@lamalibre/create-lamaste 4.5.0 → 4.7.0

package/vendor/serverd/src/middleware/user-access-session.js

@@ -1,6 +1,7 @@
 import fp from 'fastify-plugin';
 import { getConfig } from '../lib/config.js';
 import { findDirectoryUser } from '../lib/directory.js';
+import { isPrimaryMember } from '../lib/domains.js';
 import {
   REFRESH_THRESHOLD,
   validateUserSession,
@@ -38,11 +39,17 @@ async function userAccessSessionPlugin(fastify, _opts) {
       return reply.code(401).send({ error: 'user_session_required' });
     }
 
-    // The session's user must still hold the username, and be enabled: a
-    // deleted user's username given to someone else never inherits it, and
-    // a disabled user is out at once.
+    // The session's user must still hold the username, be enabled and be a
+    // member of the primary domain: a deleted user's username given to
+    // someone else never inherits it, and a disabled user, one whose
+    // membership ended or one made an external member is out at once.
     const holder = await findDirectoryUser(result.payload.username);
-    if (!holder || holder.userId !== result.payload.userId || holder.status !== 'active') {
+    if (
+      !holder ||
+      holder.userId !== result.payload.userId ||
+      holder.status !== 'active' ||
+      !(await isPrimaryMember(holder.userId))
+    ) {
       return reply.code(401).send({ error: 'user_session_required' });
     }
 

package/vendor/serverd/src/routes/invite.js

@@ -8,9 +8,9 @@ import {
   generateTotpSecret,
   writeTotpToDatabase,
 } from '../lib/authelia.js';
-import { getConfig } from '../lib/config.js';
 import { httpError } from '../lib/app-error.js';
 import { changeUsers, usersFileError } from '../lib/directory.js';
+import { invitationDomainsNow, invitationSignInDomain } from '../lib/domains.js';
 
 /**
  * Find an invitation by token using a constant-time comparison.
@@ -119,8 +119,11 @@ export default async function inviteRoutes(fastify, _opts) {
       return reply.code(500).send({ error: 'Failed to process password' });
     }
 
-    // Through the users lock: the directory gives the user their id before
-    // Authelia restarts and lets them sign in.
+    const grantedDomains = await invitationDomainsNow(invitation);
+
+    // Through the users lock: the directory gives the user their id, and
+    // the domains are rendered (their memberships, with the kinds the
+    // invitation named), before they can sign in.
     try {
       await changeUsers(
         async () => {
@@ -149,6 +152,12 @@ export default async function inviteRoutes(fastify, _opts) {
           // A removed user's grants, groups and second factors under the
           // username go first; a username with an OIDC identity is refused.
           creates: [invitation.username],
+          // The domains the invitation names that still are the ones it
+          // named (an invitation from before the multi-domain relay names
+          // none: the relay's one domain).
+          ...(Array.isArray(invitation.domains)
+            ? { domains: { [invitation.username]: grantedDomains } }
+            : {}),
           expect: (users) => users[invitation.username]?.password === hashedPassword,
         },
       );
@@ -191,8 +200,9 @@ export default async function inviteRoutes(fastify, _opts) {
       request.log.warn(err, 'Failed to update invitation status (user was created)');
     }
 
-    const config = getConfig();
-    const loginUrl = config.domain ? `https://auth.${config.domain}/` : null;
+    // The sign-in of the first domain the user is a member of.
+    const loginDomain = await invitationSignInDomain(invitation);
+    const loginUrl = loginDomain ? `https://auth.${loginDomain}/` : null;
 
     return {
       ok: true,

package/vendor/serverd/src/routes/management/domains.js

@@ -0,0 +1,154 @@
+/**
+ * The relay's base domains and their members (the multi-domain relay,
+ * lib/domains.js). Admin only (mTLS).
+ *
+ *   GET    /api/domains                          domains, member counts (members, external), what uses each
+ *   POST   /api/domains                          add one (`pending`)
+ *   POST   /api/domains/:name/verify-dns         does auth.<domain> resolve here?
+ *   POST   /api/domains/:name/activate           issue auth.<domain>, serve its sign-in
+ *   DELETE /api/domains/:name                    remove an unused, non-primary domain
+ *   GET    /api/domains/:name/members            its members, each with the membership's kind
+ *   PUT    /api/domains/:name/members/:user      make a user (id or username) a member —
+ *                                                `{ kind: 'member' | 'external' }`, member
+ *                                                unless named; another kind changes it
+ *   DELETE /api/domains/:name/members/:user      end a membership
+ *   PUT    /api/plugins/:name/domain             move a plugin to another domain
+ *
+ * Routes validate and answer; the work is in lib/domains.js and
+ * lib/plugin-domain.js. Refusals answer `{ error, code }`.
+ */
+
+import { z } from 'zod';
+import { DomainNameSchema, MEMBERSHIP_KINDS } from '@lamalibre/lamaste';
+import { actorFromRequest } from '../../lib/actor.js';
+import { sendFailure } from '../../lib/app-error.js';
+import {
+  activateDomain,
+  addDomain,
+  addDomainMember,
+  domainsOverview,
+  getDomain,
+  listDomainMembers,
+  newUsersNeedDomains,
+  removeDomain,
+  removeDomainMember,
+  verifyDomainDns,
+} from '../../lib/domains.js';
+import { setPluginDomain } from '../../lib/plugin-domain.js';
+
+const NameParamSchema = z.object({ name: DomainNameSchema });
+// `user`: a directory id or a username (lib/domains.js decides which).
+const MemberParamsSchema = z.object({ name: DomainNameSchema, user: z.string().min(1).max(64) });
+const AddDomainSchema = z.object({ name: DomainNameSchema }).strict();
+const MemberBodySchema = z.object({ kind: z.enum(MEMBERSHIP_KINDS).optional() }).strict();
+const PluginParamSchema = z.object({ name: z.string().min(1).max(200) });
+const PluginDomainSchema = z.object({ domain: DomainNameSchema }).strict();
+
+export default async function domainRoutes(fastify) {
+  const admin = { preHandler: fastify.requireRole(['admin']) };
+
+  fastify.get('/domains', admin, async () => {
+    const domains = await domainsOverview();
+    // Whether users and invitations must name their domains (`domains_required`).
+    return { domains, newUsersNeedDomains: newUsersNeedDomains(domains) };
+  });
+
+  fastify.post('/domains', admin, async (request, reply) => {
+    const { name } = AddDomainSchema.parse(request.body);
+    try {
+      const domain = await addDomain(name, {
+        actor: actorFromRequest(request),
+        logger: request.log,
+      });
+      return reply.code(201).send({ domain });
+    } catch (err) {
+      return sendFailure(request, reply, err, 'The domain change failed');
+    }
+  });
+
+  fastify.post(
+    '/domains/:name/verify-dns',
+    { ...admin, config: { rateLimit: { max: 30, timeWindow: '1 minute' } } },
+    async (request, reply) => {
+      const { name } = NameParamSchema.parse(request.params);
+      try {
+        return await verifyDomainDns(name);
+      } catch (err) {
+        return sendFailure(request, reply, err, 'The domain change failed');
+      }
+    },
+  );
+
+  fastify.post(
+    '/domains/:name/activate',
+    { ...admin, config: { rateLimit: { max: 10, timeWindow: '1 minute' } } },
+    async (request, reply) => {
+      const { name } = NameParamSchema.parse(request.params);
+      try {
+        const domain = await activateDomain(name, {
+          actor: actorFromRequest(request),
+          logger: request.log,
+        });
+        return { domain };
+      } catch (err) {
+        return sendFailure(request, reply, err, 'The domain change failed');
+      }
+    },
+  );
+
+  fastify.delete('/domains/:name', admin, async (request, reply) => {
+    const { name } = NameParamSchema.parse(request.params);
+    try {
+      return await removeDomain(name, { actor: actorFromRequest(request), logger: request.log });
+    } catch (err) {
+      return sendFailure(request, reply, err, 'The domain change failed');
+    }
+  });
+
+  fastify.get('/domains/:name/members', admin, async (request, reply) => {
+    const { name } = NameParamSchema.parse(request.params);
+    if (!(await getDomain(name))) {
+      return reply.code(404).send({ error: 'Domain not found', code: 'domain_not_found' });
+    }
+    return { members: await listDomainMembers(name) };
+  });
+
+  fastify.put('/domains/:name/members/:user', admin, async (request, reply) => {
+    const { name, user } = MemberParamsSchema.parse(request.params);
+    const { kind } = MemberBodySchema.parse(request.body ?? {});
+    try {
+      return await addDomainMember(name, user, {
+        ...(kind ? { kind } : {}),
+        actor: actorFromRequest(request),
+        logger: request.log,
+      });
+    } catch (err) {
+      return sendFailure(request, reply, err, 'The domain change failed');
+    }
+  });
+
+  fastify.delete('/domains/:name/members/:user', admin, async (request, reply) => {
+    const { name, user } = MemberParamsSchema.parse(request.params);
+    try {
+      return await removeDomainMember(name, user, {
+        actor: actorFromRequest(request),
+        logger: request.log,
+      });
+    } catch (err) {
+      return sendFailure(request, reply, err, 'The domain change failed');
+    }
+  });
+
+  fastify.put('/plugins/:name/domain', admin, async (request, reply) => {
+    const { name } = PluginParamSchema.parse(request.params);
+    const { domain } = PluginDomainSchema.parse(request.body);
+    try {
+      return await setPluginDomain(name, domain, {
+        actor: actorFromRequest(request),
+        logger: request.log,
+      });
+    } catch (err) {
+      return sendFailure(request, reply, err, 'The domain change failed');
+    }
+  });
+}

package/vendor/serverd/src/routes/management/gatekeeper-proxy.js

@@ -21,13 +21,24 @@
  * cannot be) — a reused username inherits nothing. The access log is purged
  * for one username by POST, its name in the body (never in a URL, which
  * logs keep).
+ *
+ * Grants and groups also decide what external members of a domain reach
+ * (packages/core/docs/external-members-design.md): after every change that
+ * went through, the domains are rendered (users.yml's owned groups — the
+ * restricted hosts and OIDC clients that name each external member), which
+ * follows whoever it narrowed (registry tokens, a device-code session). A
+ * rendering that fails is answered with `warnings` and tried again within
+ * seconds. A grant on an OIDC client (`resourceType: 'oidc-client'`) must
+ * name a user-facing client an installed plugin declares.
  */
 
 import { recomputeAudiences } from '../../lib/audience.js';
 import { withUsernamesForGrants } from '../../lib/directory.js';
+import { scheduleRenderRetry, syncDomainAccess } from '../../lib/domains.js';
 import { checkProxiedGrant } from '../../lib/entitlements.js';
 import { actorFromRequest } from '../../lib/actor.js';
 import { gatekeeperRequest } from '../../lib/gatekeeper-client.js';
+import { checkOidcClientGrant } from '../../lib/owned-groups.js';
 
 /** Gatekeeper's `path`, with the request's query string when it has one. */
 function withQuery(path, request) {
@@ -55,18 +66,43 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
     };
   };
 
-  /** When Gatekeeper took a grant or group change, the plugin audiences follow it. */
-  const followAudiences = async (request, answer) => {
-    if (answer.statusCode < 400) await recomputeAudiences({ logger: request.log });
-    return answer;
+  /**
+   * When Gatekeeper took a grant or group change: the plugin audiences and
+   * the domains' rendering follow it — which follows whoever it narrowed —
+   * all before the answer goes back. When the rendering fails, the answer
+   * carries `warnings` (Gatekeeper took the change, and enforces it on its
+   * own hosts; an OIDC client it no longer grants waits for a rendering)
+   * and one is tried again within seconds.
+   */
+  const followChange = async (request, answer) => {
+    if (answer.statusCode >= 400) return answer;
+    await recomputeAudiences({ logger: request.log });
+    let warnings;
+    try {
+      warnings = (await syncDomainAccess({ logger: request.log })).warnings ?? [];
+    } catch (err) {
+      request.log.warn({ err: err.message }, 'Rendering domain access after a grant change failed');
+      scheduleRenderRetry(request.log);
+      warnings = [
+        ...(err.warnings ?? []),
+        {
+          step: 'render',
+          message: `Gatekeeper took the change, but who may reach what was not fully rendered (${err.message}); the panel tries again within seconds`,
+        },
+      ];
+    }
+    if (warnings.length === 0 || typeof answer.data !== 'object' || answer.data === null) {
+      return answer;
+    }
+    return { ...answer, data: { ...answer.data, warnings } };
   };
 
   /**
    * A grant or group change: forwarded, and when Gatekeeper took it, the
-   * plugin audiences follow it before the answer goes back.
+   * plugin audiences and the domains follow it before the answer goes back.
    */
   const proxyChange = async (request, method, gatekeeperPath, body) =>
-    followAudiences(request, await proxy(method, gatekeeperPath, body));
+    followChange(request, await proxy(method, gatekeeperPath, body));
 
   /**
    * Give something to `usernames` in Gatekeeper: forwarded holding the
@@ -85,7 +121,7 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
       if (!Number.isInteger(err.statusCode)) throw err;
       return { statusCode: err.statusCode, data: { error: err.message, code: err.code } };
     }
-    return followAudiences(request, answer);
+    return followChange(request, answer);
   };
 
   // --- Groups ---
@@ -164,7 +200,7 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
   fastify.post('/gatekeeper/grants', async (request, reply) => {
     let body;
     try {
-      body = await checkProxiedGrant(request.body);
+      body = await checkOidcClientGrant(await checkProxiedGrant(request.body));
     } catch (err) {
       if (!Number.isInteger(err.statusCode)) throw err;
       return reply.code(err.statusCode).send({

package/vendor/serverd/src/routes/management/identity.js

@@ -1,5 +1,16 @@
 import { z } from 'zod';
 import { readUsers } from '../../lib/authelia.js';
+import { adminGroups, domainNames } from '../../lib/domains.js';
+
+/**
+ * Authelia's users with their groups as anything outside Authelia sees
+ * them: the groups Lamaste owns (domain memberships, host groups, OIDC
+ * client grants) left out.
+ */
+async function shownUsers() {
+  const [users, domains] = await Promise.all([readUsers(), domainNames()]);
+  return users.map((u) => ({ ...u, groups: adminGroups(u.groups, domains) }));
+}
 
 const UsernameParamSchema = z.object({
   username: z
@@ -37,10 +48,13 @@ export default async function identityRoutes(fastify, _opts) {
       }
 
       const groupsRaw = headerValue(request.headers['remote-groups']) || '';
-      const groups = groupsRaw
-        .split(',')
-        .map((g) => g.trim())
-        .filter(Boolean);
+      const groups = adminGroups(
+        groupsRaw
+          .split(',')
+          .map((g) => g.trim())
+          .filter(Boolean),
+        await domainNames(),
+      );
       const name = headerValue(request.headers['remote-name']) || '';
       const email = headerValue(request.headers['remote-email']) || '';
 
@@ -54,7 +68,7 @@ export default async function identityRoutes(fastify, _opts) {
     { preHandler: fastify.requireRole(['admin', 'agent'], { capability: 'identity:query' }) },
     async (request, reply) => {
       try {
-        const users = await readUsers();
+        const users = await shownUsers();
         return { users };
       } catch (err) {
         request.log.error({ err }, 'Failed to read Authelia users');
@@ -70,7 +84,7 @@ export default async function identityRoutes(fastify, _opts) {
     async (request, reply) => {
       const { username } = UsernameParamSchema.parse(request.params);
       try {
-        const users = await readUsers();
+        const users = await shownUsers();
         const user = users.find((u) => u.username === username);
         if (!user) {
           return reply.code(404).send({ error: 'User not found' });
@@ -89,7 +103,7 @@ export default async function identityRoutes(fastify, _opts) {
     { preHandler: fastify.requireRole(['admin', 'agent'], { capability: 'identity:query' }) },
     async (request, reply) => {
       try {
-        const users = await readUsers();
+        const users = await shownUsers();
         /** @type {Set<string>} */
         const groupSet = new Set();
         for (const u of users) {

package/vendor/serverd/src/routes/management/invitations.js

@@ -3,7 +3,15 @@ import { z } from 'zod';
 import { USERNAME_MAX_LENGTH, USERNAME_MIN_LENGTH, USERNAME_REGEX } from '@lamalibre/lamaste';
 import { readInvitations, withInvitationsLock, writeInvitations } from '../../lib/state.js';
 import { readUsersRaw } from '../../lib/authelia.js';
-import { getConfig } from '../../lib/config.js';
+import {
+  MembershipInputSchema,
+  assertAssignableGroups,
+  domainsForNewUser,
+  externalMemberGroupsError,
+  invitationMemberships,
+  invitationSignInDomain,
+} from '../../lib/domains.js';
+import { sendFailure } from '../../lib/app-error.js';
 
 const IdParamSchema = z.object({ id: z.string().uuid() });
 
@@ -19,8 +27,15 @@ const CreateInvitationSchema = z.object({
       'Username must start with a lowercase letter or digit and may contain underscores or hyphens',
     ),
   email: z.string().email(),
-  groups: z.array(z.string()).optional().default([]),
+  // Authelia groups (`admins`, `feria-*`): letters, digits, "-" and "_" —
+  // never for an external member.
+  groups: z.array(z.string()).max(100).optional().default([]),
   expiresInDays: z.number().int().min(1).max(30).optional().default(7),
+  // The domains the user becomes a member of on accepting — a name (a
+  // member) or `{ name, kind }` (an external member reaches only what names
+  // them). Required while the relay has two or more; with one, the user
+  // becomes its member.
+  domains: z.array(MembershipInputSchema).max(50).optional(),
 });
 
 export default async function invitationRoutes(fastify, _opts) {
@@ -37,6 +52,7 @@ export default async function invitationRoutes(fastify, _opts) {
         const enriched = invitations.map((inv) => ({
           ...inv,
           token: undefined,
+          domains: invitationMemberships(inv),
           status: inv.used ? 'accepted' : new Date(inv.expiresAt) < now ? 'expired' : 'pending',
         }));
         return { invitations: enriched };
@@ -55,6 +71,16 @@ export default async function invitationRoutes(fastify, _opts) {
     },
     async (request, reply) => {
       const body = CreateInvitationSchema.parse(request.body);
+      let domains;
+      try {
+        assertAssignableGroups(body.groups);
+        domains = await domainsForNewUser(body.domains, { required: true });
+        if (body.groups.length > 0 && domains.some((m) => m.kind === 'external')) {
+          throw externalMemberGroupsError(400);
+        }
+      } catch (err) {
+        return sendFailure(request, reply, err, 'Failed to read the domains');
+      }
 
       // Check username doesn't already exist in Authelia
       let usersData;
@@ -97,6 +123,7 @@ export default async function invitationRoutes(fastify, _opts) {
           username: body.username,
           email: body.email,
           groups: body.groups,
+          domains,
           createdAt: now.toISOString(),
           expiresAt: expiresAt.toISOString(),
           used: false,
@@ -116,8 +143,10 @@ export default async function invitationRoutes(fastify, _opts) {
 
       const { invitation } = outcome;
       const { token } = invitation;
-      const config = getConfig();
-      const inviteUrl = config.domain ? `https://auth.${config.domain}/invite/${token}` : null;
+      // On the sign-in page of the first domain it names (the invitation
+      // page is served on every domain's auth portal).
+      const inviteDomain = await invitationSignInDomain(invitation);
+      const inviteUrl = inviteDomain ? `https://auth.${inviteDomain}/invite/${token}` : null;
 
       return reply.code(201).send({
         ok: true,

package/vendor/serverd/src/routes/management/plugin-web-surface.js

@@ -0,0 +1,151 @@
+/**
+ * A plugin's web surface (slice 7): the site it owns, where the relay
+ * serves the shell its server package ships beside its user surface's API.
+ * Admin only. Business logic lives in `lib/web-surface.js`.
+ *
+ *   GET    /plugins/:name/web-surface        what the installed version declares, the
+ *                                            site, whether it is served, the trees, the offer
+ *   POST   /plugins/:name/web-surface        { subdomain?, accessMode? } — create the site
+ *   POST   /plugins/:name/web-surface/move   { tunnelId } — take over the bound tunnel's host
+ *   DELETE /plugins/:name/web-surface        delete the site and its trees
+ */
+
+import { z } from 'zod';
+import { WEB_SURFACE_ACCESS_MODES, derivePluginRoute } from '@lamalibre/lamaste';
+import { actorFromRequest } from '../../lib/actor.js';
+import { findPlugin } from '../../lib/plugins.js';
+import {
+  createWebSurface,
+  deleteWebSurface,
+  moveWebSurfaceFromTunnel,
+  webSurfaceStatus,
+} from '../../lib/web-surface.js';
+
+const PluginNameParamSchema = z.object({
+  name: z
+    .string()
+    .min(1)
+    .max(100)
+    .regex(/^[a-z0-9-]+$/, 'Plugin name must contain only lowercase letters, numbers, and hyphens'),
+});
+
+const CreateBodySchema = z
+  .object({
+    subdomain: z
+      .string()
+      .min(1)
+      .max(63)
+      .regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, 'subdomain is a DNS label')
+      .optional(),
+    accessMode: z.enum(WEB_SURFACE_ACCESS_MODES).optional(),
+  })
+  .strict();
+
+const MoveBodySchema = z.object({ tunnelId: z.string().min(1).max(64) }).strict();
+
+/** The refusal a library threw (its `statusCode`, message and `code`), or a 500. */
+function sendFailure(request, reply, err, fallback) {
+  if (Number.isInteger(err.statusCode) && err.statusCode < 500) {
+    return reply
+      .code(err.statusCode)
+      .send({ error: err.message, ...(err.code ? { code: err.code } : {}) });
+  }
+  request.log.error(err, fallback);
+  return reply
+    .code(Number.isInteger(err.statusCode) ? err.statusCode : 500)
+    .send({ error: fallback, details: err.message });
+}
+
+/**
+ * The route plugin `:name` holds: the installed plugin's, else the one its
+ * name derives — a site outlives its plugin, and its status and deletion
+ * stay reachable (creating or moving refuses without an installed plugin).
+ */
+async function routeOf(request) {
+  const { name } = PluginNameParamSchema.parse(request.params);
+  const plugin = await findPlugin(name);
+  return plugin?.route ?? derivePluginRoute(name);
+}
+
+export default async function pluginWebSurfaceRoutes(fastify, _opts) {
+  fastify.get(
+    '/plugins/:name/web-surface',
+    { preHandler: fastify.requireRole(['admin']) },
+    async (request, reply) => {
+      const route = await routeOf(request);
+      try {
+        return { webSurface: await webSurfaceStatus(route) };
+      } catch (err) {
+        return sendFailure(request, reply, err, 'Failed to read the web surface');
+      }
+    },
+  );
+
+  fastify.post(
+    '/plugins/:name/web-surface',
+    {
+      preHandler: fastify.requireRole(['admin']),
+      // Issues a certificate and reloads nginx.
+      config: { rateLimit: { max: 10, timeWindow: '1 minute' } },
+    },
+    async (request, reply) => {
+      const route = await routeOf(request);
+      const body = CreateBodySchema.parse(request.body ?? {});
+      try {
+        const webSurface = await createWebSurface(route, body, {
+          actor: actorFromRequest(request),
+          logger: request.log,
+        });
+        return reply.code(201).send({ webSurface });
+      } catch (err) {
+        return sendFailure(request, reply, err, 'Failed to create the web surface');
+      }
+    },
+  );
+
+  fastify.post(
+    '/plugins/:name/web-surface/move',
+    {
+      preHandler: fastify.requireRole(['admin']),
+      config: { rateLimit: { max: 10, timeWindow: '1 minute' } },
+    },
+    async (request, reply) => {
+      const route = await routeOf(request);
+      const { tunnelId } = MoveBodySchema.parse(request.body);
+      try {
+        return {
+          webSurface: await moveWebSurfaceFromTunnel(route, tunnelId, {
+            actor: actorFromRequest(request),
+            logger: request.log,
+          }),
+        };
+      } catch (err) {
+        return sendFailure(
+          request,
+          reply,
+          err,
+          'Failed to move the user surface to the web surface',
+        );
+      }
+    },
+  );
+
+  fastify.delete(
+    '/plugins/:name/web-surface',
+    {
+      preHandler: fastify.requireRole(['admin']),
+      config: { rateLimit: { max: 10, timeWindow: '1 minute' } },
+    },
+    async (request, reply) => {
+      const route = await routeOf(request);
+      try {
+        return await deleteWebSurface(route, {
+          actor: actorFromRequest(request),
+          logger: request.log,
+        });
+      } catch (err) {
+        return sendFailure(request, reply, err, 'Failed to delete the web surface');
+      }
+    },
+  );
+}

package/vendor/serverd/src/routes/management/plugins.js

@@ -42,6 +42,7 @@ import {
 } from '../../lib/plugin-settings.js';
 import { actorFromRequest, certSerialFromRequest } from '../../lib/actor.js';
 import { recordAudit } from '../../lib/audit.js';
+import { withPluginDomains } from '../../lib/domains.js';
 import {
   readPushInstallConfig,
   readPushInstallSessions,
@@ -301,6 +302,8 @@ async function withHooks(plugin) {
       agent: status.agent !== null,
       // Lamaste installs the agent half (agent.package); false: none, or installed by hand.
       agentHalf: status.agentHalf !== null,
+      // The installed version declares a web surface (its tree is in the approval).
+      web: status.web.declared,
       approval: status.approval.state,
       autoApprove: status.autoApprove,
       failOpenCount: status.relay?.failOpenCount ?? 0,
@@ -335,7 +338,7 @@ export default async function pluginRoutes(fastify, _opts) {
       // (see GET /plugins/:name/settings).
       const plugins = await attachSettingsSummaries(await attachHostings(registry.plugins));
       return {
-        plugins: await Promise.all(plugins.map(withHooks)),
+        plugins: await withPluginDomains(await Promise.all(plugins.map(withHooks))),
         // Every agent's retained data — of uninstalled plugins too, which
         // no entry of `plugins` lists any more.
         retainedData: await listRetainedData(),
@@ -361,7 +364,8 @@ export default async function pluginRoutes(fastify, _opts) {
       }
 
       const [withHosting] = await attachSettingsSummaries(await attachHostings([plugin]));
-      return { plugin: await withHooks(withHosting) };
+      const [shown] = await withPluginDomains([await withHooks(withHosting)]);
+      return { plugin: shown };
     },
   );