
+     * GET /authz/check — what tunnel vhosts written before 4.3 call. They name
+     * the tunnel by the client's Host header (`$http_host`), which an
+     * absolute-form request line can point at another tunnel than the one
+     * nginx serves, so their requests are refused: until the panel rewrites
+     * such a vhost (it does when it starts) its tunnel is closed, rather than
+     * open to the users of every other tunnel.
+     */
+    fastify.get('/authz/check', { config: INTERNAL_RATE_LIMIT }, async (request, reply) => {
+        request.log.error({
+            requestId: request.id,
+            reason: 'vhost_predates_host_binding',
+            hostHeader: request.headers['host'],
+        }, 'authz refused: this tunnel vhost names its tunnel by the client Host header; restart lamalibre-lamaste-serverd to rewrite it');
+        return reply
+            .code(403)
+            .header('Cache-Control', 'no-store')
+            .type('text/plain; charset=utf-8')
+            .send('This tunnel is unavailable until the relay rewrites its configuration.\n');
+    });
+}
+/**
+ * Authorize one request on the tunnel named `fqdn` (see the
+ * `/authz/tunnel/:fqdn` route).
+ */
+async function authorizeTunnelRequest(fastify, request, reply, fqdn) {
+    const requestId = request.id;
+    if (!TUNNEL_FQDN_RE.test(fqdn)) {
+        request.log.info({ requestId, reason: 'invalid_tunnel_name' }, 'authz denied');
+        return reply.code(401).send();
+    }
+    const cookie = request.headers['cookie'] ?? '';
+    const originalUrl = request.headers['x-original-url'] ?? '';
+    if (!cookie || !originalUrl) {
+        return reply.code(401).send();
+    }
+    const parsed = parseOriginalUrl(originalUrl);
+    if (!parsed) {
+        request.log.info({ requestId, reason: 'invalid_original_url' }, 'authz denied');
+        return reply.code(401).send();
+    }
+    // The vhost writes the same hostname into the path, X-Original-URL and
+    // Host. Disagreement means a request that did not come from a tunnel
+    // vhost of this version: refuse it before Authelia is asked anything.
+    const named = fqdn.toLowerCase();
+    const hostHeader = request.headers['host'] ?? '';
+    const hostOnly = hostHeader.split(':')[0]?.toLowerCase() ?? '';
+    if (parsed.hostname.toLowerCase() !== named || hostOnly !== named) {
+        request.log.info({
+            requestId,
+            reason: hostOnly ? 'tunnel_name_mismatch' : 'missing_host_header',
+            tunnel: fqdn,
+            originalHost: parsed.hostname,
+            hostHeader,
+        }, 'authz denied');
+        return reply.code(401).send();
+    }
+    const tunnels = fastify.getTunnels();
+    const tunnel = findTunnelByFqdn(tunnels, fqdn);
+    if (!tunnel) {
+        request.log.info({ requestId, reason: 'unknown_tunnel_fqdn', fqdn }, 'authz denied');
+        return reply.code(401).send();
+    }
+    // Check session cache (keyed by Authelia session cookie only to prevent
+    // cache pollution via unrelated cookies like CSRF tokens or analytics).
+    const autheliaCookie = extractAutheliaCookie(cookie);
+    if (!autheliaCookie) {
+        // No authelia_session — short-circuit before any cache work or the
+        // upstream Authelia /verify call. Without this, an unauthenticated
+        // request would still cost us an Authelia round-trip.
+        request.log.info({ requestId, reason: 'missing_authelia_cookie', fqdn: parsed.hostname }, 'authz denied');
+        return reply.code(401).send();
+    }
+    const cacheKey = hashCookie(autheliaCookie);
+    const sessionCache = fastify.getSessionCache();
+    const cached = sessionCache.get(cacheKey);
+    const now = Date.now();
+    let session;
+    if (cached && cached.expiresAt > now) {
+        session = cached;
+    }
+    else {
+        if (cached) {
+            // Lazy TTL eviction — one stale entry pruned per request.
+            sessionCache.delete(cacheKey);
         }
-        // Check session cache (keyed by Authelia session cookie only to prevent
-        // cache pollution via unrelated cookies like CSRF tokens or analytics).
-        const autheliaCookie = extractAutheliaCookie(cookie);
-        if (!autheliaCookie) {
-            // No authelia_session — short-circuit before any cache work or the
-            // upstream Authelia /verify call. Without this, an unauthenticated
-            // request would still cost us an Authelia round-trip.
-            request.log.info({ requestId, reason: 'missing_authelia_cookie', fqdn: parsed.hostname }, 'authz denied');
+        const validated = await validateWithAuthelia(cookie, originalUrl, requestId);
+        if (!validated) {
+            request.log.info({ requestId, reason: 'authelia_rejected', fqdn: parsed.hostname }, 'authz denied');
             return reply.code(401).send();
         }
-        const cacheKey = hashCookie(autheliaCookie);
-        const sessionCache = fastify.getSessionCache();
-        const cached = sessionCache.get(cacheKey);
-        const now = Date.now();
-        let session;
-        if (cached && cached.expiresAt > now) {
-            session = cached;
-        }
-        else {
-            if (cached) {
-                // Lazy TTL eviction — one stale entry pruned per request.
-                sessionCache.delete(cacheKey);
-            }
-            const validated = await validateWithAuthelia(cookie, originalUrl, requestId);
-            if (!validated) {
-                request.log.info({ requestId, reason: 'authelia_rejected', fqdn: parsed.hostname }, 'authz denied');
-                return reply.code(401).send();
-            }
-            // Opportunistic eviction — drop oldest (insertion-order head) when at cap.
-            while (sessionCache.size >= MAX_SESSION_CACHE_ENTRIES) {
-                const oldestKey = sessionCache.keys().next().value;
-                if (oldestKey === undefined)
-                    break;
-                sessionCache.delete(oldestKey);
-            }
-            sessionCache.set(cacheKey, validated);
-            session = validated;
-        }
-        // Check access mode
-        if (tunnel.accessMode === 'public' || tunnel.accessMode === 'authenticated') {
-            setAutheliaHeaders(reply, session);
-            reply.header('Cache-Control', `public, max-age=${AUTHZ_SUCCESS_MAX_AGE_SECONDS}`);
-            reply.header('X-Gatekeeper-Cache-Version', String(fastify.getCacheVersion()));
-            return reply.code(200).send();
+        // Opportunistic eviction — drop oldest (insertion-order head) when at cap.
+        while (sessionCache.size >= MAX_SESSION_CACHE_ENTRIES) {
+            const oldestKey = sessionCache.keys().next().value;
+            if (oldestKey === undefined)
+                break;
+            sessionCache.delete(oldestKey);
         }
-        // restricted — check grants
-        const result = await checkAccess(session.username, 'tunnel', tunnel.id, {
-            adminContact: fastify.getSettings().adminEmail,
-            adminName: fastify.getSettings().adminName,
-        });
-        if (result.allowed) {
-            setAutheliaHeaders(reply, session);
-            reply.header('Cache-Control', `public, max-age=${AUTHZ_SUCCESS_MAX_AGE_SECONDS}`);
-            reply.header('X-Gatekeeper-Cache-Version', String(fastify.getCacheVersion()));
-            return reply.code(200).send();
-        }
-        request.log.info({
-            requestId,
-            reason: 'no_matching_grant',
+        sessionCache.set(cacheKey, validated);
+        session = validated;
+    }
+    // Check access mode
+    if (tunnel.accessMode === 'public' || tunnel.accessMode === 'authenticated') {
+        return allow(fastify, request, reply, tunnel, session);
+    }
+    // restricted — check grants
+    const result = await checkAccess(session.username, 'tunnel', tunnel.id, {
+        adminContact: fastify.getSettings().adminEmail,
+        adminName: fastify.getSettings().adminName,
+    });
+    if (result.allowed) {
+        return allow(fastify, request, reply, tunnel, session);
+    }
+    request.log.info({
+        requestId,
+        reason: 'no_matching_grant',
+        username: session.username,
+        resourceType: 'tunnel',
+        resourceId: tunnel.id,
+        requiredGrant: `tunnel:${tunnel.id}`,
+        fqdn: parsed.hostname,
+    }, 'authz denied');
+    if (fastify.getSettings().accessLoggingEnabled) {
+        logAccessRequest({
+            timestamp: new Date().toISOString(),
             username: session.username,
             resourceType: 'tunnel',
             resourceId: tunnel.id,
-            requiredGrant: `tunnel:${tunnel.id}`,
-            fqdn: parsed.hostname,
-        }, 'authz denied');
-        if (fastify.getSettings().accessLoggingEnabled) {
-            logAccessRequest({
-                timestamp: new Date().toISOString(),
-                username: session.username,
-                resourceType: 'tunnel',
-                resourceId: tunnel.id,
-                resourceFqdn: parsed.hostname,
-            });
-        }
-        // Access denied — return inline HTML page as 403 body.
-        // Cache-Control: no-store so nginx never caches the denial; the matching
-        // proxy_cache_valid 403 0 in the snippet is the authoritative setting.
-        const html = buildAccessRequestPage(session.username, parsed.hostname, {
-            adminContact: fastify.getSettings().adminEmail,
-            adminName: fastify.getSettings().adminName,
+            resourceFqdn: parsed.hostname,
         });
-        return reply
-            .code(403)
-            .header('Cache-Control', 'no-store')
-            .type('text/html; charset=utf-8')
-            .send(html);
+    }
+    // Access denied — return inline HTML page as 403 body.
+    // Cache-Control: no-store so nginx never caches the denial; the matching
+    // proxy_cache_valid 403 0 in the snippet is the authoritative setting.
+    const html = buildAccessRequestPage(session.username, parsed.hostname, {
+        adminContact: fastify.getSettings().adminEmail,
+        adminName: fastify.getSettings().adminName,
     });
+    return reply
+        .code(403)
+        .header('Cache-Control', 'no-store')
+        .type('text/html; charset=utf-8')
+        .send(html);
+}
+/**
+ * Answer an allowed request: the Authelia identity headers nginx forwards
+ * to the tunnel backend.
+ *
+ * A plugin tunnel's backend is the agent's lamaste-agentd, which takes the
+ * user only from a relay assertion — anything that reaches its loopback port
+ * could write `Remote-User`. Sign one for this request: the agent, its
+ * daemon's port, the plugin route, the method, a nonce. It is single use,
+ * so the answer must never be cached.
+ */
+async function allow(fastify, request, reply, tunnel, session) {
+    reply.header('X-Gatekeeper-Cache-Version', String(fastify.getCacheVersion()));
+    if (!tunnel.plugin) {
+        setAutheliaHeaders(reply, session);
+        reply.header('Cache-Control', `public, max-age=${AUTHZ_SUCCESS_MAX_AGE_SECONDS}`);
+        return reply.code(200).send();
+    }
+    reply.header('Cache-Control', 'no-store');
+    let key = null;
+    try {
+        key = await fastify.getRelaySigner().current();
+    }
+    catch (err) {
+        request.log.error({ err: err instanceof Error ? err.message : String(err) }, 'Relay signing key unusable');
+    }
+    if (!key) {
+        request.log.error({ requestId: request.id, reason: 'relay_signing_key_unavailable', fqdn: tunnel.fqdn }, 'authz failed');
+        return reply.code(503).send();
+    }
+    const originalMethod = request.headers['x-original-method'];
+    let assertion;
+    try {
+        assertion = signRelayAssertion({
+            aud: tunnel.plugin.agentLabel,
+            port: tunnel.plugin.port,
+            caller: {
+                type: 'user',
+                username: session.username,
+                groups: session.groups
+                    .split(',')
+                    .map((g) => g.trim())
+                    .filter((g) => g.length > 0),
+                name: session.displayName,
+                email: session.email,
+            },
+            method: typeof originalMethod === 'string' ? originalMethod : 'GET',
+            target: { route: tunnel.plugin.route },
+        }, key);
+    }
+    catch (err) {
+        // An identity an assertion cannot carry (a username outside
+        // [A-Za-z0-9_.-], control characters, ...) — the agent would refuse it.
+        request.log.info({
+            requestId: request.id,
+            reason: 'identity_not_assertable',
+            detail: err instanceof Error ? err.message : String(err),
+            fqdn: tunnel.fqdn,
+        }, 'authz denied');
+        return reply.code(403).send();
+    }
+    setAutheliaHeaders(reply, session);
+    reply.header(RELAY_ASSERTION_HEADER, assertion);
+    return reply.code(200).send();
 }
 /**
  * Set Authelia identity headers on the response so nginx can