@lamalibre/create-lamaste 4.6.0 → 4.7.0

package/vendor/serverd/src/lib/vhost-reconcile.js

@@ -37,15 +37,27 @@
  * tunnel or agent backend keeps Authelia's session cookie from it
  * (`$lamaste_backend_cookie`), so an installed vhost from before that is
  * rewritten too.
+ *
+ * From the multi-domain relay, tunnel vhosts are named by their full
+ * hostname and every domain has its own auth portal
+ * (`lamalibre-lamaste-auth-<domain>`): {@link renameLegacyVhosts} renames
+ * the ones an older version named by subdomain, in one reload, before the
+ * reconcile renders them.
  */
 
-import { tunnelUserSurfaceRoutes } from '@lamalibre/lamaste';
-import { withTunnelLock } from '@lamalibre/lamaste/server';
+import { domainOfHost, tunnelUserSurfaceRoutes } from '@lamalibre/lamaste';
+import { tunnelHost, vhostTunnelHost, withTunnelLock } from '@lamalibre/lamaste/server';
 import {
+  LEGACY_AUTH_VHOST,
   PANEL_DOMAIN_VHOST,
+  agentPanelVhostName,
+  appVhostName,
+  authVhostName,
   installVhost,
   isSiteEnabled,
+  legacyTunnelVhostName,
   readInstalledVhost,
+  renameVhosts,
   renderAgentPanelVhost,
   renderAuthVhost,
   renderPanelVhost,
@@ -53,13 +65,12 @@ import {
   renderTunnelVhost,
   vhostCertDir,
 } from './nginx.js';
+import { notifyAdminsBestEffort } from './notifications.js';
 import { readSites, readTunnels } from './state.js';
 
 /** A subdomain or site id as it may appear in a site name. */
 const SITE_NAME_PART_RE = /^[A-Za-z0-9][A-Za-z0-9-]{0,62}$/;
 
-const AUTH_VHOST = 'lamalibre-lamaste-auth';
-
 /**
  * Which of a tunnel's bound routes its vhost serves now — the panel's
  * plugins and their hostings decide (`lib/user-surface.js`), loaded when
@@ -84,11 +95,10 @@ async function servedUserSurface(routes, tunnel) {
  * @returns {{ name: string, fqdn: string, config: string } | null}
  */
 export function expectedTunnelVhost(tunnel, certDir, userSurface = []) {
-  if (!managedTunnelVhostName(tunnel) || typeof tunnel.fqdn !== 'string') return null;
-  if (!tunnel.fqdn.startsWith(`${tunnel.subdomain}.`)) return null;
-  const domain = tunnel.fqdn.slice(tunnel.subdomain.length + 1);
+  if (!managedTunnelVhostName(tunnel)) return null;
+  const { fqdn, domain } = tunnelHost(tunnel);
   if (tunnel.type === 'panel') {
-    return renderAgentPanelVhost(tunnel.subdomain, domain, tunnel.port, certDir);
+    return renderAgentPanelVhost(fqdn, domain, tunnel.port, certDir);
   }
   // As createTunnel and updateTunnel write it: the stored access mode
   // (restricted when absent, as Gatekeeper reads it), the plugin route of a
@@ -97,21 +107,27 @@ export function expectedTunnelVhost(tunnel, certDir, userSurface = []) {
   // rendered, and a bound tunnel cannot be made public).
   const accessMode = tunnel.accessMode ?? 'restricted';
   if (accessMode === 'public' && userSurface.length > 0) return null;
-  return renderTunnelVhost(accessMode, tunnel.subdomain, domain, tunnel.port, certDir, {
+  return renderTunnelVhost(accessMode, fqdn, domain, tunnel.port, certDir, {
     ...(tunnel.type === 'plugin' && tunnel.pluginRoute ? { pathPrefix: tunnel.pluginRoute } : {}),
     ...(tunnel.maxBodySizeMb !== undefined ? { maxBodySizeMb: tunnel.maxBodySizeMb } : {}),
     ...(userSurface.length > 0 ? { userSurface } : {}),
   });
 }
 
-/** Site name of a tunnel's vhost, or null for a tunnel without one. */
+/**
+ * Site name of a tunnel's vhost — by its hostname — or null for a tunnel
+ * without one (internal, or whose state names no `<subdomain>.<domain>`).
+ */
 function managedTunnelVhostName(tunnel) {
-  if (tunnel.exposure === 'internal' || typeof tunnel.subdomain !== 'string') return null;
-  if (!SITE_NAME_PART_RE.test(tunnel.subdomain)) return null;
-  if (tunnel.type === 'panel') return `lamalibre-lamaste-agent-panel-${tunnel.subdomain}`;
+  if (typeof tunnel.subdomain !== 'string' || !SITE_NAME_PART_RE.test(tunnel.subdomain)) {
+    return null;
+  }
+  const host = vhostTunnelHost(tunnel);
+  if (host === null) return null;
+  if (tunnel.type === 'panel') return agentPanelVhostName(host.fqdn);
   // Tunnels persisted before `type` existed are app tunnels.
   if (tunnel.type === 'app' || tunnel.type === 'plugin' || tunnel.type === undefined) {
-    return `lamalibre-lamaste-app-${tunnel.subdomain}`;
+    return appVhostName(host.fqdn);
   }
   return null;
 }
@@ -295,43 +311,58 @@ export async function reconcileUserSurfaceVhosts(
   });
 }
 
-const defaultSiteDeps = { readSites, readInstalledVhost, installVhost, isSiteEnabled };
+const defaultSiteDeps = {
+  readSites,
+  readInstalledVhost,
+  installVhost,
+  isSiteEnabled,
+  notify: notifyAdminsBestEffort,
+};
 
 /**
  * Reconcile the vhosts that proxy a browser to the panel or ask Authelia
- * directly: the panel's own (`panel.<domain>`), the auth portal
- * (`auth.<domain>`) and every static site but a plugin's web surface. Call
- * it before the panel listens — then nothing can change a site meanwhile.
+ * directly: the panel's own (`panel.<primary>`), every active domain's auth
+ * portal (`auth.<domain>`) and every static site but a plugin's web surface.
+ * Call it before the panel listens — then nothing can change a site
+ * meanwhile.
  *
  * @param {Parameters<typeof logResult>[0]} log
- * @param {string} domain
+ * @param {ReadonlyArray<{ name: string, primary: boolean }>} domains the active domains
  * @param {typeof defaultSiteDeps} [deps]
  * @returns {Promise<ReturnType<typeof newResult>>}
  */
-export async function reconcileSiteVhosts(log, domain, deps = defaultSiteDeps) {
+export async function reconcileSiteVhosts(log, domains, deps = defaultSiteDeps) {
   const result = newResult();
+  const primary = domains.find((d) => d.primary)?.name;
 
-  await reconcileOne(
-    {
-      name: PANEL_DOMAIN_VHOST,
-      label: `panel.${domain}`,
-      render: (certDir) => renderPanelVhost(domain, certDir),
-      enabled: () => deps.isSiteEnabled(PANEL_DOMAIN_VHOST),
-    },
-    result,
-    deps,
-  );
+  if (primary) {
+    await reconcileOne(
+      {
+        name: PANEL_DOMAIN_VHOST,
+        label: `panel.${primary}`,
+        render: (certDir) => renderPanelVhost(primary, certDir),
+        enabled: () => deps.isSiteEnabled(PANEL_DOMAIN_VHOST),
+      },
+      result,
+      deps,
+    );
+  }
 
-  await reconcileOne(
-    {
-      name: AUTH_VHOST,
-      label: `auth.${domain}`,
-      render: (certDir) => renderAuthVhost(domain, certDir),
-      enabled: () => deps.isSiteEnabled(AUTH_VHOST),
-    },
-    result,
-    deps,
-  );
+  for (const domain of domains) {
+    const name = authVhostName(domain.name);
+    await reconcileOne(
+      {
+        name,
+        label: `auth.${domain.name}`,
+        render: (certDir) => renderAuthVhost(domain.name, certDir, { primary: domain.primary }),
+        enabled: () => deps.isSiteEnabled(name),
+      },
+      result,
+      deps,
+    );
+  }
+
+  const names = domains.map((d) => d.name);
 
   let sites = [];
   try {
@@ -339,17 +370,29 @@ export async function reconcileSiteVhosts(log, domain, deps = defaultSiteDeps) {
   } catch (err) {
     result.failed.push({ vhost: 'sites', error: err instanceof Error ? err.message : String(err) });
   }
+  const closed = [];
   for (const site of sites) {
     if (typeof site.id !== 'string' || !SITE_NAME_PART_RE.test(site.id)) continue;
     // A plugin's web surface is its plugin's to render (lib/web-surface.js
     // `reconcileWebSurfaces`, once plugins and hostings can be read).
     if (site.owner) continue;
+
     const name = `lamalibre-lamaste-site-${site.id}`;
     await reconcileOne(
       {
         name,
         label: site.fqdn ?? site.id,
-        render: (certDir) => renderStaticSiteVhost(site, certDir, domain),
+        render: (certDir) => {
+          const rendered = renderStaticSiteVhost(
+            site,
+            certDir,
+            typeof site.fqdn === 'string' ? domainOfHost(site.fqdn, names) : null,
+          );
+          // Protected, but under none of the relay's domains (possible since
+          // 4.6): it renders closed — said once, at the end.
+          if (rendered.closed) closed.push(site.fqdn);
+          return rendered;
+        },
         enabled: () => deps.isSiteEnabled(name),
         // A site still waiting for its DNS or certificate has no vhost yet.
         reportMissing: site.certIssued === true,
@@ -359,6 +402,71 @@ export async function reconcileSiteVhosts(log, domain, deps = defaultSiteDeps) {
     );
   }
 
+  if (closed.length > 0) {
+    log.warn(
+      { sites: closed },
+      'protected static sites under none of the relay domains are closed (403)',
+    );
+    await deps.notify(
+      {
+        source: 'lamaste',
+        level: 'warning',
+        message: `Protected static sites under none of this relay's domains answer 403 to everyone: ${closed.join(', ')}. Add their domain, or turn protection off.`,
+      },
+      log,
+    );
+  }
+  result.closed = closed;
+
   logResult(log, 'site', result);
   return result;
 }
+
+const defaultRenameDeps = { readTunnels, renameVhosts };
+
+/**
+ * Rename the vhosts an older version named by subdomain — every tunnel's
+ * (`lamalibre-lamaste-app-<subdomain>`, `-agent-panel-<subdomain>`) and the
+ * auth portal (`lamalibre-lamaste-auth`, the primary's) — to their names by
+ * hostname, in one reload ({@link renameVhosts} in nginx.js: same text, same
+ * link state; all of it undone when nginx refuses). Idempotent: a vhost
+ * already renamed, or never installed, is left alone. Before the panel
+ * listens, under the tunnel lock; a failure is logged and the old names keep
+ * serving (the next start tries again).
+ *
+ * @param {Parameters<typeof logResult>[0]} log
+ * @param {string} primary the primary domain
+ * @param {typeof defaultRenameDeps} [deps]
+ * @returns {Promise<string[]>} the names written
+ */
+export async function renameLegacyVhosts(log, primary, deps = defaultRenameDeps) {
+  return withTunnelLock(async () => {
+    const renames = [
+      { from: LEGACY_AUTH_VHOST, to: authVhostName(primary), serverName: `auth.${primary}` },
+    ];
+    for (const tunnel of await deps.readTunnels()) {
+      const to = managedTunnelVhostName(tunnel);
+      if (to === null) continue;
+      // Names by subdomain existed only on the primary domain, and an old
+      // file is the tunnel's only when it serves the tunnel's hostname — a
+      // same-subdomain tunnel of another domain never takes it.
+      if (tunnel.fqdn !== `${tunnel.subdomain}.${primary}`) continue;
+      renames.push({
+        from: legacyTunnelVhostName(tunnel.type, tunnel.subdomain),
+        to,
+        serverName: tunnel.fqdn,
+      });
+    }
+    try {
+      const renamed = await deps.renameVhosts(renames);
+      if (renamed.length > 0) log.info({ renamed }, 'Renamed vhosts to their hostnames');
+      return renamed;
+    } catch (err) {
+      log.error(
+        { err: err instanceof Error ? err.message : String(err) },
+        'Renaming vhosts to their hostnames failed; the old names keep serving',
+      );
+      return [];
+    }
+  });
+}

package/vendor/serverd/src/lib/web-surface.js

@@ -41,10 +41,12 @@ import {
 import {
   TUNNEL_MAX_BODY_MB,
   WEB_TREES_ROOT,
+  hostnameHolder,
   readWebTreeStore,
   removeWebTreeStore,
   stageWebTree,
   switchWebTree,
+  tunnelHost,
   webTreeStoreDir,
   withTunnelLock,
 } from '@lamalibre/lamaste/server';
@@ -53,12 +55,14 @@ import { recordAuditBestEffort } from './audit.js';
 import { getCertPath, issueTunnelCert } from './certbot.js';
 import { syncChisel } from './chisel.js';
 import { getConfig } from './config.js';
+import { domainOfHostname, pluginDomainName } from './domains.js';
 import {
   createGatekeeperGrant,
   listResourceGrants,
   revokeGatekeeperGrant,
 } from './gatekeeper-client.js';
 import {
+  appVhostName,
   installVhost,
   moveAppVhostToWebSurface,
   readInstalledVhost,
@@ -208,15 +212,25 @@ export async function webSurfaceServing(route, tunnels) {
 }
 
 /**
- * The vhost of the site `site` (owned by plugin `route`) as it should be
- * now, on certificate directory `certDir`.
+ * The active domain a plugin's site is under — always one: it is created
+ * on its plugin's domain, and a domain a site uses cannot be removed.
  */
-async function renderOwnedSite(site, route, certDir, tunnels) {
+async function siteDomain(site) {
+  const domain = await domainOfHostname(site.fqdn);
+  if (domain === null) throw new Error(`${site.fqdn} is under none of the relay's active domains`);
+  return domain;
+}
+
+/**
+ * The vhost of the site `site` (owned by plugin `route`, under `domain`)
+ * as it should be now, on certificate directory `certDir`.
+ */
+async function renderOwnedSite(site, route, certDir, tunnels, domain) {
   const serving = await webSurfaceServing(route, tunnels);
   const maxBodySizeMb = serving.plugin
     ? await internalTunnelBodyLimit(serving.plugin, tunnels)
     : undefined;
-  return renderWebSurfaceVhost(site, certDir, getConfig().domain, {
+  return renderWebSurfaceVhost(site, certDir, domain, {
     route,
     served: serving.served,
     maxBodySizeMb: maxBodySizeMb ?? TUNNEL_MAX_BODY_MB.default,
@@ -234,12 +248,12 @@ async function reconcileOwnedSiteVhost(site, route, tunnels) {
   // A move stopped between its state writes and the handover leaves the
   // tunnel's vhost linked beside the site's, on the same hostname.
   const moved = tunnels.find((t) => t.fqdn === site.fqdn && t.enabled === false && t.subdomain);
-  const unlinked = moved ? await deps.unlinkMovedAppVhost(moved.subdomain) : false;
+  const unlinked = moved ? await deps.unlinkMovedAppVhost(moved.fqdn) : false;
   const installed = await deps.readInstalledVhost(siteVhostName(site));
+  const domain = await siteDomain(site);
   const certDir =
-    (installed && vhostCertDir(installed)) ||
-    (await deps.getCertPath(site.fqdn, getConfig().domain));
-  const { name, fqdn, config } = await renderOwnedSite(site, route, certDir, tunnels);
+    (installed && vhostCertDir(installed)) || (await deps.getCertPath(site.fqdn, domain));
+  const { name, fqdn, config } = await renderOwnedSite(site, route, certDir, tunnels, domain);
   if (installed === config) {
     if (unlinked) await deps.reloadNginx();
     return unlinked;
@@ -328,10 +342,12 @@ export async function webSurfaceStatus(route) {
   let offer = null;
   if (!site && declared && !boundTunnel) {
     const subdomain = declared.defaultSubdomain;
+    const domain = await pluginDomainName(plugin);
     offer = {
       subdomain,
+      domain,
       accessMode: declared.accessMode,
-      available: (await hostnameTaken(subdomain, sites, tunnels)) === null,
+      available: (await hostnameTaken(subdomain, domain, sites, tunnels)) === null,
     };
   }
   return {
@@ -369,21 +385,18 @@ export async function webSurfaceStatus(route) {
 // ---------------------------------------------------------------------------
 
 /**
- * Why `subdomain` (of the relay's domain) cannot be a new web surface's
- * hostname, or null when it can: reserved, held by a tunnel, or taken by a
- * site (its name, hostname or an alias).
+ * Why `subdomain` of `domain` cannot be a new web surface's hostname, or
+ * null when it can: reserved, held by a tunnel, or taken by a site (its
+ * hostname or an alias — or its name: site names are unique relay-wide).
  */
-async function hostnameTaken(subdomain, sites, tunnels) {
+async function hostnameTaken(subdomain, domain, sites, tunnels) {
   if (!isWebSurfaceSubdomain(subdomain))
     return `'${subdomain}' cannot be a web surface's subdomain`;
-  const fqdn = `${subdomain}.${getConfig().domain}`;
-  if (tunnels.some((t) => t.subdomain === subdomain || t.fqdn === fqdn)) {
-    return `a tunnel holds '${subdomain}'`;
-  }
-  if (
-    sites.some((s) => s.name === subdomain || s.fqdn === fqdn || (s.aliases ?? []).includes(fqdn))
-  ) {
-    return `a site holds '${subdomain}'`;
+  const fqdn = `${subdomain}.${domain}`;
+  const holder = hostnameHolder(fqdn, { tunnels, sites });
+  if (holder) return `${holder.kind === 'tunnel' ? 'a tunnel' : 'a site'} holds '${fqdn}'`;
+  if (sites.some((s) => s.name === subdomain)) {
+    return `a site is named '${subdomain}'`;
   }
   return null;
 }
@@ -446,7 +459,7 @@ async function serveApprovedTree(plugin, logger) {
 }
 
 /**
- * Give plugin `route` its web surface on `subdomain` of the relay's domain
+ * Give plugin `route` its web surface on `subdomain` of the plugin's domain
  * (default: the one its manifest declares) with `accessMode` (default: the
  * declared one): a certificate, the site entry, the vhost. The plugin must
  * declare a web surface and own no site, and no tunnel may be bound as its
@@ -479,16 +492,23 @@ export function createWebSurface(route, input, { actor, logger }) {
           'bound_to_tunnel',
         );
       }
-      const taken = await hostnameTaken(subdomain, sites, tunnels);
+      const domain = await pluginDomainName(plugin);
+      const taken = await hostnameTaken(subdomain, domain, sites, tunnels);
       if (taken) throw refuse(`Cannot use '${subdomain}': ${taken}`, 409, 'hostname_taken');
 
       await serveApprovedTree(plugin, logger);
-      const fqdn = `${subdomain}.${config.domain}`;
+      const fqdn = `${subdomain}.${domain}`;
       const cert = await deps.issueTunnelCert(fqdn, config.email);
       const site = ownedSiteEntry({ id: crypto.randomUUID(), subdomain, fqdn, plugin, accessMode });
       await writeSites([...sites, site]);
       try {
-        const { name, config: vhost } = await renderOwnedSite(site, route, cert.certPath, tunnels);
+        const { name, config: vhost } = await renderOwnedSite(
+          site,
+          route,
+          cert.certPath,
+          tunnels,
+          domain,
+        );
         await deps.installVhost(name, vhost, fqdn, { enabled: true });
       } catch (err) {
         await writeSites(sites);
@@ -697,13 +717,10 @@ export function moveWebSurfaceFromTunnel(route, tunnelId, { actor, logger }) {
       let wroteSites = false;
       let wroteTunnels = false;
       try {
-        const config = getConfig();
-        const installed = await deps.readInstalledVhost(
-          `lamalibre-lamaste-app-${tunnel.subdomain}`,
-        );
+        const { domain } = tunnelHost(tunnel);
+        const installed = await deps.readInstalledVhost(appVhostName(tunnel.fqdn));
         const certDir =
-          (installed && vhostCertDir(installed)) ||
-          (await deps.getCertPath(tunnel.fqdn, config.domain));
+          (installed && vhostCertDir(installed)) || (await deps.getCertPath(tunnel.fqdn, domain));
         // The state first — Gatekeeper reads both files on a change of
         // either, so the old vhost's API requests already resolve to the
         // site — then one reload hands the hostname over, then the port
@@ -712,7 +729,7 @@ export function moveWebSurfaceFromTunnel(route, tunnelId, { actor, logger }) {
         wroteSites = true;
         await writeTunnels(movedTunnels);
         wroteTunnels = true;
-        await deps.moveAppVhostToWebSurface(tunnel.subdomain, site, certDir, config.domain, {
+        await deps.moveAppVhostToWebSurface(tunnel.fqdn, site, certDir, domain, {
           route,
           served: (await webSurfaceServing(route, movedTunnels)).served,
           maxBodySizeMb: await internalTunnelBodyLimit(plugin, movedTunnels),

package/vendor/serverd/src/middleware/user-access-session.js

@@ -1,6 +1,7 @@
 import fp from 'fastify-plugin';
 import { getConfig } from '../lib/config.js';
 import { findDirectoryUser } from '../lib/directory.js';
+import { isPrimaryMember } from '../lib/domains.js';
 import {
   REFRESH_THRESHOLD,
   validateUserSession,
@@ -38,11 +39,17 @@ async function userAccessSessionPlugin(fastify, _opts) {
       return reply.code(401).send({ error: 'user_session_required' });
     }
 
-    // The session's user must still hold the username, and be enabled: a
-    // deleted user's username given to someone else never inherits it, and
-    // a disabled user is out at once.
+    // The session's user must still hold the username, be enabled and be a
+    // member of the primary domain: a deleted user's username given to
+    // someone else never inherits it, and a disabled user, one whose
+    // membership ended or one made an external member is out at once.
     const holder = await findDirectoryUser(result.payload.username);
-    if (!holder || holder.userId !== result.payload.userId || holder.status !== 'active') {
+    if (
+      !holder ||
+      holder.userId !== result.payload.userId ||
+      holder.status !== 'active' ||
+      !(await isPrimaryMember(holder.userId))
+    ) {
       return reply.code(401).send({ error: 'user_session_required' });
     }
 

package/vendor/serverd/src/routes/invite.js

@@ -8,9 +8,9 @@ import {
   generateTotpSecret,
   writeTotpToDatabase,
 } from '../lib/authelia.js';
-import { getConfig } from '../lib/config.js';
 import { httpError } from '../lib/app-error.js';
 import { changeUsers, usersFileError } from '../lib/directory.js';
+import { invitationDomainsNow, invitationSignInDomain } from '../lib/domains.js';
 
 /**
  * Find an invitation by token using a constant-time comparison.
@@ -119,8 +119,11 @@ export default async function inviteRoutes(fastify, _opts) {
       return reply.code(500).send({ error: 'Failed to process password' });
     }
 
-    // Through the users lock: the directory gives the user their id before
-    // Authelia restarts and lets them sign in.
+    const grantedDomains = await invitationDomainsNow(invitation);
+
+    // Through the users lock: the directory gives the user their id, and
+    // the domains are rendered (their memberships, with the kinds the
+    // invitation named), before they can sign in.
     try {
       await changeUsers(
         async () => {
@@ -149,6 +152,12 @@ export default async function inviteRoutes(fastify, _opts) {
           // A removed user's grants, groups and second factors under the
           // username go first; a username with an OIDC identity is refused.
           creates: [invitation.username],
+          // The domains the invitation names that still are the ones it
+          // named (an invitation from before the multi-domain relay names
+          // none: the relay's one domain).
+          ...(Array.isArray(invitation.domains)
+            ? { domains: { [invitation.username]: grantedDomains } }
+            : {}),
           expect: (users) => users[invitation.username]?.password === hashedPassword,
         },
       );
@@ -191,8 +200,9 @@ export default async function inviteRoutes(fastify, _opts) {
       request.log.warn(err, 'Failed to update invitation status (user was created)');
     }
 
-    const config = getConfig();
-    const loginUrl = config.domain ? `https://auth.${config.domain}/` : null;
+    // The sign-in of the first domain the user is a member of.
+    const loginDomain = await invitationSignInDomain(invitation);
+    const loginUrl = loginDomain ? `https://auth.${loginDomain}/` : null;
 
     return {
       ok: true,