@lamalibre/create-lamaste 4.4.1 → 4.6.0

package/vendor/server-ui/dist/index.html

@@ -4,8 +4,8 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Lamaste</title>
-    <script type="module" crossorigin src="/assets/index-roDHz3dM.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-25wo_8av.css">
+    <script type="module" crossorigin src="/assets/index-BvEfCZYS.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BZwQ_aQc.css">
   </head>
   <body style="background-color: #09090b">
     <div id="root"></div>

package/vendor/serverd/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/lamaste-serverd",
-  "version": "4.4.1",
+  "version": "4.6.0",
   "description": "Lamaste server daemon — REST API and plugin host",
   "license": "SEE LICENSE IN LICENSE.md",
   "publishConfig": {
@@ -29,7 +29,7 @@
     "@fastify/rate-limit": "^10.3.0",
     "@fastify/static": "^9.1.1",
     "@fastify/websocket": "^11.0.0",
-    "@lamalibre/lamaste": "^4.4.1",
+    "@lamalibre/lamaste": "^4.6.0",
     "bcryptjs": "^3.0.3",
     "execa": "^9.6.1",
     "fastify": "^5.8.4",

package/vendor/serverd/src/index.js

@@ -8,7 +8,9 @@ import fastifyStatic from '@fastify/static';
 import websocket from '@fastify/websocket';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { logRequestMetadata } from '@lamalibre/lamaste';
 import { loadConfig } from './lib/config.js';
+import { panelRequestLogOptions } from './lib/request-logging.js';
 import mtlsMiddleware from './middleware/mtls.js';
 import twofaSession from './middleware/twofa-session.js';
 import roleGuard from './middleware/role-guard.js';
@@ -18,6 +20,7 @@ import onboardingRoutes from './routes/onboarding/index.js';
 import managementRoutes from './routes/management.js';
 import pluginRouter from './routes/plugin-router.js';
 import agentForwarderRoutes from './routes/agent-forwarder.js';
+import userSurfaceContext from './routes/user-surface.js';
 import inviteRoutes from './routes/invite.js';
 import enrollmentRoutes from './routes/enrollment.js';
 import {
@@ -38,9 +41,11 @@ import {
   stopHostedPluginHealthMonitor,
 } from './lib/plugin-hosting.js';
 import { refreshHostedPluginSettings } from './lib/plugin-settings.js';
+import { startIdentityServices, stopIdentityServices } from './lib/identity-sync.js';
 import { syncOidcClients } from './lib/plugin-oidc.js';
 import { ensureRelaySigningKey } from './lib/relay-signing.js';
 import { reconcileSiteVhosts, reconcileTunnelVhosts } from './lib/vhost-reconcile.js';
+import { reconcileWebSurfaces } from './lib/web-surface.js';
 import {
   loadTicketScopeCapabilities,
   checkInstanceLiveness,
@@ -73,12 +78,19 @@ async function start() {
 
   const server = Fastify({
     logger: true,
+    // Fastify's own request lines carry every URL with its query and the
+    // client address; one metadata line per request replaces them (below).
+    disableRequestLogging: true,
     // Behind the local nginx: trust exactly that one loopback hop, so
     // request.ip is the client address nginx appended to X-Forwarded-For —
     // not a value the client sent, and nothing from a non-local peer.
     trustProxy: trustLocalNginxHop,
   });
 
+  // One metadata line per request, never a URL or a person's address
+  // (lib/request-logging.js).
+  logRequestMetadata(server, panelRequestLogOptions);
+
   // Wire ticket module to the Fastify root logger so any load-time warnings
   // (e.g. legacy tickets.json shape dropped on upgrade) reach journalctl.
   setTicketModuleLogger(server.log);
@@ -177,10 +189,16 @@ async function start() {
     app.register(userAccessAdminRoutes, { prefix: '/api' });
     app.register(pluginRouter, { prefix: '/api' });
     // Last: agent-hosted plugins with an agent half, forwarded over their
-    // internal tunnels. Only what no other /api route answers reaches it.
+    // internal tunnels. Only what no other /api route answers reaches it —
+    // and never /api/<route>/app[/*], the user surface's static routes below.
     app.register(agentForwarderRoutes, { prefix: '/api' });
   });
 
+  // --- Plugins' user surfaces: /api/<route>/app[/*] from the host bound to
+  // the plugin. No mTLS, 2FA or role: only a relay assertion Gatekeeper
+  // signed for the panel admits a request (routes/user-surface.js) ---
+  server.register(userSurfaceContext);
+
   // --- User-access session-protected routes (Bearer token, no mTLS) ---
   server.register(async function userAccessContext(app) {
     app.register(userAccessSessionMiddleware);
@@ -200,7 +218,7 @@ async function start() {
 
   // The auth portal and static site vhosts an older version wrote name the
   // client's Host header, not their own hostname, to Authelia. Before listen:
-  // site changes take no lock, and none can arrive until the panel listens.
+  // no site change can arrive until the panel listens.
   if (config.onboarding.status === 'COMPLETED' && config.domain) {
     await reconcileSiteVhosts(server.log, config.domain).catch((err) => {
       server.log.error({ err: err.message }, 'Startup site vhost reconcile failed');
@@ -222,9 +240,13 @@ async function start() {
   // relay, and Gatekeeper vhosts name the client's Host header to Gatekeeper.
   // After listen: a rewritten agent-panel vhost asks this server at once.
   if (config.onboarding.status === 'COMPLETED') {
-    reconcileTunnelVhosts(server.log).catch((err) => {
-      server.log.error({ err: err.message }, 'Startup tunnel vhost reconcile failed');
-    });
+    reconcileTunnelVhosts(server.log)
+      .catch((err) => {
+        server.log.error({ err: err.message }, 'Startup tunnel vhost reconcile failed');
+      })
+      // Plugins' web surfaces: each approved tree served (a redeploy may
+      // have reset the web root), each site's vhost in line.
+      .then(() => reconcileWebSurfaces(server.log));
   }
 
   // --- Health of hosted agent-hosted plugins (every 10s; idle without hostings) ---
@@ -238,6 +260,12 @@ async function start() {
     server.log.warn({ err: err.message }, 'Startup refresh of plugin settings failed');
   });
 
+  // --- Users and identity: the directory reconciled with users.yml (read
+  // only), the plugin audiences recomputed and sent to the agent halves that
+  // are behind — now, then every minute (Gatekeeper CLI edits, users.yml
+  // changed outside Lamaste, retries), with a daily full reconcile per plugin ---
+  startIdentityServices(server.log);
+
   // --- Periodic ticket instance liveness check (every 60s) ---
   const livenessInterval = setInterval(() => {
     checkInstanceLiveness(server.log).catch((err) => {
@@ -250,6 +278,7 @@ async function start() {
   const shutdown = async (signal) => {
     server.log.info({ signal }, 'Received signal, shutting down gracefully');
     clearInterval(livenessInterval);
+    stopIdentityServices();
     stopHostedPluginHealthMonitor();
     clearRateLimitInterval();
     await server.close();