@lamalibre/create-lamaste 4.2.0 → 4.3.0

package/vendor/serverd/src/routes/management/tunnels.js

@@ -17,14 +17,18 @@ import {
 } from '@lamalibre/lamaste/server';
 import {
   AGENT_LABEL_REGEX,
+  INTERNAL_PLUGIN_PORT_RANGE,
   PLUGIN_AGENT_CN_PREFIX,
   RESERVED_TUNNEL_PORTS,
+  isInternalPluginPort,
 } from '@lamalibre/lamaste';
 import { getConfig } from '../../lib/config.js';
 import { readTunnels, readSites } from '../../lib/state.js';
 import { loadAgentRegistry } from '../../lib/mtls.js';
 import { getChiselCredentialIssuedAt } from '../../lib/chisel-users.js';
 import { buildChiselArgs } from '../../lib/chisel-args.js';
+import { listAgentPluginAssignments } from '../../lib/plugin-hosting.js';
+import { pendingAgentJobs } from '../../lib/agent-jobs.js';
 import {
   tunnelNginxDeps,
   tunnelCertbotDeps,
@@ -41,6 +45,9 @@ const TunnelPortSchema = z
   .max(65535, 'Port must be at most 65535')
   .refine((p) => !RESERVED_TUNNEL_PORTS.includes(p), {
     message: `Ports ${RESERVED_TUNNEL_PORTS.join(', ')} belong to Lamaste services on the relay`,
+  })
+  .refine((p) => !isInternalPluginPort(p), {
+    message: `Ports ${INTERNAL_PLUGIN_PORT_RANGE.min}–${INTERNAL_PLUGIN_PORT_RANGE.max} are reserved for the internal tunnels of agent-hosted plugins`,
   });
 
 const AgentLabelSchema = z.string().regex(AGENT_LABEL_REGEX, 'Invalid agent label format');
@@ -155,6 +162,15 @@ function authorizeFor(request, action) {
     if (!mayActOn(request, tunnel)) {
       throw new TunnelError('Tunnel not found', 'NOT_FOUND');
     }
+    // An internal plugin tunnel belongs to the plugin's hosting: it is
+    // created and removed with it (DELETE /api/plugins/:name/hosting).
+    if (tunnel.exposure === 'internal') {
+      throw new TunnelError(
+        `Cannot ${action} an internal plugin tunnel here — it belongs to the hosting of plugin ` +
+          `"${tunnel.pluginRoute ?? tunnel.pluginName ?? '?'}"`,
+        'FORBIDDEN',
+      );
+    }
     if (tunnel.type === 'panel' && request.certRole !== 'admin') {
       const caps = request.certCapabilities || [];
       if (!caps.includes('panel:expose')) {
@@ -259,6 +275,16 @@ export default async function tunnelRoutes(fastify, _opts) {
             port: t.port,
             subdomain: t.subdomain,
           })),
+          // The agent-hosted plugins this agent hosts: the agent fetches a
+          // plugin's config when it does not hold the secret issued at
+          // `secretIssuedAt`, and acknowledges it (see converge).
+          appPlugins: AGENT_LABEL_REGEX.test(label) ? await listAgentPluginAssignments(label) : [],
+          // Work for the agent's sync, reported to /agents/me/jobs/:id/result:
+          // lifecycle hook calls to its agent halves on its own loopback
+          // (`hook`), and installing, switching or removing an agent half
+          // through its app host helper (`app-install`, `app-activate`,
+          // `app-remove`) — see lib/agent-jobs.js for each job's fields.
+          agentJobs: AGENT_LABEL_REGEX.test(label) ? await pendingAgentJobs(label) : [],
         };
       } catch (err) {
         request.log.error(err, 'Failed to generate agent config');

package/vendor/serverd/src/routes/management.js

@@ -15,6 +15,8 @@ import storageRoutes from './management/storage.js';
 import gatekeeperProxyRoutes from './management/gatekeeper-proxy.js';
 import agentsRoutes from './management/agents.js';
 import registryCredentialRoutes from './management/registry-credential.js';
+import auditRoutes from './management/audit.js';
+import agentPanelAuthzRoutes from './management/agent-panel-authz.js';
 
 export default async function managementRoutes(fastify, _opts) {
   fastify.addHook('onRequest', managementOnly());
@@ -35,4 +37,6 @@ export default async function managementRoutes(fastify, _opts) {
   await fastify.register(gatekeeperProxyRoutes);
   await fastify.register(agentsRoutes);
   await fastify.register(registryCredentialRoutes);
+  await fastify.register(auditRoutes);
+  await fastify.register(agentPanelAuthzRoutes);
 }