@lamalibre/create-lamaste 4.5.0 → 4.7.0

package/vendor/serverd/src/routes/management/registry-credential.js

@@ -9,7 +9,8 @@
  *
  * `auth.kind` is `token` (a pasted long-lived Feria token) or `oidc` (the
  * panel's own `lamaste-server` client on Authelia: client-credentials grant,
- * Feria login). For `oidc` the client is written to Authelia before the
+ * Feria login; `issuerDomain` names the active domain whose issuer,
+ * `https://auth.<domain>`, the registry trusts — the primary when absent). For `oidc` the client is written to Authelia before the
  * chain is verified; if verification fails it is removed again, and the
  * error says what Feria's `auth.json` needs.
  *
@@ -28,9 +29,12 @@ import {
   clearRegistryCredentialConfig,
   readRegistryCredentialConfig,
   verifyRegistryCredential,
-  writeRegistryCredentialConfig,
+  setRegistryCredential,
 } from '../../lib/registry-credential.js';
-import { syncOidcClients } from '../../lib/plugin-oidc.js';
+import { DomainNameSchema } from '@lamalibre/lamaste';
+import { sendFailure } from '../../lib/app-error.js';
+import { resolveActiveDomain } from '../../lib/domains.js';
+import { syncOidcClients, withRegistryCandidate } from '../../lib/plugin-oidc.js';
 
 const FeriaTokenSchema = z
   .string()
@@ -40,7 +44,7 @@ const FeriaTokenSchema = z
 
 const AuthSchema = z.discriminatedUnion('kind', [
   z.object({ kind: z.literal('token'), token: FeriaTokenSchema }),
-  z.object({ kind: z.literal('oidc') }),
+  z.object({ kind: z.literal('oidc'), issuerDomain: DomainNameSchema.optional() }),
 ]);
 
 const PutSchema = z
@@ -64,9 +68,13 @@ const PutSchema = z
     }
   });
 
-/** The stored `auth` for a request body. */
-function authOf(body) {
-  if (body.auth?.kind === 'oidc') return { kind: 'oidc', clientId: LAMASTE_SERVER_OIDC_CLIENT_ID };
+/** The stored `auth` for a request body (`issuerDomain` resolved against the active domains). */
+async function authOf(body) {
+  if (body.auth?.kind === 'oidc') {
+    const auth = { kind: 'oidc', clientId: LAMASTE_SERVER_OIDC_CLIENT_ID };
+    if (body.auth.issuerDomain === undefined) return auth;
+    return { ...auth, issuerDomain: await resolveActiveDomain(body.auth.issuerDomain) };
+  }
   if (body.auth?.kind === 'token') return { kind: 'token', token: body.auth.token };
   return { kind: 'token', token: body.token };
 }
@@ -90,62 +98,83 @@ export default async function registryCredentialRoutes(fastify) {
     },
     async (request, reply) => {
       const body = PutSchema.parse(request.body);
-      const auth = authOf(body);
+      let auth;
+      try {
+        auth = await authOf(body);
+      } catch (err) {
+        return sendFailure(request, reply, err, 'Failed to read the domains');
+      }
       const candidate = { registryUrl: body.registryUrl, auth };
 
-      // The panel's own client must exist in Authelia (with a secret in the
-      // store) before the chain can be exercised.
-      if (auth.kind === 'oidc') {
-        try {
-          const synced = await syncOidcClients(request.log, {
-            registryAuth: { registryUrl: body.registryUrl },
-          });
-          if (!synced) {
-            return reply.code(503).send({ error: 'Complete onboarding (set a domain) first' });
+      // An oidc candidate is what every sync serves until it is stored or
+      // dropped — the identity tick's too, which would otherwise remove the
+      // panel's client from Authelia under the verification.
+      const registryAuth =
+        auth.kind === 'oidc'
+          ? {
+              registryUrl: body.registryUrl,
+              ...(auth.issuerDomain ? { issuerDomain: auth.issuerDomain } : {}),
+            }
+          : undefined;
+      try {
+        return await withRegistryCandidate(registryAuth, async () => {
+          // The panel's own client must exist in Authelia (with a secret in
+          // the store) before the chain can be exercised.
+          if (registryAuth) {
+            try {
+              if (!(await syncOidcClients(request.log))) {
+                return reply.code(503).send({ error: 'Complete onboarding (set a domain) first' });
+              }
+            } catch (err) {
+              return reply.code(500).send({
+                error: `Could not register the ${LAMASTE_SERVER_OIDC_CLIENT_ID} client in Authelia: ${err.message}`,
+              });
+            }
           }
-        } catch (err) {
-          return reply.code(500).send({
-            error: `Could not register the ${LAMASTE_SERVER_OIDC_CLIENT_ID} client in Authelia: ${err.message}`,
-          });
-        }
-      }
 
-      let verified;
-      try {
-        verified = await verifyRegistryCredential(candidate);
-      } catch (err) {
-        if (auth.kind === 'oidc') {
-          // Leave Authelia as the stored credential says — the candidate is
-          // not kept.
-          await syncOidcClients(request.log).catch((syncErr) =>
-            request.log.warn({ err: syncErr.message }, 'Failed to roll back the OIDC client'),
+          let verified;
+          try {
+            verified = await verifyRegistryCredential(candidate);
+          } catch (err) {
+            const status = err instanceof RegistryCredentialError ? err.statusCode : 502;
+            return reply.code(status).send({ error: err.message });
+          }
+
+          const config = {
+            provider: 'feria',
+            registryUrl: body.registryUrl,
+            scope: body.scope ?? '@lamalibre',
+            auth,
+            owner: verified.owner,
+            configuredAt: new Date().toISOString(),
+          };
+          let warnings;
+          try {
+            warnings = await setRegistryCredential(config, { logger: request.log });
+          } catch (err) {
+            return sendFailure(request, reply, err, 'Failed to store the registry credential');
+          }
+          request.log.info(
+            { registryUrl: body.registryUrl, owner: verified.owner, auth: auth.kind },
+            'Registry credential configured',
           );
-        }
-        const status = err instanceof RegistryCredentialError ? err.statusCode : 502;
-        return reply.code(status).send({ error: err.message });
+          return {
+            configured: true,
+            ...summariseRegistryCredential(config),
+            ...(warnings.length > 0 ? { warnings } : {}),
+          };
+        });
+      } finally {
+        // With the candidate dropped, the stored credential decides whether
+        // Authelia carries the panel's client: the new one once stored, the
+        // previous one after a refusal (the candidate is not kept).
+        await syncOidcClients(request.log).catch((err) =>
+          request.log.warn(
+            { err: err.message },
+            'Failed to sync OIDC clients after the registry credential request',
+          ),
+        );
       }
-
-      const config = {
-        provider: 'feria',
-        registryUrl: body.registryUrl,
-        scope: body.scope ?? '@lamalibre',
-        auth,
-        owner: verified.owner,
-        configuredAt: new Date().toISOString(),
-      };
-      await writeRegistryCredentialConfig(config);
-      // The stored credential now decides whether Authelia carries the client.
-      await syncOidcClients(request.log).catch((err) =>
-        request.log.warn(
-          { err: err.message },
-          'Failed to sync OIDC clients after credential change',
-        ),
-      );
-      request.log.info(
-        { registryUrl: body.registryUrl, owner: verified.owner, auth: auth.kind },
-        'Registry credential configured',
-      );
-      return { configured: true, ...summariseRegistryCredential(config) };
     },
   );
 

package/vendor/serverd/src/routes/management/sites.js

@@ -11,11 +11,20 @@ import {
   updateSite,
   verifyDns,
   SiteError,
+  withTunnelLock,
 } from '@lamalibre/lamaste/server';
+import { DomainNameSchema } from '@lamalibre/lamaste';
+import { AppError } from '../../lib/app-error.js';
+import { webSurfaceServing } from '../../lib/web-surface.js';
 import { getConfig } from '../../lib/config.js';
-import { readSites, writeSites, readTunnels } from '../../lib/state.js';
+import { readSites, writeSites, readTunnels, withSitesLock } from '../../lib/state.js';
 import { writeStaticSiteVhost, removeStaticSiteVhost } from '../../lib/nginx.js';
-import { updateAccessControl } from '../../lib/authelia.js';
+import {
+  activeDomainNames,
+  domainNames,
+  resolveActiveDomain,
+  syncDomainAccess,
+} from '../../lib/domains.js';
 import { issueTunnelCert, getCertPath, issueSiteCert } from '../../lib/certbot.js';
 import {
   createSiteDirectory,
@@ -54,6 +63,8 @@ const CreateSiteSchema = z.object({
   aliases: z.array(AliasSchema).max(10, 'At most 10 aliases').optional(),
   spaMode: z.boolean().optional().default(false),
   autheliaProtected: z.boolean().optional().default(false),
+  /** A managed site's domain (an active one; the primary when absent). */
+  domain: DomainNameSchema.optional(),
 });
 
 const UpdateSiteSchema = z.object({
@@ -104,8 +115,31 @@ function buildTunnelReadDeps() {
   return { readTunnels };
 }
 
-function buildAutheliaDeps() {
-  return { updateAccessControl };
+/**
+ * Authelia renders every site's protection together with the domains'
+ * members (lib/domains.js) — given the sites being saved.
+ */
+function buildAutheliaDeps(logger) {
+  return {
+    renderAccess: async (sites) => {
+      await syncDomainAccess({ logger, sites });
+    },
+  };
+}
+
+/**
+ * The active domain a managed site is put on (the primary unless named), as
+ * a SiteError the create route answers like its other refusals.
+ *
+ * @param {string | undefined} requested
+ */
+async function siteDomain(requested) {
+  try {
+    return await resolveActiveDomain(requested);
+  } catch (err) {
+    if (Number.isInteger(err.statusCode)) throw new SiteError(err.message, 'DOMAIN_NOT_CONFIGURED');
+    throw err;
+  }
 }
 
 /**
@@ -116,7 +150,6 @@ function siteErrorStatus(code) {
     case 'CUSTOM_DOMAIN_REQUIRED':
     case 'NAME_IN_USE':
     case 'RESERVED_NAME':
-    case 'NAME_TUNNEL_COLLISION':
     case 'FQDN_IN_USE':
     case 'FQDN_TUNNEL_COLLISION':
     case 'NOT_CUSTOM':
@@ -124,6 +157,7 @@ function siteErrorStatus(code) {
     case 'INVALID_ALIAS':
     case 'ALIAS_IN_USE':
     case 'DNS_MISMATCH':
+    case 'NOT_UNDER_DOMAIN':
       return 400;
     case 'NOT_FOUND':
       return 404;
@@ -134,6 +168,79 @@ function siteErrorStatus(code) {
   }
 }
 
+/**
+ * Run a site workflow that may give a site a hostname: under core's tunnel
+ * lock, then the sites lock — the order every such workflow takes them in
+ * (`withSitesLock`) — so no tunnel takes the name meanwhile.
+ *
+ * @template T
+ * @param {() => Promise<T>} fn
+ * @returns {Promise<T>}
+ */
+function withHostnameLocks(fn) {
+  return withTunnelLock(() => withSitesLock(fn));
+}
+
+/**
+ * Refuse (409) a site a plugin owns: its files are the plugin's approved
+ * web tree and its settings follow the plugin — it is managed through the
+ * plugin's web surface, never here (and never by `lamaste-agent deploy`).
+ */
+function assertNotPluginOwned(site) {
+  if (site?.owner) {
+    throw new AppError(
+      `Site '${site.name}' is the web surface of plugin '${site.owner.plugin}' — manage it through the plugin`,
+      409,
+      { code: 'plugin_owned_site' },
+    );
+  }
+}
+
+/** The site `id`, refused when a plugin owns it; null when there is none. */
+async function siteForManagement(id) {
+  const site = (await readSites()).find((s) => s.id === id) ?? null;
+  assertNotPluginOwned(site);
+  return site;
+}
+
+/**
+ * Record the size of site `id` on disk in sites.json, re-reading the file
+ * under the sites lock — never a copy read before an upload, which would
+ * undo every change made meanwhile.
+ *
+ * @returns {Promise<number>} the size
+ */
+async function recordSiteSize(id) {
+  const totalSize = await getSiteSize(id);
+  await withSitesLock(async () => {
+    const sites = await readSites();
+    const site = sites.find((s) => s.id === id);
+    if (!site) return;
+    site.totalSize = totalSize;
+    await writeSites(sites);
+  });
+  return totalSize;
+}
+
+/**
+ * Sites as listed: a plugin-owned one with `webSurface: { served, reason }`
+ * — whether it serves its plugin's shell and API now, or answers 503 and why.
+ */
+async function withWebSurfaceState(sites) {
+  if (!sites.some((site) => site.owner)) return sites;
+  const tunnels = await readTunnels();
+  return Promise.all(
+    sites.map(async (site) => {
+      if (!site.owner) return site;
+      const serving = await webSurfaceServing(site.owner.plugin, tunnels);
+      return {
+        ...site,
+        webSurface: { served: serving.served, reason: serving.served ? null : serving.reason },
+      };
+    }),
+  );
+}
+
 function assertAgentSiteAccess(request, site) {
   if (request.certRole === 'agent') {
     const allowed = request.certAllowedSites || [];
@@ -151,7 +258,6 @@ export default async function sitesRoutes(fastify, _opts) {
   const filesDeps = buildFilesDeps();
   const siteStateDeps = buildSiteStateDeps();
   const tunnelReadDeps = buildTunnelReadDeps();
-  const autheliaDeps = buildAutheliaDeps();
 
   // GET /api/sites
   //
@@ -191,7 +297,7 @@ export default async function sitesRoutes(fastify, _opts) {
       }
 
       const total = sites.length;
-      const windowed = sites.slice(offset, offset + limit);
+      const windowed = await withWebSurfaceState(sites.slice(offset, offset + limit));
 
       return { sites: windowed, total, limit, offset };
     },
@@ -212,24 +318,34 @@ export default async function sitesRoutes(fastify, _opts) {
           error: 'Domain and email must be configured before creating sites',
         });
       }
-
-      try {
-        const result = await createSite({
-          name: body.name,
-          type: body.type,
-          customDomain: body.customDomain,
-          aliases: body.aliases,
-          spaMode: body.spaMode,
-          autheliaProtected: body.autheliaProtected,
-          domain: config.domain,
-          email: config.email,
-          nginx: nginxDeps,
-          certbot: certbotDeps,
-          files: filesDeps,
-          siteState: siteStateDeps,
-          tunnelState: tunnelReadDeps,
-          logger: request.log,
+      if (body.domain !== undefined && body.type !== 'managed') {
+        return reply.code(400).send({
+          error: "A custom site's hostname names its domain — `domain` is for managed sites",
         });
+      }
+      try {
+        // The domain is resolved under the hostname locks — those a domain's
+        // removal takes — so the site never lands on a removed domain.
+        const result = await withHostnameLocks(async () =>
+          createSite({
+            name: body.name,
+            type: body.type,
+            customDomain: body.customDomain,
+            aliases: body.aliases,
+            spaMode: body.spaMode,
+            autheliaProtected: body.autheliaProtected,
+            domain: await siteDomain(body.domain),
+            domains: await activeDomainNames(),
+            relayDomains: await domainNames(),
+            email: config.email,
+            nginx: nginxDeps,
+            certbot: certbotDeps,
+            files: filesDeps,
+            siteState: siteStateDeps,
+            tunnelState: tunnelReadDeps,
+            logger: request.log,
+          }),
+        );
 
         const response = { ok: true, site: result.site };
         if (result.message) response.message = result.message;
@@ -261,12 +377,15 @@ export default async function sitesRoutes(fastify, _opts) {
       const { id } = IdParamSchema.parse(request.params);
 
       try {
-        await deleteSite({
-          id,
-          nginx: nginxDeps,
-          files: filesDeps,
-          siteState: siteStateDeps,
-          logger: request.log,
+        await withSitesLock(async () => {
+          await siteForManagement(id);
+          await deleteSite({
+            id,
+            nginx: nginxDeps,
+            files: filesDeps,
+            siteState: siteStateDeps,
+            logger: request.log,
+          });
         });
         return { ok: true };
       } catch (err) {
@@ -277,6 +396,7 @@ export default async function sitesRoutes(fastify, _opts) {
             details: err.message,
           });
         }
+        if (err instanceof AppError) throw err;
         request.log.error(err, 'Failed to delete site');
         return reply.code(500).send({
           error: 'Failed to delete site',
@@ -298,21 +418,25 @@ export default async function sitesRoutes(fastify, _opts) {
       const config = getConfig();
 
       try {
-        const result = await updateSite({
-          id,
-          spaMode: body.spaMode,
-          autheliaProtected: body.autheliaProtected,
-          allowedUsers: body.allowedUsers,
-          aliases: body.aliases,
-          domain: config.domain,
-          email: config.email,
-          serverIp: config.ip,
-          nginx: nginxDeps,
-          certbot: certbotDeps,
-          siteState: siteStateDeps,
-          tunnelState: tunnelReadDeps,
-          authelia: autheliaDeps,
-          logger: request.log,
+        const result = await withHostnameLocks(async () => {
+          await siteForManagement(id);
+          return updateSite({
+            id,
+            spaMode: body.spaMode,
+            autheliaProtected: body.autheliaProtected,
+            allowedUsers: body.allowedUsers,
+            aliases: body.aliases,
+            domains: await activeDomainNames(),
+            relayDomains: await domainNames(),
+            email: config.email,
+            serverIp: config.ip,
+            nginx: nginxDeps,
+            certbot: certbotDeps,
+            siteState: siteStateDeps,
+            tunnelState: tunnelReadDeps,
+            authelia: buildAutheliaDeps(request.log),
+            logger: request.log,
+          });
         });
         return result;
       } catch (err) {
@@ -330,6 +454,7 @@ export default async function sitesRoutes(fastify, _opts) {
             details: err.message,
           });
         }
+        if (err instanceof AppError) throw err;
         request.log.error(err, 'Failed to update site');
         return reply.code(500).send({
           error: 'Failed to update site configuration',
@@ -353,15 +478,18 @@ export default async function sitesRoutes(fastify, _opts) {
       const config = getConfig();
 
       try {
-        const result = await verifyDns({
-          id,
-          serverIp: config.ip,
-          domain: config.domain,
-          email: config.email,
-          nginx: nginxDeps,
-          certbot: certbotDeps,
-          siteState: siteStateDeps,
-          logger: request.log,
+        const result = await withHostnameLocks(async () => {
+          await siteForManagement(id);
+          return verifyDns({
+            id,
+            serverIp: config.ip,
+            domains: await activeDomainNames(),
+            email: config.email,
+            nginx: nginxDeps,
+            certbot: certbotDeps,
+            siteState: siteStateDeps,
+            logger: request.log,
+          });
         });
         return result;
       } catch (err) {
@@ -371,6 +499,7 @@ export default async function sitesRoutes(fastify, _opts) {
             error: err.message,
           });
         }
+        if (err instanceof AppError) throw err;
         request.log.error(err, 'Failed to verify DNS');
         return reply.code(500).send({
           error: 'DNS verification failed',
@@ -390,8 +519,7 @@ export default async function sitesRoutes(fastify, _opts) {
       const { id } = IdParamSchema.parse(request.params);
       const { path: relativePath } = PathQuerySchema.parse(request.query);
 
-      const sites = await readSites();
-      const site = sites.find((s) => s.id === id);
+      const site = await siteForManagement(id);
       if (!site) {
         return reply.code(404).send({ error: 'Site not found' });
       }
@@ -417,8 +545,7 @@ export default async function sitesRoutes(fastify, _opts) {
       const { id } = IdParamSchema.parse(request.params);
       const config = getConfig();
 
-      const sites = await readSites();
-      const site = sites.find((s) => s.id === id);
+      const site = await siteForManagement(id);
       if (!site) {
         return reply.code(404).send({ error: 'Site not found' });
       }
@@ -450,13 +577,9 @@ export default async function sitesRoutes(fastify, _opts) {
 
       // Update site size
       try {
-        const totalSize = await getSiteSize(id);
-        const siteIndex = sites.findIndex((s) => s.id === id);
-        sites[siteIndex].totalSize = totalSize;
-
+        const totalSize = await recordSiteSize(id);
         if (totalSize > config.maxSiteSize) {
           // Don't block but warn
-          await writeSites(sites);
           return reply.code(200).send({
             ok: true,
             files: uploadedFiles,
@@ -464,8 +587,6 @@ export default async function sitesRoutes(fastify, _opts) {
             totalSize,
           });
         }
-
-        await writeSites(sites);
       } catch {
         // Non-critical — don't fail the upload
       }
@@ -483,8 +604,7 @@ export default async function sitesRoutes(fastify, _opts) {
     async (request, reply) => {
       const { id } = IdParamSchema.parse(request.params);
 
-      const sites = await readSites();
-      const site = sites.find((s) => s.id === id);
+      const site = await siteForManagement(id);
       if (!site) {
         return reply.code(404).send({ error: 'Site not found' });
       }
@@ -501,10 +621,7 @@ export default async function sitesRoutes(fastify, _opts) {
 
       // Update site size
       try {
-        const totalSize = await getSiteSize(id);
-        const siteIndex = sites.findIndex((s) => s.id === id);
-        sites[siteIndex].totalSize = totalSize;
-        await writeSites(sites);
+        await recordSiteSize(id);
       } catch {
         // Non-critical
       }