@lamalibre/create-lamaste 4.4.1 → 4.6.0

package/vendor/gatekeeper/dist/server/routes/diagnostic.js

@@ -15,6 +15,20 @@ const DEFAULT_RETENTION_DAYS = 90;
 // JSON-era rotation cadence loosely and is comfortably below any sensible
 // retention setting.
 const RETENTION_SWEEP_INTERVAL_MS = 60 * 60 * 1000;
+/**
+ * `POST /api/access-log/purge { username, before? }`: the rows of one
+ * username, before a time when given. The username travels in the body —
+ * a URL is what request logs keep.
+ */
+const PurgeBodySchema = z
+    .object({
+    username: z.string().min(1).max(100),
+    before: z
+        .string()
+        .regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,3})?Z$/, 'before is an ISO 8601 UTC time')
+        .optional(),
+})
+    .strict();
 const UpdateSettingsSchema = z.object({
     adminEmail: z.string().email().max(200).optional(),
     adminName: z.string().max(200).optional(),
@@ -41,6 +55,11 @@ async function getStmts() {
         countAll: db.prepare('SELECT COUNT(*) AS n FROM access_request_log'),
         deleteAll: db.prepare('DELETE FROM access_request_log'),
         deleteOlderThan: db.prepare('DELETE FROM access_request_log WHERE timestamp < ?'),
+        // Erasing a removed user (the panel): their rows only — those logged
+        // before they were removed, when the panel says when that was (a later
+        // user may have the same username).
+        deleteByUsername: db.prepare('DELETE FROM access_request_log WHERE username = ?'),
+        deleteByUsernameBefore: db.prepare('DELETE FROM access_request_log WHERE username = ? AND timestamp < ?'),
         begin: db.prepare('BEGIN IMMEDIATE'),
         commit: db.prepare('COMMIT'),
         rollback: db.prepare('ROLLBACK'),
@@ -223,12 +242,50 @@ export async function diagnosticRoutes(fastify) {
             return reply.code(500).send({ error: err.message });
         }
     });
-    // DELETE /api/access-log — clear access request log
-    fastify.delete('/access-log', async (_request, reply) => {
+    // DELETE /api/access-log — clear the whole access request log (and the
+    // entries still queued for it). It takes no query: a purge of one user's
+    // rows is POST /api/access-log/purge, and a query an older caller sent to
+    // narrow the purge must never clear everything instead. Answers how many
+    // rows went (`removed`).
+    fastify.delete('/access-log', async (request, reply) => {
+        if (Object.keys(request.query ?? {}).length > 0) {
+            return reply.code(400).send({
+                error: "DELETE clears the whole log and takes no query — purge one user's rows with POST /api/access-log/purge",
+            });
+        }
+        try {
+            const s = await getStmts();
+            logQueue = [];
+            const result = s.deleteAll.run();
+            return { ok: true, removed: Number(result.changes) };
+        }
+        catch (err) {
+            return reply.code(500).send({ error: err.message });
+        }
+    });
+    // POST /api/access-log/purge { username, before? } — one user's rows,
+    // logged before `before` when given (a later user may hold the username),
+    // and the matching entries still queued for the log, so none of them is
+    // written after the purge. Answers how many rows went (`removed`).
+    fastify.post('/access-log/purge', async (request, reply) => {
+        const parsed = PurgeBodySchema.safeParse(request.body ?? {});
+        if (!parsed.success) {
+            return reply.code(400).send({
+                error: 'Invalid body',
+                details: parsed.error.issues.map((i) => i.message),
+            });
+        }
+        const { username, before } = parsed.data;
         try {
             const s = await getStmts();
-            s.deleteAll.run();
-            return { ok: true };
+            const matches = (e) => e.username === username && (before === undefined || e.timestamp < before);
+            const kept = logQueue.filter((e) => !matches(e));
+            const queued = logQueue.length - kept.length;
+            logQueue = kept;
+            const result = before === undefined
+                ? s.deleteByUsername.run(username)
+                : s.deleteByUsernameBefore.run(username, before);
+            return { ok: true, removed: Number(result.changes) + queued };
         }
         catch (err) {
             return reply.code(500).send({ error: err.message });

package/vendor/gatekeeper/dist/server/routes/diagnostic.js.map

@@ -1 +1 @@
-{"version":3,"file":"diagnostic.js","sourceRoot":"","sources":["../../../src/server/routes/diagnostic.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,IAAI,gBAAgB,CAAC;AAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAEvD,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAC7C,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,qBAAqB;AACrB,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC5C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;IACpE,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5C,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC;AAiBH,IAAI,KAAK,GAAoB,IAAI,CAAC;AAElC,KAAK,UAAU,QAAQ;IACrB,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IACnC,KAAK,GAAG;QACN,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC;;;;KAIlB,CAAC;QACF,qEAAqE;QACrE,4DAA4D;QAC5D,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC;QAC5F,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC;QACpE,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC;QACvD,eAAe,EAAE,EAAE,CAAC,OAAO,CAAC,oDAAoD,CAAC;QACjF,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACpC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC5B,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;KACjC,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAeD,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,YAAY,EAAE,GAAG,CAAC,aAAa;KAChC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E,KAAK,UAAU,cAAc,CAAC,OAA6B;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;QACtF,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,IAAI,oBAAoB,GAAG,CAAC,CAAC;AAC7B,IAAI,qBAAqB,GAAkB,IAAI,CAAC;AAEhD,SAAS,gBAAgB,CAAC,IAAmB;IAC3C,qBAAqB,GAAG,IAAI,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,oBAAoB,GAAG,2BAA2B;QAAE,OAAO;IACrE,oBAAoB,GAAG,GAAG,CAAC;IAC3B,MAAM,IAAI,GAAG,qBAAqB,IAAI,sBAAsB,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACxE,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,IAAI,QAAQ,GAAyB,EAAE,CAAC;AACxC,IAAI,UAAU,GAA0C,IAAI,CAAC;AAC7D,IAAI,kBAAkB,GAAG,CAAC,CAAC;AAC3B,IAAI,YAAY,GAA4B,IAAI,CAAC;AAEjD,SAAS,oBAAoB;IAC3B,IAAI,UAAU;QAAE,OAAO;IACvB,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;QAC5B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,iEAAiE;YACjE,kDAAkD;YAClD,mBAAmB,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAClC,YAAY,EAAE,KAAK,CAAC,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,wBAAwB,CAAC,CAAC;YACjF,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC;QACvB,QAAQ,GAAG,EAAE,CAAC;QACd,cAAc,CAAC,KAAK,CAAC;aAClB,IAAI,CAAC,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC;aACjC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,YAAY,EAAE,KAAK,CAAC,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,oCAAoC,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;IACP,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC1B,6DAA6D;IAC7D,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,QAAQ,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;QACrC,yEAAyE;QACzE,8DAA8D;QAC9D,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,kBAAkB,IAAI,6BAA6B,EAAE,CAAC;YAC9D,kBAAkB,GAAG,GAAG,CAAC;YACzB,YAAY,EAAE,IAAI,CAChB,EAAE,QAAQ,EAAE,aAAa,EAAE,EAC3B,iDAAiD,CAClD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,oBAAoB,EAAE,CAAC;AACzB,CAAC;AAED,8EAA8E;AAC9E,qEAAqE;AACrE,8EAA8E;AAE9E,KAAK,UAAU,YAAY,CAAC,QAA4B;IACtD,MAAM,eAAe,CAAC,YAAY,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAwB;IAC7D,6DAA6D;IAC7D,YAAY,GAAG,OAAO,CAAC,GAAuB,CAAC;IAC/C,2EAA2E;IAC3E,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,sBAAsB,IAAI,IAAI,CAAC,CAAC;IACvE,oBAAoB,EAAE,CAAC;IAEvB,iDAAiD;IACjD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAClF,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2C,CAAC;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAChC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACxC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QAEpC,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,mEAAmE;aAC3E,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;YACrE,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,8DAA8D;IAC9D,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,QAAwB,EAAE,KAAmB,EAAE,EAAE;QAClF,OAAO,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,8CAA8C;IAC9C,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,QAAwB,EAAE,MAAoB,EAAE,EAAE;QAChF,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,mDAAmD;IACnD,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAChF,IAAI,IAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAG,GAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,OAAO,GAAuB,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;YAC5D,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YAChC,sEAAsE;YACtE,IAAI,IAAI,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;gBAC9C,gBAAgB,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAChF,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2C,CAAC;QAClE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAEtD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAmB,CAAC;YACnD,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAwB,CAAC;YACpE,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;gBAC7B,KAAK,EAAE,QAAQ,CAAC,CAAC;gBACjB,KAAK;gBACL,MAAM;aACP,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,oDAAoD;IACpD,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,QAAwB,EAAE,KAAmB,EAAE,EAAE;QACpF,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC3B,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;YAClB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAyB;IACxD,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"diagnostic.js","sourceRoot":"","sources":["../../../src/server/routes/diagnostic.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,IAAI,gBAAgB,CAAC;AAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAEvD,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAC7C,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,qBAAqB;AACrB,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD;;;;GAIG;AACH,MAAM,eAAe,GAAG,CAAC;KACtB,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,KAAK,CAAC,oDAAoD,EAAE,gCAAgC,CAAC;SAC7F,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC5C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;IACpE,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5C,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC;AAmBH,IAAI,KAAK,GAAoB,IAAI,CAAC;AAElC,KAAK,UAAU,QAAQ;IACrB,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IACnC,KAAK,GAAG;QACN,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC;;;;KAIlB,CAAC;QACF,qEAAqE;QACrE,4DAA4D;QAC5D,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC;QAC5F,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC;QACpE,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC;QACvD,eAAe,EAAE,EAAE,CAAC,OAAO,CAAC,oDAAoD,CAAC;QACjF,qEAAqE;QACrE,uEAAuE;QACvE,oCAAoC;QACpC,gBAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC;QACjF,sBAAsB,EAAE,EAAE,CAAC,OAAO,CAChC,qEAAqE,CACtE;QACD,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACpC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC5B,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;KACjC,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAeD,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,YAAY,EAAE,GAAG,CAAC,aAAa;KAChC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E,KAAK,UAAU,cAAc,CAAC,OAA6B;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;QACtF,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,IAAI,oBAAoB,GAAG,CAAC,CAAC;AAC7B,IAAI,qBAAqB,GAAkB,IAAI,CAAC;AAEhD,SAAS,gBAAgB,CAAC,IAAmB;IAC3C,qBAAqB,GAAG,IAAI,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,oBAAoB,GAAG,2BAA2B;QAAE,OAAO;IACrE,oBAAoB,GAAG,GAAG,CAAC;IAC3B,MAAM,IAAI,GAAG,qBAAqB,IAAI,sBAAsB,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACxE,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,IAAI,QAAQ,GAAyB,EAAE,CAAC;AACxC,IAAI,UAAU,GAA0C,IAAI,CAAC;AAC7D,IAAI,kBAAkB,GAAG,CAAC,CAAC;AAC3B,IAAI,YAAY,GAA4B,IAAI,CAAC;AAEjD,SAAS,oBAAoB;IAC3B,IAAI,UAAU;QAAE,OAAO;IACvB,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;QAC5B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,iEAAiE;YACjE,kDAAkD;YAClD,mBAAmB,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAClC,YAAY,EAAE,KAAK,CAAC,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,wBAAwB,CAAC,CAAC;YACjF,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC;QACvB,QAAQ,GAAG,EAAE,CAAC;QACd,cAAc,CAAC,KAAK,CAAC;aAClB,IAAI,CAAC,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC;aACjC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,YAAY,EAAE,KAAK,CAAC,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,oCAAoC,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;IACP,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC1B,6DAA6D;IAC7D,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,QAAQ,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;QACrC,yEAAyE;QACzE,8DAA8D;QAC9D,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,kBAAkB,IAAI,6BAA6B,EAAE,CAAC;YAC9D,kBAAkB,GAAG,GAAG,CAAC;YACzB,YAAY,EAAE,IAAI,CAChB,EAAE,QAAQ,EAAE,aAAa,EAAE,EAC3B,iDAAiD,CAClD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,oBAAoB,EAAE,CAAC;AACzB,CAAC;AAED,8EAA8E;AAC9E,qEAAqE;AACrE,8EAA8E;AAE9E,KAAK,UAAU,YAAY,CAAC,QAA4B;IACtD,MAAM,eAAe,CAAC,YAAY,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAwB;IAC7D,6DAA6D;IAC7D,YAAY,GAAG,OAAO,CAAC,GAAuB,CAAC;IAC/C,2EAA2E;IAC3E,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,sBAAsB,IAAI,IAAI,CAAC,CAAC;IACvE,oBAAoB,EAAE,CAAC;IAEvB,iDAAiD;IACjD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAClF,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2C,CAAC;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAChC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACxC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QAEpC,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,mEAAmE;aAC3E,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;YACrE,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,8DAA8D;IAC9D,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,QAAwB,EAAE,KAAmB,EAAE,EAAE;QAClF,OAAO,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,8CAA8C;IAC9C,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,QAAwB,EAAE,MAAoB,EAAE,EAAE;QAChF,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,mDAAmD;IACnD,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAChF,IAAI,IAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAG,GAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,OAAO,GAAuB,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;YAC5D,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YAChC,sEAAsE;YACtE,IAAI,IAAI,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;gBAC9C,gBAAgB,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAChF,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2C,CAAC;QAClE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAEtD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAmB,CAAC;YACnD,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAwB,CAAC;YACpE,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;gBAC7B,KAAK,EAAE,QAAQ,CAAC,CAAC;gBACjB,KAAK;gBACL,MAAM;aACP,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,yBAAyB;IACzB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACnF,IAAI,MAAM,CAAC,IAAI,CAAE,OAAO,CAAC,KAA6C,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EACH,wGAAwG;aAC3G,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC3B,QAAQ,GAAG,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,0EAA0E;IAC1E,wEAAwE;IACxE,mEAAmE;IACnE,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACvF,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,CAAC,CAAqB,EAAE,EAAE,CACxC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;YAC5E,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC7C,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,MAAM,GACV,MAAM,KAAK,SAAS;gBAClB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClC,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAyB;IACxD,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC"}

package/vendor/gatekeeper/dist/server/routes/principals.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from 'fastify';
+export declare function principalRoutes(fastify: FastifyInstance): Promise<void>;
+//# sourceMappingURL=principals.d.ts.map

package/vendor/gatekeeper/dist/server/routes/principals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principals.d.ts","sourceRoot":"","sources":["../../../src/server/routes/principals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAO7E,wBAAsB,eAAe,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB7E"}

package/vendor/gatekeeper/dist/server/routes/principals.js

@@ -0,0 +1,27 @@
+import { z } from 'zod';
+import { removeUserPrincipal } from '../../lib/principals.js';
+/** A username as grants and group members hold it — in the body, never in a URL. */
+const RemoveUserBodySchema = z.object({ username: z.string().min(1).max(100) }).strict();
+export async function principalRoutes(fastify) {
+    // POST /api/principals/user/remove { username } — remove a user principal
+    // everywhere: every grant naming the username (any resource type) and its
+    // membership of every group, in one transaction. The panel calls it when
+    // a user is removed, and before it creates one whose username an earlier
+    // user held, so a reused username inherits nothing. The username travels
+    // in the body: a URL is what request logs keep.
+    fastify.post('/principals/user/remove', async (request, reply) => {
+        const parsed = RemoveUserBodySchema.safeParse(request.body);
+        if (!parsed.success) {
+            return reply.code(400).send({ error: 'The body is { username } (1-100 characters)' });
+        }
+        try {
+            const removed = await removeUserPrincipal(parsed.data.username);
+            return { ok: true, ...removed };
+        }
+        catch (err) {
+            request.log.error({ err: err.message }, 'Removing a user principal failed');
+            return reply.code(500).send({ error: 'Removing the user principal failed' });
+        }
+    });
+}
+//# sourceMappingURL=principals.js.map

package/vendor/gatekeeper/dist/server/routes/principals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principals.js","sourceRoot":"","sources":["../../../src/server/routes/principals.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,oFAAoF;AACpF,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAEzF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAwB;IAC5D,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,gDAAgD;IAChD,OAAO,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC7F,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,kCAAkC,CAAC,CAAC;YACvF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/vendor/gatekeeper/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/lamaste-gatekeeper",
-  "version": "4.4.1",
+  "version": "4.6.0",
   "description": "Authorization layer for Lamaste — groups, grants, and tunnel access control",
   "type": "module",
   "exports": {
@@ -32,7 +32,7 @@
   },
   "dependencies": {
     "@fastify/rate-limit": "^10.3.0",
-    "@lamalibre/lamaste": "^4.4.1",
+    "@lamalibre/lamaste": "^4.6.0",
     "fastify": "^5.3.3",
     "undici": "^7.8.0",
     "zod": "^3.24.4"

package/vendor/server/bin/lamaste-server.js

@@ -15,6 +15,7 @@
  *   restart       Restart panel server (and optionally gatekeeper)
  *   plugins       Manage server-side plugins
  *   push-install  Push install: the switch, the default policy, agents' windows
+ *   users         Users and the user directory: disable, delete, erase
  *   tunnels       Manage tunnels
  *   sites         Manage static sites
  *   certs         Certificate status and renewal
@@ -63,7 +64,8 @@ ${b('COMMANDS')}
   ${c('plugins')}         Manage plugins (list, install, enable, disable, uninstall, update, hosting, hooks, settings, …)
   ${c('push-install')}    Push install: on/off, default policy, open/close an agent's window
   ${c('audit')}           The panel's audit log (approvals, hostings, updates, hook events)
-  ${c('tunnels')}         Manage tunnels (list, create, delete, toggle)
+  ${c('users')}           Users and the user directory (list, disable, enable, delete, erase, directory)
+  ${c('tunnels')}         Manage tunnels (list, create, delete, toggle, bind a plugin's user surface)
   ${c('sites')}           Manage static sites (list, create, delete)
   ${c('certs')}           Certificate status, renewal, and agent cert listing
   ${c('reset-admin')}     Emergency admin reset (reverts to P12, clears 2FA)
@@ -109,6 +111,13 @@ ${b('EXAMPLES')}
   ${d("# Broker agent install tokens from the registry as the panel's own Authelia client")}
   ${c('lamaste-server registry-credential set --url https://feria.example.com --oidc')}
 
+  ${d('# Offboard a user: they cannot sign in, plugins see them disabled')}
+  ${c('lamaste-server users disable alice')}
+
+  ${d("# Give a user an agent-hosted plugin's role, and serve its user surface on a tunnel")}
+  ${c('lamaste-server plugins entitlements market-indicators --user alice --roles viewer')}
+  ${c('lamaste-server tunnels bind-user-surface piyasa market-indicators')}
+
   ${d('# List tunnels')}
   ${c('lamaste-server tunnels list')}
 
@@ -170,6 +179,11 @@ async function main() {
       await runAudit(args.slice(1), { json });
       break;
     }
+    case 'users': {
+      const { runUsers } = await import('../src/commands/users.js');
+      await runUsers(args.slice(1), { json });
+      break;
+    }
     case 'tunnels': {
       const { runTunnels } = await import('../src/commands/tunnels.js');
       await runTunnels(args.slice(1), { json });

package/vendor/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/lamaste-server",
-  "version": "4.4.1",
+  "version": "4.6.0",
   "description": "Server operations CLI for Lamaste",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -18,7 +18,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.8.1",
-    "@lamalibre/lamaste": "^4.4.1",
+    "@lamalibre/lamaste": "^4.6.0",
     "chalk": "^5.3.0",
     "execa": "^9.0.0"
   },

package/vendor/server/src/commands/plugin-identity.js

@@ -0,0 +1,335 @@
+/**
+ * lamaste-server plugins identity|audience|entitlements|identity-sync — the
+ * people of an agent-hosted plugin that declares identity (its manifest's
+ * `identity` block: roles, and the attributes it receives about its users).
+ *
+ *   identity <name>       What its installed version declares, its approval,
+ *                         whether users reach its application (and why not),
+ *                         its audience in numbers, the feed to its agent half
+ *                         and the erasures it has not acknowledged
+ *   audience <name>       Its members — and the users who left (tombstones) —
+ *                         as its agent half is told
+ *   entitlements <name>   Who may use it, with which roles: Gatekeeper plugin
+ *                         grants with roles, to users or Lamaste groups
+ *   entitlements <name> --user <u> | --group <g> --roles a,b
+ *                         Give exactly these roles (replacing what it held)
+ *   entitlements <name> --revoke --user <u> | --group <g>
+ *                         Take every role away
+ *   identity-sync <name> [--reconcile]
+ *                         Send its agent half what it has not applied now;
+ *                         --reconcile replays everything and counts what was
+ *                         out of step (as the daily reconcile does)
+ *
+ * Every subcommand goes through the running panel
+ * (`/api/plugins/:name/{identity,audience,entitlements,identity/sync}`,
+ * admin certificate). What the panel says is printed only as
+ * `terminalText`; `--json` emits it as it came.
+ */
+
+import chalk from 'chalk';
+import { panelRequest } from '../panel-api.js';
+import { emit, emitComplete, emitError } from '../ndjson.js';
+import { identityBlockLines } from '../plugin-approval.js';
+import {
+  audienceRowText,
+  parseEntitlementsArgs,
+  parseIdentitySyncArgs,
+  readinessText,
+  syncRows,
+  warningLine,
+} from '../plugin-identity.js';
+import { terminalText } from '../plugin-settings.js';
+
+/** `/api/plugins/<name>/<rest>`. */
+function pluginPath(name, rest) {
+  return `/api/plugins/${encodeURIComponent(name)}/${rest}`;
+}
+
+/**
+ * Exit with a usage error or a refused request, as text or NDJSON (with
+ * the refusal's `code`).
+ *
+ * @param {string} message
+ * @param {boolean} json
+ * @param {{ code?: string }} [err]
+ * @returns {never}
+ */
+function fail(message, json, err = {}) {
+  if (json) emitError(message, false, typeof err.code === 'string' ? { code: err.code } : {});
+  else console.error(`\n  ${chalk.red(terminalText(message))}\n`);
+  process.exit(1);
+}
+
+/** Print a change's warnings: what the panel could not complete beside it. */
+function printWarnings(warnings) {
+  for (const warning of warnings ?? []) {
+    console.log(`  ${chalk.yellow('!')} ${warningLine(warning)}`);
+  }
+}
+
+/** `label:` padded, then the value. */
+function row(label, value) {
+  console.log(`  ${chalk.dim(`${label}:`.padEnd(16))}${value}`);
+}
+
+/**
+ * `plugins identity <name>`.
+ *
+ * @param {string | undefined} name
+ * @param {{ json: boolean }} options
+ */
+export async function identityCmd(name, { json }) {
+  if (!name) fail('Usage: lamaste-server plugins identity <name>', json);
+  let result;
+  try {
+    result = await panelRequest('GET', pluginPath(name, 'identity'));
+  } catch (err) {
+    fail(err.message, json, err);
+  }
+  if (json) {
+    emit(result);
+    return;
+  }
+  const view = result.identity;
+  const now = Date.now();
+  const ready = readinessText(view.readiness);
+  console.log('');
+  if (!view.declared) {
+    console.log(`  Plugin ${chalk.cyan(name)} declares no identity: no user reaches it.`);
+    console.log(chalk.dim(`  (${ready.text})`));
+    console.log('');
+    return;
+  }
+  console.log(chalk.bold(`  People of ${terminalText(name)}`));
+  console.log(chalk.dim('  ' + '─'.repeat(40)));
+  row(
+    'identity',
+    view.approval.approved
+      ? chalk.green('approved')
+      : chalk.yellow('waits for approval — lamaste-server plugins hooks ' + terminalText(name)),
+  );
+  row('users', ready.ready ? chalk.green(ready.text) : chalk.yellow(ready.text));
+  for (const line of identityBlockLines(view.declared)) {
+    const [label, ...value] = line.split(':');
+    row(label.trim(), value.join(':').trim());
+  }
+  const counts = view.audience;
+  if (counts) {
+    row(
+      'audience',
+      `${counts.active} active, ${counts.disabled} disabled` +
+        chalk.dim(` · left: ${counts.removed} removed, ${counts.erased} erased`),
+    );
+  }
+  if (view.sync) {
+    console.log('');
+    console.log(chalk.bold('  Feed to the agent half'));
+    for (const [label, value] of syncRows(view.sync, now)) {
+      row(label, label === 'last error' ? chalk.red(value) : value);
+    }
+  }
+  if (view.pendingErasures.length > 0) {
+    console.log('');
+    console.log(chalk.bold('  Erasures its agent half has not acknowledged'));
+    for (const userId of view.pendingErasures) console.log(`    ${terminalText(userId)}`);
+  }
+  console.log('');
+}
+
+/**
+ * `plugins audience <name>`.
+ *
+ * @param {string | undefined} name
+ * @param {{ json: boolean }} options
+ */
+export async function audienceCmd(name, { json }) {
+  if (!name) fail('Usage: lamaste-server plugins audience <name>', json);
+  let result;
+  try {
+    result = await panelRequest('GET', pluginPath(name, 'audience'));
+  } catch (err) {
+    fail(err.message, json, err);
+  }
+  if (json) {
+    emit(result);
+    return;
+  }
+  const rows = result.audience.map(audienceRowText);
+  if (rows.length === 0) {
+    console.log(`\n  ${chalk.cyan(name)} has no members yet.\n`);
+    return;
+  }
+  const print = (list, title) => {
+    if (list.length === 0) return;
+    const who = Math.max('USER'.length, ...list.map((r) => r.who.length));
+    console.log('');
+    console.log(chalk.bold(`  ${title}`));
+    console.log(chalk.dim(`  ${'USER ID'.padEnd(36)}  ${'USER'.padEnd(who)}  STATUS    ROLES`));
+    for (const r of list) {
+      const status =
+        r.status === 'active'
+          ? chalk.green(r.status.padEnd(8))
+          : r.status === 'disabled'
+            ? chalk.yellow(r.status.padEnd(8))
+            : chalk.dim(r.status);
+      console.log(
+        `  ${r.userId.padEnd(36)}  ${r.who.padEnd(who)}  ${status}  ${r.roles}${chalk.dim(` (seq ${r.seq})`)}`,
+      );
+    }
+  };
+  print(
+    rows.filter((r) => r.member),
+    `Audience of ${terminalText(name)} (head seq ${result.head})`,
+  );
+  print(
+    rows.filter((r) => !r.member),
+    'Left the audience (the plugin keeps their last known name until they are erased)',
+  );
+  console.log('');
+}
+
+/**
+ * `plugins entitlements <name> [--user <u> | --group <g> --roles a,b]
+ * [--revoke --user <u> | --group <g>]`.
+ *
+ * @param {string[]} args  what follows the subcommand
+ * @param {{ json: boolean }} options
+ */
+export async function entitlementsCmd(args, { json }) {
+  const parsed = parseEntitlementsArgs(args);
+  if (!parsed.ok) fail(parsed.error, json);
+  const { name } = parsed;
+  const path = pluginPath(name, 'entitlements');
+
+  if (parsed.action === 'list') {
+    let result;
+    try {
+      result = await panelRequest('GET', path);
+    } catch (err) {
+      fail(err.message, json, err);
+    }
+    if (json) {
+      emit(result);
+      return;
+    }
+    const { entitlements, roleless } = result;
+    console.log('');
+    if (entitlements.length === 0) {
+      console.log(`  Nobody holds a role on ${chalk.cyan(name)} yet.`);
+    } else {
+      console.log(chalk.bold(`  Entitlements on ${terminalText(name)}`));
+      const width = Math.max(
+        'PRINCIPAL'.length,
+        ...entitlements.map((e) => `${e.principalType}:${e.principalId}`.length),
+      );
+      console.log(chalk.dim(`  ${'PRINCIPAL'.padEnd(width)}  ROLES`));
+      for (const e of entitlements) {
+        const principal = terminalText(`${e.principalType}:${e.principalId}`);
+        const unknown =
+          e.unknownRoles.length > 0
+            ? chalk.dim(` (no longer declared: ${terminalText(e.unknownRoles.join(', '))})`)
+            : '';
+        const userId = e.userId ? chalk.dim(`  ${terminalText(e.userId)}`) : '';
+        console.log(
+          `  ${chalk.cyan(principal.padEnd(width))}  ${terminalText(e.roles.join(', '))}${unknown}${userId}`,
+        );
+      }
+    }
+    if (roleless > 0) {
+      console.log(
+        chalk.dim(
+          `\n  ${roleless} grant(s) on it carry no roles (desktop installs, migrated grants) — they never make anyone a member.`,
+        ),
+      );
+    }
+    console.log(
+      chalk.dim(
+        `\n  Give roles:  lamaste-server plugins entitlements ${terminalText(name)} --user <u> | --group <g> --roles a,b` +
+          `\n  Take away:   lamaste-server plugins entitlements ${terminalText(name)} --revoke --user <u> | --group <g>`,
+      ),
+    );
+    console.log('');
+    return;
+  }
+
+  const principal = { principalType: parsed.principalType, principalId: parsed.principalId };
+  const who = `${principal.principalType} ${principal.principalId}`;
+  if (parsed.action === 'set') {
+    let result;
+    try {
+      result = await panelRequest('PUT', path, { ...principal, roles: parsed.roles });
+    } catch (err) {
+      fail(err.message, json, err);
+    }
+    if (json) {
+      emitComplete({ name, ...result });
+      return;
+    }
+    console.log(
+      result.changed
+        ? `\n  ${chalk.green('✓')} ${terminalText(who)} holds ${chalk.cyan(parsed.roles.join(', '))} on ${terminalText(name)}`
+        : `\n  ${terminalText(who)} already holds exactly ${parsed.roles.join(', ')} on ${terminalText(name)}`,
+    );
+    printWarnings(result.warnings);
+    console.log('');
+    return;
+  }
+
+  const query = new URLSearchParams(principal).toString();
+  let result;
+  try {
+    result = await panelRequest('DELETE', `${path}?${query}`);
+  } catch (err) {
+    fail(err.message, json, err);
+  }
+  if (json) {
+    emitComplete({ name, ...principal, ...result });
+    return;
+  }
+  console.log(
+    `\n  ${chalk.green('✓')} ${terminalText(who)} holds no role on ${terminalText(name)} any more` +
+      chalk.dim(` (${result.revoked} grant(s) revoked)`),
+  );
+  printWarnings(result.warnings);
+  console.log('');
+}
+
+/**
+ * `plugins identity-sync <name> [--reconcile]`: exits non-zero when the
+ * sync was skipped or failed.
+ *
+ * @param {string[]} args  what follows the subcommand
+ * @param {{ json: boolean }} options
+ */
+export async function identitySyncCmd(args, { json }) {
+  const parsed = parseIdentitySyncArgs(args);
+  if (!parsed.ok) fail(parsed.error, json);
+  const { name, reconcile } = parsed;
+  let response;
+  try {
+    response = await panelRequest('POST', pluginPath(name, 'identity/sync'), { reconcile });
+  } catch (err) {
+    fail(err.message, json, err);
+  }
+  if (json) {
+    emitComplete({ name, ...response });
+  } else {
+    const { result } = response;
+    if (result.status === 'synced') {
+      console.log(
+        `\n  ${chalk.green('✓')} ${terminalText(name)}: ${result.replay ? 'replayed' : 'synced'} up to seq ${result.cursor}` +
+          (reconcile ? ` — ${result.mismatches ?? 0} out of step` : ''),
+      );
+    } else if (result.status === 'up-to-date') {
+      console.log(
+        `\n  ${chalk.green('✓')} ${terminalText(name)}: its agent half is up to date (seq ${result.cursor})`,
+      );
+    } else {
+      console.error(
+        `\n  ${chalk.red(`${result.status}:`)} ${terminalText(result.error ?? result.reason ?? '')}`,
+      );
+    }
+    console.log('');
+  }
+  if (!response.ok) process.exit(1);
+}