@lamalibre/create-lamaste 4.4.0 → 4.5.0

package/vendor/serverd/src/lib/vhost-reconcile.js

@@ -13,7 +13,11 @@
  *   Authelia-protected static site and of the auth portal named the client's
  *   `Host` header rather than the vhost's own hostname, so a request line for
  *   one hostname sent with the `Host` of another was authorized for the other
- *   (see `originalUrl` in nginx.js).
+ *   (see `originalUrl` in nginx.js);
+ * - from 4.5 the panel serves plugins' user surfaces to a relay assertion
+ *   Gatekeeper signs, so every vhost that proxies a browser to the panel —
+ *   the panel's own and the auth portal — clears one a client sent, and so
+ *   does every tunnel vhost that does not set Gatekeeper's.
  *
  * Each installed vhost is rendered again from state, on the certificate
  * directory the installed file names (a wildcard certificate stays a wildcard
@@ -23,15 +27,28 @@
  * A rewrite never adds or removes authentication: a vhost that disagrees with
  * its state on that is reported and left alone. The one exception is the
  * agent-panel vhost, whose mTLS check gains the panel's `auth_request`.
+ *
+ * A tunnel bound as plugins' user surface is rendered with the locations of
+ * the routes it serves now (`servedUserSurfaceRoutes`: identity declared and
+ * approved, and the tunnel's agent hosting the plugin); the same reconcile,
+ * limited to the tunnels a route is bound to, follows the plugin's identity
+ * through approval, update and uninstall, its hosting, and the tunnels'
+ * agents ({@link reconcileUserSurfaceVhosts}). Every location proxying to a
+ * tunnel or agent backend keeps Authelia's session cookie from it
+ * (`$lamaste_backend_cookie`), so an installed vhost from before that is
+ * rewritten too.
  */
 
+import { tunnelUserSurfaceRoutes } from '@lamalibre/lamaste';
 import { withTunnelLock } from '@lamalibre/lamaste/server';
 import {
+  PANEL_DOMAIN_VHOST,
   installVhost,
   isSiteEnabled,
   readInstalledVhost,
   renderAgentPanelVhost,
   renderAuthVhost,
+  renderPanelVhost,
   renderStaticSiteVhost,
   renderTunnelVhost,
   vhostCertDir,
@@ -43,15 +60,30 @@ const SITE_NAME_PART_RE = /^[A-Za-z0-9][A-Za-z0-9-]{0,62}$/;
 
 const AUTH_VHOST = 'lamalibre-lamaste-auth';
 
+/**
+ * Which of a tunnel's bound routes its vhost serves now — the panel's
+ * plugins and their hostings decide (`lib/user-surface.js`), loaded when
+ * first needed so this module stays free of the plugin registry.
+ *
+ * @param {readonly string[]} routes
+ * @param {{ agentLabel?: string }} tunnel
+ */
+async function servedUserSurface(routes, tunnel) {
+  const { servedUserSurfaceRoutes } = await import('./user-surface.js');
+  return servedUserSurfaceRoutes(routes, tunnel);
+}
+
 /**
  * The vhost a tunnel should have, rendered on `certDir`; null for tunnels
  * without one (internal plugin tunnels) or whose state cannot be rendered.
  *
  * @param {object} tunnel
  * @param {string} certDir
+ * @param {ReadonlyArray<{ route: string, maxBodySizeMb: number }>} [userSurface] - the user
+ *   surfaces its vhost serves (`servedUserSurfaceRoutes` of its bound routes)
  * @returns {{ name: string, fqdn: string, config: string } | null}
  */
-export function expectedTunnelVhost(tunnel, certDir) {
+export function expectedTunnelVhost(tunnel, certDir, userSurface = []) {
   if (!managedTunnelVhostName(tunnel) || typeof tunnel.fqdn !== 'string') return null;
   if (!tunnel.fqdn.startsWith(`${tunnel.subdomain}.`)) return null;
   const domain = tunnel.fqdn.slice(tunnel.subdomain.length + 1);
@@ -60,18 +92,16 @@ export function expectedTunnelVhost(tunnel, certDir) {
   }
   // As createTunnel and updateTunnel write it: the stored access mode
   // (restricted when absent, as Gatekeeper reads it), the plugin route of a
-  // plugin tunnel, and a body limit only when the tunnel has one.
-  return renderTunnelVhost(
-    tunnel.accessMode ?? 'restricted',
-    tunnel.subdomain,
-    domain,
-    tunnel.port,
-    certDir,
-    {
-      ...(tunnel.type === 'plugin' && tunnel.pluginRoute ? { pathPrefix: tunnel.pluginRoute } : {}),
-      ...(tunnel.maxBodySizeMb !== undefined ? { maxBodySizeMb: tunnel.maxBodySizeMb } : {}),
-    },
-  );
+  // plugin tunnel, a body limit only when the tunnel has one, and the user
+  // surfaces it serves (never on a public vhost: such state cannot be
+  // rendered, and a bound tunnel cannot be made public).
+  const accessMode = tunnel.accessMode ?? 'restricted';
+  if (accessMode === 'public' && userSurface.length > 0) return null;
+  return renderTunnelVhost(accessMode, tunnel.subdomain, domain, tunnel.port, certDir, {
+    ...(tunnel.type === 'plugin' && tunnel.pluginRoute ? { pathPrefix: tunnel.pluginRoute } : {}),
+    ...(tunnel.maxBodySizeMb !== undefined ? { maxBodySizeMb: tunnel.maxBodySizeMb } : {}),
+    ...(userSurface.length > 0 ? { userSurface } : {}),
+  });
 }
 
 /** Site name of a tunnel's vhost, or null for a tunnel without one. */
@@ -168,7 +198,45 @@ function logResult(log, what, result) {
   }
 }
 
-const defaultTunnelDeps = { readTunnels, readInstalledVhost, installVhost, isSiteEnabled };
+const defaultTunnelDeps = {
+  readTunnels,
+  readInstalledVhost,
+  installVhost,
+  isSiteEnabled,
+  servedUserSurface,
+};
+
+/**
+ * Reconcile one tunnel's vhost (see {@link reconcileOne}), with the user
+ * surfaces it serves now. The caller holds the tunnel lock.
+ */
+async function reconcileTunnel(tunnel, result, deps) {
+  const name = managedTunnelVhostName(tunnel);
+  if (!name) return;
+  const label = tunnel.fqdn ?? tunnel.subdomain;
+  const bound = tunnelUserSurfaceRoutes(tunnel);
+  let served;
+  try {
+    served = bound.length > 0 ? await deps.servedUserSurface(bound, tunnel) : [];
+  } catch (err) {
+    result.failed.push({ vhost: label, error: err instanceof Error ? err.message : String(err) });
+    return;
+  }
+  await reconcileOne(
+    {
+      name,
+      label,
+      render: (certDir) => expectedTunnelVhost(tunnel, certDir, served),
+      // Linked only when it is now and the tunnel is enabled: a rewrite of
+      // the text never publishes a vhost someone unlinked, and unlinks a
+      // disabled tunnel's.
+      enabled: async () => tunnel.enabled !== false && (await deps.isSiteEnabled(name)),
+      keepAuthentication: tunnel.type !== 'panel',
+    },
+    result,
+    deps,
+  );
+}
 
 /**
  * Reconcile the vhost of every tunnel that has one: agent-panel, app and
@@ -184,34 +252,57 @@ export async function reconcileTunnelVhosts(log, deps = defaultTunnelDeps) {
   return withTunnelLock(async () => {
     const result = newResult();
     for (const tunnel of await deps.readTunnels()) {
-      const name = managedTunnelVhostName(tunnel);
-      if (!name) continue;
-      await reconcileOne(
-        {
-          name,
-          label: tunnel.fqdn ?? tunnel.subdomain,
-          render: (certDir) => expectedTunnelVhost(tunnel, certDir),
-          // Linked only when it is now and the tunnel is enabled: a rewrite of
-          // the text never publishes a vhost someone unlinked, and unlinks a
-          // disabled tunnel's.
-          enabled: async () => tunnel.enabled !== false && (await deps.isSiteEnabled(name)),
-          keepAuthentication: tunnel.type !== 'panel',
-        },
-        result,
-        deps,
-      );
+      await reconcileTunnel(tunnel, result, deps);
     }
     logResult(log, 'tunnel', result);
     return result;
   });
 }
 
+/**
+ * Reconcile the vhosts of the tunnels `route` is bound to as a user
+ * surface — after a change that decides whether they serve it: the
+ * plugin's installation, the approval of its version, an update or its
+ * reversal, its hosting. `ids` names tunnels to reconcile besides (the
+ * route's binding was just released from them, or their agent was
+ * revoked — `route` null then). Under the tunnel lock.
+ *
+ * @param {Parameters<typeof logResult>[0]} log
+ * @param {string | null} route
+ * @param {{ ids?: readonly string[] }} [opts]
+ * @param {typeof defaultTunnelDeps} [deps]
+ * @returns {Promise<ReturnType<typeof newResult>>}
+ */
+export async function reconcileUserSurfaceVhosts(
+  log,
+  route,
+  { ids = [] } = {},
+  deps = defaultTunnelDeps,
+) {
+  return withTunnelLock(async () => {
+    const result = newResult();
+    for (const tunnel of await deps.readTunnels()) {
+      if (
+        !ids.includes(tunnel.id) &&
+        (route === null || !tunnelUserSurfaceRoutes(tunnel).includes(route))
+      ) {
+        continue;
+      }
+      await reconcileTunnel(tunnel, result, deps);
+    }
+    logResult(log, 'user-surface tunnel', result);
+    return result;
+  });
+}
+
 const defaultSiteDeps = { readSites, readInstalledVhost, installVhost, isSiteEnabled };
 
 /**
- * Reconcile the vhosts that ask Authelia directly: the auth portal
- * (`auth.<domain>`) and every static site. Site changes take no lock, so call
- * it before the panel listens — then nothing can change a site meanwhile.
+ * Reconcile the vhosts that proxy a browser to the panel or ask Authelia
+ * directly: the panel's own (`panel.<domain>`), the auth portal
+ * (`auth.<domain>`) and every static site. Site changes take no lock, so
+ * call it before the panel listens — then nothing can change a site
+ * meanwhile.
  *
  * @param {Parameters<typeof logResult>[0]} log
  * @param {string} domain
@@ -221,6 +312,17 @@ const defaultSiteDeps = { readSites, readInstalledVhost, installVhost, isSiteEna
 export async function reconcileSiteVhosts(log, domain, deps = defaultSiteDeps) {
   const result = newResult();
 
+  await reconcileOne(
+    {
+      name: PANEL_DOMAIN_VHOST,
+      label: `panel.${domain}`,
+      render: (certDir) => renderPanelVhost(domain, certDir),
+      enabled: () => deps.isSiteEnabled(PANEL_DOMAIN_VHOST),
+    },
+    result,
+    deps,
+  );
+
   await reconcileOne(
     {
       name: AUTH_VHOST,

package/vendor/serverd/src/middleware/user-access-session.js

@@ -1,5 +1,6 @@
 import fp from 'fastify-plugin';
 import { getConfig } from '../lib/config.js';
+import { findDirectoryUser } from '../lib/directory.js';
 import {
   REFRESH_THRESHOLD,
   validateUserSession,
@@ -37,6 +38,14 @@ async function userAccessSessionPlugin(fastify, _opts) {
       return reply.code(401).send({ error: 'user_session_required' });
     }
 
+    // The session's user must still hold the username, and be enabled: a
+    // deleted user's username given to someone else never inherits it, and
+    // a disabled user is out at once.
+    const holder = await findDirectoryUser(result.payload.username);
+    if (!holder || holder.userId !== result.payload.userId || holder.status !== 'active') {
+      return reply.code(401).send({ error: 'user_session_required' });
+    }
+
     // Set username on request for downstream route handlers
     request.userAccessUsername = result.payload.username;
 

package/vendor/serverd/src/routes/agent-forwarder.js

@@ -2,8 +2,10 @@
  * `/api/<route>/*` for agent-hosted plugins with an agent half — forwarded
  * by the panel to the plugin's agent half over its internal tunnel, through
  * the plugin's approved request hooks (`request:pre-forward` /
- * `request:post-forward`) and, while it is down, its `tunnel:down` fallback.
- * See `createHookedForwarder` in `@lamalibre/lamaste/server`.
+ * `request:post-forward`). While its hosting is down nothing is forwarded:
+ * its `tunnel:down` fallback answers, or `502` with the reason
+ * (`resolveForwardTarget`). See `createHookedForwarder` in
+ * `@lamalibre/lamaste/server`.
  *
  * Registered after every other `/api` route: static routes win over its
  * `/:route/*`, so only what nothing else answers arrives here, and a route

package/vendor/serverd/src/routes/invite.js

@@ -1,6 +1,6 @@
 import crypto from 'node:crypto';
 import { z } from 'zod';
-import { readInvitations, writeInvitations } from '../lib/state.js';
+import { readInvitations, withInvitationsLock, writeInvitations } from '../lib/state.js';
 import {
   createUserFromInvitation,
   hashPassword,
@@ -9,6 +9,8 @@ import {
   writeTotpToDatabase,
 } from '../lib/authelia.js';
 import { getConfig } from '../lib/config.js';
+import { httpError } from '../lib/app-error.js';
+import { changeUsers, usersFileError } from '../lib/directory.js';
 
 /**
  * Find an invitation by token using a constant-time comparison.
@@ -117,15 +119,49 @@ export default async function inviteRoutes(fastify, _opts) {
       return reply.code(500).send({ error: 'Failed to process password' });
     }
 
+    // Through the users lock: the directory gives the user their id before
+    // Authelia restarts and lets them sign in.
     try {
-      await createUserFromInvitation(
-        invitation.username,
-        invitation.email,
-        invitation.groups,
-        hashedPassword,
+      await changeUsers(
+        async () => {
+          // An unreadable users file is refused, never written over.
+          let current = { users: {} };
+          try {
+            current = await readUsersRaw();
+          } catch (err) {
+            if (err.code !== 'ENOENT') {
+              throw httpError('Failed to read user database', 500, { cause: usersFileError(err) });
+            }
+          }
+          if (current.users[invitation.username]) {
+            throw httpError('This username already exists', 409);
+          }
+          await createUserFromInvitation(
+            invitation.username,
+            invitation.email,
+            invitation.groups,
+            hashedPassword,
+          );
+        },
+        {
+          actor: 'invitation',
+          logger: request.log,
+          // A removed user's grants, groups and second factors under the
+          // username go first; a username with an OIDC identity is refused.
+          creates: [invitation.username],
+          expect: (users) => users[invitation.username]?.password === hashedPassword,
+        },
       );
     } catch (err) {
-      request.log.error(err, 'Failed to create user from invitation');
+      if (err.statusCode === 409) {
+        return reply
+          .code(409)
+          .send({ error: err.message, ...(err.code ? { code: err.code } : {}) });
+      }
+      if (err.statusCode === 503) {
+        return reply.code(503).send({ error: err.message, code: err.code });
+      }
+      request.log.error(err.cause ?? err, 'Failed to create user from invitation');
       return reply.code(500).send({ error: 'Failed to create user account' });
     }
 
@@ -140,12 +176,17 @@ export default async function inviteRoutes(fastify, _opts) {
       // Non-fatal: user was created, they can have admin reset TOTP later
     }
 
-    // Mark invitation as used
-    invitation.used = true;
-    invitation.acceptedAt = new Date().toISOString();
-
+    // Mark invitation as used — on the file as it is now, under its lock.
     try {
-      await writeInvitations(invitations);
+      await withInvitationsLock(async () => {
+        const current = await readInvitations();
+        // The token found it (checked above); it names this invitation alone.
+        const accepted = current.find((inv) => inv.token === invitation.token);
+        if (!accepted) return;
+        accepted.used = true;
+        accepted.acceptedAt = new Date().toISOString();
+        await writeInvitations(current);
+      });
     } catch (err) {
       request.log.warn(err, 'Failed to update invitation status (user was created)');
     }

package/vendor/serverd/src/routes/management/gatekeeper-proxy.js

@@ -8,10 +8,33 @@
  * forwarding needed.
  *
  * Admin-only (lamaste-serverd's mTLS + roleGuard protect these routes).
+ *
+ * Grants and groups decide who is in an agent-hosted plugin's audience
+ * (slice 6): a plugin grant whose context names `roles` is an entitlement,
+ * checked against the roles the plugin declares and passed on sorted
+ * (`checkProxiedGrant`), and every grant or group change that went through
+ * recomputes the audiences. A grant or a group membership is given to a
+ * username holding the users lock (`withUsernamesForGrants`), so no
+ * deletion races it: a username a removed user held and nobody holds now is
+ * refused (409 `username_deleted`), and whatever a removed user who held it
+ * left in Gatekeeper is cleared first (503 `gatekeeper_unavailable` when it
+ * cannot be) — a reused username inherits nothing. The access log is purged
+ * for one username by POST, its name in the body (never in a URL, which
+ * logs keep).
  */
 
+import { recomputeAudiences } from '../../lib/audience.js';
+import { withUsernamesForGrants } from '../../lib/directory.js';
+import { checkProxiedGrant } from '../../lib/entitlements.js';
+import { actorFromRequest } from '../../lib/actor.js';
 import { gatekeeperRequest } from '../../lib/gatekeeper-client.js';
 
+/** Gatekeeper's `path`, with the request's query string when it has one. */
+function withQuery(path, request) {
+  const qs = new URLSearchParams(request.query).toString();
+  return qs ? `${path}?${qs}` : path;
+}
+
 export default async function gatekeeperProxyRoutes(fastify, _opts) {
   // All gatekeeper management routes are admin-only
   fastify.addHook('preHandler', fastify.requireRole(['admin']));
@@ -32,6 +55,39 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
     };
   };
 
+  /** When Gatekeeper took a grant or group change, the plugin audiences follow it. */
+  const followAudiences = async (request, answer) => {
+    if (answer.statusCode < 400) await recomputeAudiences({ logger: request.log });
+    return answer;
+  };
+
+  /**
+   * A grant or group change: forwarded, and when Gatekeeper took it, the
+   * plugin audiences follow it before the answer goes back.
+   */
+  const proxyChange = async (request, method, gatekeeperPath, body) =>
+    followAudiences(request, await proxy(method, gatekeeperPath, body));
+
+  /**
+   * Give something to `usernames` in Gatekeeper: forwarded holding the
+   * users lock, after the usernames' checks (`withUsernamesForGrants`); a
+   * refusal of those checks is the answer. The audiences follow.
+   */
+  const proxyGive = async (request, usernames, method, gatekeeperPath, body) => {
+    let answer;
+    try {
+      answer = await withUsernamesForGrants(
+        usernames,
+        { actor: actorFromRequest(request), logger: request.log },
+        () => proxy(method, gatekeeperPath, body),
+      );
+    } catch (err) {
+      if (!Number.isInteger(err.statusCode)) throw err;
+      return { statusCode: err.statusCode, data: { error: err.message, code: err.code } };
+    }
+    return followAudiences(request, answer);
+  };
+
   // --- Groups ---
 
   fastify.get('/gatekeeper/groups', async (_request, reply) => {
@@ -40,7 +96,7 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
   });
 
   fastify.post('/gatekeeper/groups', async (request, reply) => {
-    const { statusCode, data } = await proxy('POST', '/api/groups', request.body);
+    const { statusCode, data } = await proxyChange(request, 'POST', '/api/groups', request.body);
     return reply.code(statusCode).send(data);
   });
 
@@ -52,7 +108,8 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
 
   fastify.patch('/gatekeeper/groups/:name', async (request, reply) => {
     const { name } = request.params;
-    const { statusCode, data } = await proxy(
+    const { statusCode, data } = await proxyChange(
+      request,
       'PATCH',
       `/api/groups/${encodeURIComponent(name)}`,
       request.body,
@@ -62,13 +119,22 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
 
   fastify.delete('/gatekeeper/groups/:name', async (request, reply) => {
     const { name } = request.params;
-    const { statusCode, data } = await proxy('DELETE', `/api/groups/${encodeURIComponent(name)}`);
+    const { statusCode, data } = await proxyChange(
+      request,
+      'DELETE',
+      `/api/groups/${encodeURIComponent(name)}`,
+    );
     return reply.code(statusCode).send(data);
   });
 
   fastify.post('/gatekeeper/groups/:name/members', async (request, reply) => {
     const { name } = request.params;
-    const { statusCode, data } = await proxy(
+    const usernames = Array.isArray(request.body?.usernames)
+      ? request.body.usernames.filter((u) => typeof u === 'string')
+      : [];
+    const { statusCode, data } = await proxyGive(
+      request,
+      usernames,
       'POST',
       `/api/groups/${encodeURIComponent(name)}/members`,
       request.body,
@@ -78,7 +144,8 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
 
   fastify.delete('/gatekeeper/groups/:name/members/:username', async (request, reply) => {
     const { name, username } = request.params;
-    const { statusCode, data } = await proxy(
+    const { statusCode, data } = await proxyChange(
+      request,
       'DELETE',
       `/api/groups/${encodeURIComponent(name)}/members/${encodeURIComponent(username)}`,
     );
@@ -88,14 +155,29 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
   // --- Grants ---
 
   fastify.get('/gatekeeper/grants', async (request, reply) => {
-    const qs = new URLSearchParams(request.query).toString();
-    const grantPath = qs ? `/api/grants?${qs}` : '/api/grants';
-    const { statusCode, data } = await proxy('GET', grantPath);
+    const { statusCode, data } = await proxy('GET', withQuery('/api/grants', request));
     return reply.code(statusCode).send(data);
   });
 
+  // A plugin grant with `context.roles` is an entitlement: its roles must be
+  // the plugin's (400 otherwise), and go on sorted, without repeats.
   fastify.post('/gatekeeper/grants', async (request, reply) => {
-    const { statusCode, data } = await proxy('POST', '/api/grants', request.body);
+    let body;
+    try {
+      body = await checkProxiedGrant(request.body);
+    } catch (err) {
+      if (!Number.isInteger(err.statusCode)) throw err;
+      return reply.code(err.statusCode).send({
+        error: err.message,
+        ...(err.code ? { code: err.code } : {}),
+        ...(Array.isArray(err.unknown) ? { unknown: err.unknown } : {}),
+      });
+    }
+    const usernames =
+      body?.principalType === 'user' && typeof body.principalId === 'string'
+        ? [body.principalId]
+        : [];
+    const { statusCode, data } = await proxyGive(request, usernames, 'POST', '/api/grants', body);
     return reply.code(statusCode).send(data);
   });
 
@@ -107,7 +189,8 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
 
   fastify.delete('/gatekeeper/grants/:grantId', async (request, reply) => {
     const { grantId } = request.params;
-    const { statusCode, data } = await proxy(
+    const { statusCode, data } = await proxyChange(
+      request,
       'DELETE',
       `/api/grants/${encodeURIComponent(grantId)}`,
     );
@@ -117,9 +200,11 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
   // Bulk-revoke every grant for a principal. Forwarded to gatekeeper as
   // DELETE /api/grants?principalType=...&principalId=...
   fastify.delete('/gatekeeper/grants', async (request, reply) => {
-    const qs = new URLSearchParams(request.query).toString();
-    const grantPath = qs ? `/api/grants?${qs}` : '/api/grants';
-    const { statusCode, data } = await proxy('DELETE', grantPath);
+    const { statusCode, data } = await proxyChange(
+      request,
+      'DELETE',
+      withQuery('/api/grants', request),
+    );
     return reply.code(statusCode).send(data);
   });
 
@@ -147,14 +232,20 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
   });
 
   fastify.get('/gatekeeper/access-log', async (request, reply) => {
-    const qs = new URLSearchParams(request.query).toString();
-    const logPath = qs ? `/api/access-log?${qs}` : '/api/access-log';
-    const { statusCode, data } = await proxy('GET', logPath);
+    const { statusCode, data } = await proxy('GET', withQuery('/api/access-log', request));
     return reply.code(statusCode).send(data);
   });
 
+  // DELETE clears the whole log. One username's rows (before a time, when
+  // given) are purged by POST with `{ username, before? }` in the body — a
+  // username in a query string would be in every access log on the way.
   fastify.delete('/gatekeeper/access-log', async (_request, reply) => {
     const { statusCode, data } = await proxy('DELETE', '/api/access-log');
     return reply.code(statusCode).send(data);
   });
+
+  fastify.post('/gatekeeper/access-log/purge', async (request, reply) => {
+    const { statusCode, data } = await proxy('POST', '/api/access-log/purge', request.body);
+    return reply.code(statusCode).send(data);
+  });
 }

package/vendor/serverd/src/routes/management/identity-directory.js

@@ -0,0 +1,79 @@
+/**
+ * The user directory (slice 6), admin only:
+ *
+ *   GET  /identity/directory                 every user the directory knows —
+ *                                            tombstones and erased ones too — with
+ *                                            the plugins that have not yet
+ *                                            acknowledged an erasure (those the
+ *                                            feed does not reach now marked)
+ *   POST /identity/directory/:userId/erase   erase a removed user
+ *
+ * Business logic lives in `lib/directory.js` and `lib/identity-sync.js`.
+ */
+
+import { z } from 'zod';
+import { IDENTITY_UUID_REGEX } from '@lamalibre/lamaste';
+import { actorFromRequest } from '../../lib/actor.js';
+import {
+  eraseDirectoryUser,
+  getDirectoryId,
+  listDirectoryUsers,
+  listErasures,
+} from '../../lib/directory.js';
+import { pendingErasuresByUser } from '../../lib/identity-sync.js';
+
+const UserIdParamSchema = z.object({
+  userId: z.string().regex(IDENTITY_UUID_REGEX, 'userId is a directory user id'),
+});
+
+export default async function identityDirectoryRoutes(fastify, _opts) {
+  fastify.get('/identity/directory', { preHandler: fastify.requireRole(['admin']) }, async () => {
+    const [directoryId, users, erasures, pending] = await Promise.all([
+      getDirectoryId(),
+      listDirectoryUsers(),
+      listErasures(),
+      pendingErasuresByUser(),
+    ]);
+    return {
+      directoryId,
+      users: users.map((user) => {
+        const waiting = pending.get(user.userId) ?? [];
+        return {
+          ...user,
+          erasure: erasures.get(user.userId) ?? null,
+          pendingErasures: waiting.map((p) => p.plugin),
+          // Among them, the plugins the feed does not reach now (uninstalled,
+          // or no longer declaring identity) whose data an agent keeps.
+          pendingErasuresInactive: waiting.filter((p) => p.inactive).map((p) => p.plugin),
+        };
+      }),
+    };
+  });
+
+  fastify.post(
+    '/identity/directory/:userId/erase',
+    {
+      preHandler: fastify.requireRole(['admin']),
+      // Moderate tier, as deleting a user: destructive, and it calls Gatekeeper.
+      config: { rateLimit: { max: 30, timeWindow: '1 minute' } },
+    },
+    async (request, reply) => {
+      const { userId } = UserIdParamSchema.parse(request.params);
+      try {
+        const erased = await eraseDirectoryUser(userId, {
+          actor: actorFromRequest(request),
+          logger: request.log,
+        });
+        return { ok: true, ...erased };
+      } catch (err) {
+        if (Number.isInteger(err.statusCode)) {
+          return reply
+            .code(err.statusCode)
+            .send({ error: err.message, ...(err.code ? { code: err.code } : {}) });
+        }
+        request.log.error(err, 'Failed to erase the user');
+        return reply.code(500).send({ error: 'Failed to erase the user' });
+      }
+    },
+  );
+}