@lamalibre/create-lamaste 4.5.0 → 4.7.0

package/vendor/serverd/src/lib/gatekeeper-client.js

@@ -225,26 +225,53 @@ function groupOf(raw) {
 }
 
 /**
- * Every grant on plugin `route` (`resourceType: 'plugin'`, `resourceId:
- * <route>`) — with roles or without.
+ * Every grant on one resource (`resourceType`, `resourceId`).
  *
- * @param {string} route
+ * @param {string} resourceType
+ * @param {string} resourceId
+ * @returns {Promise<{ ok: true, grants: GatekeeperGrant[] } | Extract<GatekeeperResult, { ok: false }>>}
+ */
+export function listResourceGrants(resourceType, resourceId) {
+  return listGrantsMatching({ resourceType, resourceId });
+}
+
+/**
+ * Every grant on resources of `resourceType` (`tunnel`, `site`,
+ * `oidc-client`, …).
+ *
+ * @param {string} resourceType
  * @returns {Promise<{ ok: true, grants: GatekeeperGrant[] } | Extract<GatekeeperResult, { ok: false }>>}
  */
-export async function listPluginGrants(route) {
-  const qs = new URLSearchParams({ resourceType: 'plugin', resourceId: route }).toString();
+export function listGrantsOfType(resourceType) {
+  return listGrantsMatching({ resourceType });
+}
+
+/** The grants matching `filter` (its fields are Gatekeeper's query filters). */
+async function listGrantsMatching(filter) {
+  const qs = new URLSearchParams(filter).toString();
   const result = await gatekeeperRequest('GET', `/api/grants?${qs}`);
   if (!result.ok) return result;
   if (!isRecord(result.data) || !Array.isArray(result.data.grants)) return malformed('its grants');
   const grants = result.data.grants.map(grantOf);
   if (grants.some((g) => g === null)) return malformed('its grants');
-  // Gatekeeper filters by the query; a grant on anything else is not this plugin's.
+  // Gatekeeper filters by the query; a grant on anything else is not one asked for.
   return {
     ok: true,
-    grants: grants.filter((g) => g.resourceType === 'plugin' && g.resourceId === route),
+    grants: grants.filter((g) => Object.entries(filter).every(([key, value]) => g[key] === value)),
   };
 }
 
+/**
+ * Every grant on plugin `route` (`resourceType: 'plugin'`, `resourceId:
+ * <route>`) — with roles or without.
+ *
+ * @param {string} route
+ * @returns {Promise<{ ok: true, grants: GatekeeperGrant[] } | Extract<GatekeeperResult, { ok: false }>>}
+ */
+export function listPluginGrants(route) {
+  return listResourceGrants('plugin', route);
+}
+
 /**
  * Every Lamaste group with its members.
  *

package/vendor/serverd/src/lib/hook-pipelines.js

@@ -871,8 +871,10 @@ export async function runUninstallPipeline(op, ctx, { force = false } = {}) {
 /**
  * The install pipeline around an upgrade of the relay package (the agent
  * half is already running; its stages go through the tunnel). `apply` is
- * Lamaste's step — install the new package and its hook module; `revert`
- * restores the previous ones. Agent and relay stages see `phase: "upgrade"`.
+ * Lamaste's step — install the new package and its hook module; `serve`,
+ * when given, is the last step (the new version's web tree served, once
+ * every stage passed);
+ * `revert` restores the previous ones. Agent and relay stages see `phase: "upgrade"`.
  *
  * A hosted plugin whose agent half Lamaste installs gets the new version of
  * it first (after the agent's pre stage): the agent's helper installs it
@@ -880,7 +882,7 @@ export async function runUninstallPipeline(op, ctx, { force = false } = {}) {
  * tunnel. A failure after that switch activates the version that ran
  * before (`ctx.previousAgentHalfVersion`).
  */
-export async function runUpgradePipeline(op, ctx, { apply, revert, hosted }) {
+export async function runUpgradePipeline(op, ctx, { apply, serve, revert, hosted }) {
   let applied = false;
   try {
     if (hosted) {
@@ -906,6 +908,9 @@ export async function runUpgradePipeline(op, ctx, { apply, revert, hosted }) {
       await agentStageOrSkip(op, ctx, 'install:post-tunnel', 'upgrade', 'tunnel');
       await relayStageOrSkip(op, ctx, 'install:post-tunnel', 'upgrade');
     }
+    // What the new version serves its users from the relay (its web tree):
+    // the last step, once every stage passed — a failure still reverts.
+    if (serve) await op.step('serve the new web tree', serve);
   } catch (err) {
     op.warn(`Reverting: ${String(err.message ?? err).slice(0, 300)}`);
     try {

package/vendor/serverd/src/lib/identity-sync.js

@@ -77,6 +77,7 @@ import {
 } from './audience.js';
 import { getConfig } from './config.js';
 import { clearPendingPrincipals, getDirectoryId, reconcileDirectory } from './directory.js';
+import { ensurePrimaryDomain, syncDomainAccess } from './domains.js';
 import { installedVersionApproved } from './plugin-hooks.js';
 import { findPlugin, findPluginByRoute, readPlugins } from './plugins.js';
 import { retainedIdentityPositions } from './retained-data.js';
@@ -859,6 +860,9 @@ async function syncDuePlugins(logger) {
 let tickTimer = null;
 let ticking = false;
 
+/** The OIDC sync failure the tick last logged — logged again only when it changes. */
+let lastOidcSyncError = null;
+
 /**
  * One tick: reconcile the directory with users.yml (once onboarding is
  * done), clear the Gatekeeper principals of removed users still pending,
@@ -875,6 +879,37 @@ export async function identityTick(logger) {
       } catch (err) {
         logger?.warn({ err: err.message }, 'Could not reconcile the user directory');
       }
+      // Who may reach each domain, as the directory now says: users adopted
+      // or removed outside Lamaste, and a rendering a failure left behind.
+      try {
+        await ensurePrimaryDomain({ logger });
+        await syncDomainAccess({ logger });
+      } catch (err) {
+        logger?.warn({ err: err.message }, 'Could not render domain access');
+      }
+      // users.yml touched once a minute: a reload Authelia skipped (its
+      // cooldown) or that a restart of the panel cut short is never missing
+      // for longer, and a hand edit gets Lamaste's groups back.
+      try {
+        const { touchUsersFile } = await import('./authelia.js');
+        await touchUsersFile();
+      } catch (err) {
+        logger?.warn({ err: err.message }, 'Could not touch users.yml');
+      }
+      // The OIDC provider too, as the plugins and the members now say: a
+      // plugin moved to another domain whose sync failed is healed here.
+      // Compare-first, so a steady relay writes nothing.
+      try {
+        const { syncOidcClients } = await import('./plugin-oidc.js');
+        await syncOidcClients(logger);
+        lastOidcSyncError = null;
+      } catch (err) {
+        // Once per distinct failure, not every minute.
+        if (err.message !== lastOidcSyncError) {
+          logger?.warn({ err: err.message }, 'Could not sync the OIDC clients');
+        }
+        lastOidcSyncError = err.message;
+      }
     }
     await clearPendingPrincipals({ logger });
     await recomputeAudiences({ logger });

package/vendor/serverd/src/lib/migrations/state/0015_plugin_web_surface.sql

@@ -0,0 +1,14 @@
+-- A plugin's web surface (4.6, slice 7).
+--
+-- user_surface is the manifest's `userSurface` block as the installed
+-- version declares it (JSON; NULL when it declares none): its `web` names
+-- the default subdomain and access mode Lamaste offers for the plugin's own
+-- site and the directory of the server package that holds the shell.
+--
+-- web_tree_sha256 is the digest of that directory's web tree (core
+-- `webTreeManifest`), read from the installed package: it enters the
+-- approval digest, and the relay serves a copy of the tree only when the
+-- copy's own digest equals it. NULL when the version declares no web
+-- surface.
+ALTER TABLE plugins ADD COLUMN user_surface TEXT;
+ALTER TABLE plugins ADD COLUMN web_tree_sha256 TEXT;

package/vendor/serverd/src/lib/migrations/state/0016_domains.sql

@@ -0,0 +1,53 @@
+-- The relay's base domains and who is a member of each (the multi-domain
+-- relay, packages/core/docs/multi-domain-relay-design.md; lib/domains.js).
+--
+-- One domain is the primary: the panel's (panel.json `domain`), inserted at
+-- the first start after onboarding together with every user the directory
+-- holds as its members (lib/domains.js `ensurePrimaryDomain`) — an upgraded
+-- single-domain relay keeps letting everyone in.
+
+-- A base domain:
+--   name          lower case, two labels at least; domains never overlap
+--   is_primary    1 for exactly one row: the panel's domain
+--   status        pending (added, auth.<domain> not yet issued) | active
+--                 (its sign-in, session cookie and members rendered)
+CREATE TABLE domains (
+  name          TEXT PRIMARY KEY,
+  is_primary    INTEGER NOT NULL DEFAULT 0 CHECK (is_primary IN (0, 1)),
+  status        TEXT NOT NULL CHECK (status IN ('pending', 'active')),
+  created_at    TEXT NOT NULL,
+  activated_at  TEXT,
+  CHECK (is_primary = 0 OR status = 'active'),
+  CHECK ((status = 'active') = (activated_at IS NOT NULL))
+);
+CREATE UNIQUE INDEX domains_one_primary ON domains (is_primary) WHERE is_primary = 1;
+
+-- Who may reach a domain: one row per domain and user, by user id (a
+-- re-created username is a new user with no membership). Rows go when the
+-- user is deleted or the domain removed; a disabled user keeps theirs but
+-- is never rendered as a member. Changes take the directory's store-wide
+-- sequence, as plugin audiences do.
+CREATE TABLE domain_members (
+  domain    TEXT NOT NULL REFERENCES domains (name),
+  user_id   TEXT NOT NULL REFERENCES directory_users (user_id),
+  added_at  TEXT NOT NULL,
+  added_by  TEXT NOT NULL,
+  seq       INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY (domain, user_id)
+);
+CREATE INDEX domain_members_user ON domain_members (user_id);
+
+CREATE TRIGGER domain_members_stamp_insert AFTER INSERT ON domain_members
+BEGIN
+  UPDATE directory_counter SET seq = seq + 1 WHERE id = 1;
+  UPDATE domain_members SET seq = (SELECT seq FROM directory_counter WHERE id = 1)
+    WHERE domain = NEW.domain AND user_id = NEW.user_id;
+END;
+CREATE TRIGGER domain_members_stamp_delete AFTER DELETE ON domain_members
+BEGIN
+  UPDATE directory_counter SET seq = seq + 1 WHERE id = 1;
+END;
+
+-- The domain a plugin belongs to — its OIDC clients' `{domain}` and sign-in,
+-- its user and web surfaces, its audience. NULL: the primary domain.
+ALTER TABLE plugins ADD COLUMN domain TEXT;

package/vendor/serverd/src/lib/migrations/state/0017_membership_kind.sql

@@ -0,0 +1,15 @@
+-- The kind of a domain membership (packages/core/docs/external-members-design.md;
+-- lib/domains.js): a `member` reaches what the domain gives its members, an
+-- `external` member only what names them (a grant, a site's listed users, an
+-- OIDC client granted to them). Every membership from before is a member.
+ALTER TABLE domain_members ADD COLUMN kind TEXT NOT NULL DEFAULT 'member'
+  CHECK (kind IN ('member', 'external'));
+
+-- A change of kind takes the directory's store-wide sequence, as an insert does.
+CREATE TRIGGER domain_members_stamp_kind AFTER UPDATE OF kind ON domain_members
+WHEN OLD.kind IS NOT NEW.kind
+BEGIN
+  UPDATE directory_counter SET seq = seq + 1 WHERE id = 1;
+  UPDATE domain_members SET seq = (SELECT seq FROM directory_counter WHERE id = 1)
+    WHERE domain = NEW.domain AND user_id = NEW.user_id;
+END;

package/vendor/serverd/src/lib/migrations/state/0018_domain_group_keys.sql

@@ -0,0 +1,23 @@
+-- Opaque names for the Authelia groups Lamaste owns
+-- (packages/core/docs/external-members-design.md, security review): a
+-- domain's members and external members are `lamaste:m:<key>` and
+-- `lamaste:x:<key>`, with a random key per domain, so an OIDC relying party
+-- that asks for the `groups` claim learns no domain's name. The panel gives
+-- a new domain its key when it inserts it; the trigger is the fallback, and
+-- existing domains get one here.
+ALTER TABLE domains ADD COLUMN group_key TEXT;
+UPDATE domains SET group_key = lower(hex(randomblob(8))) WHERE group_key IS NULL;
+CREATE UNIQUE INDEX domains_group_key ON domains(group_key);
+CREATE TRIGGER domains_group_key_fill AFTER INSERT ON domains
+WHEN NEW.group_key IS NULL
+BEGIN
+  UPDATE domains SET group_key = lower(hex(randomblob(8))) WHERE name = NEW.name;
+END;
+
+-- Domains removed from the relay: hostnames under them are still Lamaste's
+-- groups (a host group left on a user is stripped at the next rendering,
+-- never taken for an administrator's group).
+CREATE TABLE retired_domains (
+  name       TEXT PRIMARY KEY,
+  removed_at TEXT NOT NULL
+);