@lamalibre/create-lamaste 4.5.0 → 4.7.0

package/vendor/serverd/src/lib/plugins.js

@@ -22,6 +22,7 @@ import {
   normalizeIdentityBlock,
   pluginHostCapability,
   validateManifest as coreValidateManifest,
+  validateInstalledManifest,
 } from '@lamalibre/lamaste';
 import { listRegisteredSubScopeNames } from './tickets.js';
 import { getStateDb } from './state-db.js';
@@ -31,6 +32,7 @@ import { RegistryCredentialError } from '@lamalibre/lamaste/server';
 import {
   bareLamalibrePackageName,
   installedHookEntrySha256,
+  installedWebTreeSha256,
   pinAgentHalf,
 } from './plugin-packages.js';
 
@@ -72,8 +74,9 @@ async function getStmts() {
       INSERT INTO plugins
         (name, route, display_name, package_name, version, description, capabilities,
          packages, panel, config, modes, hosting, agent, hooks, hooks_entry_sha256,
-         agent_half_pin, settings, identity, status, installed_at, enabled_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+         agent_half_pin, settings, identity, user_surface, web_tree_sha256, status,
+         installed_at, enabled_at, domain)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `),
     deleteByName: db.prepare('DELETE FROM plugins WHERE name = ?'),
     // The plugin's audience and the state of its identity feed
@@ -141,7 +144,11 @@ function rowToPlugin(row) {
   if (row.agent_half_pin != null) entry.agentHalfPin = JSON.parse(row.agent_half_pin);
   if (row.settings != null) entry.settings = JSON.parse(row.settings);
   if (row.identity != null) entry.identity = JSON.parse(row.identity);
+  if (row.user_surface != null) entry.userSurface = JSON.parse(row.user_surface);
+  if (row.web_tree_sha256 != null) entry.webTreeSha256 = row.web_tree_sha256;
   if (row.enabled_at != null) entry.enabledAt = row.enabled_at;
+  // The domain the plugin belongs to; null: the primary (lib/domains.js).
+  entry.domain = row.domain ?? null;
   return entry;
 }
 
@@ -224,9 +231,12 @@ export async function writePlugins(data) {
         nullableJson(p.agentHalfPin),
         nullableJson(p.settings),
         nullableJson(p.identity),
+        nullableJson(p.userSurface),
+        nullableString(p.webTreeSha256),
         p.status,
         p.installedAt,
         nullableString(p.enabledAt),
+        nullableString(p.domain),
       );
     }
     s.commit.run();
@@ -457,6 +467,17 @@ export function installPlugin(packageName, logger) {
       throw Object.assign(new Error(err.message), { statusCode: err.statusCode || 400 });
     }
 
+    // A web surface: its tree must be in the package and keep every rule of
+    // a web tree; its digest goes into the approval digest, and the relay
+    // serves only a copy that matches it.
+    let webTreeSha256 = null;
+    try {
+      webTreeSha256 = await installedWebTreeSha256(packageName, manifest);
+    } catch (err) {
+      await discardPackage();
+      throw Object.assign(new Error(err.message), { statusCode: err.statusCode || 400 });
+    }
+
     // An agent half Lamaste installs: its tarball's integrity is pinned now,
     // from the registry this install used — the approval covers it and the
     // agent installs only a tarball that matches it.
@@ -508,6 +529,8 @@ export function installPlugin(packageName, logger) {
       agentHalfPin,
       settings: manifest.settings,
       identity: identityOf(manifest),
+      userSurface: manifest.userSurface,
+      webTreeSha256,
       status: 'disabled',
       installedAt: new Date().toISOString(),
     };
@@ -536,9 +559,13 @@ export function installPlugin(packageName, logger) {
         nullableJson(entry.agentHalfPin),
         nullableJson(entry.settings),
         nullableJson(entry.identity),
+        nullableJson(entry.userSurface),
+        nullableString(entry.webTreeSha256),
         entry.status,
         entry.installedAt,
         null,
+        // A plugin installed now belongs to the primary domain (lib/plugin-domain.js moves it).
+        null,
       );
       s.commit.run();
     } catch (err) {
@@ -601,6 +628,13 @@ export function uninstallPlugin(name, logger) {
     const { removeRelayHooks } = await import('./plugin-hooks.js');
     await removeRelayHooks(name, logger);
 
+    // The OIDC clients it declares, read while its manifest is installed:
+    // their grants go with it below.
+    const { collectPluginOidcClients } = await import('./plugin-oidc.js');
+    const clientIds = (await collectPluginOidcClients().catch(() => []))
+      .filter((c) => c.plugin === name)
+      .map((c) => c.id);
+
     // Uninstall the npm package
     logger.info({ name, packageName: plugin.packageName }, 'Uninstalling plugin package');
     await execa('npm', ['uninstall', plugin.packageName], {
@@ -674,6 +708,24 @@ export function uninstallPlugin(name, logger) {
 
     logger.info({ name }, 'Plugin uninstalled');
     await syncOidcClientsBestEffort(logger);
+
+    // Grants on its OIDC clients end with it: client ids are chosen, not
+    // random, so a later install of the plugin (or another declaring the
+    // same id) would otherwise admit whoever was granted before.
+    const { revokeOidcClientGrants } = await import('./owned-groups.js');
+    const revoked = await revokeOidcClientGrants(clientIds);
+    if (!revoked.ok) {
+      logger.warn(
+        { name, err: revoked.error },
+        "Grants on the uninstalled plugin's OIDC clients stayed — revoke them in Gatekeeper",
+      );
+    } else if (revoked.revoked > 0) {
+      logger.info({ name, revoked: revoked.revoked }, 'Grants on its OIDC clients revoked');
+      const { syncDomainAccess } = await import('./domains.js');
+      await syncDomainAccess({ logger }).catch((err) => {
+        logger.warn({ err: err.message }, 'Rendering domain access after an uninstall failed');
+      });
+    }
     return { ok: true, name };
   });
 }
@@ -684,7 +736,7 @@ const updateRowSql = `
   UPDATE plugins SET
     display_name = ?, version = ?, description = ?, capabilities = ?, packages = ?, panel = ?,
     config = ?, modes = ?, hosting = ?, agent = ?, hooks = ?, hooks_entry_sha256 = ?,
-    agent_half_pin = ?, settings = ?, identity = ?
+    agent_half_pin = ?, settings = ?, identity = ?, user_surface = ?, web_tree_sha256 = ?
   WHERE name = ?`;
 
 /**
@@ -698,8 +750,16 @@ const updateRowSql = `
  * beside it, and a secret whose field became a plain value is no longer
  * reported set. The identity block is stored normalized; the update's
  * caller recomputes the audiences once the version is in place.
+ * `webTreeSha256` is the digest of the version's web tree, read from the
+ * installed package (null when it declares no web surface).
  */
-export async function writePluginRow(name, manifest, hooksEntrySha256, agentHalfPin) {
+export async function writePluginRow(
+  name,
+  manifest,
+  hooksEntrySha256,
+  agentHalfPin,
+  webTreeSha256 = null,
+) {
   const s = await getStmts();
   const { prunedSettingsCache } = await import('./plugin-settings.js');
   s.begin.run();
@@ -723,6 +783,8 @@ export async function writePluginRow(name, manifest, hooksEntrySha256, agentHalf
         nullableJson(agentHalfPin),
         nullableJson(manifest.settings),
         nullableJson(identityOf(manifest)),
+        nullableJson(manifest.userSurface),
+        nullableString(webTreeSha256),
         name,
       );
     const pruned = prunedSettingsCache(
@@ -750,12 +812,21 @@ export async function writePluginRow(name, manifest, hooksEntrySha256, agentHalf
 
 /**
  * Install `<packageName>@<version>` over the installed copy and read it
- * back: the validated manifest and its relay entry module's SHA-256. The
+ * back: the validated manifest, its relay entry module's SHA-256 and its
+ * web tree's digest. The
  * row is not touched — the caller compares the result with what was
  * reviewed and then writes it. Refuses a package whose manifest names
- * another plugin.
+ * another plugin. `restoring` puts back the version that was installed (an
+ * update's revert): its manifest is read as an installed one, so a rule
+ * tightened since it was installed does not leave the revert half done.
  */
-export function replacePluginPackage(name, packageName, version, logger) {
+export function replacePluginPackage(
+  name,
+  packageName,
+  version,
+  logger,
+  { restoring = false } = {},
+) {
   return withPluginLock(async () => {
     const bare = bareLamalibrePackageName(packageName);
     const spec = `${bare}@${version}`;
@@ -777,7 +848,8 @@ export function replacePluginPackage(name, packageName, version, logger) {
     }
     const require = createRequire(`${STATE_DIR}/`);
     const manifestPath = require.resolve(`${bare}/lamaste-plugin.json`);
-    const manifest = validateManifest(JSON.parse(await readFile(manifestPath, 'utf-8')));
+    const raw = JSON.parse(await readFile(manifestPath, 'utf-8'));
+    const manifest = restoring ? validateInstalledManifest(raw) : validateManifest(raw);
     if (manifest.name !== name) {
       throw Object.assign(new Error(`${spec} is plugin "${manifest.name}", not "${name}"`), {
         statusCode: 400,
@@ -790,7 +862,8 @@ export function replacePluginPackage(name, packageName, version, logger) {
       );
     }
     const hooksEntrySha256 = await installedHookEntrySha256(packageName, manifest);
-    return { manifest, hooksEntrySha256 };
+    const webTreeSha256 = await installedWebTreeSha256(packageName, manifest);
+    return { manifest, hooksEntrySha256, webTreeSha256 };
   });
 }
 

package/vendor/serverd/src/lib/registry-credential.js

@@ -57,6 +57,33 @@ export async function writeRegistryCredentialConfig(config) {
   resetRegistryTokenState();
 }
 
+/**
+ * Store `config` as the registry credential: written while its issuer
+ * domain is still an active domain (a domain's removal checks the
+ * credential under the same lock — 400 `unknown_domain` otherwise). When the
+ * registry's domains change (its issuer domain, the domain its host is
+ * under), the tokens of every user who is a member of none of the new ones
+ * are revoked: who may hold a token follows them. Returns the warnings.
+ *
+ * @param {object} config
+ * @param {{ logger?: import('pino').Logger }} [opts]
+ * @returns {Promise<Array<{ step: string, message: string }>>}
+ */
+export async function setRegistryCredential(config, { logger } = {}) {
+  const { registryDomainsOf, revokeRegistryTokensOutside, withActiveDomain } =
+    await import('./domains.js');
+  const issuerDomain = config.auth?.kind === 'oidc' ? config.auth.issuerDomain : undefined;
+  const change = await withActiveDomain(issuerDomain, async () => {
+    const before = await registryDomainsOf(await readRegistryCredentialConfig().catch(() => null));
+    await writeRegistryCredentialConfig(config);
+    const after = await registryDomainsOf(config);
+    const same = after.length === before.length && after.every((d) => before.includes(d));
+    return { changed: !same, after };
+  });
+  if (!change.changed) return [];
+  return revokeRegistryTokensOutside(change.after, config, logger);
+}
+
 export async function clearRegistryCredentialConfig() {
   const removed = await clearCore(STATE_DIR);
   resetRegistryTokenState();
@@ -70,9 +97,9 @@ export function resetRegistryTokenState() {
 }
 
 /**
- * What the core needs to run the OIDC chain for a credential: the relay
- * domain and the `lamaste-server` client secret. Pasted-token credentials
- * need nothing.
+ * What the core needs to run the OIDC chain for a credential: the primary
+ * domain (the issuer when the credential names no `issuerDomain`) and the
+ * `lamaste-server` client secret. Pasted-token credentials need nothing.
  * @param {{ auth: { kind: string } }} config
  */
 async function oidcDeps(config) {
@@ -166,10 +193,16 @@ export async function acquireAgentToken(agentLabel) {
  * @param {string} username
  * @param {{ before: string[], after: string[] } | { deleted: true }} change
  * @param {import('pino').Logger | undefined} log
- * @param {{ userId?: string | null }} [who]
+ * @param {{ userId?: string | null, config?: object }} [who] `config`: the credential
+ *   already read (a batch of revocations reads it once)
  */
-export async function revokeUserRegistryTokens(username, change, log, { userId = null } = {}) {
-  const config = await readRegistryCredentialConfig();
+export async function revokeUserRegistryTokens(
+  username,
+  change,
+  log,
+  { userId = null, config: given } = {},
+) {
+  const config = given ?? (await readRegistryCredentialConfig());
   if (!config) return null;
 
   const lost =

package/vendor/serverd/src/lib/services.js

@@ -1,4 +1,5 @@
 import { execa } from 'execa';
+import { autheliaReady } from '@lamalibre/lamaste/server';
 
 export const ALLOWED_SERVICES = ['nginx', 'chisel', 'authelia', 'lamalibre-lamaste-serverd'];
 
@@ -120,7 +121,6 @@ export async function executeServiceAction(name, action) {
 
   try {
     await execa('sudo', ['systemctl', action, name], { timeout: 30_000 });
-    return { ok: true, name, action };
   } catch (err) {
     const details = err.stderr || err.message;
     const error = new Error(`Failed to ${action} ${name}`);
@@ -128,4 +128,12 @@ export async function executeServiceAction(name, action) {
     error.details = details;
     throw error;
   }
+  // systemctl returns when Authelia's process is spawned, before it serves
+  // requests: the action is done once it does.
+  if (name === 'authelia' && action !== 'stop' && !(await autheliaReady(execa))) {
+    const error = new Error(`Authelia is not serving requests after ${action}`);
+    error.statusCode = 500;
+    throw error;
+  }
+  return { ok: true, name, action };
 }

package/vendor/serverd/src/lib/state.js

@@ -48,6 +48,16 @@ export async function writeTunnels(tunnels) {
   await fd.close();
 
   await rename(tmpPath, filePath);
+  await hostsChanged();
+}
+
+/**
+ * A tunnel or a site changed: the hosts that name external members are
+ * rendered again shortly (lib/domains.js `scheduleHostRender`).
+ */
+async function hostsChanged() {
+  const { scheduleHostRender } = await import('./domains.js');
+  scheduleHostRender();
 }
 
 function sitesPath() {
@@ -93,6 +103,25 @@ export async function writeSites(sites) {
   await fd.close();
 
   await rename(tmpPath, filePath);
+  await hostsChanged();
+}
+
+/** Serializes every read-modify-write of sites.json in this process. */
+const sitesMutex = new PromiseChainMutex();
+
+/**
+ * Run `fn` holding the sites lock: a read of sites.json, the decisions made
+ * on it and the write that follows must not interleave with another. A
+ * workflow that gives a site a hostname (creating it, adding an alias,
+ * taking a tunnel's host) takes core's tunnel lock first, then this one —
+ * always in that order — so a site and a tunnel never take one name at once.
+ *
+ * @template T
+ * @param {() => Promise<T>} fn
+ * @returns {Promise<T>}
+ */
+export function withSitesLock(fn) {
+  return sitesMutex.run(fn);
 }
 
 function invitationsPath() {

package/vendor/serverd/src/lib/tunnel-deps.js

@@ -7,8 +7,7 @@
 
 import {
   writePublicVhost,
-  writeAuthenticatedVhost,
-  writeRestrictedVhost,
+  writeGatekeeperVhost,
   removeAppVhost,
   enableAppVhost,
   disableAppVhost,
@@ -23,8 +22,7 @@ import { readTunnels, writeTunnels } from './state.js';
 
 export const tunnelNginxDeps = Object.freeze({
   writePublicVhost,
-  writeAuthenticatedVhost,
-  writeRestrictedVhost,
+  writeGatekeeperVhost,
   writeAgentPanelVhost,
   removeAppVhost,
   removeAgentPanelVhost,

package/vendor/serverd/src/lib/user-surface.js

@@ -45,8 +45,11 @@ import {
   RELAY_PANEL_AUDIENCE,
   RELAY_PANEL_PORT,
   isAgentHostedPlugin,
+  siteUserSurfaceRoute,
   tunnelUserSurfaceRoutes,
+  userSurfaceHostServing,
   userSurfaceHostingAgent,
+  userSurfaceHosts,
   verifyRelayAssertion,
 } from '@lamalibre/lamaste';
 import {
@@ -54,15 +57,17 @@ import {
   TunnelError,
   bindUserSurface,
   releaseUserSurfaceRoute,
+  tunnelHost,
   unbindUserSurface,
 } from '@lamalibre/lamaste/server';
 import { httpError } from './app-error.js';
 import { recordAuditBestEffort } from './audit.js';
 import { getConfig } from './config.js';
+import { pluginDomainName } from './domains.js';
 import { installedVersionApproved } from './plugin-hooks.js';
 import { findPluginByRoute } from './plugins.js';
 import { relaySigner } from './relay-signing.js';
-import { readTunnels } from './state.js';
+import { readSites, readTunnels } from './state.js';
 import { tunnelCertbotDeps, tunnelNginxDeps, tunnelStateDeps } from './tunnel-deps.js';
 
 /**
@@ -102,7 +107,7 @@ export const USER_SURFACE_ROUTE_CONFIG = Object.freeze({
  * @param {readonly object[]} tunnels
  * @returns {Promise<string | null>}
  */
-async function hostingAgentOf(plugin, tunnels) {
+export async function hostingAgentOf(plugin, tunnels) {
   if (!plugin.route) return null;
   const { ownHosting } = await import('./plugin-hosting.js');
   const record = await ownHosting(plugin);
@@ -160,7 +165,7 @@ async function routeServing(route, agentLabel, tunnels) {
  * @param {object} plugin
  * @param {readonly object[]} tunnels the tunnel state
  */
-async function internalTunnelBodyLimit(plugin, tunnels) {
+export async function internalTunnelBodyLimit(plugin, tunnels) {
   const { ownHosting } = await import('./plugin-hosting.js');
   const record = await ownHosting(plugin);
   if (!record) return TUNNEL_MAX_BODY_MB.default;
@@ -222,8 +227,8 @@ export async function withUserSurfaceStatus(tunnel) {
 // ---------------------------------------------------------------------------
 
 /**
- * What core's binding workflows need from the panel — among them its domain
- * and Let's Encrypt email, which a vhost rewrite needs.
+ * What core's binding workflows need from the panel — among them its Let's
+ * Encrypt email, which a vhost rewrite needs.
  */
 function bindingOptions(id, route, logger) {
   const config = getConfig();
@@ -233,7 +238,6 @@ function bindingOptions(id, route, logger) {
   return {
     id,
     route,
-    domain: config.domain,
     email: config.email,
     nginx: tunnelNginxDeps,
     certbot: tunnelCertbotDeps,
@@ -287,6 +291,34 @@ async function assertBindableRoute(route) {
       'INVALID_SETTING',
     );
   }
+  // A route is served on one host at most: the plugin's own site, when it
+  // has one, is that host.
+  if ((await readSites()).some((site) => siteUserSurfaceRoute(site) === route)) {
+    throw new TunnelError(
+      `Plugin "${plugin.name}" has a web surface — its user surface is served there`,
+      'INVALID_SETTING',
+    );
+  }
+}
+
+/**
+ * Refuse binding tunnel `id` as the user surface of the plugin at `route`
+ * when the tunnel's hostname is not on the plugin's domain (400
+ * `not_plugin_domain`): a plugin's users are its domain's members.
+ */
+async function assertOnPluginDomain(id, route) {
+  const tunnel = (await readTunnels()).find((t) => t.id === id);
+  const host = tunnel ? tunnelHost(tunnel) : null;
+  if (!host) return; // core refuses a tunnel without a hostname
+  const plugin = await findPluginByRoute(route);
+  const domain = await pluginDomainName(plugin);
+  if (host.domain !== domain) {
+    throw httpError(
+      `The tunnel is on ${host.domain}; the plugin holding '${route}' belongs to ${domain}`,
+      400,
+      { code: 'not_plugin_domain' },
+    );
+  }
 }
 
 /** Whether an installed agent-hosted plugin holds `route`. */
@@ -318,7 +350,11 @@ async function isBindableRoute(route) {
 export async function bindTunnelUserSurface(id, route, { actor, logger }) {
   const result = await bindUserSurface({
     ...bindingOptions(id, route, logger),
-    assertRoute: assertBindableRoute,
+    // Under the tunnel lock, as the plugin's domain changes (lib/domains.js).
+    assertRoute: async (r) => {
+      await assertBindableRoute(r);
+      await assertOnPluginDomain(id, r);
+    },
   });
   if (result.changed && !(await isBindableRoute(route))) {
     await pruneUserSurfaceBindings(route, { plugin: null, logger });
@@ -413,7 +449,8 @@ export async function refreshTunnelUserSurfaceVhosts(ids, logger) {
  * Whether plugin `route`'s user surface is served may have changed — its
  * version was approved, updated or reverted, it was hosted or unhosted (the
  * body limit is its internal tunnel's): bring the vhosts of the tunnels it
- * is bound to in line. Best effort — logged, never thrown; the panel's
+ * is bound to in line, and its web surface — the approved tree served, the
+ * vhost of the site it owns (`lib/web-surface.js`). Best effort — logged, never thrown; the panel's
  * start reconciles every vhost again.
  *
  * @param {string | null | undefined} route
@@ -429,6 +466,9 @@ export async function refreshUserSurfaceVhosts(route, logger) {
       'Could not bring the user-surface vhosts of a plugin in line',
     );
   }
+  // Its web surface too: the approved tree served, the site's vhost in line.
+  const { refreshWebSurface } = await import('./web-surface.js');
+  await refreshWebSurface(route, logger);
 }
 
 /**
@@ -491,6 +531,10 @@ export async function releasePluginUserSurface(route, { plugin, logger }) {
       'Could not release the user surface of an uninstalled plugin',
     );
   }
+  // The site it owns stays, answering 503 until the plugin is back (or an
+  // administrator deletes it): its vhost goes in line.
+  const { refreshWebSurface } = await import('./web-surface.js');
+  await refreshWebSurface(route, logger);
 }
 
 // ---------------------------------------------------------------------------
@@ -560,33 +604,35 @@ export async function verifyUserSurfaceRelay(request) {
 }
 
 /**
- * The enabled tunnel whose host serves `route`'s user surface, or null:
- * bound to the route, and carried by the agent hosting its plugin — the
- * check of every request, whatever a vhost not yet re-rendered still
- * routes here.
+ * The enabled host that serves `route`'s user surface, or null — the check
+ * of every request, whatever a vhost not yet re-rendered still routes here:
+ * a tunnel bound to the route and carried by the agent hosting its plugin,
+ * or the site the plugin owns while its web surface is served
+ * (`lib/web-surface.js`). Read with core `userSurfaceHosts`, as Gatekeeper
+ * reads it, so a route two hosts would serve is served by neither.
  *
  * @param {string} route
+ * @returns {Promise<import('@lamalibre/lamaste').UserSurfaceHost | null>}
  */
-async function servedUserSurfaceTunnel(route) {
-  const tunnels = await readTunnels();
-  const tunnel =
-    tunnels.find(
-      (t) =>
-        t.enabled !== false &&
-        typeof t.fqdn === 'string' &&
-        tunnelUserSurfaceRoutes(t).includes(route),
-    ) ?? null;
-  if (!tunnel) return null;
+async function servedUserSurfaceHost(route) {
+  const [tunnels, sites] = await Promise.all([readTunnels(), readSites()]);
+  const host = userSurfaceHostServing(userSurfaceHosts(tunnels, sites), route);
+  if (!host) return null;
+  if (host.kind === 'site') {
+    const { webSurfaceServing } = await import('./web-surface.js');
+    return (await webSurfaceServing(route, tunnels)).served ? host : null;
+  }
   const plugin = await findPluginByRoute(route);
   if (!plugin) return null;
+  const tunnel = tunnels.find((t) => t.id === host.id);
   const hosting = await hostingAgentOf(plugin, tunnels);
-  return hosting !== null && tunnel.agentLabel === hosting ? tunnel : null;
+  return hosting !== null && tunnel?.agentLabel === hosting ? host : null;
 }
 
 /**
  * The forward target of `route`'s user surface (core `userSurfacePlugin`'s
- * `resolveTarget`): null when no enabled tunnel its hosting agent carries
- * is bound to it, else what the admin forwarder resolves — the hosting's
+ * `resolveTarget`): null when no host serves it (see
+ * {@link servedUserSurfaceHost}), else what the admin forwarder resolves — the hosting's
  * internal tunnel, or why not (not found, disabled, not hosted) — and
  * `down` while the hosting's health is down: nothing of a user's request
  * reaches the relay-loopback port then (503).
@@ -594,7 +640,7 @@ async function servedUserSurfaceTunnel(route) {
  * @param {string} route
  */
 export async function resolveUserSurfaceTarget(route) {
-  if (!(await servedUserSurfaceTunnel(route))) return null;
+  if (!(await servedUserSurfaceHost(route))) return null;
   const { resolveForwardTarget } = await import('./plugin-hosting.js');
   return resolveForwardTarget(route);
 }
@@ -602,15 +648,15 @@ export async function resolveUserSurfaceTarget(route) {
 /**
  * The origin a request that may change something on `route`'s user surface
  * must come from (core `userSurfacePlugin`'s `originFor`): the bound host,
- * as the tunnel state names it — never the request's `Host`. Null when no
- * enabled tunnel its hosting agent carries is bound to the route.
+ * as the state names it — never the request's `Host`. Null when no host
+ * serves the route.
  *
  * @param {string} route
  * @returns {Promise<string | null>}
  */
 export async function userSurfaceOrigin(route) {
-  const tunnel = await servedUserSurfaceTunnel(route);
-  return tunnel ? `https://${tunnel.fqdn.toLowerCase()}` : null;
+  const host = await servedUserSurfaceHost(route);
+  return host ? `https://${host.fqdn}` : null;
 }
 
 // ---------------------------------------------------------------------------
@@ -702,7 +748,7 @@ export async function sweepOpenUserSurfaceResponses(logger) {
       const { route, caller } = response;
       let verdict;
       try {
-        if (!served.has(route)) served.set(route, (await servedUserSurfaceTunnel(route)) !== null);
+        if (!served.has(route)) served.set(route, (await servedUserSurfaceHost(route)) !== null);
         const key = `${route}\n${caller.username}`;
         if (!callers.has(key)) callers.set(key, await resolveUserCaller(route, caller.username));
         const resolution = callers.get(key);

package/vendor/serverd/src/lib/users-lock.js

@@ -0,0 +1,23 @@
+/**
+ * The users lock — the one lock around every read-modify-write of users.yml
+ * and every change of the user directory in this process (core's users
+ * functions take none), and around the changes that must agree with
+ * users.yml's groups: a membership's kind (an external member holds no
+ * Authelia group — lib/domains.js). Taken before the domains lock, never
+ * after it.
+ */
+
+import { PromiseChainMutex } from '@lamalibre/lamaste';
+
+const usersMutex = new PromiseChainMutex();
+
+/**
+ * Run `fn` holding the users lock.
+ *
+ * @template T
+ * @param {() => Promise<T>} fn
+ * @returns {Promise<T>}
+ */
+export function withUsersLock(fn) {
+  return usersMutex.run(fn);
+}