@lamalibre/create-lamaste 4.4.0 → 4.5.0

package/vendor/serverd/src/lib/plugin-packages.js

@@ -29,6 +29,7 @@ import {
 } from '@lamalibre/lamaste';
 import { readTarballFiles } from '@lamalibre/lamaste/server';
 import { httpError } from './app-error.js';
+import { withRegistryUserconfig } from './registry-credential.js';
 
 const STATE_DIR = process.env.LAMALIBRE_LAMASTE_STATE_DIR || '/etc/lamalibre/lamaste';
 
@@ -88,9 +89,11 @@ export async function installedHookEntrySha256(packageName, manifest) {
 }
 
 /**
- * Fetch `<package>@<version>` from the registry STATE_DIR is configured
- * for (`npm pack`, as the panel's user) and read its manifest and, when
- * the manifest names one, its relay hook module — in memory only.
+ * Fetch `<package>@<version>` from the registry the panel installs from
+ * (`npm pack` through {@link withRegistryUserconfig}: the configured
+ * registry credential, else the machine's npm configuration) and read its
+ * manifest and, when the manifest names one, its relay hook module — in
+ * memory only.
  *
  * @param {string} packageName bare `@lamalibre/<name>`
  * @param {string} version an exact version or a dist-tag (`latest`)
@@ -103,22 +106,24 @@ export async function readRegistryPackage(packageName, version) {
   try {
     let packed;
     try {
-      const { stdout } = await execa(
-        'npm',
-        [
-          'pack',
-          `${packageName}@${version}`,
-          '--json',
-          '--ignore-scripts',
-          '--pack-destination',
-          dir,
-        ],
-        { cwd: STATE_DIR, timeout: 120000 },
+      const { stdout } = await withRegistryUserconfig((env) =>
+        execa(
+          'npm',
+          [
+            'pack',
+            `${packageName}@${version}`,
+            '--json',
+            '--ignore-scripts',
+            '--pack-destination',
+            dir,
+          ],
+          { cwd: STATE_DIR, timeout: 120000, env },
+        ),
       );
       packed = JSON.parse(stdout);
     } catch (err) {
       throw httpError(
-        `Could not fetch ${packageName}@${version} from the registry: ${(err.stderr || err.message || '').split('\n')[0]}`,
+        `Could not fetch ${packageName}@${version} from the registry: ${npmFailureLine(err)}`,
         502,
       );
     }
@@ -171,9 +176,9 @@ function npmFailureLine(err) {
 
 /**
  * The npm Subresource Integrity of `<package>@<version>`'s tarball, as the
- * registry STATE_DIR is configured for publishes it — `npm view … dist.integrity`
- * as the panel's user, so the registry and credential are the ones plugin
- * installs use. Only a sha512 SRI is accepted: it is what the approval
+ * registry the panel installs from publishes it — `npm view … dist.integrity`
+ * through {@link withRegistryUserconfig}, so the registry and credential
+ * are the ones plugin installs use. Only a sha512 SRI is accepted: it is what the approval
  * binds and what the agent checks the tarball it fetches against.
  *
  * @param {string} packageName bare `@lamalibre/<name>`
@@ -186,10 +191,13 @@ export async function readRegistryIntegrity(packageName, version) {
   const spec = `${packageName}@${version}`;
   let stdout;
   try {
-    ({ stdout } = await execa('npm', ['view', spec, 'dist.integrity', '--json'], {
-      cwd: STATE_DIR,
-      timeout: 60000,
-    }));
+    ({ stdout } = await withRegistryUserconfig((env) =>
+      execa('npm', ['view', spec, 'dist.integrity', '--json'], {
+        cwd: STATE_DIR,
+        timeout: 60000,
+        env,
+      }),
+    ));
   } catch (err) {
     if (/\bE404\b/.test(`${err.stderr ?? ''}\n${err.stdout ?? ''}`)) {
       throw httpError(

package/vendor/serverd/src/lib/plugins.js

@@ -19,12 +19,15 @@ import {
   RESERVED_NAV_LABELS,
   derivePluginRoute,
   hasAgentHalf,
+  normalizeIdentityBlock,
   pluginHostCapability,
   validateManifest as coreValidateManifest,
 } from '@lamalibre/lamaste';
 import { listRegisteredSubScopeNames } from './tickets.js';
 import { getStateDb } from './state-db.js';
 import { revokePluginCapabilitiesFromAgents } from './mtls.js';
+import { withRegistryUserconfig } from './registry-credential.js';
+import { RegistryCredentialError } from '@lamalibre/lamaste/server';
 import {
   bareLamalibrePackageName,
   installedHookEntrySha256,
@@ -69,10 +72,12 @@ async function getStmts() {
       INSERT INTO plugins
         (name, route, display_name, package_name, version, description, capabilities,
          packages, panel, config, modes, hosting, agent, hooks, hooks_entry_sha256,
-         agent_half_pin, settings, status, installed_at, enabled_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+         agent_half_pin, settings, identity, status, installed_at, enabled_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `),
     deleteByName: db.prepare('DELETE FROM plugins WHERE name = ?'),
+    // The plugin's audience and the state of its identity feed
+    // (lib/audience.js, lib/identity-sync.js) go with its row.
     // The relay's cache of the plugin's settings (lib/plugin-settings.js)
     // goes with its row, and follows its settings schema.
     deleteSettingsByName: db.prepare('DELETE FROM plugin_settings WHERE plugin = ?'),
@@ -135,6 +140,7 @@ function rowToPlugin(row) {
   if (row.hooks_entry_sha256 != null) entry.hooksEntrySha256 = row.hooks_entry_sha256;
   if (row.agent_half_pin != null) entry.agentHalfPin = JSON.parse(row.agent_half_pin);
   if (row.settings != null) entry.settings = JSON.parse(row.settings);
+  if (row.identity != null) entry.identity = JSON.parse(row.identity);
   if (row.enabled_at != null) entry.enabledAt = row.enabled_at;
   return entry;
 }
@@ -147,6 +153,29 @@ function nullableJson(value) {
   return value === undefined || value === null ? null : JSON.stringify(value);
 }
 
+/**
+ * A manifest's `identity` block as the registry stores it — normalized
+ * (core `normalizeIdentityBlock`: roles by id, attributes sorted, the
+ * default applied) — or undefined when it declares none. The stored block
+ * enters the approval digest.
+ *
+ * @param {{ identity?: import('@lamalibre/lamaste').IdentityBlockInput }} manifest
+ * @returns {import('@lamalibre/lamaste').NormalizedIdentityBlock | undefined}
+ */
+export function identityOf(manifest) {
+  return manifest.identity ? normalizeIdentityBlock(manifest.identity) : undefined;
+}
+
+/** Recompute the plugin audiences (lib/audience.js) beside other work — never throws. */
+async function recomputeAudiencesInBackground(logger) {
+  try {
+    const { recomputeAudiences } = await import('./audience.js');
+    void recomputeAudiences({ logger });
+  } catch (err) {
+    logger?.warn({ err: err.message }, 'Could not recompute the plugin audiences');
+  }
+}
+
 // --- Plugin registry persistence ---
 
 /**
@@ -194,6 +223,7 @@ export async function writePlugins(data) {
         nullableString(p.hooksEntrySha256),
         nullableJson(p.agentHalfPin),
         nullableJson(p.settings),
+        nullableJson(p.identity),
         p.status,
         p.installedAt,
         nullableString(p.enabledAt),
@@ -326,6 +356,17 @@ export async function manifestPolicyError(manifest) {
   return null;
 }
 
+/**
+ * What a failed install of `spec` is reported as. A registry that refused
+ * the panel's credential says so (the registry host and the status, from
+ * {@link withRegistryUserconfig}); anything else is npm's failure, whose
+ * output is in the log.
+ */
+function installFailure(spec, err) {
+  const detail = err instanceof RegistryCredentialError ? `: ${err.message}` : '';
+  return `Failed to install "${spec}"${detail}`;
+}
+
 export function installPlugin(packageName, logger) {
   return withPluginLock(async () => {
     // Validate package scope
@@ -358,19 +399,25 @@ export function installPlugin(packageName, logger) {
       }
     }
 
-    // Install the npm package
+    // Install the npm package — from the configured registry, as the
+    // panel's own identity, when a registry credential is set.
     logger.info({ packageName: installSpec }, 'Installing plugin package');
     try {
-      await execa('npm', ['install', '--ignore-scripts', installSpec], {
-        cwd: STATE_DIR,
-        timeout: 120000,
-      });
+      await withRegistryUserconfig(
+        (env) =>
+          execa('npm', ['install', '--ignore-scripts', installSpec], {
+            cwd: STATE_DIR,
+            timeout: 120000,
+            env,
+          }),
+        { log: logger },
+      );
     } catch (err) {
       logger.error(
         { packageName: installSpec, stderr: err.stderr, err: err.message },
         'npm install failed',
       );
-      throw Object.assign(new Error(`Failed to install "${installSpec}"`), { statusCode: 500 });
+      throw Object.assign(new Error(installFailure(installSpec, err)), { statusCode: 500 });
     }
 
     // Read the plugin manifest from the installed package
@@ -460,6 +507,7 @@ export function installPlugin(packageName, logger) {
       hooksEntrySha256,
       agentHalfPin,
       settings: manifest.settings,
+      identity: identityOf(manifest),
       status: 'disabled',
       installedAt: new Date().toISOString(),
     };
@@ -487,6 +535,7 @@ export function installPlugin(packageName, logger) {
         nullableString(entry.hooksEntrySha256),
         nullableJson(entry.agentHalfPin),
         nullableJson(entry.settings),
+        nullableJson(entry.identity),
         entry.status,
         entry.installedAt,
         null,
@@ -499,6 +548,13 @@ export function installPlugin(packageName, logger) {
 
     logger.info({ name: manifest.name, packageName }, 'Plugin installed');
     const oidcClients = await syncOidcClientsBestEffort(logger);
+    // Users already entitled to its route (grants that outlived an earlier
+    // installation) make up its audience from the start.
+    if (entry.identity) await recomputeAudiencesInBackground(logger);
+    // A new installation is served on no host (its version is not approved
+    // yet): a vhost still carrying the route from before goes in line.
+    const { refreshUserSurfaceVhosts } = await import('./user-surface.js');
+    await refreshUserSurfaceVhosts(entry.route, logger);
     return { ...entry, oidcClients };
   });
 }
@@ -572,6 +628,17 @@ export function uninstallPlugin(name, logger) {
       throw err;
     }
 
+    // Its identity ledger — everyone its agent halves were sent, and the
+    // erasures it owes — stays while an agent keeps its data (an uninstall
+    // without purge); with no data left anywhere it goes. A later install
+    // replays whatever is left of it at its first hosting.
+    try {
+      const { dropIdentityLedgerIfNoData } = await import('./audience.js');
+      await dropIdentityLedgerIfNoData(name, logger);
+    } catch (err) {
+      logger.warn({ name, err: err.message }, 'Could not settle the identity ledger on uninstall');
+    }
+
     // Sweep this plugin's capabilities off every agent so re-installing the
     // plugin later does NOT silently re-grant. Failure here is non-fatal
     // (the plugin is already gone), but logged loudly. A plugin without a
@@ -600,6 +667,11 @@ export function uninstallPlugin(name, logger) {
       );
     }
 
+    // Its user surface is unbound from every host, so a later install
+    // starts unbound (a plugin sharing another's route never held one).
+    const { releasePluginUserSurface } = await import('./user-surface.js');
+    await releasePluginUserSurface(plugin.route, { plugin: name, logger });
+
     logger.info({ name }, 'Plugin uninstalled');
     await syncOidcClientsBestEffort(logger);
     return { ok: true, name };
@@ -612,7 +684,7 @@ const updateRowSql = `
   UPDATE plugins SET
     display_name = ?, version = ?, description = ?, capabilities = ?, packages = ?, panel = ?,
     config = ?, modes = ?, hosting = ?, agent = ?, hooks = ?, hooks_entry_sha256 = ?,
-    agent_half_pin = ?, settings = ?
+    agent_half_pin = ?, settings = ?, identity = ?
   WHERE name = ?`;
 
 /**
@@ -624,7 +696,8 @@ const updateRowSql = `
  * (`prunedSettingsCache`) — so no read pairs the new schema with values
  * stored for the old one: a value whose field became a secret never shows
  * beside it, and a secret whose field became a plain value is no longer
- * reported set.
+ * reported set. The identity block is stored normalized; the update's
+ * caller recomputes the audiences once the version is in place.
  */
 export async function writePluginRow(name, manifest, hooksEntrySha256, agentHalfPin) {
   const s = await getStmts();
@@ -649,6 +722,7 @@ export async function writePluginRow(name, manifest, hooksEntrySha256, agentHalf
         nullableString(hooksEntrySha256),
         nullableJson(agentHalfPin),
         nullableJson(manifest.settings),
+        nullableJson(identityOf(manifest)),
         name,
       );
     const pruned = prunedSettingsCache(
@@ -688,13 +762,18 @@ export function replacePluginPackage(name, packageName, version, logger) {
     assertSafeLamalibrePackage(spec);
     logger?.info({ name, spec }, 'Installing plugin package version');
     try {
-      await execa('npm', ['install', '--ignore-scripts', spec], {
-        cwd: STATE_DIR,
-        timeout: 120000,
-      });
+      await withRegistryUserconfig(
+        (env) =>
+          execa('npm', ['install', '--ignore-scripts', spec], {
+            cwd: STATE_DIR,
+            timeout: 120000,
+            env,
+          }),
+        { log: logger },
+      );
     } catch (err) {
       logger?.error({ spec, stderr: err.stderr, err: err.message }, 'npm install failed');
-      throw Object.assign(new Error(`Failed to install "${spec}"`), { statusCode: 502 });
+      throw Object.assign(new Error(installFailure(spec, err)), { statusCode: 502 });
     }
     const require = createRequire(`${STATE_DIR}/`);
     const manifestPath = require.resolve(`${bare}/lamaste-plugin.json`);

package/vendor/serverd/src/lib/registry-credential.js

@@ -12,6 +12,13 @@
  *   install within the hour and limited to ten new tokens per agent per
  *   hour.
  *
+ * The panel's own npm calls — installing a plugin, staging an update with
+ * `npm pack`, pinning an agent half with `npm view` — go through
+ * {@link withRegistryUserconfig}: with a credential configured, npm is
+ * routed to its registry for its scope and authenticated with the service
+ * token through a throw-away userconfig; without one, npm runs as it is
+ * configured on the machine (the public registry by default).
+ *
  * Also the one piece of policy that belongs here: when a user loses a
  * `feria-*` group or is deleted, their registry tokens are revoked (best
  * effort, never blocks the user operation).
@@ -26,6 +33,7 @@ import {
   revokeRegistryTokensForOwner,
   lostFeriaGroups,
   readOidcClientSecret,
+  withRegistryUserconfig as withRegistryUserconfigCore,
   RegistryServiceTokenCache,
   AgentTokenBroker,
   RegistryCredentialError,
@@ -88,7 +96,7 @@ async function oidcDeps(config) {
 
 /**
  * Verify a candidate credential end to end (for `oidc`: Authelia token
- * endpoint → Feria login → whoami with the admin scope). The
+ * endpoint → Feria login → whoami with the read and admin scopes). The
  * `lamaste-server` client must already be in Authelia — the route syncs it
  * first.
  * @param {{ registryUrl: string, auth: { kind: 'token', token: string } | { kind: 'oidc', clientId: string } }} candidate
@@ -102,6 +110,35 @@ async function serviceToken(config) {
   return (await serviceTokens.resolve(config, await oidcDeps(config))).token;
 }
 
+/**
+ * Run `fn(env)` — one npm call of the panel's own — against the configured
+ * registry: with a credential, `env` names an isolated userconfig (0600,
+ * removed afterwards) routing the credential's scope to its registry with
+ * the panel's service token; a `401` refreshes the token once and retries.
+ * Without a credential `fn({})` runs npm as the machine configures it.
+ * A credential file that cannot be read fails the call rather than
+ * silently installing from the public registry.
+ *
+ * @template T
+ * @param {(env: Record<string, string>) => Promise<T>} fn
+ * @param {{ log?: import('pino').Logger | undefined }} [options]
+ * @returns {Promise<T>}
+ */
+export async function withRegistryUserconfig(fn, options = {}) {
+  const config = await readRegistryCredentialConfig();
+  if (!config) return fn({});
+  const deps = await oidcDeps(config);
+  return withRegistryUserconfigCore(
+    config,
+    async ({ refresh }) => {
+      if (refresh) serviceTokens.invalidate();
+      return (await serviceTokens.resolve(config, deps)).token;
+    },
+    fn,
+    { log: options.log },
+  );
+}
+
 /**
  * The calling agent's registry token: the cached one when it is still good
  * for an install, otherwise a freshly brokered one-hour token — unless the
@@ -121,14 +158,17 @@ export async function acquireAgentToken(agentLabel) {
 
 /**
  * Revoke a user's registry tokens after their `feria-*` groups changed or
- * they were deleted. Returns the number revoked, or `null` when nothing
- * needed doing (no credential configured, or no feria group lost).
+ * they were offboarded (`{ deleted: true }`: disabled or removed). Returns
+ * the number revoked, or `null` when nothing needed doing (no credential
+ * configured, or no feria group lost). The registry knows the user by
+ * username (`user:<username>`); the log line names them by `userId` alone.
  *
  * @param {string} username
  * @param {{ before: string[], after: string[] } | { deleted: true }} change
- * @param {import('pino').Logger} log
+ * @param {import('pino').Logger | undefined} log
+ * @param {{ userId?: string | null }} [who]
  */
-export async function revokeUserRegistryTokens(username, change, log) {
+export async function revokeUserRegistryTokens(username, change, log, { userId = null } = {}) {
   const config = await readRegistryCredentialConfig();
   if (!config) return null;
 
@@ -140,6 +180,6 @@ export async function revokeUserRegistryTokens(username, change, log) {
   const revoked = await revokeRegistryTokensForOwner(config, owner, {
     serviceToken: await serviceToken(config),
   });
-  log.info({ username, lost, revoked }, 'Revoked registry tokens after group change');
+  log?.info({ userId, lost, revoked }, 'Revoked a user’s registry tokens');
   return revoked;
 }

package/vendor/serverd/src/lib/request-logging.js

@@ -0,0 +1,19 @@
+/**
+ * How the panel logs its requests: one metadata line per request (core
+ * `logRequestMetadata`) instead of Fastify's own lines, which carry every
+ * URL with its query and the client address. The line has the method, the
+ * route pattern (never the URL a username or a query may be in), the
+ * status, the duration and the caller's certificate role; the client
+ * address only for certificate holders — administrators and agents, not
+ * people: never for a user of a plugin's user surface, the desktop's
+ * user-access calls or the public routes.
+ */
+
+/** Callers whose address a request line may carry: certificate holders, not people. */
+const CERT_ROLES_LOGGED_WITH_IP = new Set(['admin', 'agent', 'plugin-agent']);
+
+/** The options the panel passes to `logRequestMetadata`. */
+export const panelRequestLogOptions = Object.freeze({
+  fields: (request) => ({ certRole: request.certRole ?? null }),
+  logIp: (request) => CERT_ROLES_LOGGED_WITH_IP.has(request.certRole),
+});

package/vendor/serverd/src/lib/retained-data.js

@@ -38,18 +38,64 @@ function rowToRecord(row) {
  * agent package `pkg` of plugin `plugin`. A record that exists already keeps
  * its `since` — the data has been there since then.
  *
+ * With it goes how far the agent half's identity projection — part of that
+ * data — had applied the plugin's feed, as the half last answered (the
+ * plugin's feed state, read now, before the hosting's is forgotten): the
+ * erasures of the plugin's ledger after that cursor are pending on this
+ * agent (`pendingErasures` in `lib/identity-sync.js`). When the relay knows
+ * no position, a record that exists keeps the one it had — the projection
+ * did not move without a feed.
+ *
  * @param {{ agentLabel: string, route: string, plugin: string, package: string, operation?: string | null }} record
  */
 export async function recordRetainedData({ agentLabel, route, plugin, package: pkg, operation }) {
   const db = await getStateDb();
+  const feed = db
+    .prepare('SELECT directory_id, cursor FROM plugin_identity_sync WHERE plugin = ?')
+    .get(plugin);
+  const known = feed && feed.directory_id !== null && feed.cursor !== null;
   db.prepare(
-    `INSERT INTO retained_agent_data (agent_label, route, plugin, package, since, operation)
-     VALUES (?, ?, ?, ?, ?, ?)
+    `INSERT INTO retained_agent_data
+       (agent_label, route, plugin, package, since, operation, identity_directory_id, identity_cursor)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)
      ON CONFLICT(agent_label, route) DO UPDATE SET
        plugin = excluded.plugin,
        package = excluded.package,
-       operation = excluded.operation`,
-  ).run(agentLabel, route, plugin, pkg, new Date().toISOString(), operation ?? null);
+       operation = excluded.operation,
+       identity_directory_id = CASE WHEN excluded.identity_cursor IS NULL
+         THEN identity_directory_id ELSE excluded.identity_directory_id END,
+       identity_cursor = COALESCE(excluded.identity_cursor, identity_cursor)`,
+  ).run(
+    agentLabel,
+    route,
+    plugin,
+    pkg,
+    new Date().toISOString(),
+    operation ?? null,
+    known ? feed.directory_id : null,
+    known ? Number(feed.cursor) : null,
+  );
+}
+
+/**
+ * Where the identity projection in each record's data stands, for plugin
+ * `plugin`: `[{ agentLabel, directoryId, cursor }]` (both null when unknown).
+ *
+ * @param {string} plugin
+ */
+export async function retainedIdentityPositions(plugin) {
+  const db = await getStateDb();
+  return db
+    .prepare(
+      `SELECT agent_label, identity_directory_id, identity_cursor FROM retained_agent_data
+       WHERE plugin = ? ORDER BY since, agent_label`,
+    )
+    .all(plugin)
+    .map((row) => ({
+      agentLabel: row.agent_label,
+      directoryId: row.identity_directory_id,
+      cursor: row.identity_cursor === null ? null : Number(row.identity_cursor),
+    }));
 }
 
 /** Drop the record of the data agent `agentLabel` keeps for route `route` (purged, or taken back). */

package/vendor/serverd/src/lib/state.js

@@ -1,5 +1,6 @@
 import { readFile, writeFile, rename, open } from 'node:fs/promises';
 import path from 'node:path';
+import { PromiseChainMutex } from '@lamalibre/lamaste';
 
 const STATE_DIR = process.env.LAMALIBRE_LAMASTE_STATE_DIR || '/etc/lamalibre/lamaste';
 
@@ -138,3 +139,20 @@ export async function writeInvitations(invitations) {
 
   await rename(tmpPath, filePath);
 }
+
+/** Serializes every read-modify-write of invitations.json in this process. */
+const invitationsMutex = new PromiseChainMutex();
+
+/**
+ * Run `fn` holding the invitations lock: a read of invitations.json, the
+ * decisions made on it and the write that follows must not interleave with
+ * another — creating, revoking, accepting an invitation, and purging a
+ * removed user's.
+ *
+ * @template T
+ * @param {() => Promise<T>} fn
+ * @returns {Promise<T>}
+ */
+export function withInvitationsLock(fn) {
+  return invitationsMutex.run(fn);
+}

package/vendor/serverd/src/lib/tunnel-hooks.js

@@ -12,7 +12,8 @@
  * Whenever the plugin comes up — after a `down`, or first seen up — the
  * relay also re-reads its settings from the agent half: they may have
  * changed while the relay could not see it (a restore, a retyped field
- * dropped by a new version).
+ * dropped by a new version) — and, for a plugin that declares identity,
+ * sends its agent half the audience changes it missed while it was down.
  *
  * Calls for one plugin are serialised and run beside the monitor, which
  * does not wait for them.
@@ -27,6 +28,7 @@ import {
 import { runRelayHook } from './relay-hooks.js';
 import { rememberTunnelFallback } from './request-hooks.js';
 import { refreshPluginSettingsBestEffort } from './plugin-settings.js';
+import { syncPluginIdentity } from './identity-sync.js';
 
 const chains = new Map();
 
@@ -44,6 +46,7 @@ export function onHealthTransition(plugin, before, after, logger) {
     .then(async () => {
       if (after.state === 'up' && before?.state !== 'up') {
         await refreshPluginSettingsBestEffort(plugin, logger);
+        await syncPluginIdentity(plugin, { logger });
       }
     });
   chains.set(plugin, next);

package/vendor/serverd/src/lib/user-access-session.js

@@ -1,4 +1,5 @@
 import crypto from 'node:crypto';
+import { isIdentityUuid } from '@lamalibre/lamaste';
 
 const SESSION_MAX_AGE = 12 * 60 * 60; // 12 hours in seconds
 const INACTIVITY_TIMEOUT = 2 * 60 * 60; // 2 hours in seconds
@@ -21,19 +22,23 @@ function signPayload(payloadB64, secretHex) {
 }
 
 /**
- * Create a signed user-access session token.
+ * Create a signed user-access session token, bound to the user's directory
+ * id as well as their username: a later user given the same username never
+ * holds this session (the middleware checks the username's current holder).
  *
  * @param {string} sessionSecret - Hex-encoded session secret
- * @param {string} username - Authelia username to bind the session to
+ * @param {{ username: string, userId: string }} user - the Authelia username and its directory id
  * @returns {{ value: string, maxAge: number, expiresAt: string }}
  */
-export function createUserSession(sessionSecret, username) {
+export function createUserSession(sessionSecret, { username, userId }) {
+  if (!isIdentityUuid(userId)) throw new Error('A user session names a directory user id');
   const now = Math.floor(Date.now() / 1000);
   const payload = {
     iat: now,
     exp: now + SESSION_MAX_AGE,
     lastActivity: now,
     username,
+    userId,
     type: 'user-access',
   };
   const payloadB64 = Buffer.from(JSON.stringify(payload)).toString('base64url');
@@ -52,10 +57,12 @@ export function createUserSession(sessionSecret, username) {
  * @param {string} tokenValue - The token (payload.sig)
  * @param {string} sessionSecret - Hex-encoded session secret
  * @param {{ userEpochs?: Record<string, number> }} [options]
- *   userEpochs maps username → Unix-second epoch. If the session's `iat`
- *   is older than the user's epoch, the session is rejected as revoked.
- *   This is how Authelia user deletions invalidate live sessions whose
- *   HMAC signature is otherwise still valid.
+ *   userEpochs maps a directory user id → Unix-second epoch. If the
+ *   session's `iat` is older than its user's epoch, the session is rejected
+ *   as revoked. This is how offboarding (disable, delete) invalidates live
+ *   sessions whose HMAC signature is otherwise still valid. A session
+ *   without a user id (issued before 4.5) is rejected: it could not be
+ *   told from a later user's.
  * @returns {{ valid: boolean, payload?: object, reason?: string }}
  */
 export function validateUserSession(tokenValue, sessionSecret, options = {}) {
@@ -96,6 +103,10 @@ export function validateUserSession(tokenValue, sessionSecret, options = {}) {
     return { valid: false, reason: 'missing_username' };
   }
 
+  if (!isIdentityUuid(payload.userId)) {
+    return { valid: false, reason: 'missing_user_id' };
+  }
+
   const now = Math.floor(Date.now() / 1000);
 
   if (payload.exp && now > payload.exp) {
@@ -106,12 +117,11 @@ export function validateUserSession(tokenValue, sessionSecret, options = {}) {
     return { valid: false, reason: 'inactive' };
   }
 
-  // Per-user invalidation epoch (set when a user is deleted from Authelia).
-  // Reject sessions issued before that epoch — they belong to a user who no
-  // longer exists, even if a same-named user is later re-created.
+  // Per-user invalidation epoch (set when a user is offboarded). Reject
+  // sessions issued before it.
   const userEpochs = options.userEpochs;
   if (userEpochs && typeof userEpochs === 'object') {
-    const epoch = userEpochs[payload.username];
+    const epoch = userEpochs[payload.userId];
     if (typeof epoch === 'number' && typeof payload.iat === 'number' && payload.iat < epoch) {
       return { valid: false, reason: 'revoked' };
     }