@lamalibre/create-lamaste 4.4.0 → 4.5.0

package/vendor/serverd/src/routes/management/users.js

@@ -1,25 +1,34 @@
 import { z } from 'zod';
+import { USERNAME_MAX_LENGTH, USERNAME_MIN_LENGTH, USERNAME_REGEX } from '@lamalibre/lamaste';
 import {
   readUsers,
   readUsersRaw,
   writeUsers,
-  reloadAuthelia,
   hashPassword,
   generateTotpSecret,
   writeTotpToDatabase,
 } from '../../lib/authelia.js';
-import { removeGrantsForUser } from '../../lib/user-access.js';
 import { revokeUserRegistryTokens } from '../../lib/registry-credential.js';
-import { bumpUserEpoch } from '../../lib/config.js';
-import { gatekeeperRequest } from '../../lib/gatekeeper-client.js';
+import { httpError } from '../../lib/app-error.js';
+import { actorFromRequest } from '../../lib/actor.js';
+import { recordAuditBestEffort } from '../../lib/audit.js';
+import {
+  ADMIN_GROUP,
+  changeUsers,
+  directoryUsersByUsername,
+  eraseDirectoryUser,
+  findDirectoryUser,
+  getDirectoryUser,
+  usersFileError,
+} from '../../lib/directory.js';
 
 const CreateUserSchema = z.object({
   username: z
     .string()
-    .min(2)
-    .max(32)
+    .min(USERNAME_MIN_LENGTH)
+    .max(USERNAME_MAX_LENGTH)
     .regex(
-      /^[a-z0-9][a-z0-9_-]*$/,
+      USERNAME_REGEX,
       'Username must start with a lowercase letter or digit and may contain underscores or hyphens',
     ),
   displayname: z.string().min(1).max(100),
@@ -31,9 +40,9 @@ const CreateUserSchema = z.object({
 const UsernameParamSchema = z.object({
   username: z
     .string()
-    .min(2)
-    .max(32)
-    .regex(/^[a-z0-9][a-z0-9_-]*$/, 'Invalid username format'),
+    .min(USERNAME_MIN_LENGTH)
+    .max(USERNAME_MAX_LENGTH)
+    .regex(USERNAME_REGEX, 'Invalid username format'),
 });
 
 const UpdateUserSchema = z
@@ -42,13 +51,76 @@ const UpdateUserSchema = z
     email: z.string().email().optional(),
     password: z.string().min(8).max(128).optional(),
     groups: z.array(z.string()).optional(),
+    // Authelia's `disabled: true`: the user cannot sign in, every plugin
+    // audience shows them disabled, and the user surface refuses them.
+    disabled: z.boolean().optional(),
   })
   .refine((data) => Object.keys(data).length > 0, {
     message: 'At least one field must be provided',
   });
 
+const DeleteQuerySchema = z
+  .object({
+    // Erase the tombstone at once: what the directory, invitations and
+    // Gatekeeper's access-request log keep of the user goes too.
+    erase: z.enum(['true', 'false']).optional(),
+  })
+  .strict();
+
+/** users.yml, or a 500 the route answers with (its cause logged without the file's content). */
+async function readUsersOrFail() {
+  try {
+    return await readUsersRaw();
+  } catch (err) {
+    throw httpError('Failed to read user database', 500, { cause: usersFileError(err) });
+  }
+}
+
+async function writeUsersOrFail(usersData) {
+  try {
+    await writeUsers(usersData);
+  } catch (err) {
+    throw httpError('Failed to update user database', 500, { cause: err });
+  }
+}
+
+/** The user's groups as a sorted list (users.yml may hold none). */
+function groupsOf(entry) {
+  return Array.isArray(entry?.groups) ? [...entry.groups].sort() : [];
+}
+
+/** Whether two lists hold the same strings. */
+function sameList(a, b) {
+  return a.length === b.length && a.every((value, i) => value === b[i]);
+}
+
+/** An enabled member of the administrators' group. */
+function isEnabledAdmin(entry) {
+  return (
+    Array.isArray(entry?.groups) && entry.groups.includes(ADMIN_GROUP) && entry.disabled !== true
+  );
+}
+
+/**
+ * Answer a refusal a users change threw (an error with `statusCode`: its
+ * message and `code`), or a 500 for anything else — logged either way when
+ * it is the panel's own failure.
+ */
+function sendFailure(request, reply, err, fallback) {
+  if (Number.isInteger(err.statusCode)) {
+    if (err.statusCode >= 500) request.log.error(err.cause ?? err, err.message);
+    return reply
+      .code(err.statusCode)
+      .send({ error: err.message, ...(err.code ? { code: err.code } : {}) });
+  }
+  request.log.error(err, fallback);
+  return reply.code(500).send({ error: fallback });
+}
+
 export default async function usersRoutes(fastify, _opts) {
-  // GET /api/users — list all users (no sensitive fields)
+  // GET /api/users — list all users (no sensitive fields): users.yml's, with
+  // each one's directory id (null until the directory has seen them, within
+  // a minute) and status (`active` or `disabled`)
   fastify.get(
     '/users',
     {
@@ -57,8 +129,18 @@ export default async function usersRoutes(fastify, _opts) {
     async (request, reply) => {
       try {
         const users = await readUsers();
-        const sorted = users.sort((a, b) => a.username.localeCompare(b.username));
-        return { users: sorted };
+        const directory = await directoryUsersByUsername();
+        const listed = users
+          .map((user) => {
+            const known = directory.get(user.username);
+            return {
+              ...user,
+              userId: known?.userId ?? null,
+              status: known?.status ?? (user.disabled ? 'disabled' : 'active'),
+            };
+          })
+          .sort((a, b) => a.username.localeCompare(b.username));
+        return { users: listed };
       } catch (err) {
         request.log.error(err, 'Failed to read user database');
         return reply.code(500).send({ error: 'Failed to read user database' });
@@ -78,16 +160,13 @@ export default async function usersRoutes(fastify, _opts) {
     async (request, reply) => {
       const body = CreateUserSchema.parse(request.body);
 
-      let usersData;
       try {
-        usersData = await readUsersRaw();
+        // Refused before a password is hashed; checked again under the lock.
+        if ((await readUsersOrFail()).users[body.username]) {
+          return reply.code(409).send({ error: 'Username already exists' });
+        }
       } catch (err) {
-        request.log.error(err, 'Failed to read user database');
-        return reply.code(500).send({ error: 'Failed to read user database' });
-      }
-
-      if (usersData.users[body.username]) {
-        return reply.code(409).send({ error: 'Username already exists' });
+        return sendFailure(request, reply, err, 'Failed to read user database');
       }
 
       let hash;
@@ -98,39 +177,54 @@ export default async function usersRoutes(fastify, _opts) {
         return reply.code(500).send({ error: 'Failed to hash password' });
       }
 
-      usersData.users[body.username] = {
-        displayname: body.displayname,
-        email: body.email,
-        password: hash,
-        groups: body.groups,
-      };
-
-      try {
-        await writeUsers(usersData);
-      } catch (err) {
-        request.log.error(err, 'Failed to update user database');
-        return reply.code(500).send({ error: 'Failed to update user database' });
-      }
-
+      let warnings;
+      let persisted;
       try {
-        await reloadAuthelia();
+        ({ warnings, persisted } = await changeUsers(
+          async () => {
+            const usersData = await readUsersOrFail();
+            if (usersData.users[body.username]) throw httpError('Username already exists', 409);
+            usersData.users[body.username] = {
+              displayname: body.displayname,
+              email: body.email,
+              password: hash,
+              groups: body.groups,
+            };
+            await writeUsersOrFail(usersData);
+          },
+          {
+            actor: actorFromRequest(request),
+            logger: request.log,
+            // A removed user's grants, groups and second factors under the
+            // username go first; a username with an OIDC identity is refused.
+            creates: [body.username],
+            expect: (users) => users[body.username]?.password === hash,
+          },
+        ));
       } catch (err) {
-        request.log.warn(err, 'Failed to reload Authelia after user creation');
+        return sendFailure(request, reply, err, 'Failed to update user database');
       }
 
-      return reply.code(201).send({
-        ok: true,
+      const created = await findDirectoryUser(body.username);
+      return reply.code(persisted ? 201 : 200).send({
+        ok: persisted,
+        ...(persisted ? {} : { persisted: false }),
         user: {
           username: body.username,
           displayname: body.displayname,
           email: body.email,
           groups: body.groups,
+          disabled: false,
+          userId: created?.userId ?? null,
+          status: 'active',
         },
+        ...(warnings.length > 0 ? { warnings } : {}),
       });
     },
   );
 
-  // PUT /api/users/:username — update a user
+  // PUT /api/users/:username — update a user; `disabled: true` disables
+  // them (the last enabled administrator cannot be), `false` enables them
   fastify.put(
     '/users/:username',
     {
@@ -144,83 +238,130 @@ export default async function usersRoutes(fastify, _opts) {
       const { username } = UsernameParamSchema.parse(request.params);
       const body = UpdateUserSchema.parse(request.body);
 
-      let usersData;
-      try {
-        usersData = await readUsersRaw();
-      } catch (err) {
-        request.log.error(err, 'Failed to read user database');
-        return reply.code(500).send({ error: 'Failed to read user database' });
-      }
-
-      if (!usersData.users[username]) {
-        return reply.code(404).send({ error: 'User not found' });
-      }
-
-      const user = usersData.users[username];
-      const groupsBefore = Array.isArray(user.groups) ? [...user.groups] : [];
-
-      if (body.displayname !== undefined) {
-        user.displayname = body.displayname;
-      }
-      if (body.email !== undefined) {
-        user.email = body.email;
-      }
-      if (body.groups !== undefined) {
-        user.groups = body.groups;
-      }
+      let passwordHash;
       if (body.password !== undefined) {
         try {
-          user.password = await hashPassword(body.password);
+          passwordHash = await hashPassword(body.password);
         } catch (err) {
           request.log.error(err, 'Failed to hash password');
           return reply.code(500).send({ error: 'Failed to hash password' });
         }
       }
 
+      /** Whether users.yml's entry holds every field this request set. */
+      const intended = (entry) =>
+        entry !== undefined &&
+        entry !== null &&
+        (body.displayname === undefined || entry.displayname === body.displayname) &&
+        (body.email === undefined || entry.email === body.email) &&
+        (body.groups === undefined || sameList(groupsOf(entry), [...body.groups].sort())) &&
+        (passwordHash === undefined || entry.password === passwordHash) &&
+        (body.disabled === undefined || (entry.disabled === true) === body.disabled);
+
+      let outcome;
+      let before = null;
       try {
-        await writeUsers(usersData);
-      } catch (err) {
-        request.log.error(err, 'Failed to update user database');
-        return reply.code(500).send({ error: 'Failed to update user database' });
-      }
-
-      try {
-        await reloadAuthelia();
+        outcome = await changeUsers(
+          async () => {
+            const usersData = await readUsersOrFail();
+            const user = usersData.users[username];
+            if (!user) throw httpError('User not found', 404);
+            // As it was before this request (a second attempt finds it changed already).
+            before ??= { groups: groupsOf(user), disabled: user.disabled === true };
+            if (body.disabled === true && isEnabledAdmin(user)) {
+              const enabledAdmins = Object.values(usersData.users).filter(isEnabledAdmin).length;
+              if (enabledAdmins <= 1) {
+                throw httpError('Cannot disable the last enabled administrator', 400, {
+                  code: 'last_admin',
+                });
+              }
+            }
+
+            if (body.displayname !== undefined) user.displayname = body.displayname;
+            if (body.email !== undefined) user.email = body.email;
+            if (body.groups !== undefined) user.groups = body.groups;
+            if (passwordHash !== undefined) user.password = passwordHash;
+            if (body.disabled === true) user.disabled = true;
+            if (body.disabled === false) delete user.disabled;
+
+            await writeUsersOrFail(usersData);
+            return user;
+          },
+          {
+            actor: actorFromRequest(request),
+            logger: request.log,
+            // Authelia's own password reset may rewrite users.yml under the
+            // change: it is checked after the restart, and made once more.
+            expect: (users) => intended(users[username]),
+          },
+        );
       } catch (err) {
-        request.log.warn(err, 'Failed to reload Authelia after user update');
+        return sendFailure(request, reply, err, 'Failed to update user database');
       }
 
-      // Registry scopes are granted at login from feria-* groups; losing a
-      // group must not leave a valid token behind. Best effort — the user
-      // update itself is already done.
-      const warnings = [];
-      if (body.groups !== undefined) {
+      const user = outcome.result;
+      const disabled = user.disabled === true;
+      const warnings = [...outcome.warnings];
+      const known = await findDirectoryUser(username);
+      const userId = known?.userId ?? null;
+
+      // Disabling is offboarding, which the change did as the directory saw
+      // the user become disabled (`changeUsers`): sessions ended, registry
+      // tokens revoked. Registry scopes are granted at login from feria-*
+      // groups too: losing one must not leave a valid token behind either.
+      const groupsAfter = groupsOf(user);
+      const groupsChanged = body.groups !== undefined && !sameList(before.groups, groupsAfter);
+      if (groupsChanged && !(disabled && !before.disabled)) {
         try {
           await revokeUserRegistryTokens(
             username,
-            { before: groupsBefore, after: user.groups || [] },
+            { before: before.groups, after: groupsAfter },
             request.log,
+            { userId },
           );
         } catch (err) {
-          request.log.warn({ username, err: err.message }, 'Failed to revoke registry tokens');
-          warnings.push(`registry tokens were not revoked: ${err.message}`);
+          request.log.warn({ userId, err: err.message }, 'Failed to revoke registry tokens');
+          warnings.push({
+            step: 'registry',
+            message: `Registry tokens were not revoked: ${err.message}`,
+          });
         }
       }
 
+      // The directory audits status and attributes; these are the users API's own.
+      const audit = (action, details = {}) =>
+        recordAuditBestEffort(
+          { actor: actorFromRequest(request), action, details: { userId, ...details } },
+          request.log,
+        );
+      if (passwordHash !== undefined) await audit('user.password.set');
+      if (groupsChanged) {
+        await audit('user.groups.changed', {
+          added: groupsAfter.filter((g) => !before.groups.includes(g)),
+          removed: before.groups.filter((g) => !groupsAfter.includes(g)),
+        });
+      }
+
       return {
-        ok: true,
+        ok: outcome.persisted,
         user: {
           username,
           displayname: user.displayname,
           email: user.email,
           groups: user.groups || [],
+          disabled,
+          userId,
+          status: disabled ? 'disabled' : 'active',
         },
+        ...(outcome.persisted ? {} : { persisted: false }),
         ...(warnings.length > 0 ? { warnings } : {}),
       };
     },
   );
 
-  // DELETE /api/users/:username — delete a user
+  // DELETE /api/users/:username?erase= — delete a user. The directory keeps
+  // a tombstone (the id and the last known name and address, `removed`);
+  // `erase=true` scrubs it at once (see POST /api/identity/directory/:userId/erase)
   fastify.delete(
     '/users/:username',
     {
@@ -232,139 +373,72 @@ export default async function usersRoutes(fastify, _opts) {
     },
     async (request, reply) => {
       const { username } = UsernameParamSchema.parse(request.params);
+      const { erase } = DeleteQuerySchema.parse(request.query ?? {});
+      const actor = actorFromRequest(request);
 
-      let usersData;
+      let outcome;
       try {
-        usersData = await readUsersRaw();
-      } catch (err) {
-        request.log.error(err, 'Failed to read user database');
-        return reply.code(500).send({ error: 'Failed to read user database' });
-      }
-
-      if (!usersData.users[username]) {
-        return reply.code(404).send({ error: 'User not found' });
-      }
-
-      const userCount = Object.keys(usersData.users).length;
-      if (userCount <= 1) {
-        return reply.code(400).send({ error: 'Cannot delete the last user' });
-      }
-
-      delete usersData.users[username];
-
-      try {
-        await writeUsers(usersData);
-      } catch (err) {
-        request.log.error(err, 'Failed to update user database');
-        return reply.code(500).send({ error: 'Failed to update user database' });
-      }
-
-      try {
-        await reloadAuthelia();
-      } catch (err) {
-        request.log.warn(err, 'Failed to reload Authelia after user deletion');
-      }
-
-      // ---------------------------------------------------------------
-      // Cascade cleanup. The user is already gone from users.yml; from
-      // here on we never roll back. Failures collect into `warnings` so
-      // the admin sees a partial-success response and can investigate.
-      // ---------------------------------------------------------------
-      const warnings = [];
-
-      // 0. Registry (Feria) tokens the user holds — their groups are gone.
-      try {
-        await revokeUserRegistryTokens(username, { deleted: true }, request.log);
-      } catch (err) {
-        request.log.warn(
-          { username, err: err.message },
-          'Cascade: registry token revocation failed',
+        outcome = await changeUsers(
+          async () => {
+            const usersData = await readUsersOrFail();
+            if (!usersData.users[username]) throw httpError('User not found', 404);
+            if (Object.keys(usersData.users).length <= 1) {
+              throw httpError('Cannot delete the last user', 400);
+            }
+            delete usersData.users[username];
+            await writeUsersOrFail(usersData);
+          },
+          {
+            actor,
+            logger: request.log,
+            deleted: [username],
+            expect: (users) => !Object.hasOwn(users, username),
+          },
         );
-        warnings.push(`registry tokens were not revoked: ${err.message}`);
-      }
-
-      // 1. Legacy user-plugin-access.json grants (pre-gatekeeper migration)
-      try {
-        const removed = await removeGrantsForUser(username, request.log);
-        if (removed > 0) {
-          request.log.info(
-            { username, removed },
-            'Cascade: removed legacy user-plugin-access grants',
-          );
-        }
       } catch (err) {
-        request.log.warn(
-          { err, username },
-          'Cascade: failed to remove legacy user-plugin-access grants',
-        );
-        warnings.push({
-          step: 'user-plugin-access',
-          message: `Failed to remove legacy grants: ${err.message}`,
-        });
+        return sendFailure(request, reply, err, 'Failed to update user database');
       }
-
-      // 2. Gatekeeper grants — single bulk-delete keyed by principal
-      try {
-        const result = await gatekeeperRequest(
-          'DELETE',
-          `/api/grants?principalType=user&principalId=${encodeURIComponent(username)}`,
-        );
-        if (result.ok) {
-          const removed =
-            result.data && typeof result.data === 'object' && 'removed' in result.data
-              ? result.data.removed
-              : 0;
-          if (removed > 0) {
-            request.log.info(
-              { username, removed },
-              'Cascade: removed gatekeeper grants for deleted user',
-            );
-          }
-        } else if (result.reason === 'unreachable' || result.reason === 'no-secret') {
-          request.log.warn(
-            { username, reason: result.reason },
-            'Cascade: gatekeeper unreachable — grants for deleted user remain in access-grants.json',
-          );
+      const userId =
+        outcome.directory?.removed.find((removed) => removed.username === username)?.userId ?? null;
+
+      // The user was offboarded as the directory saw them go (`changeUsers`):
+      // desktop sessions ended, registry tokens revoked, legacy
+      // user-plugin-access grants removed, Gatekeeper's grants and group
+      // memberships under the username dropped, Authelia's second factors
+      // deleted. What failed is among the warnings; the tombstone keeps a
+      // Gatekeeper cleanup pending until it succeeds.
+      const warnings = [...outcome.warnings];
+
+      // Erase the tombstone, when asked to. Its failure leaves the tombstone
+      // in place, to be erased later by its id.
+      let erased = false;
+      if (erase === 'true') {
+        if (userId === null) {
           warnings.push({
-            step: 'gatekeeper',
+            step: 'erase',
             message:
-              'Gatekeeper service was unreachable. Re-run grant cleanup once it is back online — grants for this user may still exist in access-grants.json.',
+              'The user directory holds no tombstone for this user — nothing was erased; erase it from the directory once it appears there',
           });
         } else {
-          request.log.warn(
-            { username, statusCode: result.statusCode, error: result.error },
-            'Cascade: gatekeeper returned an error',
-          );
-          warnings.push({
-            step: 'gatekeeper',
-            message: `Gatekeeper returned HTTP ${result.statusCode}: ${result.error}`,
-          });
+          try {
+            await eraseDirectoryUser(userId, { actor, logger: request.log });
+            erased = true;
+          } catch (err) {
+            request.log.warn({ userId, err: err.message }, 'Cascade: erasing the user failed');
+            warnings.push({ step: 'erase', message: err.message });
+          }
         }
-      } catch (err) {
-        request.log.warn({ err, username }, 'Cascade: unexpected failure calling gatekeeper');
-        warnings.push({
-          step: 'gatekeeper',
-          message: `Unexpected failure: ${err.message}`,
-        });
       }
 
-      // 3. Live user-access sessions — bump per-user epoch in panel.json so
-      //    middleware rejects every session token with iat < epoch.
-      try {
-        const epoch = await bumpUserEpoch(username);
-        request.log.info({ username, epoch }, 'Cascade: bumped user-access session epoch');
-      } catch (err) {
-        request.log.warn(
-          { err, username },
-          'Cascade: failed to bump user-access session epoch — old session tokens may still validate',
-        );
-        warnings.push({
-          step: 'session-epoch',
-          message: `Failed to invalidate live sessions: ${err.message}. Old session tokens for this username may still validate until their natural expiry.`,
-        });
-      }
-
-      const response = { ok: true };
+      const tombstone = userId ? await getDirectoryUser(userId) : null;
+      const response = {
+        ok: outcome.persisted,
+        ...(outcome.persisted ? {} : { persisted: false }),
+        userId,
+        // Gatekeeper dropped the grants and group memberships under the username.
+        principalCleared: tombstone?.principalClearedAt != null,
+        ...(erase === 'true' ? { erased } : {}),
+      };
       if (warnings.length > 0) {
         response.warnings = warnings;
       }
@@ -383,10 +457,9 @@ export default async function usersRoutes(fastify, _opts) {
 
       let usersData;
       try {
-        usersData = await readUsersRaw();
+        usersData = await readUsersOrFail();
       } catch (err) {
-        request.log.error(err, 'Failed to read user database');
-        return reply.code(500).send({ error: 'Failed to read user database' });
+        return sendFailure(request, reply, err, 'Failed to read user database');
       }
 
       if (!usersData.users[username]) {
@@ -402,6 +475,15 @@ export default async function usersRoutes(fastify, _opts) {
         return reply.code(500).send({ error: 'Failed to write TOTP configuration' });
       }
 
+      const known = await findDirectoryUser(username);
+      await recordAuditBestEffort(
+        {
+          actor: actorFromRequest(request),
+          action: 'user.totp.reset',
+          details: { userId: known?.userId ?? null },
+        },
+        request.log,
+      );
       return { ok: true, totpUri: uri };
     },
   );

package/vendor/serverd/src/routes/management.js

@@ -11,6 +11,8 @@ import pluginRoutes from './management/plugins.js';
 import settingsRoutes from './management/settings.js';
 import ticketRoutes from './management/tickets.js';
 import identityRoutes from './management/identity.js';
+import identityDirectoryRoutes from './management/identity-directory.js';
+import pluginIdentityRoutes from './management/plugin-identity.js';
 import storageRoutes from './management/storage.js';
 import gatekeeperProxyRoutes from './management/gatekeeper-proxy.js';
 import agentsRoutes from './management/agents.js';
@@ -33,6 +35,8 @@ export default async function managementRoutes(fastify, _opts) {
   await fastify.register(settingsRoutes);
   await fastify.register(ticketRoutes);
   await fastify.register(identityRoutes);
+  await fastify.register(identityDirectoryRoutes);
+  await fastify.register(pluginIdentityRoutes);
   await fastify.register(storageRoutes);
   await fastify.register(gatekeeperProxyRoutes);
   await fastify.register(agentsRoutes);