@lamalibre/create-lamaste 4.6.0 → 4.7.0

package/vendor/serverd/src/lib/plugin-oidc.js

@@ -19,6 +19,16 @@
  * `identity_providers.oidc` section is written; Authelia is restarted only
  * when the section actually changed.
  *
+ * Every client belongs to a domain — its plugin's (the panel's own: the
+ * registry credential's issuer domain): `{domain}` in its audience and
+ * redirect URIs is that domain, and a user-facing client has its own
+ * authorization policy (core `renderOidcClientPolicies`): that domain's
+ * members, and its external members granted the client (a Gatekeeper grant
+ * `resourceType: 'oidc-client'`, rendered by lib/domains.js into users.yml's
+ * owned groups). The provider is written under lib/domains.js
+ * `withDomainRendering` — the one writer of what members may do — with the
+ * domains read under it.
+ *
  * Best effort by design where a plugin lifecycle calls it: a failure here
  * must not fail the plugin operation — the caller logs it and the next
  * lifecycle change retries.
@@ -26,9 +36,11 @@
 
 import { readFile } from 'node:fs/promises';
 import { createRequire } from 'node:module';
-import { validateManifest } from '@lamalibre/lamaste';
+import { PromiseChainMutex, validateInstalledManifest } from '@lamalibre/lamaste';
 import {
   LAMASTE_REGISTRY_OIDC_SCOPES,
+  LAMASTE_SERVER_OIDC_CLIENT_ID,
+  registryIssuerDomain,
   lamasteServerOidcClient,
   listOidcClientSecrets,
   reconcileOidcClientSecrets,
@@ -36,32 +48,43 @@ import {
   rotateOidcClientSecret,
 } from '@lamalibre/lamaste/server';
 
-import { getConfig } from './config.js';
 import { updateOidcProvider } from './authelia.js';
+import { listGrantsOfType } from './gatekeeper-client.js';
+import { OIDC_CLIENT_RESOURCE, isUserFacingOidcClient } from './owned-groups.js';
+import { pluginDomainOr, primaryDomainName, withDomainRendering } from './domains.js';
 import { readPlugins } from './plugins.js';
 import { readRegistryCredentialConfig } from './registry-credential.js';
 
 const STATE_DIR = process.env.LAMALIBRE_LAMASTE_STATE_DIR || '/etc/lamalibre/lamaste';
 
+/** The domains a rendering read, as the OIDC provider's policies name them: name and group key. */
+const keyed = (domains) => domains.map(({ name, groupKey }) => ({ name, groupKey }));
+
 /**
  * The OIDC clients every installed plugin declares, tagged with the plugin
- * name and whether the plugin is enabled. Manifests are re-read from the
- * installed packages — the plugin registry does not store them.
+ * name, its domain and whether the plugin is enabled. Manifests are re-read
+ * from the installed packages — the plugin registry does not store them.
  * @returns {Promise<Array<import('@lamalibre/lamaste/server').AutheliaOidcClient & { enabled: boolean }>>}
  */
 export async function collectPluginOidcClients() {
   const require = createRequire(`${STATE_DIR}/`);
+  const primary = await primaryDomainName();
   const clients = [];
   for (const plugin of (await readPlugins()).plugins) {
     let manifest;
     try {
       const manifestPath = require.resolve(`${plugin.packageName}/lamaste-plugin.json`);
-      manifest = validateManifest(JSON.parse(await readFile(manifestPath, 'utf-8')));
+      manifest = validateInstalledManifest(JSON.parse(await readFile(manifestPath, 'utf-8')));
     } catch {
       continue; // an unreadable manifest contributes no clients
     }
     for (const client of manifest.oidcClients) {
-      clients.push({ ...client, plugin: manifest.name, enabled: plugin.status === 'enabled' });
+      clients.push({
+        ...client,
+        plugin: manifest.name,
+        domain: pluginDomainOr(plugin, primary),
+        enabled: plugin.status === 'enabled',
+      });
     }
   }
   return clients;
@@ -69,31 +92,77 @@ export async function collectPluginOidcClients() {
 
 /**
  * The panel's own client, when the registry credential (stored, or the
- * candidate being verified) uses it.
- * @param {{ registryUrl: string } | null | undefined} registryAuth
+ * candidate being verified) uses it — of the credential's issuer domain.
+ * @param {{ registryUrl: string, issuerDomain?: string } | null | undefined} registryAuth
  */
-function lamasteOwnClient(registryAuth) {
+async function lamasteOwnClient(registryAuth) {
   if (!registryAuth) return [];
-  return [{ ...lamasteServerOidcClient(registryAuth.registryUrl), enabled: true }];
+  const domain = registryIssuerDomain(
+    { kind: 'oidc', clientId: LAMASTE_SERVER_OIDC_CLIENT_ID, ...registryAuth },
+    await primaryDomainName(),
+  );
+  return [{ ...lamasteServerOidcClient(registryAuth.registryUrl, domain), enabled: true }];
+}
+
+/**
+ * A registry credential being set (`PUT /api/registry-credential`): its
+ * `registryAuth` while the panel's client is synced, the chain verified and
+ * the credential stored. Every sync that names no override serves it — the
+ * identity tick's every-minute sync included, which otherwise reads the
+ * stored credential, removes the client the candidate needs and restarts
+ * Authelia under the verification's token request. Every sync reads it under
+ * the one writer ({@link syncOidcClients}), so none can write a plan made
+ * before it was set.
+ * @type {{ registryUrl: string, issuerDomain?: string } | undefined}
+ */
+let registryCandidate;
+const registryCandidateMutex = new PromiseChainMutex();
+
+/**
+ * Run `fn` with `registryAuth` as the candidate registry credential
+ * (see {@link registryCandidate}); one candidate at a time. Without one
+ * (a pasted token), `fn` just runs.
+ * @template T
+ * @param {{ registryUrl: string, issuerDomain?: string } | undefined} registryAuth
+ * @param {() => Promise<T>} fn
+ * @returns {Promise<T>}
+ */
+export function withRegistryCandidate(registryAuth, fn) {
+  if (registryAuth === undefined) return fn();
+  return registryCandidateMutex.run(async () => {
+    registryCandidate = registryAuth;
+    try {
+      return await fn();
+    } finally {
+      registryCandidate = undefined;
+    }
+  });
 }
 
 /**
  * Everything Authelia should know, from the stored state.
- * @param {{ registryAuth?: { registryUrl: string } | null }} [overrides]
+ * @param {{ registryAuth?: { registryUrl: string, issuerDomain?: string } | null }} [overrides]
  *   `registryAuth` replaces the stored registry credential's say in the
- *   matter: `{ registryUrl }` while a candidate oidc credential is being
- *   verified, `null` to leave the panel's client out.
+ *   matter: `{ registryUrl, issuerDomain }` while a candidate oidc
+ *   credential is being verified, `null` to leave the panel's client out.
  */
 async function collectAllClients(overrides = {}) {
   let registryAuth;
   if (overrides.registryAuth !== undefined) {
     registryAuth = overrides.registryAuth;
+  } else if (registryCandidate !== undefined) {
+    registryAuth = registryCandidate;
   } else {
     const stored = await readRegistryCredentialConfig().catch(() => null);
     registryAuth =
-      stored && stored.auth.kind === 'oidc' ? { registryUrl: stored.registryUrl } : null;
+      stored && stored.auth.kind === 'oidc'
+        ? {
+            registryUrl: stored.registryUrl,
+            ...(stored.auth.issuerDomain ? { issuerDomain: stored.auth.issuerDomain } : {}),
+          }
+        : null;
   }
-  return [...(await collectPluginOidcClients()), ...lamasteOwnClient(registryAuth)];
+  return [...(await collectPluginOidcClients()), ...(await lamasteOwnClient(registryAuth))];
 }
 
 /**
@@ -103,7 +172,7 @@ async function collectAllClients(overrides = {}) {
  * enabled plugins served, and the panel's own scopes when its client is.
  * Pure with respect to Authelia — nothing is written.
  *
- * @param {{ registryAuth?: { registryUrl: string } | null }} [overrides] see collectAllClients
+ * @param {{ registryAuth?: { registryUrl: string, issuerDomain?: string } | null }} [overrides] see collectAllClients
  * @returns {Promise<{
  *   confidential: Array<{ id: string, plugin: string }>,
  *   served: Array<import('@lamalibre/lamaste/server').AutheliaOidcClient>,
@@ -123,37 +192,41 @@ export async function planOidcClients(overrides = {}) {
 /**
  * Sync Authelia's OIDC clients and the secret store with the plugins and
  * the registry credential. Returns what was done, or `null` when the panel
- * has no domain yet (onboarding).
+ * has no domain yet (onboarding). Plan, secrets and write all happen under
+ * the one writer: a sync that waited for it plans from what is true then,
+ * never from before another sync's change (a registry credential being
+ * set, a plugin moved).
  *
  * @param {import('pino').Logger} logger
- * @param {{ registryAuth?: { registryUrl: string } | null }} [overrides] see collectAllClients
  * @returns {Promise<{ changed: boolean, clients: string[], createdSecrets: Array<{ id: string, plugin: string, secret: string }> } | null>}
  */
-export async function syncOidcClients(logger, overrides = {}) {
-  let domain = null;
-  try {
-    domain = getConfig().domain;
-  } catch {
-    domain = null;
-  }
-  if (!domain) {
+export async function syncOidcClients(logger) {
+  if (!(await primaryDomainName())) {
     logger.debug('OIDC client sync skipped — no domain configured yet');
     return null;
   }
 
-  const { confidential, served, scopes } = await planOidcClients(overrides);
-  const reconciled = await reconcileOidcClientSecrets(STATE_DIR, confidential);
+  const { served, reconciled, result } = await withDomainRendering(
+    async (domains) => {
+      const plan = await planOidcClients();
+      const secrets = await reconcileOidcClientSecrets(STATE_DIR, plan.confidential);
+      return {
+        served: plan.served,
+        reconciled: secrets,
+        result: await updateOidcProvider(keyed(domains), plan.served, {
+          secretDigests: secrets.digests,
+          scopes: plan.scopes,
+        }),
+      };
+    },
+    { logger },
+  );
   if (reconciled.created.length > 0 || reconciled.removed.length > 0) {
     logger.info(
       { created: reconciled.created.map((c) => c.id), removed: reconciled.removed },
       'OIDC client secrets reconciled',
     );
   }
-
-  const result = await updateOidcProvider(domain, served, {
-    secretDigests: reconciled.digests,
-    scopes,
-  });
   if (result.changed) {
     logger.info({ clients: served.map((c) => c.id) }, 'Authelia OIDC provider updated');
   }
@@ -166,16 +239,37 @@ export async function syncOidcClients(logger, overrides = {}) {
 
 /**
  * Metadata of a plugin's OIDC clients: what the manifest declares, whether
- * it is served, and — for confidential clients — when the secret was
- * created and last rotated. Never the secret.
+ * it is served, whether it signs users in (`userFacing`) and — for those —
+ * the Gatekeeper grants on it (`grants`: who among the external members of
+ * its domain may sign in with it; members of the domain always may; null
+ * when Gatekeeper cannot be read), and — for confidential clients — when
+ * the secret was created and last rotated. Never the secret.
  * @param {string} pluginName
  */
 export async function listPluginOidcClients(pluginName) {
   const declared = (await collectPluginOidcClients()).filter((c) => c.plugin === pluginName);
   const secrets = new Map((await listOidcClientSecrets(STATE_DIR)).map((m) => [m.id, m]));
+  const grants = declared.some(isUserFacingOidcClient)
+    ? await listGrantsOfType(OIDC_CLIENT_RESOURCE)
+    : null;
   return declared.map((client) => {
     const secret = client.confidential ? (secrets.get(client.id) ?? null) : null;
     return {
+      userFacing: isUserFacingOidcClient(client),
+      ...(isUserFacingOidcClient(client)
+        ? {
+            grants: grants?.ok
+              ? grants.grants
+                  .filter((g) => g.resourceId === client.id)
+                  .map((g) => ({
+                    grantId: g.grantId,
+                    principalType: g.principalType,
+                    principalId: g.principalId,
+                    createdAt: g.createdAt,
+                  }))
+              : null,
+          }
+        : {}),
       id: client.id,
       name: client.name ?? null,
       confidential: client.confidential,
@@ -216,13 +310,21 @@ export async function rotatePluginOidcClientSecret(pluginName, clientId, logger)
   // The store is reconciled first so a client that was never synced (an
   // earlier Authelia failure) gets its record now.
   await syncOidcClients(logger);
-  const rotated = await rotateOidcClientSecret(STATE_DIR, clientId);
-  const digests = await readOidcClientSecretDigests(STATE_DIR);
-  if (client.enabled) {
-    const domain = getConfig().domain;
-    const { served, scopes } = await planOidcClients();
-    await updateOidcProvider(domain, served, { secretDigests: digests, scopes });
-  }
+  // Rotate, plan and write under the one writer (see syncOidcClients).
+  const rotated = await withDomainRendering(
+    async (domains) => {
+      const secret = await rotateOidcClientSecret(STATE_DIR, clientId);
+      if (client.enabled) {
+        const { served, scopes } = await planOidcClients();
+        await updateOidcProvider(keyed(domains), served, {
+          secretDigests: await readOidcClientSecretDigests(STATE_DIR),
+          scopes,
+        });
+      }
+      return secret;
+    },
+    { logger },
+  );
   logger.info({ plugin: pluginName, clientId }, 'OIDC client secret rotated');
   return {
     id: rotated.id,

package/vendor/serverd/src/lib/plugins.js

@@ -22,6 +22,7 @@ import {
   normalizeIdentityBlock,
   pluginHostCapability,
   validateManifest as coreValidateManifest,
+  validateInstalledManifest,
 } from '@lamalibre/lamaste';
 import { listRegisteredSubScopeNames } from './tickets.js';
 import { getStateDb } from './state-db.js';
@@ -74,8 +75,8 @@ async function getStmts() {
         (name, route, display_name, package_name, version, description, capabilities,
          packages, panel, config, modes, hosting, agent, hooks, hooks_entry_sha256,
          agent_half_pin, settings, identity, user_surface, web_tree_sha256, status,
-         installed_at, enabled_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+         installed_at, enabled_at, domain)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `),
     deleteByName: db.prepare('DELETE FROM plugins WHERE name = ?'),
     // The plugin's audience and the state of its identity feed
@@ -146,6 +147,8 @@ function rowToPlugin(row) {
   if (row.user_surface != null) entry.userSurface = JSON.parse(row.user_surface);
   if (row.web_tree_sha256 != null) entry.webTreeSha256 = row.web_tree_sha256;
   if (row.enabled_at != null) entry.enabledAt = row.enabled_at;
+  // The domain the plugin belongs to; null: the primary (lib/domains.js).
+  entry.domain = row.domain ?? null;
   return entry;
 }
 
@@ -233,6 +236,7 @@ export async function writePlugins(data) {
         p.status,
         p.installedAt,
         nullableString(p.enabledAt),
+        nullableString(p.domain),
       );
     }
     s.commit.run();
@@ -560,6 +564,8 @@ export function installPlugin(packageName, logger) {
         entry.status,
         entry.installedAt,
         null,
+        // A plugin installed now belongs to the primary domain (lib/plugin-domain.js moves it).
+        null,
       );
       s.commit.run();
     } catch (err) {
@@ -622,6 +628,13 @@ export function uninstallPlugin(name, logger) {
     const { removeRelayHooks } = await import('./plugin-hooks.js');
     await removeRelayHooks(name, logger);
 
+    // The OIDC clients it declares, read while its manifest is installed:
+    // their grants go with it below.
+    const { collectPluginOidcClients } = await import('./plugin-oidc.js');
+    const clientIds = (await collectPluginOidcClients().catch(() => []))
+      .filter((c) => c.plugin === name)
+      .map((c) => c.id);
+
     // Uninstall the npm package
     logger.info({ name, packageName: plugin.packageName }, 'Uninstalling plugin package');
     await execa('npm', ['uninstall', plugin.packageName], {
@@ -695,6 +708,24 @@ export function uninstallPlugin(name, logger) {
 
     logger.info({ name }, 'Plugin uninstalled');
     await syncOidcClientsBestEffort(logger);
+
+    // Grants on its OIDC clients end with it: client ids are chosen, not
+    // random, so a later install of the plugin (or another declaring the
+    // same id) would otherwise admit whoever was granted before.
+    const { revokeOidcClientGrants } = await import('./owned-groups.js');
+    const revoked = await revokeOidcClientGrants(clientIds);
+    if (!revoked.ok) {
+      logger.warn(
+        { name, err: revoked.error },
+        "Grants on the uninstalled plugin's OIDC clients stayed — revoke them in Gatekeeper",
+      );
+    } else if (revoked.revoked > 0) {
+      logger.info({ name, revoked: revoked.revoked }, 'Grants on its OIDC clients revoked');
+      const { syncDomainAccess } = await import('./domains.js');
+      await syncDomainAccess({ logger }).catch((err) => {
+        logger.warn({ err: err.message }, 'Rendering domain access after an uninstall failed');
+      });
+    }
     return { ok: true, name };
   });
 }
@@ -785,9 +816,17 @@ export async function writePluginRow(
  * web tree's digest. The
  * row is not touched — the caller compares the result with what was
  * reviewed and then writes it. Refuses a package whose manifest names
- * another plugin.
+ * another plugin. `restoring` puts back the version that was installed (an
+ * update's revert): its manifest is read as an installed one, so a rule
+ * tightened since it was installed does not leave the revert half done.
  */
-export function replacePluginPackage(name, packageName, version, logger) {
+export function replacePluginPackage(
+  name,
+  packageName,
+  version,
+  logger,
+  { restoring = false } = {},
+) {
   return withPluginLock(async () => {
     const bare = bareLamalibrePackageName(packageName);
     const spec = `${bare}@${version}`;
@@ -809,7 +848,8 @@ export function replacePluginPackage(name, packageName, version, logger) {
     }
     const require = createRequire(`${STATE_DIR}/`);
     const manifestPath = require.resolve(`${bare}/lamaste-plugin.json`);
-    const manifest = validateManifest(JSON.parse(await readFile(manifestPath, 'utf-8')));
+    const raw = JSON.parse(await readFile(manifestPath, 'utf-8'));
+    const manifest = restoring ? validateInstalledManifest(raw) : validateManifest(raw);
     if (manifest.name !== name) {
       throw Object.assign(new Error(`${spec} is plugin "${manifest.name}", not "${name}"`), {
         statusCode: 400,

package/vendor/serverd/src/lib/registry-credential.js

@@ -57,6 +57,33 @@ export async function writeRegistryCredentialConfig(config) {
   resetRegistryTokenState();
 }
 
+/**
+ * Store `config` as the registry credential: written while its issuer
+ * domain is still an active domain (a domain's removal checks the
+ * credential under the same lock — 400 `unknown_domain` otherwise). When the
+ * registry's domains change (its issuer domain, the domain its host is
+ * under), the tokens of every user who is a member of none of the new ones
+ * are revoked: who may hold a token follows them. Returns the warnings.
+ *
+ * @param {object} config
+ * @param {{ logger?: import('pino').Logger }} [opts]
+ * @returns {Promise<Array<{ step: string, message: string }>>}
+ */
+export async function setRegistryCredential(config, { logger } = {}) {
+  const { registryDomainsOf, revokeRegistryTokensOutside, withActiveDomain } =
+    await import('./domains.js');
+  const issuerDomain = config.auth?.kind === 'oidc' ? config.auth.issuerDomain : undefined;
+  const change = await withActiveDomain(issuerDomain, async () => {
+    const before = await registryDomainsOf(await readRegistryCredentialConfig().catch(() => null));
+    await writeRegistryCredentialConfig(config);
+    const after = await registryDomainsOf(config);
+    const same = after.length === before.length && after.every((d) => before.includes(d));
+    return { changed: !same, after };
+  });
+  if (!change.changed) return [];
+  return revokeRegistryTokensOutside(change.after, config, logger);
+}
+
 export async function clearRegistryCredentialConfig() {
   const removed = await clearCore(STATE_DIR);
   resetRegistryTokenState();
@@ -70,9 +97,9 @@ export function resetRegistryTokenState() {
 }
 
 /**
- * What the core needs to run the OIDC chain for a credential: the relay
- * domain and the `lamaste-server` client secret. Pasted-token credentials
- * need nothing.
+ * What the core needs to run the OIDC chain for a credential: the primary
+ * domain (the issuer when the credential names no `issuerDomain`) and the
+ * `lamaste-server` client secret. Pasted-token credentials need nothing.
  * @param {{ auth: { kind: string } }} config
  */
 async function oidcDeps(config) {
@@ -166,10 +193,16 @@ export async function acquireAgentToken(agentLabel) {
  * @param {string} username
  * @param {{ before: string[], after: string[] } | { deleted: true }} change
  * @param {import('pino').Logger | undefined} log
- * @param {{ userId?: string | null }} [who]
+ * @param {{ userId?: string | null, config?: object }} [who] `config`: the credential
+ *   already read (a batch of revocations reads it once)
  */
-export async function revokeUserRegistryTokens(username, change, log, { userId = null } = {}) {
-  const config = await readRegistryCredentialConfig();
+export async function revokeUserRegistryTokens(
+  username,
+  change,
+  log,
+  { userId = null, config: given } = {},
+) {
+  const config = given ?? (await readRegistryCredentialConfig());
   if (!config) return null;
 
   const lost =

package/vendor/serverd/src/lib/services.js

@@ -1,4 +1,5 @@
 import { execa } from 'execa';
+import { autheliaReady } from '@lamalibre/lamaste/server';
 
 export const ALLOWED_SERVICES = ['nginx', 'chisel', 'authelia', 'lamalibre-lamaste-serverd'];
 
@@ -120,7 +121,6 @@ export async function executeServiceAction(name, action) {
 
   try {
     await execa('sudo', ['systemctl', action, name], { timeout: 30_000 });
-    return { ok: true, name, action };
   } catch (err) {
     const details = err.stderr || err.message;
     const error = new Error(`Failed to ${action} ${name}`);
@@ -128,4 +128,12 @@ export async function executeServiceAction(name, action) {
     error.details = details;
     throw error;
   }
+  // systemctl returns when Authelia's process is spawned, before it serves
+  // requests: the action is done once it does.
+  if (name === 'authelia' && action !== 'stop' && !(await autheliaReady(execa))) {
+    const error = new Error(`Authelia is not serving requests after ${action}`);
+    error.statusCode = 500;
+    throw error;
+  }
+  return { ok: true, name, action };
 }

package/vendor/serverd/src/lib/state.js

@@ -48,6 +48,16 @@ export async function writeTunnels(tunnels) {
   await fd.close();
 
   await rename(tmpPath, filePath);
+  await hostsChanged();
+}
+
+/**
+ * A tunnel or a site changed: the hosts that name external members are
+ * rendered again shortly (lib/domains.js `scheduleHostRender`).
+ */
+async function hostsChanged() {
+  const { scheduleHostRender } = await import('./domains.js');
+  scheduleHostRender();
 }
 
 function sitesPath() {
@@ -93,6 +103,7 @@ export async function writeSites(sites) {
   await fd.close();
 
   await rename(tmpPath, filePath);
+  await hostsChanged();
 }
 
 /** Serializes every read-modify-write of sites.json in this process. */

package/vendor/serverd/src/lib/tunnel-deps.js

@@ -7,8 +7,7 @@
 
 import {
   writePublicVhost,
-  writeAuthenticatedVhost,
-  writeRestrictedVhost,
+  writeGatekeeperVhost,
   removeAppVhost,
   enableAppVhost,
   disableAppVhost,
@@ -23,8 +22,7 @@ import { readTunnels, writeTunnels } from './state.js';
 
 export const tunnelNginxDeps = Object.freeze({
   writePublicVhost,
-  writeAuthenticatedVhost,
-  writeRestrictedVhost,
+  writeGatekeeperVhost,
   writeAgentPanelVhost,
   removeAppVhost,
   removeAgentPanelVhost,

package/vendor/serverd/src/lib/user-surface.js

@@ -57,11 +57,13 @@ import {
   TunnelError,
   bindUserSurface,
   releaseUserSurfaceRoute,
+  tunnelHost,
   unbindUserSurface,
 } from '@lamalibre/lamaste/server';
 import { httpError } from './app-error.js';
 import { recordAuditBestEffort } from './audit.js';
 import { getConfig } from './config.js';
+import { pluginDomainName } from './domains.js';
 import { installedVersionApproved } from './plugin-hooks.js';
 import { findPluginByRoute } from './plugins.js';
 import { relaySigner } from './relay-signing.js';
@@ -225,8 +227,8 @@ export async function withUserSurfaceStatus(tunnel) {
 // ---------------------------------------------------------------------------
 
 /**
- * What core's binding workflows need from the panel — among them its domain
- * and Let's Encrypt email, which a vhost rewrite needs.
+ * What core's binding workflows need from the panel — among them its Let's
+ * Encrypt email, which a vhost rewrite needs.
  */
 function bindingOptions(id, route, logger) {
   const config = getConfig();
@@ -236,7 +238,6 @@ function bindingOptions(id, route, logger) {
   return {
     id,
     route,
-    domain: config.domain,
     email: config.email,
     nginx: tunnelNginxDeps,
     certbot: tunnelCertbotDeps,
@@ -300,6 +301,26 @@ async function assertBindableRoute(route) {
   }
 }
 
+/**
+ * Refuse binding tunnel `id` as the user surface of the plugin at `route`
+ * when the tunnel's hostname is not on the plugin's domain (400
+ * `not_plugin_domain`): a plugin's users are its domain's members.
+ */
+async function assertOnPluginDomain(id, route) {
+  const tunnel = (await readTunnels()).find((t) => t.id === id);
+  const host = tunnel ? tunnelHost(tunnel) : null;
+  if (!host) return; // core refuses a tunnel without a hostname
+  const plugin = await findPluginByRoute(route);
+  const domain = await pluginDomainName(plugin);
+  if (host.domain !== domain) {
+    throw httpError(
+      `The tunnel is on ${host.domain}; the plugin holding '${route}' belongs to ${domain}`,
+      400,
+      { code: 'not_plugin_domain' },
+    );
+  }
+}
+
 /** Whether an installed agent-hosted plugin holds `route`. */
 async function isBindableRoute(route) {
   return assertBindableRoute(route).then(
@@ -329,7 +350,11 @@ async function isBindableRoute(route) {
 export async function bindTunnelUserSurface(id, route, { actor, logger }) {
   const result = await bindUserSurface({
     ...bindingOptions(id, route, logger),
-    assertRoute: assertBindableRoute,
+    // Under the tunnel lock, as the plugin's domain changes (lib/domains.js).
+    assertRoute: async (r) => {
+      await assertBindableRoute(r);
+      await assertOnPluginDomain(id, r);
+    },
   });
   if (result.changed && !(await isBindableRoute(route))) {
     await pruneUserSurfaceBindings(route, { plugin: null, logger });

package/vendor/serverd/src/lib/users-lock.js

@@ -0,0 +1,23 @@
+/**
+ * The users lock — the one lock around every read-modify-write of users.yml
+ * and every change of the user directory in this process (core's users
+ * functions take none), and around the changes that must agree with
+ * users.yml's groups: a membership's kind (an external member holds no
+ * Authelia group — lib/domains.js). Taken before the domains lock, never
+ * after it.
+ */
+
+import { PromiseChainMutex } from '@lamalibre/lamaste';
+
+const usersMutex = new PromiseChainMutex();
+
+/**
+ * Run `fn` holding the users lock.
+ *
+ * @template T
+ * @param {() => Promise<T>} fn
+ * @returns {Promise<T>}
+ */
+export function withUsersLock(fn) {
+  return usersMutex.run(fn);
+}