@lamalibre/create-lamaste 4.6.0 → 4.7.0

package/vendor/server/src/commands/domains.js

@@ -0,0 +1,214 @@
+/**
+ * lamaste-server domains — the relay's base domains and their members
+ * (the multi-domain relay).
+ *
+ * Subcommands:
+ *   list                              Domains with their state, member count and what uses them
+ *   add <domain>                      Add a domain (pending until activated)
+ *   verify-dns <domain>               The records it needs, and whether they point here
+ *   activate <domain>                 Issue auth.<domain>, serve its sign-in, admit its members
+ *   remove <domain>                   Remove an unused, non-primary domain (its memberships end)
+ *   members <domain>                  Its members, each with the kind of the membership
+ *   members <domain> add <user> [--external]
+ *                                     Make a user (directory id or username) a member —
+ *                                     an external one with --external
+ *   members <domain> kind <user> member|external
+ *                                     Change the kind of a membership
+ *   members <domain> remove <user>    End a membership
+ *
+ * Also `plugins domain <name> [<domain>]` ({@link pluginDomainCmd}).
+ *
+ * Every subcommand goes through the running panel (`/api/domains`, admin
+ * certificate), which decides every rule. What the panel says is printed
+ * only as `terminalText`; `--json` emits it as it came.
+ */
+
+import chalk from 'chalk';
+import { panelRequest } from '../panel-api.js';
+import { emit, emitComplete } from '../ndjson.js';
+import { fail } from '../fail.js';
+import { terminalText } from '../plugin-settings.js';
+import { domainPath, domainRows, memberRequest } from '../domains.js';
+
+/** A panel request, or exit with its refusal. */
+const call = (json, ...args) => panelRequest(...args).catch((err) => fail(err.message, json, err));
+
+/**
+ * @param {string[]} args
+ * @param {{ json: boolean }} options
+ */
+export async function runDomains(args, { json }) {
+  const [sub, name, ...rest] = args;
+  if (sub === 'list') return listDomains({ json });
+  if (sub === 'members' && name) return membersCmd(name.toLowerCase(), rest, { json });
+  const command = DOMAIN_COMMANDS[sub];
+  if (!command || !name) return usage(sub ? 1 : 0);
+  const domain = name.toLowerCase();
+  const result = await call(json, ...command.request(domain), { timeoutMs: command.timeoutMs });
+  if (json) emitComplete(result);
+  else command.print(terminalText(domain), result);
+}
+
+function usage(code) {
+  const b = chalk.bold;
+  const c = chalk.cyan;
+  console.log(`
+${b('Usage:')} lamaste-server domains <subcommand>
+
+${b('Subcommands:')}
+  ${c('list')}                              Domains: state, members, what uses each
+  ${c('add <domain>')}                      Add a domain (pending until activated)
+  ${c('verify-dns <domain>')}               The DNS records it needs, and whether they point here
+  ${c('activate <domain>')}                 Issue auth.<domain> and serve its sign-in
+  ${c('remove <domain>')}                   Remove an unused, non-primary domain
+  ${c('members <domain>')}                  Its members and external members
+  ${c('members <domain> add <user> [--external]')}
+                                    Make a user (directory id or username) a member
+  ${c('members <domain> kind <user> member|external')}
+                                    Change the kind of a membership
+  ${c('members <domain> remove <user>')}    End a membership
+
+  Every domain has its own sign-in (auth.<domain>) and member list; a user reaches a
+  domain's protected hosts only as its member. An external member reaches only what
+  names them — restricted hosts that grant them, sites that list them, OIDC clients
+  granted to them — and holds no Authelia groups. The panel and tunnel. stay on the primary.
+`);
+  process.exit(code);
+}
+
+async function listDomains({ json }) {
+  const { domains } = await call(json, 'GET', '/api/domains');
+  if (json) {
+    emit({ domains });
+    return;
+  }
+  const d = chalk.dim;
+  console.log('');
+  console.log(chalk.bold('  Domains'));
+  console.log(d('  ' + '─'.repeat(50)));
+  for (const row of domainRows(domains)) {
+    const state = row.state === 'pending' ? chalk.yellow(row.state) : chalk.green(row.state);
+    const used = row.usedBy ? d(`  used by ${row.usedBy}`) : '';
+    const external = row.externalMembers > 0 ? `, ${row.externalMembers} external` : '';
+    console.log(`  ${chalk.cyan(row.name)}  ${state}  ${row.members} member(s)${external}${used}`);
+  }
+  console.log('');
+}
+
+/** One entry per domain subcommand: its request, its time budget, how it is printed. */
+const DOMAIN_COMMANDS = {
+  add: {
+    request: (name) => ['POST', '/api/domains', { name }],
+    timeoutMs: 30000,
+    print: (domain) => {
+      console.log(`\n  ${chalk.green('✓')} ${domain} added (pending).`);
+      console.log(
+        `  Create its DNS records (${chalk.cyan(`lamaste-server domains verify-dns ${domain}`)}),`,
+      );
+      console.log(`  then ${chalk.cyan(`lamaste-server domains activate ${domain}`)}\n`);
+    },
+  },
+  'verify-dns': {
+    request: (name) => ['POST', domainPath(name, '/verify-dns'), null],
+    timeoutMs: 30000,
+    print: (domain, result) => {
+      const mark = result.ok ? chalk.green('✓') : chalk.yellow('!');
+      console.log(
+        `\n  ${mark} ${domain}: ${result.ok ? 'its sign-in points at this relay' : 'records still missing'}`,
+      );
+      for (const r of result.records ?? []) {
+        const state = r.ok
+          ? chalk.green('in place')
+          : chalk.yellow(r.required ? 'missing' : 'optional, absent');
+        console.log(
+          `    ${terminalText(r.type)} ${chalk.cyan(terminalText(r.name))} → ${terminalText(r.value)}  ${state}`,
+        );
+        console.log(chalk.dim(`      ${terminalText(r.purpose)}`));
+      }
+      console.log('');
+    },
+  },
+  activate: {
+    request: (name) => ['POST', domainPath(name, '/activate'), null],
+    // Activation issues a certificate: give it time.
+    timeoutMs: 180000,
+    print: (domain) =>
+      console.log(`\n  ${chalk.green('✓')} ${domain} is active — its sign-in is auth.${domain}\n`),
+  },
+  remove: {
+    request: (name) => ['DELETE', domainPath(name), null],
+    timeoutMs: 30000,
+    print: (domain) =>
+      console.log(`\n  ${chalk.green('✓')} ${domain} removed; its memberships ended.\n`),
+  },
+};
+
+async function membersCmd(name, rest, { json }) {
+  if (rest.length === 0) {
+    const { members } = await call(json, 'GET', domainPath(name, '/members'));
+    if (json) {
+      emit({ members });
+      return;
+    }
+    console.log('');
+    for (const m of members) {
+      const status = m.status === 'active' ? '' : chalk.yellow(` (${m.status})`);
+      const kind = m.kind === 'external' ? chalk.magenta(' external') : '';
+      console.log(
+        `  ${chalk.cyan(terminalText(m.username ?? m.userId))}${kind}${status}  ${chalk.dim(m.userId)}`,
+      );
+    }
+    if (members.length === 0) console.log(chalk.dim('  No members.'));
+    console.log('');
+    return;
+  }
+  const request = memberRequest(name, rest);
+  if (!request) return usage(1);
+  // The panel takes a directory id or a username.
+  const result = await call(json, request.method, request.path, request.body);
+  if (json) {
+    emitComplete(result);
+    return;
+  }
+  const who = terminalText(request.user);
+  const where = terminalText(name);
+  console.log(
+    request.kind === null
+      ? `\n  ${chalk.green('✓')} ${who} is no longer a member of ${where}\n`
+      : `\n  ${chalk.green('✓')} ${who} is now ${request.kind === 'external' ? 'an external member' : 'a member'} of ${where}\n`,
+  );
+}
+
+/**
+ * `plugins domain <name> [<domain>]`: the domain a plugin belongs to, or
+ * move it to another active one.
+ *
+ * @param {string[]} args
+ * @param {{ json: boolean }} options
+ */
+export async function pluginDomainCmd(args, { json }) {
+  const [name, domain] = args;
+  if (!name) {
+    console.error('\n  Usage: lamaste-server plugins domain <name> [<domain>]\n');
+    process.exit(1);
+  }
+  if (domain === undefined) {
+    const { plugin } = await call(json, 'GET', `/api/plugins/${encodeURIComponent(name)}`);
+    if (json) {
+      emit({ name, domain: plugin.domain });
+      return;
+    }
+    console.log(`\n  ${terminalText(name)}: ${terminalText(plugin.domain)}\n`);
+    return;
+  }
+  const result = await call(json, 'PUT', `/api/plugins/${encodeURIComponent(name)}/domain`, {
+    domain: domain.toLowerCase(),
+  });
+  if (json) {
+    emitComplete(result);
+    return;
+  }
+  console.log(
+    `\n  ${chalk.green('✓')} ${terminalText(name)} ${result.changed ? 'now belongs to' : 'already belongs to'} ${terminalText(result.domain)}\n`,
+  );
+}

package/vendor/server/src/commands/plugin-identity.js

@@ -28,7 +28,8 @@
 
 import chalk from 'chalk';
 import { panelRequest } from '../panel-api.js';
-import { emit, emitComplete, emitError } from '../ndjson.js';
+import { emit, emitComplete } from '../ndjson.js';
+import { fail } from '../fail.js';
 import { identityBlockLines } from '../plugin-approval.js';
 import {
   audienceRowText,
@@ -45,21 +46,6 @@ function pluginPath(name, rest) {
   return `/api/plugins/${encodeURIComponent(name)}/${rest}`;
 }
 
-/**
- * Exit with a usage error or a refused request, as text or NDJSON (with
- * the refusal's `code`).
- *
- * @param {string} message
- * @param {boolean} json
- * @param {{ code?: string }} [err]
- * @returns {never}
- */
-function fail(message, json, err = {}) {
-  if (json) emitError(message, false, typeof err.code === 'string' ? { code: err.code } : {});
-  else console.error(`\n  ${chalk.red(terminalText(message))}\n`);
-  process.exit(1);
-}
-
 /** Print a change's warnings: what the panel could not complete beside it. */
 function printWarnings(warnings) {
   for (const warning of warnings ?? []) {

package/vendor/server/src/commands/plugins.js

@@ -10,7 +10,12 @@
  *                        Remove a plugin (must be disabled first); a hosted one
  *                        through its uninstall pipeline (an operation); --purge also
  *                        deletes the data of the agent half Lamaste installed
- *   oidc-clients <name>  The OIDC clients a plugin declares on Authelia
+ *   oidc-clients <name> [grants]
+ *                        The OIDC clients a plugin declares on Authelia, and who is
+ *                        granted each user-facing one
+ *   oidc-clients <name> grant|revoke <clientId> --user <u>|--group <g>
+ *                        Grant (or revoke) a user-facing client to a user or a Lamaste
+ *                        group: what admits an external member to its sign-in
  *   rotate-secret <name> <clientId>
  *                        New secret for a confidential OIDC client (shown once)
  *   hosting <name>       Which agent hosts an agent-hosted plugin's agent half
@@ -59,6 +64,7 @@
  *                        Who holds which of its roles; give or take them away
  *   identity-sync <name> [--reconcile]
  *                        Sync its audience to its agent half now
+ *   domain <name> [<domain>]   The domain a plugin belongs to; move it to another active one
  *   web-surface <name> [create [--subdomain <s>] [--access-mode <m>] | move --tunnel <t> | delete [--yes]]
  *                        The site an agent-hosted plugin owns for its web surface: what it
  *                        declares, whether it is served, its trees; create, move a bound
@@ -82,6 +88,14 @@ import { emit, emitStep, emitError, emitComplete, emitLog } from '../ndjson.js';
 import { configureCmd, settingsCmd } from './plugin-settings.js';
 import { audienceCmd, entitlementsCmd, identityCmd, identitySyncCmd } from './plugin-identity.js';
 import { webSurfaceCmd } from './plugin-web-surface.js';
+import { pluginDomainCmd } from './domains.js';
+import { fail as failPanel } from '../fail.js';
+import {
+  OIDC_CLIENT_RESOURCE,
+  findClientGrants,
+  parsePrincipal,
+  principalText,
+} from '../oidc-client-grants.js';
 import { settingsDiffLines, terminalText } from '../plugin-settings.js';
 import {
   APPROVE_HOOKS_USAGE,
@@ -116,7 +130,7 @@ export async function runPlugins(args, { json }) {
     case 'uninstall':
       return uninstallPluginCmd(args[1], args.slice(2), { json });
     case 'oidc-clients':
-      return oidcClientsCmd(args[1], { json });
+      return oidcClientsCmd(args[1], args.slice(2), { json });
     case 'rotate-secret':
       return rotateSecretCmd(args[1], args[2], { json });
     case 'hosting':
@@ -161,6 +175,8 @@ export async function runPlugins(args, { json }) {
       return identitySyncCmd(args.slice(1), { json });
     case 'web-surface':
       return webSurfaceCmd(args.slice(1), { json });
+    case 'domain':
+      return pluginDomainCmd(args.slice(1), { json });
     default:
       printPluginUsage();
       process.exit(sub ? 1 : 0);
@@ -181,7 +197,11 @@ ${b('Subcommands:')}
   ${c('uninstall <name> [--force] [--purge]')}
                        Remove a disabled plugin (a hosted one through its uninstall pipeline;
                        --purge deletes the data of the agent half Lamaste installed)
-  ${c('oidc-clients <name>')}  OIDC clients the plugin declares on Authelia (no secrets)
+  ${c('oidc-clients <name> [grants]')}
+                       OIDC clients the plugin declares on Authelia (no secrets), with grants
+  ${c('oidc-clients <name> grant|revoke <clientId> --user <u>|--group <g>')}
+                       Admit (or no longer) an external member to a client's sign-in —
+                       members of the plugin's domain need no grant
   ${c('rotate-secret <name> <clientId>')}
                        Replace a confidential client's secret — printed once
   ${c('hosting <name>')}       Which agent hosts the plugin's agent half, port, health
@@ -228,6 +248,8 @@ ${b('Subcommands:')}
                        Take every role away
   ${c('identity-sync <name> [--reconcile]')}
                        Sync its audience to its agent half now; --reconcile replays all of it
+  ${c('domain <name> [<d>]')}  The domain a plugin belongs to (its OIDC sign-in, surfaces, audience);
+                       with <d>, move it to that active domain (refused while a surface is served)
   ${c('web-surface <name>')}   The site a plugin owns for its web surface: what it declares, its site,
                        whether it is served (and why not), its trees, the bound tunnel, the offer
   ${c('web-surface <name> create [--subdomain <label>] [--access-mode authenticated|restricted]')}
@@ -1433,13 +1455,25 @@ async function uninstallPluginCmd(name, rest, { json }) {
  * @param {string | undefined} name
  * @param {{ json: boolean }} options
  */
-async function oidcClientsCmd(name, { json }) {
-  if (!name) {
-    const msg = 'Usage: lamaste-server plugins oidc-clients <name>';
+async function oidcClientsCmd(name, rest, { json }) {
+  const usage = () => {
+    const msg =
+      'Usage: lamaste-server plugins oidc-clients <name> [grants | grant|revoke <clientId> --user <u>|--group <g>]';
     if (json) emitError(msg);
     else console.error(`\n  ${msg}\n`);
     process.exit(1);
-  }
+  };
+  if (!name) return usage();
+  const [action, clientId, ...principalArgs] = rest;
+  if (action === 'grant' || action === 'revoke') {
+    const principal = parsePrincipal(principalArgs);
+    if (!clientId || !principal) return usage();
+    return action === 'grant'
+      ? grantOidcClientCmd(clientId, principal, { json })
+      : revokeOidcClientCmd(name, clientId, principal, { json });
+  }
+  if (action !== undefined && (action !== 'grants' || clientId !== undefined)) return usage();
+
   const result = await panelRequest('GET', `/api/plugins/${encodeURIComponent(name)}/oidc-clients`);
   if (json) {
     emit(result);
@@ -1459,7 +1493,7 @@ async function oidcClientsCmd(name, { json }) {
     const kind = c.confidential ? chalk.yellow('confidential') : chalk.green('public');
     const served = c.enabled ? '' : d(' (plugin disabled — not served)');
     console.log(`  ${chalk.cyan(c.id)}  ${kind}${served}`);
-    console.log(`    grants:   ${c.grantTypes.join(', ')}`);
+    console.log(`    flows:    ${c.grantTypes.join(', ')}`);
     console.log(`    scopes:   ${c.scopes.join(', ')}`);
     if (c.audience.length > 0) console.log(`    audience: ${c.audience.join(', ')}`);
     if (c.accessTokenClaims.length > 0) {
@@ -1472,10 +1506,80 @@ async function oidcClientsCmd(name, { json }) {
         }`,
       );
     }
+    if (c.userFacing) {
+      const granted = Array.isArray(c.grants)
+        ? c.grants.length > 0
+          ? c.grants.map(principalText).join(', ')
+          : d('none — external members do not sign in')
+        : chalk.yellow('unknown (Gatekeeper could not be read)');
+      console.log(`    granted:  ${granted}`);
+    }
   }
   console.log('');
 }
 
+/** Grant a user-facing client to a user or a Lamaste group (a Gatekeeper grant the panel checks). */
+async function grantOidcClientCmd(clientId, principal, { json }) {
+  let result;
+  try {
+    result = await panelRequest('POST', '/api/gatekeeper/grants', {
+      ...principal,
+      resourceType: OIDC_CLIENT_RESOURCE,
+      resourceId: clientId,
+    });
+  } catch (err) {
+    failPanel(err.message, json, err);
+  }
+  if (json) {
+    emitComplete(result);
+    return;
+  }
+  console.log(
+    `\n  ${chalk.green('✓')} ${principalText(principal)} may sign in with ${terminalText(clientId)}\n`,
+  );
+}
+
+/** Revoke the grant of a user-facing client to a user or a Lamaste group. */
+async function revokeOidcClientCmd(name, clientId, principal, { json }) {
+  let found;
+  try {
+    const { clients } = await panelRequest(
+      'GET',
+      `/api/plugins/${encodeURIComponent(name)}/oidc-clients`,
+    );
+    found = findClientGrants(clients ?? [], clientId, principal);
+  } catch (err) {
+    failPanel(err.message, json, err);
+  }
+  if ('error' in found) {
+    const reason = {
+      no_client: `Plugin ${name} declares no user-facing OIDC client ${clientId}`,
+      unreadable: "Gatekeeper's grants could not be read — try again",
+      no_grant: `${clientId} is not granted to ${principalText(principal)}`,
+    }[found.error];
+    failPanel(reason, json);
+  }
+  // Every grant naming the principal goes: one left behind would still let
+  // them sign in.
+  const results = [];
+  try {
+    for (const grantId of found.grantIds) {
+      results.push(
+        await panelRequest('DELETE', `/api/gatekeeper/grants/${encodeURIComponent(grantId)}`),
+      );
+    }
+  } catch (err) {
+    failPanel(err.message, json, err);
+  }
+  if (json) {
+    emitComplete({ revoked: found.grantIds.length, results });
+    return;
+  }
+  console.log(
+    `\n  ${chalk.green('✓')} ${principalText(principal)} no longer signs in with ${terminalText(clientId)}\n`,
+  );
+}
+
 /**
  * @param {string | undefined} name
  * @param {string | undefined} clientId

package/vendor/server/src/commands/registry-credential.js

@@ -4,7 +4,7 @@
  * for agents.
  *
  *   registry-credential show
- *   registry-credential set --url <registry> --oidc
+ *   registry-credential set --url <registry> --oidc [--issuer-domain <domain>]
  *       The panel authenticates as its own `lamaste-server` OIDC client on
  *       the relay's Authelia (client-credentials grant, Feria login). Nothing
  *       to paste; Feria's auth.json must grant the relay's lamaste-server client
@@ -35,7 +35,7 @@ export async function runRegistryCredential(args, { json }) {
       return clear({ json });
     default:
       process.stderr.write(
-        `Usage: lamaste-server registry-credential <show | set --url <registry> (--oidc | --token-stdin) | clear>\n`,
+        `Usage: lamaste-server registry-credential <show | set --url <registry> (--oidc [--issuer-domain <domain>] | --token-stdin) | clear>\n`,
       );
       process.exit(1);
   }
@@ -68,6 +68,7 @@ async function set(args, { json }) {
   let url;
   let tokenFromStdin = false;
   let oidc = false;
+  let issuerDomain;
   for (let i = 0; i < args.length; i += 1) {
     const arg = args[i];
     if (arg === '--url') {
@@ -78,6 +79,8 @@ async function set(args, { json }) {
       tokenFromStdin = true;
     } else if (arg === '--oidc') {
       oidc = true;
+    } else if (arg === '--issuer-domain') {
+      issuerDomain = args[++i]?.toLowerCase();
     } else if (arg === '--token' || arg.startsWith('--token=')) {
       throw new Error(
         'The token is never accepted on the command line — set LAMASTE_REGISTRY_TOKEN or use --token-stdin',
@@ -87,13 +90,17 @@ async function set(args, { json }) {
     }
   }
   if (!url) throw new Error('registry-credential set: --url <registry> is required');
+  if (issuerDomain !== undefined && !oidc) {
+    throw new Error('registry-credential set: --issuer-domain goes with --oidc');
+  }
   if (oidc && tokenFromStdin) {
     throw new Error('registry-credential set: choose --oidc or --token-stdin, not both');
   }
 
   let auth;
   if (oidc) {
-    auth = { kind: 'oidc' };
+    // The domain whose issuer (https://auth.<domain>) the registry trusts; the primary when absent.
+    auth = { kind: 'oidc', ...(issuerDomain ? { issuerDomain } : {}) };
   } else {
     let token = tokenFromStdin ? (await readStdin()).trim() : process.env.LAMASTE_REGISTRY_TOKEN;
     if (!token) {

package/vendor/server/src/commands/sites.js

@@ -61,6 +61,7 @@ ${b('Create options:')}
   --type <type>         Site type: managed (default) or custom
   --custom-domain <d>   Custom domain (required if type is custom)
   --aliases <a,b>       Hostnames that redirect to the custom domain (e.g. www.<domain>)
+  --domain <domain>     A managed site's base domain, an active one (default: the primary)
   --spa                 Enable SPA mode (single-page application routing)
   --authelia            Enable Authelia protection
 `);
@@ -124,6 +125,7 @@ async function createSite(args, { json }) {
   const type = getArg(args, 'type') || 'managed';
   const customDomain = getArg(args, 'custom-domain') || undefined;
   const aliasArg = getArg(args, 'aliases');
+  const domain = getArg(args, 'domain');
   const spaMode = args.includes('--spa');
   const autheliaProtected = args.includes('--authelia');
 
@@ -152,6 +154,7 @@ async function createSite(args, { json }) {
   const body = { name, type, spaMode, autheliaProtected };
   if (customDomain) body.customDomain = customDomain;
   if (aliasArg) body.aliases = splitAliases(aliasArg);
+  if (domain) body.domain = domain.toLowerCase();
 
   if (!json) process.stderr.write(`  Creating site ${chalk.cyan(name)}...`);
 

package/vendor/server/src/commands/status.js

@@ -10,6 +10,8 @@ import { readConfigSafe, PANEL_SERVICE, GATEKEEPER_SERVICE, PKI_DIR } from '../c
 import { getMtlsCerts } from '@lamalibre/lamaste/server';
 import { exec } from '../exec.js';
 import { emit } from '../ndjson.js';
+import { panelRequest } from '../panel-api.js';
+import { domainRows } from '../domains.js';
 
 /**
  * @param {{ json: boolean }} options
@@ -20,6 +22,15 @@ export async function runStatus({ json }) {
 
   // Collect service statuses
   const panelStatus = await getServiceStatus(PANEL_SERVICE);
+  // The relay's domains, from the running panel — asked while the other
+  // checks run, briefly; none while it is down or not onboarded.
+  const domainsRequest =
+    domain && panelStatus.active
+      ? panelRequest('GET', '/api/domains', null, { timeoutMs: 4000 }).then(
+          (r) => r.domains ?? [],
+          () => null,
+        )
+      : Promise.resolve(null);
   const gatekeeperStatus = await getServiceStatus(GATEKEEPER_SERVICE);
   const nginxStatus = await getServiceStatus('nginx');
   const autheliaStatus = await getServiceStatus('authelia');
@@ -35,10 +46,12 @@ export async function runStatus({ json }) {
   // Collect system info
   const uptime = await getUptime();
   const memory = await getMemoryUsage();
+  const domains = await domainsRequest;
 
   if (json) {
     emit({
       domain,
+      domains,
       services: {
         panel: panelStatus,
         gatekeeper: gatekeeperStatus,
@@ -66,6 +79,12 @@ export async function runStatus({ json }) {
   if (domain) {
     console.log(`  ${b('Domain:')}     ${c(String(domain))}`);
   }
+  if (domains && domains.length > 1) {
+    console.log(`  ${b('Domains:')}`);
+    for (const row of domainRows(domains)) {
+      console.log(`    ${c(row.name)} ${d(`${row.state}, ${row.members} member(s)`)}`);
+    }
+  }
 
   if (uptime) {
     console.log(`  ${b('Uptime:')}     ${d(uptime)}`);

package/vendor/server/src/commands/tunnels.js

@@ -89,6 +89,7 @@ ${b('Create options:')}
   --description <text>  Optional description
   --access-mode <mode>  Access mode: public, authenticated, restricted (default: restricted)
   --max-body-mb <n>     Largest request body in MiB, 1-10240 (default: 10)
+  --domain <domain>     Base domain of the hostname, an active one (default: the primary)
 `);
 }
 
@@ -125,7 +126,7 @@ async function listTunnels({ json }) {
     const carrier = t.agentLabel ? d(`via ${t.agentLabel}`) : r('no agent');
     const bodyLimit = t.type !== 'panel' ? d(`${t.maxBodySizeMb ?? 1} MiB`) : '';
     console.log(
-      `  ${c(t.subdomain)} \u2192 :${t.port}  ${enabled} ${carrier} ${accessMode} ${bodyLimit} ${type}`.trimEnd(),
+      `  ${c(t.fqdn ?? t.subdomain)} \u2192 :${t.port}  ${enabled} ${carrier} ${accessMode} ${bodyLimit} ${type}`.trimEnd(),
     );
     if (t.description) {
       console.log(`    ${d(t.description)}`);
@@ -150,6 +151,7 @@ async function createTunnel(args, { json }) {
   const accessMode = getArg(args, 'access-mode') || undefined;
   const agentLabel = getArg(args, 'agent');
   const maxBodyStr = getArg(args, 'max-body-mb');
+  const domain = getArg(args, 'domain');
 
   if (!subdomain || !portStr || !agentLabel) {
     const msg = 'Error: --subdomain, --port and --agent are required';
@@ -180,6 +182,7 @@ async function createTunnel(args, { json }) {
   if (description) body.description = description;
   if (accessMode) body.accessMode = accessMode;
   if (maxBodySizeMb !== undefined) body.maxBodySizeMb = maxBodySizeMb;
+  if (domain) body.domain = domain.toLowerCase();
 
   if (!json) process.stderr.write(`  Creating tunnel ${chalk.cyan(subdomain)} \u2192 :${port}...`);
 

package/vendor/server/src/commands/users.js

@@ -31,9 +31,11 @@
 
 import chalk from 'chalk';
 import { panelRequest } from '../panel-api.js';
-import { emit, emitComplete, emitError } from '../ndjson.js';
+import { emit, emitComplete } from '../ndjson.js';
+import { fail } from '../fail.js';
 import { parseUserArgs, warningLine } from '../plugin-identity.js';
 import { formatMoment, terminalText } from '../plugin-settings.js';
+import { membershipsText } from '../domains.js';
 
 /**
  * @param {string[]} args  Subcommand args: ['list'] | ['disable', '<u>'] | ...
@@ -78,21 +80,6 @@ ${b('Subcommands:')}
 `);
 }
 
-/**
- * Exit with a usage error or a refused request, as text or NDJSON (with
- * the refusal's `code`, e.g. `last_admin`, `user_not_removed`).
- *
- * @param {string} message
- * @param {boolean} json
- * @param {{ code?: string }} [err]
- * @returns {never}
- */
-function fail(message, json, err = {}) {
-  if (json) emitError(message, false, typeof err.code === 'string' ? { code: err.code } : {});
-  else console.error(`\n  ${chalk.red(terminalText(message))}\n`);
-  process.exit(1);
-}
-
 /** Print a change's warnings: what the panel could not complete beside it. */
 function printWarnings(warnings) {
   for (const warning of warnings ?? []) {
@@ -107,7 +94,8 @@ function statusCell(status) {
 
 /**
  * The rows `users list` prints: each user's username, status, directory id
- * (a dash until the directory has seen them) and groups, as terminal text.
+ * (a dash until the directory has seen them), groups and domain memberships
+ * (external ones marked), as terminal text.
  * Pure, exported for tests.
  *
  * @param {Array<Record<string, any>>} users  as `GET /api/users` lists them
@@ -118,6 +106,7 @@ export function userRows(users) {
     status: u.status === 'disabled' ? 'disabled' : 'active',
     userId: u.userId ? terminalText(u.userId) : '—',
     groups: terminalText((u.groups ?? []).join(', ')),
+    domains: membershipsText(u.domains),
   }));
 }
 
@@ -142,11 +131,11 @@ async function listUsers({ json }) {
   console.log('');
   console.log(chalk.bold('  Users'));
   console.log(
-    chalk.dim(`  ${'USERNAME'.padEnd(width)}  STATUS    ${'USER ID'.padEnd(36)}  GROUPS`),
+    chalk.dim(`  ${'USERNAME'.padEnd(width)}  STATUS    ${'USER ID'.padEnd(36)}  DOMAINS  GROUPS`),
   );
   for (const r of rows) {
     console.log(
-      `  ${chalk.cyan(r.username.padEnd(width))}  ${statusCell(r.status)}  ${r.userId.padEnd(36)}  ${chalk.dim(r.groups)}`,
+      `  ${chalk.cyan(r.username.padEnd(width))}  ${statusCell(r.status)}  ${r.userId.padEnd(36)}  ${r.domains}  ${chalk.dim(r.groups)}`,
     );
   }
   if (rows.some((r) => r.userId === '—')) {