@lamalibre/create-lamaste 4.4.0 → 4.4.1

package/vendor/serverd/src/lib/plugin-packages.js

@@ -29,6 +29,7 @@ import {
 } from '@lamalibre/lamaste';
 import { readTarballFiles } from '@lamalibre/lamaste/server';
 import { httpError } from './app-error.js';
+import { withRegistryUserconfig } from './registry-credential.js';
 
 const STATE_DIR = process.env.LAMALIBRE_LAMASTE_STATE_DIR || '/etc/lamalibre/lamaste';
 
@@ -88,9 +89,11 @@ export async function installedHookEntrySha256(packageName, manifest) {
 }
 
 /**
- * Fetch `<package>@<version>` from the registry STATE_DIR is configured
- * for (`npm pack`, as the panel's user) and read its manifest and, when
- * the manifest names one, its relay hook module — in memory only.
+ * Fetch `<package>@<version>` from the registry the panel installs from
+ * (`npm pack` through {@link withRegistryUserconfig}: the configured
+ * registry credential, else the machine's npm configuration) and read its
+ * manifest and, when the manifest names one, its relay hook module — in
+ * memory only.
  *
  * @param {string} packageName bare `@lamalibre/<name>`
  * @param {string} version an exact version or a dist-tag (`latest`)
@@ -103,22 +106,24 @@ export async function readRegistryPackage(packageName, version) {
   try {
     let packed;
     try {
-      const { stdout } = await execa(
-        'npm',
-        [
-          'pack',
-          `${packageName}@${version}`,
-          '--json',
-          '--ignore-scripts',
-          '--pack-destination',
-          dir,
-        ],
-        { cwd: STATE_DIR, timeout: 120000 },
+      const { stdout } = await withRegistryUserconfig((env) =>
+        execa(
+          'npm',
+          [
+            'pack',
+            `${packageName}@${version}`,
+            '--json',
+            '--ignore-scripts',
+            '--pack-destination',
+            dir,
+          ],
+          { cwd: STATE_DIR, timeout: 120000, env },
+        ),
       );
       packed = JSON.parse(stdout);
     } catch (err) {
       throw httpError(
-        `Could not fetch ${packageName}@${version} from the registry: ${(err.stderr || err.message || '').split('\n')[0]}`,
+        `Could not fetch ${packageName}@${version} from the registry: ${npmFailureLine(err)}`,
         502,
       );
     }
@@ -171,9 +176,9 @@ function npmFailureLine(err) {
 
 /**
  * The npm Subresource Integrity of `<package>@<version>`'s tarball, as the
- * registry STATE_DIR is configured for publishes it — `npm view … dist.integrity`
- * as the panel's user, so the registry and credential are the ones plugin
- * installs use. Only a sha512 SRI is accepted: it is what the approval
+ * registry the panel installs from publishes it — `npm view … dist.integrity`
+ * through {@link withRegistryUserconfig}, so the registry and credential
+ * are the ones plugin installs use. Only a sha512 SRI is accepted: it is what the approval
  * binds and what the agent checks the tarball it fetches against.
  *
  * @param {string} packageName bare `@lamalibre/<name>`
@@ -186,10 +191,13 @@ export async function readRegistryIntegrity(packageName, version) {
   const spec = `${packageName}@${version}`;
   let stdout;
   try {
-    ({ stdout } = await execa('npm', ['view', spec, 'dist.integrity', '--json'], {
-      cwd: STATE_DIR,
-      timeout: 60000,
-    }));
+    ({ stdout } = await withRegistryUserconfig((env) =>
+      execa('npm', ['view', spec, 'dist.integrity', '--json'], {
+        cwd: STATE_DIR,
+        timeout: 60000,
+        env,
+      }),
+    ));
   } catch (err) {
     if (/\bE404\b/.test(`${err.stderr ?? ''}\n${err.stdout ?? ''}`)) {
       throw httpError(

package/vendor/serverd/src/lib/plugins.js

@@ -25,6 +25,8 @@ import {
 import { listRegisteredSubScopeNames } from './tickets.js';
 import { getStateDb } from './state-db.js';
 import { revokePluginCapabilitiesFromAgents } from './mtls.js';
+import { withRegistryUserconfig } from './registry-credential.js';
+import { RegistryCredentialError } from '@lamalibre/lamaste/server';
 import {
   bareLamalibrePackageName,
   installedHookEntrySha256,
@@ -326,6 +328,17 @@ export async function manifestPolicyError(manifest) {
   return null;
 }
 
+/**
+ * What a failed install of `spec` is reported as. A registry that refused
+ * the panel's credential says so (the registry host and the status, from
+ * {@link withRegistryUserconfig}); anything else is npm's failure, whose
+ * output is in the log.
+ */
+function installFailure(spec, err) {
+  const detail = err instanceof RegistryCredentialError ? `: ${err.message}` : '';
+  return `Failed to install "${spec}"${detail}`;
+}
+
 export function installPlugin(packageName, logger) {
   return withPluginLock(async () => {
     // Validate package scope
@@ -358,19 +371,25 @@ export function installPlugin(packageName, logger) {
       }
     }
 
-    // Install the npm package
+    // Install the npm package — from the configured registry, as the
+    // panel's own identity, when a registry credential is set.
     logger.info({ packageName: installSpec }, 'Installing plugin package');
     try {
-      await execa('npm', ['install', '--ignore-scripts', installSpec], {
-        cwd: STATE_DIR,
-        timeout: 120000,
-      });
+      await withRegistryUserconfig(
+        (env) =>
+          execa('npm', ['install', '--ignore-scripts', installSpec], {
+            cwd: STATE_DIR,
+            timeout: 120000,
+            env,
+          }),
+        { log: logger },
+      );
     } catch (err) {
       logger.error(
         { packageName: installSpec, stderr: err.stderr, err: err.message },
         'npm install failed',
       );
-      throw Object.assign(new Error(`Failed to install "${installSpec}"`), { statusCode: 500 });
+      throw Object.assign(new Error(installFailure(installSpec, err)), { statusCode: 500 });
     }
 
     // Read the plugin manifest from the installed package
@@ -688,13 +707,18 @@ export function replacePluginPackage(name, packageName, version, logger) {
     assertSafeLamalibrePackage(spec);
     logger?.info({ name, spec }, 'Installing plugin package version');
     try {
-      await execa('npm', ['install', '--ignore-scripts', spec], {
-        cwd: STATE_DIR,
-        timeout: 120000,
-      });
+      await withRegistryUserconfig(
+        (env) =>
+          execa('npm', ['install', '--ignore-scripts', spec], {
+            cwd: STATE_DIR,
+            timeout: 120000,
+            env,
+          }),
+        { log: logger },
+      );
     } catch (err) {
       logger?.error({ spec, stderr: err.stderr, err: err.message }, 'npm install failed');
-      throw Object.assign(new Error(`Failed to install "${spec}"`), { statusCode: 502 });
+      throw Object.assign(new Error(installFailure(spec, err)), { statusCode: 502 });
     }
     const require = createRequire(`${STATE_DIR}/`);
     const manifestPath = require.resolve(`${bare}/lamaste-plugin.json`);

package/vendor/serverd/src/lib/registry-credential.js

@@ -12,6 +12,13 @@
  *   install within the hour and limited to ten new tokens per agent per
  *   hour.
  *
+ * The panel's own npm calls — installing a plugin, staging an update with
+ * `npm pack`, pinning an agent half with `npm view` — go through
+ * {@link withRegistryUserconfig}: with a credential configured, npm is
+ * routed to its registry for its scope and authenticated with the service
+ * token through a throw-away userconfig; without one, npm runs as it is
+ * configured on the machine (the public registry by default).
+ *
  * Also the one piece of policy that belongs here: when a user loses a
  * `feria-*` group or is deleted, their registry tokens are revoked (best
  * effort, never blocks the user operation).
@@ -26,6 +33,7 @@ import {
   revokeRegistryTokensForOwner,
   lostFeriaGroups,
   readOidcClientSecret,
+  withRegistryUserconfig as withRegistryUserconfigCore,
   RegistryServiceTokenCache,
   AgentTokenBroker,
   RegistryCredentialError,
@@ -102,6 +110,35 @@ async function serviceToken(config) {
   return (await serviceTokens.resolve(config, await oidcDeps(config))).token;
 }
 
+/**
+ * Run `fn(env)` — one npm call of the panel's own — against the configured
+ * registry: with a credential, `env` names an isolated userconfig (0600,
+ * removed afterwards) routing the credential's scope to its registry with
+ * the panel's service token; a `401` refreshes the token once and retries.
+ * Without a credential `fn({})` runs npm as the machine configures it.
+ * A credential file that cannot be read fails the call rather than
+ * silently installing from the public registry.
+ *
+ * @template T
+ * @param {(env: Record<string, string>) => Promise<T>} fn
+ * @param {{ log?: import('pino').Logger | undefined }} [options]
+ * @returns {Promise<T>}
+ */
+export async function withRegistryUserconfig(fn, options = {}) {
+  const config = await readRegistryCredentialConfig();
+  if (!config) return fn({});
+  const deps = await oidcDeps(config);
+  return withRegistryUserconfigCore(
+    config,
+    async ({ refresh }) => {
+      if (refresh) serviceTokens.invalidate();
+      return (await serviceTokens.resolve(config, deps)).token;
+    },
+    fn,
+    { log: options.log },
+  );
+}
+
 /**
  * The calling agent's registry token: the cached one when it is still good
  * for an install, otherwise a freshly brokered one-hour token — unless the