@lamalibre/create-lamaste 4.6.0 → 4.7.0

package/vendor/server/src/domains.js

@@ -0,0 +1,92 @@
+/**
+ * The relay's domains as `lamaste-server domains` prints them — pure
+ * helpers, exported for tests (the command is src/commands/domains.js).
+ */
+
+import { terminalText } from './plugin-settings.js';
+
+/**
+ * One row per domain: name, state, members, what uses it — as terminal text.
+ *
+ * @param {Array<Record<string, any>>} domains  as `GET /api/domains` lists them
+ */
+export function domainRows(domains) {
+  return domains.map((d) => ({
+    name: terminalText(d.name),
+    state: d.status === 'active' ? (d.primary ? 'primary' : 'active') : 'pending',
+    members: Number.isInteger(d.members) ? d.members : 0,
+    externalMembers: Number.isInteger(d.externalMembers) ? d.externalMembers : 0,
+    usedBy: usageText(d.usedBy),
+  }));
+}
+
+/** What uses a domain, in one line (empty when nothing does). */
+export function usageText(usedBy) {
+  if (!usedBy) return '';
+  const parts = [];
+  const count = (label, items) => {
+    if (Array.isArray(items) && items.length > 0) parts.push(`${items.length} ${label}`);
+  };
+  count('tunnel(s)', usedBy.tunnels);
+  count('site(s)', usedBy.sites);
+  count('plugin(s)', usedBy.plugins);
+  if (usedBy.registry) parts.push('the registry credential');
+  return parts.join(', ');
+}
+
+/** `/api/domains/<name><rest>`. */
+export function domainPath(name, rest = '') {
+  return `/api/domains/${encodeURIComponent(name)}${rest}`;
+}
+
+/**
+ * A user's memberships in one line — `a.example, b.example (external)` —
+ * as terminal text; `—` for none. A bare name (an older panel's answer) is
+ * a member.
+ *
+ * @param {ReadonlyArray<string | { name: string, kind?: string }> | undefined} domains
+ */
+export function membershipsText(domains) {
+  const parts = (domains ?? []).flatMap((d) => {
+    const name = typeof d === 'string' ? d : d?.name;
+    if (typeof name !== 'string') return [];
+    return [terminalText(d?.kind === 'external' ? `${name} (external)` : name)];
+  });
+  return parts.length > 0 ? parts.join(', ') : '—';
+}
+
+/** Whether any of `domains` is an external membership. */
+export function isExternalAnywhere(domains) {
+  return (domains ?? []).some((d) => d?.kind === 'external');
+}
+
+/**
+ * What `domains members <domain> <action> <user> …` asks the panel, or
+ * null for a command line it does not take:
+ *
+ * - `add <user> [--external]` — a member (an external one with the flag);
+ * - `kind <user> member|external` — change the kind of a membership;
+ * - `remove <user>` — end it.
+ *
+ * `user` is a directory id or a username.
+ *
+ * @param {string} domain
+ * @param {string[]} rest  what follows `members <domain>`
+ * @returns {{ method: 'PUT' | 'DELETE', path: string, body: object | null, user: string, kind: 'member' | 'external' | null } | null}
+ */
+export function memberRequest(domain, rest) {
+  const [action, user, ...more] = rest;
+  if (!user) return null;
+  const path = domainPath(domain, `/members/${encodeURIComponent(user)}`);
+  if (action === 'remove' && more.length === 0) {
+    return { method: 'DELETE', path, body: null, user, kind: null };
+  }
+  if (action === 'add' && more.every((a) => a === '--external')) {
+    const kind = more.length > 0 ? 'external' : 'member';
+    return { method: 'PUT', path, body: { kind }, user, kind };
+  }
+  if (action === 'kind' && more.length === 1 && (more[0] === 'member' || more[0] === 'external')) {
+    return { method: 'PUT', path, body: { kind: more[0] }, user, kind: more[0] };
+  }
+  return null;
+}

package/vendor/server/src/fail.js

@@ -0,0 +1,21 @@
+/**
+ * Exit a command with a usage error or a panel refusal — as text, or as an
+ * NDJSON error carrying the refusal's `code` (e.g. `last_admin`,
+ * `domain_in_use`). The message is printed only as terminal text.
+ */
+
+import chalk from 'chalk';
+import { emitError } from './ndjson.js';
+import { terminalText } from './plugin-settings.js';
+
+/**
+ * @param {string} message
+ * @param {boolean} json
+ * @param {{ code?: string }} [err]
+ * @returns {never}
+ */
+export function fail(message, json, err = {}) {
+  if (json) emitError(message, false, typeof err.code === 'string' ? { code: err.code } : {});
+  else console.error(`\n  ${chalk.red(terminalText(message))}\n`);
+  process.exit(1);
+}

package/vendor/server/src/oidc-client-grants.js

@@ -0,0 +1,63 @@
+/**
+ * Grants on a plugin's user-facing OIDC clients as `lamaste-server plugins
+ * oidc-clients` takes and prints them — pure helpers, exported for tests
+ * (the command is src/commands/plugins.js).
+ *
+ * A grant is a Gatekeeper grant with `resourceType: 'oidc-client'` and the
+ * client id as `resourceId`; members of the plugin's domain sign in without
+ * one, an external member only with one (to them or a Lamaste group they
+ * belong to).
+ */
+
+import { terminalText } from './plugin-settings.js';
+
+/** The Gatekeeper resource type of a grant on an OIDC client. */
+export const OIDC_CLIENT_RESOURCE = 'oidc-client';
+
+/**
+ * The principal `--user <username>` or `--group <name>` names — exactly one
+ * of them — or null.
+ *
+ * @param {string[]} args
+ * @returns {{ principalType: 'user' | 'group', principalId: string } | null}
+ */
+export function parsePrincipal(args) {
+  if (args.length !== 2) return null;
+  const [flag, id] = args;
+  if (!id || id.startsWith('--')) return null;
+  if (flag === '--user') return { principalType: 'user', principalId: id };
+  if (flag === '--group') return { principalType: 'group', principalId: id };
+  return null;
+}
+
+/** A grant's principal in words: the username, or `group:<name>`. */
+export function principalText(grant) {
+  return terminalText(
+    grant.principalType === 'group' ? `group:${grant.principalId}` : grant.principalId,
+  );
+}
+
+/**
+ * Every grant on `clientId` that names `principal`, among the clients
+ * `GET /api/plugins/:name/oidc-clients` lists — Gatekeeper may hold more
+ * than one (grants differing only in their context), and revoking means
+ * revoking them all — or why there is none to revoke: `no_client` (not a
+ * user-facing client of the plugin), `unreadable` (Gatekeeper could not be
+ * read), `no_grant`.
+ *
+ * @param {ReadonlyArray<Record<string, any>>} clients
+ * @param {string} clientId
+ * @param {{ principalType: string, principalId: string }} principal
+ * @returns {{ grantIds: string[] } | { error: 'no_client' | 'unreadable' | 'no_grant' }}
+ */
+export function findClientGrants(clients, clientId, principal) {
+  const client = clients.find((c) => c.id === clientId && c.userFacing);
+  if (!client) return { error: 'no_client' };
+  if (!Array.isArray(client.grants)) return { error: 'unreadable' };
+  const grantIds = client.grants
+    .filter(
+      (g) => g.principalType === principal.principalType && g.principalId === principal.principalId,
+    )
+    .map((g) => g.grantId);
+  return grantIds.length > 0 ? { grantIds } : { error: 'no_grant' };
+}

package/vendor/server/src/panel-api.js

@@ -129,6 +129,20 @@ export async function withCurlConfig(content, fn) {
  * @param {{ identity: { certPath: string, address: string, port: number }, method: string, path: string, body?: Record<string, unknown> | null, p12Path: string, configPath: string }} request
  * @returns {{ args: string[], input: string | undefined }}
  */
+/**
+ * Refuse a request path with a `.` or `..` segment: curl and `fetch`
+ * resolve them (`/api/domains/../activate` → `/api/activate`), so a value
+ * put into a path — a domain, a user, a plugin — could name another route.
+ * Every path the client sends passes here; values are percent-encoded as
+ * usual where the path is built.
+ */
+export function assertPanelPath(path) {
+  const route = String(path).split(/[?#]/, 1)[0];
+  if (route.split('/').some((segment) => segment === '.' || segment === '..')) {
+    throw new Error('A panel request path may not have a "." or ".." segment');
+  }
+}
+
 export function buildPanelCurlRequest({
   identity,
   method,
@@ -137,6 +151,7 @@ export function buildPanelCurlRequest({
   p12Path,
   configPath,
 }) {
+  assertPanelPath(path);
   const { certPath, address, port } = identity;
   const args = [
     '-q', // No .curlrc — it must be the first argument