@lamalibre/create-lamaste 4.4.1 → 4.6.0

package/vendor/serverd/src/middleware/user-access-session.js

@@ -1,5 +1,6 @@
 import fp from 'fastify-plugin';
 import { getConfig } from '../lib/config.js';
+import { findDirectoryUser } from '../lib/directory.js';
 import {
   REFRESH_THRESHOLD,
   validateUserSession,
@@ -37,6 +38,14 @@ async function userAccessSessionPlugin(fastify, _opts) {
       return reply.code(401).send({ error: 'user_session_required' });
     }
 
+    // The session's user must still hold the username, and be enabled: a
+    // deleted user's username given to someone else never inherits it, and
+    // a disabled user is out at once.
+    const holder = await findDirectoryUser(result.payload.username);
+    if (!holder || holder.userId !== result.payload.userId || holder.status !== 'active') {
+      return reply.code(401).send({ error: 'user_session_required' });
+    }
+
     // Set username on request for downstream route handlers
     request.userAccessUsername = result.payload.username;
 

package/vendor/serverd/src/routes/agent-forwarder.js

@@ -2,8 +2,10 @@
  * `/api/<route>/*` for agent-hosted plugins with an agent half — forwarded
  * by the panel to the plugin's agent half over its internal tunnel, through
  * the plugin's approved request hooks (`request:pre-forward` /
- * `request:post-forward`) and, while it is down, its `tunnel:down` fallback.
- * See `createHookedForwarder` in `@lamalibre/lamaste/server`.
+ * `request:post-forward`). While its hosting is down nothing is forwarded:
+ * its `tunnel:down` fallback answers, or `502` with the reason
+ * (`resolveForwardTarget`). See `createHookedForwarder` in
+ * `@lamalibre/lamaste/server`.
  *
  * Registered after every other `/api` route: static routes win over its
  * `/:route/*`, so only what nothing else answers arrives here, and a route

package/vendor/serverd/src/routes/invite.js

@@ -1,6 +1,6 @@
 import crypto from 'node:crypto';
 import { z } from 'zod';
-import { readInvitations, writeInvitations } from '../lib/state.js';
+import { readInvitations, withInvitationsLock, writeInvitations } from '../lib/state.js';
 import {
   createUserFromInvitation,
   hashPassword,
@@ -9,6 +9,8 @@ import {
   writeTotpToDatabase,
 } from '../lib/authelia.js';
 import { getConfig } from '../lib/config.js';
+import { httpError } from '../lib/app-error.js';
+import { changeUsers, usersFileError } from '../lib/directory.js';
 
 /**
  * Find an invitation by token using a constant-time comparison.
@@ -117,15 +119,49 @@ export default async function inviteRoutes(fastify, _opts) {
       return reply.code(500).send({ error: 'Failed to process password' });
     }
 
+    // Through the users lock: the directory gives the user their id before
+    // Authelia restarts and lets them sign in.
     try {
-      await createUserFromInvitation(
-        invitation.username,
-        invitation.email,
-        invitation.groups,
-        hashedPassword,
+      await changeUsers(
+        async () => {
+          // An unreadable users file is refused, never written over.
+          let current = { users: {} };
+          try {
+            current = await readUsersRaw();
+          } catch (err) {
+            if (err.code !== 'ENOENT') {
+              throw httpError('Failed to read user database', 500, { cause: usersFileError(err) });
+            }
+          }
+          if (current.users[invitation.username]) {
+            throw httpError('This username already exists', 409);
+          }
+          await createUserFromInvitation(
+            invitation.username,
+            invitation.email,
+            invitation.groups,
+            hashedPassword,
+          );
+        },
+        {
+          actor: 'invitation',
+          logger: request.log,
+          // A removed user's grants, groups and second factors under the
+          // username go first; a username with an OIDC identity is refused.
+          creates: [invitation.username],
+          expect: (users) => users[invitation.username]?.password === hashedPassword,
+        },
       );
     } catch (err) {
-      request.log.error(err, 'Failed to create user from invitation');
+      if (err.statusCode === 409) {
+        return reply
+          .code(409)
+          .send({ error: err.message, ...(err.code ? { code: err.code } : {}) });
+      }
+      if (err.statusCode === 503) {
+        return reply.code(503).send({ error: err.message, code: err.code });
+      }
+      request.log.error(err.cause ?? err, 'Failed to create user from invitation');
       return reply.code(500).send({ error: 'Failed to create user account' });
     }
 
@@ -140,12 +176,17 @@ export default async function inviteRoutes(fastify, _opts) {
       // Non-fatal: user was created, they can have admin reset TOTP later
     }
 
-    // Mark invitation as used
-    invitation.used = true;
-    invitation.acceptedAt = new Date().toISOString();
-
+    // Mark invitation as used — on the file as it is now, under its lock.
     try {
-      await writeInvitations(invitations);
+      await withInvitationsLock(async () => {
+        const current = await readInvitations();
+        // The token found it (checked above); it names this invitation alone.
+        const accepted = current.find((inv) => inv.token === invitation.token);
+        if (!accepted) return;
+        accepted.used = true;
+        accepted.acceptedAt = new Date().toISOString();
+        await writeInvitations(current);
+      });
     } catch (err) {
       request.log.warn(err, 'Failed to update invitation status (user was created)');
     }

package/vendor/serverd/src/routes/management/gatekeeper-proxy.js

@@ -8,10 +8,33 @@
  * forwarding needed.
  *
  * Admin-only (lamaste-serverd's mTLS + roleGuard protect these routes).
+ *
+ * Grants and groups decide who is in an agent-hosted plugin's audience
+ * (slice 6): a plugin grant whose context names `roles` is an entitlement,
+ * checked against the roles the plugin declares and passed on sorted
+ * (`checkProxiedGrant`), and every grant or group change that went through
+ * recomputes the audiences. A grant or a group membership is given to a
+ * username holding the users lock (`withUsernamesForGrants`), so no
+ * deletion races it: a username a removed user held and nobody holds now is
+ * refused (409 `username_deleted`), and whatever a removed user who held it
+ * left in Gatekeeper is cleared first (503 `gatekeeper_unavailable` when it
+ * cannot be) — a reused username inherits nothing. The access log is purged
+ * for one username by POST, its name in the body (never in a URL, which
+ * logs keep).
  */
 
+import { recomputeAudiences } from '../../lib/audience.js';
+import { withUsernamesForGrants } from '../../lib/directory.js';
+import { checkProxiedGrant } from '../../lib/entitlements.js';
+import { actorFromRequest } from '../../lib/actor.js';
 import { gatekeeperRequest } from '../../lib/gatekeeper-client.js';
 
+/** Gatekeeper's `path`, with the request's query string when it has one. */
+function withQuery(path, request) {
+  const qs = new URLSearchParams(request.query).toString();
+  return qs ? `${path}?${qs}` : path;
+}
+
 export default async function gatekeeperProxyRoutes(fastify, _opts) {
   // All gatekeeper management routes are admin-only
   fastify.addHook('preHandler', fastify.requireRole(['admin']));
@@ -32,6 +55,39 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
     };
   };
 
+  /** When Gatekeeper took a grant or group change, the plugin audiences follow it. */
+  const followAudiences = async (request, answer) => {
+    if (answer.statusCode < 400) await recomputeAudiences({ logger: request.log });
+    return answer;
+  };
+
+  /**
+   * A grant or group change: forwarded, and when Gatekeeper took it, the
+   * plugin audiences follow it before the answer goes back.
+   */
+  const proxyChange = async (request, method, gatekeeperPath, body) =>
+    followAudiences(request, await proxy(method, gatekeeperPath, body));
+
+  /**
+   * Give something to `usernames` in Gatekeeper: forwarded holding the
+   * users lock, after the usernames' checks (`withUsernamesForGrants`); a
+   * refusal of those checks is the answer. The audiences follow.
+   */
+  const proxyGive = async (request, usernames, method, gatekeeperPath, body) => {
+    let answer;
+    try {
+      answer = await withUsernamesForGrants(
+        usernames,
+        { actor: actorFromRequest(request), logger: request.log },
+        () => proxy(method, gatekeeperPath, body),
+      );
+    } catch (err) {
+      if (!Number.isInteger(err.statusCode)) throw err;
+      return { statusCode: err.statusCode, data: { error: err.message, code: err.code } };
+    }
+    return followAudiences(request, answer);
+  };
+
   // --- Groups ---
 
   fastify.get('/gatekeeper/groups', async (_request, reply) => {
@@ -40,7 +96,7 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
   });
 
   fastify.post('/gatekeeper/groups', async (request, reply) => {
-    const { statusCode, data } = await proxy('POST', '/api/groups', request.body);
+    const { statusCode, data } = await proxyChange(request, 'POST', '/api/groups', request.body);
     return reply.code(statusCode).send(data);
   });
 
@@ -52,7 +108,8 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
 
   fastify.patch('/gatekeeper/groups/:name', async (request, reply) => {
     const { name } = request.params;
-    const { statusCode, data } = await proxy(
+    const { statusCode, data } = await proxyChange(
+      request,
       'PATCH',
       `/api/groups/${encodeURIComponent(name)}`,
       request.body,
@@ -62,13 +119,22 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
 
   fastify.delete('/gatekeeper/groups/:name', async (request, reply) => {
     const { name } = request.params;
-    const { statusCode, data } = await proxy('DELETE', `/api/groups/${encodeURIComponent(name)}`);
+    const { statusCode, data } = await proxyChange(
+      request,
+      'DELETE',
+      `/api/groups/${encodeURIComponent(name)}`,
+    );
     return reply.code(statusCode).send(data);
   });
 
   fastify.post('/gatekeeper/groups/:name/members', async (request, reply) => {
     const { name } = request.params;
-    const { statusCode, data } = await proxy(
+    const usernames = Array.isArray(request.body?.usernames)
+      ? request.body.usernames.filter((u) => typeof u === 'string')
+      : [];
+    const { statusCode, data } = await proxyGive(
+      request,
+      usernames,
       'POST',
       `/api/groups/${encodeURIComponent(name)}/members`,
       request.body,
@@ -78,7 +144,8 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
 
   fastify.delete('/gatekeeper/groups/:name/members/:username', async (request, reply) => {
     const { name, username } = request.params;
-    const { statusCode, data } = await proxy(
+    const { statusCode, data } = await proxyChange(
+      request,
       'DELETE',
       `/api/groups/${encodeURIComponent(name)}/members/${encodeURIComponent(username)}`,
     );
@@ -88,14 +155,29 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
   // --- Grants ---
 
   fastify.get('/gatekeeper/grants', async (request, reply) => {
-    const qs = new URLSearchParams(request.query).toString();
-    const grantPath = qs ? `/api/grants?${qs}` : '/api/grants';
-    const { statusCode, data } = await proxy('GET', grantPath);
+    const { statusCode, data } = await proxy('GET', withQuery('/api/grants', request));
     return reply.code(statusCode).send(data);
   });
 
+  // A plugin grant with `context.roles` is an entitlement: its roles must be
+  // the plugin's (400 otherwise), and go on sorted, without repeats.
   fastify.post('/gatekeeper/grants', async (request, reply) => {
-    const { statusCode, data } = await proxy('POST', '/api/grants', request.body);
+    let body;
+    try {
+      body = await checkProxiedGrant(request.body);
+    } catch (err) {
+      if (!Number.isInteger(err.statusCode)) throw err;
+      return reply.code(err.statusCode).send({
+        error: err.message,
+        ...(err.code ? { code: err.code } : {}),
+        ...(Array.isArray(err.unknown) ? { unknown: err.unknown } : {}),
+      });
+    }
+    const usernames =
+      body?.principalType === 'user' && typeof body.principalId === 'string'
+        ? [body.principalId]
+        : [];
+    const { statusCode, data } = await proxyGive(request, usernames, 'POST', '/api/grants', body);
     return reply.code(statusCode).send(data);
   });
 
@@ -107,7 +189,8 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
 
   fastify.delete('/gatekeeper/grants/:grantId', async (request, reply) => {
     const { grantId } = request.params;
-    const { statusCode, data } = await proxy(
+    const { statusCode, data } = await proxyChange(
+      request,
       'DELETE',
       `/api/grants/${encodeURIComponent(grantId)}`,
     );
@@ -117,9 +200,11 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
   // Bulk-revoke every grant for a principal. Forwarded to gatekeeper as
   // DELETE /api/grants?principalType=...&principalId=...
   fastify.delete('/gatekeeper/grants', async (request, reply) => {
-    const qs = new URLSearchParams(request.query).toString();
-    const grantPath = qs ? `/api/grants?${qs}` : '/api/grants';
-    const { statusCode, data } = await proxy('DELETE', grantPath);
+    const { statusCode, data } = await proxyChange(
+      request,
+      'DELETE',
+      withQuery('/api/grants', request),
+    );
     return reply.code(statusCode).send(data);
   });
 
@@ -147,14 +232,20 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
   });
 
   fastify.get('/gatekeeper/access-log', async (request, reply) => {
-    const qs = new URLSearchParams(request.query).toString();
-    const logPath = qs ? `/api/access-log?${qs}` : '/api/access-log';
-    const { statusCode, data } = await proxy('GET', logPath);
+    const { statusCode, data } = await proxy('GET', withQuery('/api/access-log', request));
     return reply.code(statusCode).send(data);
   });
 
+  // DELETE clears the whole log. One username's rows (before a time, when
+  // given) are purged by POST with `{ username, before? }` in the body — a
+  // username in a query string would be in every access log on the way.
   fastify.delete('/gatekeeper/access-log', async (_request, reply) => {
     const { statusCode, data } = await proxy('DELETE', '/api/access-log');
     return reply.code(statusCode).send(data);
   });
+
+  fastify.post('/gatekeeper/access-log/purge', async (request, reply) => {
+    const { statusCode, data } = await proxy('POST', '/api/access-log/purge', request.body);
+    return reply.code(statusCode).send(data);
+  });
 }

package/vendor/serverd/src/routes/management/identity-directory.js

@@ -0,0 +1,79 @@
+/**
+ * The user directory (slice 6), admin only:
+ *
+ *   GET  /identity/directory                 every user the directory knows —
+ *                                            tombstones and erased ones too — with
+ *                                            the plugins that have not yet
+ *                                            acknowledged an erasure (those the
+ *                                            feed does not reach now marked)
+ *   POST /identity/directory/:userId/erase   erase a removed user
+ *
+ * Business logic lives in `lib/directory.js` and `lib/identity-sync.js`.
+ */
+
+import { z } from 'zod';
+import { IDENTITY_UUID_REGEX } from '@lamalibre/lamaste';
+import { actorFromRequest } from '../../lib/actor.js';
+import {
+  eraseDirectoryUser,
+  getDirectoryId,
+  listDirectoryUsers,
+  listErasures,
+} from '../../lib/directory.js';
+import { pendingErasuresByUser } from '../../lib/identity-sync.js';
+
+const UserIdParamSchema = z.object({
+  userId: z.string().regex(IDENTITY_UUID_REGEX, 'userId is a directory user id'),
+});
+
+export default async function identityDirectoryRoutes(fastify, _opts) {
+  fastify.get('/identity/directory', { preHandler: fastify.requireRole(['admin']) }, async () => {
+    const [directoryId, users, erasures, pending] = await Promise.all([
+      getDirectoryId(),
+      listDirectoryUsers(),
+      listErasures(),
+      pendingErasuresByUser(),
+    ]);
+    return {
+      directoryId,
+      users: users.map((user) => {
+        const waiting = pending.get(user.userId) ?? [];
+        return {
+          ...user,
+          erasure: erasures.get(user.userId) ?? null,
+          pendingErasures: waiting.map((p) => p.plugin),
+          // Among them, the plugins the feed does not reach now (uninstalled,
+          // or no longer declaring identity) whose data an agent keeps.
+          pendingErasuresInactive: waiting.filter((p) => p.inactive).map((p) => p.plugin),
+        };
+      }),
+    };
+  });
+
+  fastify.post(
+    '/identity/directory/:userId/erase',
+    {
+      preHandler: fastify.requireRole(['admin']),
+      // Moderate tier, as deleting a user: destructive, and it calls Gatekeeper.
+      config: { rateLimit: { max: 30, timeWindow: '1 minute' } },
+    },
+    async (request, reply) => {
+      const { userId } = UserIdParamSchema.parse(request.params);
+      try {
+        const erased = await eraseDirectoryUser(userId, {
+          actor: actorFromRequest(request),
+          logger: request.log,
+        });
+        return { ok: true, ...erased };
+      } catch (err) {
+        if (Number.isInteger(err.statusCode)) {
+          return reply
+            .code(err.statusCode)
+            .send({ error: err.message, ...(err.code ? { code: err.code } : {}) });
+        }
+        request.log.error(err, 'Failed to erase the user');
+        return reply.code(500).send({ error: 'Failed to erase the user' });
+      }
+    },
+  );
+}

package/vendor/serverd/src/routes/management/invitations.js

@@ -1,20 +1,21 @@
 import crypto from 'node:crypto';
 import { z } from 'zod';
-import { readInvitations, writeInvitations } from '../../lib/state.js';
+import { USERNAME_MAX_LENGTH, USERNAME_MIN_LENGTH, USERNAME_REGEX } from '@lamalibre/lamaste';
+import { readInvitations, withInvitationsLock, writeInvitations } from '../../lib/state.js';
 import { readUsersRaw } from '../../lib/authelia.js';
 import { getConfig } from '../../lib/config.js';
 
 const IdParamSchema = z.object({ id: z.string().uuid() });
 
 const CreateInvitationSchema = z.object({
+  // Same rule as the users API (core's USERNAME_REGEX). A leading "-" would
+  // read as a flag to Authelia's CLI when a TOTP secret is stored for the user.
   username: z
     .string()
-    .min(2)
-    .max(32)
+    .min(USERNAME_MIN_LENGTH)
+    .max(USERNAME_MAX_LENGTH)
     .regex(
-      // Same rule as the users API. A leading "-" would read as a flag to
-      // Authelia's CLI when a TOTP secret is stored for the user.
-      /^[a-z0-9][a-z0-9_-]*$/,
+      USERNAME_REGEX,
       'Username must start with a lowercase letter or digit and may contain underscores or hyphens',
     ),
   email: z.string().email(),
@@ -67,50 +68,55 @@ export default async function invitationRoutes(fastify, _opts) {
         return reply.code(409).send({ error: 'Username already exists as an Authelia user' });
       }
 
-      // Check username doesn't already have a pending invitation
-      let invitations;
-      try {
-        invitations = await readInvitations();
-      } catch (err) {
-        request.log.error(err, 'Failed to read invitations');
-        return reply.code(500).send({ error: 'Failed to read invitations' });
-      }
+      // The pending-invitation check and the write hold the invitations
+      // lock: nothing else may rewrite the file between them.
+      const outcome = await withInvitationsLock(async () => {
+        let invitations;
+        try {
+          invitations = await readInvitations();
+        } catch (err) {
+          request.log.error(err, 'Failed to read invitations');
+          return { status: 500, body: { error: 'Failed to read invitations' } };
+        }
 
-      const now = new Date();
-      const existingPending = invitations.find(
-        (inv) => inv.username === body.username && !inv.used && new Date(inv.expiresAt) > now,
-      );
-      if (existingPending) {
-        return reply
-          .code(409)
-          .send({ error: 'A pending invitation already exists for this username' });
-      }
+        const now = new Date();
+        const existingPending = invitations.find(
+          (inv) => inv.username === body.username && !inv.used && new Date(inv.expiresAt) > now,
+        );
+        if (existingPending) {
+          return {
+            status: 409,
+            body: { error: 'A pending invitation already exists for this username' },
+          };
+        }
+
+        const expiresAt = new Date(now.getTime() + body.expiresInDays * 24 * 60 * 60 * 1000);
+        const invitation = {
+          id: crypto.randomUUID(),
+          token: crypto.randomBytes(32).toString('hex'),
+          username: body.username,
+          email: body.email,
+          groups: body.groups,
+          createdAt: now.toISOString(),
+          expiresAt: expiresAt.toISOString(),
+          used: false,
+          acceptedAt: null,
+        };
+        invitations.push(invitation);
+
+        try {
+          await writeInvitations(invitations);
+        } catch (err) {
+          request.log.error(err, 'Failed to write invitations');
+          return { status: 500, body: { error: 'Failed to save invitation' } };
+        }
+        return { status: 201, invitation };
+      });
+      if (outcome.status !== 201) return reply.code(outcome.status).send(outcome.body);
 
+      const { invitation } = outcome;
+      const { token } = invitation;
       const config = getConfig();
-      const token = crypto.randomBytes(32).toString('hex');
-      const expiresAt = new Date(now.getTime() + body.expiresInDays * 24 * 60 * 60 * 1000);
-
-      const invitation = {
-        id: crypto.randomUUID(),
-        token,
-        username: body.username,
-        email: body.email,
-        groups: body.groups,
-        createdAt: now.toISOString(),
-        expiresAt: expiresAt.toISOString(),
-        used: false,
-        acceptedAt: null,
-      };
-
-      invitations.push(invitation);
-
-      try {
-        await writeInvitations(invitations);
-      } catch (err) {
-        request.log.error(err, 'Failed to write invitations');
-        return reply.code(500).send({ error: 'Failed to save invitation' });
-      }
-
       const inviteUrl = config.domain ? `https://auth.${config.domain}/invite/${token}` : null;
 
       return reply.code(201).send({
@@ -138,27 +144,31 @@ export default async function invitationRoutes(fastify, _opts) {
     async (request, reply) => {
       const { id } = IdParamSchema.parse(request.params);
 
-      let invitations;
-      try {
-        invitations = await readInvitations();
-      } catch (err) {
-        request.log.error(err, 'Failed to read invitations');
-        return reply.code(500).send({ error: 'Failed to read invitations' });
-      }
-
-      const index = invitations.findIndex((inv) => inv.id === id);
-      if (index === -1) {
-        return reply.code(404).send({ error: 'Invitation not found' });
-      }
-
-      invitations.splice(index, 1);
-
-      try {
-        await writeInvitations(invitations);
-      } catch (err) {
-        request.log.error(err, 'Failed to write invitations');
-        return reply.code(500).send({ error: 'Failed to revoke invitation' });
-      }
+      const outcome = await withInvitationsLock(async () => {
+        let invitations;
+        try {
+          invitations = await readInvitations();
+        } catch (err) {
+          request.log.error(err, 'Failed to read invitations');
+          return { status: 500, body: { error: 'Failed to read invitations' } };
+        }
+
+        const index = invitations.findIndex((inv) => inv.id === id);
+        if (index === -1) {
+          return { status: 404, body: { error: 'Invitation not found' } };
+        }
+
+        invitations.splice(index, 1);
+
+        try {
+          await writeInvitations(invitations);
+        } catch (err) {
+          request.log.error(err, 'Failed to write invitations');
+          return { status: 500, body: { error: 'Failed to revoke invitation' } };
+        }
+        return { status: 200 };
+      });
+      if (outcome.status !== 200) return reply.code(outcome.status).send(outcome.body);
 
       return { ok: true };
     },