@lamalibre/create-lamaste 4.4.1 → 4.6.0

package/vendor/serverd/src/lib/authelia.js

@@ -2,11 +2,18 @@
  * Shim — Authelia lifecycle + config management now lives in
  * `@lamalibre/lamaste/server`. This file wires the daemon's execa instance
  * and bcryptjs hasher to the parameterized core API.
+ *
+ * Users go through here alone: every write of users.yml is a locked
+ * read-modify-write in `lib/directory.js` (`changeUsers`), which brings the
+ * user directory in line before Authelia restarts. Tests point the users
+ * file, the restart and the TOTP writer elsewhere
+ * ({@link setAutheliaForTests}) — there is no Authelia to restart there.
  */
 
 import { execa } from 'execa';
 import bcrypt from 'bcryptjs';
 import {
+  AUTHELIA_USERS,
   isAutheliaInstalled as isAutheliaInstalledCore,
   writeAutheliaConfig as writeAutheliaConfigCore,
   createAutheliaUser,
@@ -24,11 +31,65 @@ import {
   base32Decode,
   generateTotpSecret,
   writeTotpToDatabase as writeTotpToDatabaseCore,
+  purgeAutheliaSecondFactors,
+  autheliaHoldsOpaqueIdentifier,
 } from '@lamalibre/lamaste/server';
 
 // bcryptjs hasher — signature matches the core lib's BcryptHashFn.
 const bcryptHash = (password, cost) => bcrypt.hash(password, cost);
 
+const restartRealAuthelia = () => reloadAutheliaCore(execa);
+const writeRealTotp = (username, base32Secret) =>
+  writeTotpToDatabaseCore(username, base32Secret, execa);
+
+/** Authelia's per-user storage through the root helper — replaced in tests. */
+const realUserStorage = Object.freeze({
+  purgeSecondFactors: (username) => purgeAutheliaSecondFactors(username, execa),
+  holdsOidcIdentifier: (username) => autheliaHoldsOpaqueIdentifier(username, execa),
+});
+
+/** Authelia's users file — another one in tests. */
+let usersFile = AUTHELIA_USERS;
+/** Restart Authelia (it reads users.yml when it starts) — replaced in tests. */
+let restartAuthelia = restartRealAuthelia;
+/** Store a TOTP secret in Authelia's database — replaced in tests. */
+let totpWriter = writeRealTotp;
+/** Authelia's per-user storage — replaced in tests. */
+let userStorage = realUserStorage;
+
+/**
+ * Point the users file, the Authelia restart, the TOTP writer and the
+ * per-user storage elsewhere (tests); `null` restores Authelia's.
+ *
+ * @param {{ usersFile?: string, restart?: () => Promise<unknown>, writeTotp?: (username: string, secret: string) => Promise<void>, userStorage?: { purgeSecondFactors: (username: string) => Promise<void>, holdsOidcIdentifier: (username: string) => Promise<boolean> } } | null} overrides
+ */
+export function setAutheliaForTests(overrides) {
+  usersFile = overrides?.usersFile ?? AUTHELIA_USERS;
+  restartAuthelia = overrides?.restart ?? restartRealAuthelia;
+  totpWriter = overrides?.writeTotp ?? writeRealTotp;
+  userStorage = overrides?.userStorage ?? realUserStorage;
+}
+
+/**
+ * Delete `username`'s TOTP configuration and WebAuthn credentials from
+ * Authelia's storage (idempotent; throws when the helper fails).
+ *
+ * @param {string} username
+ */
+export function purgeAutheliaUserSecondFactors(username) {
+  return userStorage.purgeSecondFactors(username);
+}
+
+/**
+ * Whether Authelia's storage holds an OpenID Connect opaque identifier for
+ * `username` (throws when it cannot be told).
+ *
+ * @param {string} username
+ */
+export function autheliaHoldsOidcIdentity(username) {
+  return userStorage.holdsOidcIdentifier(username);
+}
+
 /** True once create-lamaste has installed Authelia. */
 export function isAutheliaInstalled() {
   return isAutheliaInstalledCore();
@@ -38,20 +99,22 @@ export function writeAutheliaConfig(domain, secrets) {
   return writeAutheliaConfigCore(domain, secrets);
 }
 
+/** Add the default administrator to users.yml (onboarding) — inside `changeUsers`. */
 export function createUser(username, password) {
-  return createAutheliaUser(username, password, bcryptHash);
+  return createAutheliaUser(username, password, bcryptHash, usersFile);
 }
 
 export function readUsers() {
-  return readAutheliaUsers();
+  return readAutheliaUsers(usersFile);
 }
 
 export function writeUsers(usersData) {
-  return writeAutheliaUsers(usersData);
+  return writeAutheliaUsers(usersData, usersFile);
 }
 
+/** users.yml as written, password hashes included; throws when it cannot be read or parsed. */
 export function readUsersRaw() {
-  return readAutheliaUsersRaw();
+  return readAutheliaUsersRaw(usersFile);
 }
 
 export function hashPassword(password) {
@@ -62,8 +125,9 @@ export function startAuthelia() {
   return startAutheliaCore(execa);
 }
 
+/** Restart Authelia: it reads users.yml when it starts, and every session ends. */
 export function reloadAuthelia() {
-  return reloadAutheliaCore(execa);
+  return restartAuthelia();
 }
 
 export function isAutheliaRunning() {
@@ -84,12 +148,19 @@ export function updateOidcProvider(domain, clients, options = {}) {
   return updateAutheliaOidcProvider(domain, clients, execa, options);
 }
 
+/**
+ * Add an invited user to users.yml — inside `changeUsers`, which restarts
+ * Authelia once the directory knows the user.
+ */
 export function createUserFromInvitation(username, email, groups, hashedPassword) {
-  return createUserFromInvitationCore(username, email, groups, hashedPassword, execa);
+  return createUserFromInvitationCore(username, email, groups, hashedPassword, execa, {
+    restart: false,
+    usersFile,
+  });
 }
 
 export function writeTotpToDatabase(username, base32Secret) {
-  return writeTotpToDatabaseCore(username, base32Secret, execa);
+  return totpWriter(username, base32Secret);
 }
 
 // Pure helpers — no dependency injection needed

package/vendor/serverd/src/lib/chisel-runtime.js

@@ -30,17 +30,29 @@ export function chiselReloadsAuthfile() {
 }
 
 /**
- * Restart chisel if the change requires it. `try-restart` leaves a stopped
- * chisel stopped (see chisel-reconcile.js: a server that failed to reconcile
- * keeps chisel down until it succeeds).
+ * Whether an authfile change must restart chisel: a grant withdrawn (so
+ * live sessions drop the binding) — unless `keepLiveSessions` — or any
+ * change a chisel too old to reload its authfile would not see.
+ *
+ * @param {{ changed: boolean, revoked: boolean }} change
+ * @param {{ keepLiveSessions?: boolean }} [opts]
+ */
+export function authfileChangeNeedsRestart(change, { keepLiveSessions = false } = {}) {
+  return (change.revoked && !keepLiveSessions) || (change.changed && !runningPinnedRelease);
+}
+
+/**
+ * Restart chisel if the change requires it ({@link authfileChangeNeedsRestart}).
+ * `try-restart` leaves a stopped chisel stopped (see chisel-reconcile.js: a
+ * server that failed to reconcile keeps chisel down until it succeeds).
  *
  * @param {{ changed: boolean, revoked: boolean }} change
  * @param {import('pino').Logger} [logger]
+ * @param {{ keepLiveSessions?: boolean }} [opts]
  * @returns {Promise<{ restartOk: boolean, restartError?: string }>}
  */
-export async function applyAuthfileChange(change, logger) {
-  const needsRestart = change.revoked || (change.changed && !runningPinnedRelease);
-  if (!needsRestart) return { restartOk: true };
+export async function applyAuthfileChange(change, logger, opts = {}) {
+  if (!authfileChangeNeedsRestart(change, opts)) return { restartOk: true };
   const result = await reloadChiselAuth(execa, logger);
   return result.ok ? { restartOk: true } : { restartOk: false, restartError: result.error };
 }

package/vendor/serverd/src/lib/chisel.js

@@ -71,10 +71,18 @@ export function getChiselStatus() {
  * grant, chisel is restarted so live sessions drop the binding. Call only
  * after the tunnel state has been written. Throws if the restart fails,
  * since a withdrawn grant would otherwise stay live.
+ *
+ * `keepLiveSessions`: withdraw the grant for new sessions only, without the
+ * restart — which drops every session, the hosting agents' internal plugin
+ * tunnels with them. Only for a port nothing routes to any more, whose
+ * agent drops the binding at its next sync (a tunnel moved to a plugin's
+ * web surface).
+ *
+ * @param {{ keepLiveSessions?: boolean }} [opts]
  */
-export async function syncChisel() {
+export async function syncChisel(opts = {}) {
   const change = await syncChiselAuthfile();
-  const { restartOk, restartError } = await applyAuthfileChange(change);
+  const { restartOk, restartError } = await applyAuthfileChange(change, undefined, opts);
   if (!restartOk) {
     throw new Error(`Chisel restart failed after withdrawing a port grant: ${restartError}`);
   }

package/vendor/serverd/src/lib/config.js

@@ -3,6 +3,8 @@ import { readFile, writeFile, rename, open } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 import { z } from 'zod';
+import { isIdentityUuid } from '@lamalibre/lamaste';
+import { SESSION_MAX_AGE } from './user-access-session.js';
 
 const ConfigSchema = z.object({
   ip: z.string().min(1),
@@ -25,11 +27,13 @@ const ConfigSchema = z.object({
     .optional()
     .default({ enabled: false, secret: null, setupComplete: false }),
   sessionSecret: z.string().nullable().optional().default(null),
-  // Per-user invalidation epochs (Unix seconds). When a user is deleted from
-  // Authelia, their epoch is bumped so any in-flight user-access session token
-  // issued before that timestamp is rejected by the session middleware. The
-  // entry is preserved (never deleted) so that re-creating the same username
-  // does not resurrect old sessions.
+  // Per-user invalidation epochs (Unix seconds), keyed by the directory's
+  // user id — never by username, so panel.json names nobody. Offboarding a
+  // user (disable, delete) bumps theirs, and the session middleware rejects
+  // every user-access session issued before it. Sessions are bound to the
+  // user id too, so a username given to someone else later never revives
+  // one. An epoch older than a session's longest life can reject nothing and
+  // is dropped (`pruneUserEpochs`).
   userEpochs: z.record(z.string(), z.number().int().nonnegative()).optional().default({}),
   onboarding: z.object({
     status: z.enum(['FRESH', 'DOMAIN_SET', 'DNS_READY', 'PROVISIONING', 'COMPLETED']),
@@ -45,8 +49,8 @@ let configPath = null;
 
 /**
  * Promise-chain mutex serializing all panel.json writes so concurrent
- * updateConfig() calls cannot race (e.g. two simultaneous user deletes both
- * bumping userEpochs).
+ * updateConfig() / bumpUserEpoch() calls cannot race (e.g. two simultaneous
+ * user deletes both bumping userEpochs).
  */
 let configWriteLock = Promise.resolve();
 function withConfigLock(fn) {
@@ -58,6 +62,36 @@ function withConfigLock(fn) {
   return prev.then(fn).finally(resolve);
 }
 
+/**
+ * The epochs worth keeping: keyed by a user id (keys of earlier versions
+ * were usernames — dropped, as the sessions they guarded no longer
+ * validate: a session now names its user id) and younger than a session's
+ * longest life.
+ *
+ * @param {Record<string, number>} epochs
+ * @param {number} nowSeconds
+ */
+export function pruneUserEpochs(epochs, nowSeconds) {
+  const out = {};
+  for (const [userId, epoch] of Object.entries(epochs ?? {})) {
+    if (isIdentityUuid(userId) && epoch > nowSeconds - SESSION_MAX_AGE) out[userId] = epoch;
+  }
+  return out;
+}
+
+/** Write `validated` to panel.json atomically (temp → fsync → rename), 0600. */
+async function persistConfig(validated) {
+  const tmpPath = `${configPath}.tmp`;
+  await writeFile(tmpPath, JSON.stringify(validated, null, 2) + '\n', {
+    encoding: 'utf-8',
+    mode: 0o600,
+  });
+  const fd = await open(tmpPath, 'r');
+  await fd.sync();
+  await fd.close();
+  await rename(tmpPath, configPath);
+}
+
 function resolveConfigPath() {
   if (process.env.LAMALIBRE_LAMASTE_CONFIG) {
     return process.env.LAMALIBRE_LAMASTE_CONFIG;
@@ -95,18 +129,18 @@ export async function loadConfig() {
   const validated = ConfigSchema.parse(parsed);
 
   // Auto-generate serverId if missing — used as bucket prefix for multi-server isolation
+  let rewrite = false;
   if (!validated.serverId) {
     validated.serverId = crypto.randomUUID();
-    const tmpPath = `${configPath}.tmp`;
-    await writeFile(tmpPath, JSON.stringify(validated, null, 2) + '\n', {
-      encoding: 'utf-8',
-      mode: 0o600,
-    });
-    const fd = await open(tmpPath, 'r');
-    await fd.sync();
-    await fd.close();
-    await rename(tmpPath, configPath);
+    rewrite = true;
   }
+  // Epochs keyed by username (before 4.5) or too old to reject anything go.
+  const epochs = pruneUserEpochs(validated.userEpochs, Math.floor(Date.now() / 1000));
+  if (Object.keys(epochs).length !== Object.keys(validated.userEpochs).length) {
+    validated.userEpochs = epochs;
+    rewrite = true;
+  }
+  if (rewrite) await persistConfig(validated);
 
   config = validated;
   return structuredClone(config);
@@ -140,28 +174,13 @@ export function updateConfig(patch) {
         patch.panel2fa !== null
       ) {
         merged.panel2fa = { ...merged.panel2fa, ...patch.panel2fa };
-      } else if (
-        key === 'userEpochs' &&
-        typeof patch.userEpochs === 'object' &&
-        patch.userEpochs !== null
-      ) {
-        merged.userEpochs = { ...(merged.userEpochs ?? {}), ...patch.userEpochs };
       } else {
         merged[key] = patch[key];
       }
     }
 
     const validated = ConfigSchema.parse(merged);
-
-    const tmpPath = `${configPath}.tmp`;
-    await writeFile(tmpPath, JSON.stringify(validated, null, 2) + '\n', {
-      encoding: 'utf-8',
-      mode: 0o600,
-    });
-    const fd = await open(tmpPath, 'r');
-    await fd.sync();
-    await fd.close();
-    await rename(tmpPath, configPath);
+    await persistConfig(validated);
 
     config = validated;
     return structuredClone(config);
@@ -169,20 +188,26 @@ export function updateConfig(patch) {
 }
 
 /**
- * Bump a user's session-invalidation epoch to "now" (Unix seconds). Any
- * user-access session whose `iat` (issued-at) is older than this epoch
- * is considered revoked by the session middleware.
+ * Bump a user's session-invalidation epoch to "now" (Unix seconds): every
+ * user-access session of `userId` issued before it is revoked (the session
+ * middleware). Epochs that can no longer reject anything are dropped in
+ * the same write ({@link pruneUserEpochs}). Idempotent.
  *
- * Idempotent: calling twice in quick succession is safe (the later
- * timestamp simply replaces the earlier one).
- *
- * @param {string} username
+ * @param {string} userId the directory's id of the user
  * @returns {Promise<number>} The new epoch (Unix seconds)
  */
-export async function bumpUserEpoch(username) {
-  const nowSeconds = Math.floor(Date.now() / 1000);
-  await updateConfig({ userEpochs: { [username]: nowSeconds } });
-  return nowSeconds;
+export function bumpUserEpoch(userId) {
+  if (!isIdentityUuid(userId)) throw new Error('A session epoch is keyed by a directory user id');
+  if (config === null) throw new Error('Config not loaded. Call loadConfig() first.');
+  return withConfigLock(async () => {
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    const next = structuredClone(config);
+    next.userEpochs = { ...pruneUserEpochs(next.userEpochs, nowSeconds), [userId]: nowSeconds };
+    const validated = ConfigSchema.parse(next);
+    await persistConfig(validated);
+    config = validated;
+    return nowSeconds;
+  });
 }
 
 export function getConfigPath() {