@lamalibre/create-lamaste 4.6.0 → 4.7.0

package/vendor/serverd/src/routes/management/domains.js

@@ -0,0 +1,154 @@
+/**
+ * The relay's base domains and their members (the multi-domain relay,
+ * lib/domains.js). Admin only (mTLS).
+ *
+ *   GET    /api/domains                          domains, member counts (members, external), what uses each
+ *   POST   /api/domains                          add one (`pending`)
+ *   POST   /api/domains/:name/verify-dns         does auth.<domain> resolve here?
+ *   POST   /api/domains/:name/activate           issue auth.<domain>, serve its sign-in
+ *   DELETE /api/domains/:name                    remove an unused, non-primary domain
+ *   GET    /api/domains/:name/members            its members, each with the membership's kind
+ *   PUT    /api/domains/:name/members/:user      make a user (id or username) a member —
+ *                                                `{ kind: 'member' | 'external' }`, member
+ *                                                unless named; another kind changes it
+ *   DELETE /api/domains/:name/members/:user      end a membership
+ *   PUT    /api/plugins/:name/domain             move a plugin to another domain
+ *
+ * Routes validate and answer; the work is in lib/domains.js and
+ * lib/plugin-domain.js. Refusals answer `{ error, code }`.
+ */
+
+import { z } from 'zod';
+import { DomainNameSchema, MEMBERSHIP_KINDS } from '@lamalibre/lamaste';
+import { actorFromRequest } from '../../lib/actor.js';
+import { sendFailure } from '../../lib/app-error.js';
+import {
+  activateDomain,
+  addDomain,
+  addDomainMember,
+  domainsOverview,
+  getDomain,
+  listDomainMembers,
+  newUsersNeedDomains,
+  removeDomain,
+  removeDomainMember,
+  verifyDomainDns,
+} from '../../lib/domains.js';
+import { setPluginDomain } from '../../lib/plugin-domain.js';
+
+const NameParamSchema = z.object({ name: DomainNameSchema });
+// `user`: a directory id or a username (lib/domains.js decides which).
+const MemberParamsSchema = z.object({ name: DomainNameSchema, user: z.string().min(1).max(64) });
+const AddDomainSchema = z.object({ name: DomainNameSchema }).strict();
+const MemberBodySchema = z.object({ kind: z.enum(MEMBERSHIP_KINDS).optional() }).strict();
+const PluginParamSchema = z.object({ name: z.string().min(1).max(200) });
+const PluginDomainSchema = z.object({ domain: DomainNameSchema }).strict();
+
+export default async function domainRoutes(fastify) {
+  const admin = { preHandler: fastify.requireRole(['admin']) };
+
+  fastify.get('/domains', admin, async () => {
+    const domains = await domainsOverview();
+    // Whether users and invitations must name their domains (`domains_required`).
+    return { domains, newUsersNeedDomains: newUsersNeedDomains(domains) };
+  });
+
+  fastify.post('/domains', admin, async (request, reply) => {
+    const { name } = AddDomainSchema.parse(request.body);
+    try {
+      const domain = await addDomain(name, {
+        actor: actorFromRequest(request),
+        logger: request.log,
+      });
+      return reply.code(201).send({ domain });
+    } catch (err) {
+      return sendFailure(request, reply, err, 'The domain change failed');
+    }
+  });
+
+  fastify.post(
+    '/domains/:name/verify-dns',
+    { ...admin, config: { rateLimit: { max: 30, timeWindow: '1 minute' } } },
+    async (request, reply) => {
+      const { name } = NameParamSchema.parse(request.params);
+      try {
+        return await verifyDomainDns(name);
+      } catch (err) {
+        return sendFailure(request, reply, err, 'The domain change failed');
+      }
+    },
+  );
+
+  fastify.post(
+    '/domains/:name/activate',
+    { ...admin, config: { rateLimit: { max: 10, timeWindow: '1 minute' } } },
+    async (request, reply) => {
+      const { name } = NameParamSchema.parse(request.params);
+      try {
+        const domain = await activateDomain(name, {
+          actor: actorFromRequest(request),
+          logger: request.log,
+        });
+        return { domain };
+      } catch (err) {
+        return sendFailure(request, reply, err, 'The domain change failed');
+      }
+    },
+  );
+
+  fastify.delete('/domains/:name', admin, async (request, reply) => {
+    const { name } = NameParamSchema.parse(request.params);
+    try {
+      return await removeDomain(name, { actor: actorFromRequest(request), logger: request.log });
+    } catch (err) {
+      return sendFailure(request, reply, err, 'The domain change failed');
+    }
+  });
+
+  fastify.get('/domains/:name/members', admin, async (request, reply) => {
+    const { name } = NameParamSchema.parse(request.params);
+    if (!(await getDomain(name))) {
+      return reply.code(404).send({ error: 'Domain not found', code: 'domain_not_found' });
+    }
+    return { members: await listDomainMembers(name) };
+  });
+
+  fastify.put('/domains/:name/members/:user', admin, async (request, reply) => {
+    const { name, user } = MemberParamsSchema.parse(request.params);
+    const { kind } = MemberBodySchema.parse(request.body ?? {});
+    try {
+      return await addDomainMember(name, user, {
+        ...(kind ? { kind } : {}),
+        actor: actorFromRequest(request),
+        logger: request.log,
+      });
+    } catch (err) {
+      return sendFailure(request, reply, err, 'The domain change failed');
+    }
+  });
+
+  fastify.delete('/domains/:name/members/:user', admin, async (request, reply) => {
+    const { name, user } = MemberParamsSchema.parse(request.params);
+    try {
+      return await removeDomainMember(name, user, {
+        actor: actorFromRequest(request),
+        logger: request.log,
+      });
+    } catch (err) {
+      return sendFailure(request, reply, err, 'The domain change failed');
+    }
+  });
+
+  fastify.put('/plugins/:name/domain', admin, async (request, reply) => {
+    const { name } = PluginParamSchema.parse(request.params);
+    const { domain } = PluginDomainSchema.parse(request.body);
+    try {
+      return await setPluginDomain(name, domain, {
+        actor: actorFromRequest(request),
+        logger: request.log,
+      });
+    } catch (err) {
+      return sendFailure(request, reply, err, 'The domain change failed');
+    }
+  });
+}

package/vendor/serverd/src/routes/management/gatekeeper-proxy.js

@@ -21,13 +21,24 @@
  * cannot be) — a reused username inherits nothing. The access log is purged
  * for one username by POST, its name in the body (never in a URL, which
  * logs keep).
+ *
+ * Grants and groups also decide what external members of a domain reach
+ * (packages/core/docs/external-members-design.md): after every change that
+ * went through, the domains are rendered (users.yml's owned groups — the
+ * restricted hosts and OIDC clients that name each external member), which
+ * follows whoever it narrowed (registry tokens, a device-code session). A
+ * rendering that fails is answered with `warnings` and tried again within
+ * seconds. A grant on an OIDC client (`resourceType: 'oidc-client'`) must
+ * name a user-facing client an installed plugin declares.
  */
 
 import { recomputeAudiences } from '../../lib/audience.js';
 import { withUsernamesForGrants } from '../../lib/directory.js';
+import { scheduleRenderRetry, syncDomainAccess } from '../../lib/domains.js';
 import { checkProxiedGrant } from '../../lib/entitlements.js';
 import { actorFromRequest } from '../../lib/actor.js';
 import { gatekeeperRequest } from '../../lib/gatekeeper-client.js';
+import { checkOidcClientGrant } from '../../lib/owned-groups.js';
 
 /** Gatekeeper's `path`, with the request's query string when it has one. */
 function withQuery(path, request) {
@@ -55,18 +66,43 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
     };
   };
 
-  /** When Gatekeeper took a grant or group change, the plugin audiences follow it. */
-  const followAudiences = async (request, answer) => {
-    if (answer.statusCode < 400) await recomputeAudiences({ logger: request.log });
-    return answer;
+  /**
+   * When Gatekeeper took a grant or group change: the plugin audiences and
+   * the domains' rendering follow it — which follows whoever it narrowed —
+   * all before the answer goes back. When the rendering fails, the answer
+   * carries `warnings` (Gatekeeper took the change, and enforces it on its
+   * own hosts; an OIDC client it no longer grants waits for a rendering)
+   * and one is tried again within seconds.
+   */
+  const followChange = async (request, answer) => {
+    if (answer.statusCode >= 400) return answer;
+    await recomputeAudiences({ logger: request.log });
+    let warnings;
+    try {
+      warnings = (await syncDomainAccess({ logger: request.log })).warnings ?? [];
+    } catch (err) {
+      request.log.warn({ err: err.message }, 'Rendering domain access after a grant change failed');
+      scheduleRenderRetry(request.log);
+      warnings = [
+        ...(err.warnings ?? []),
+        {
+          step: 'render',
+          message: `Gatekeeper took the change, but who may reach what was not fully rendered (${err.message}); the panel tries again within seconds`,
+        },
+      ];
+    }
+    if (warnings.length === 0 || typeof answer.data !== 'object' || answer.data === null) {
+      return answer;
+    }
+    return { ...answer, data: { ...answer.data, warnings } };
   };
 
   /**
    * A grant or group change: forwarded, and when Gatekeeper took it, the
-   * plugin audiences follow it before the answer goes back.
+   * plugin audiences and the domains follow it before the answer goes back.
    */
   const proxyChange = async (request, method, gatekeeperPath, body) =>
-    followAudiences(request, await proxy(method, gatekeeperPath, body));
+    followChange(request, await proxy(method, gatekeeperPath, body));
 
   /**
    * Give something to `usernames` in Gatekeeper: forwarded holding the
@@ -85,7 +121,7 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
       if (!Number.isInteger(err.statusCode)) throw err;
       return { statusCode: err.statusCode, data: { error: err.message, code: err.code } };
     }
-    return followAudiences(request, answer);
+    return followChange(request, answer);
   };
 
   // --- Groups ---
@@ -164,7 +200,7 @@ export default async function gatekeeperProxyRoutes(fastify, _opts) {
   fastify.post('/gatekeeper/grants', async (request, reply) => {
     let body;
     try {
-      body = await checkProxiedGrant(request.body);
+      body = await checkOidcClientGrant(await checkProxiedGrant(request.body));
     } catch (err) {
       if (!Number.isInteger(err.statusCode)) throw err;
       return reply.code(err.statusCode).send({

package/vendor/serverd/src/routes/management/identity.js

@@ -1,5 +1,16 @@
 import { z } from 'zod';
 import { readUsers } from '../../lib/authelia.js';
+import { adminGroups, domainNames } from '../../lib/domains.js';
+
+/**
+ * Authelia's users with their groups as anything outside Authelia sees
+ * them: the groups Lamaste owns (domain memberships, host groups, OIDC
+ * client grants) left out.
+ */
+async function shownUsers() {
+  const [users, domains] = await Promise.all([readUsers(), domainNames()]);
+  return users.map((u) => ({ ...u, groups: adminGroups(u.groups, domains) }));
+}
 
 const UsernameParamSchema = z.object({
   username: z
@@ -37,10 +48,13 @@ export default async function identityRoutes(fastify, _opts) {
       }
 
       const groupsRaw = headerValue(request.headers['remote-groups']) || '';
-      const groups = groupsRaw
-        .split(',')
-        .map((g) => g.trim())
-        .filter(Boolean);
+      const groups = adminGroups(
+        groupsRaw
+          .split(',')
+          .map((g) => g.trim())
+          .filter(Boolean),
+        await domainNames(),
+      );
       const name = headerValue(request.headers['remote-name']) || '';
       const email = headerValue(request.headers['remote-email']) || '';
 
@@ -54,7 +68,7 @@ export default async function identityRoutes(fastify, _opts) {
     { preHandler: fastify.requireRole(['admin', 'agent'], { capability: 'identity:query' }) },
     async (request, reply) => {
       try {
-        const users = await readUsers();
+        const users = await shownUsers();
         return { users };
       } catch (err) {
         request.log.error({ err }, 'Failed to read Authelia users');
@@ -70,7 +84,7 @@ export default async function identityRoutes(fastify, _opts) {
     async (request, reply) => {
       const { username } = UsernameParamSchema.parse(request.params);
       try {
-        const users = await readUsers();
+        const users = await shownUsers();
         const user = users.find((u) => u.username === username);
         if (!user) {
           return reply.code(404).send({ error: 'User not found' });
@@ -89,7 +103,7 @@ export default async function identityRoutes(fastify, _opts) {
     { preHandler: fastify.requireRole(['admin', 'agent'], { capability: 'identity:query' }) },
     async (request, reply) => {
       try {
-        const users = await readUsers();
+        const users = await shownUsers();
         /** @type {Set<string>} */
         const groupSet = new Set();
         for (const u of users) {

package/vendor/serverd/src/routes/management/invitations.js

@@ -3,7 +3,15 @@ import { z } from 'zod';
 import { USERNAME_MAX_LENGTH, USERNAME_MIN_LENGTH, USERNAME_REGEX } from '@lamalibre/lamaste';
 import { readInvitations, withInvitationsLock, writeInvitations } from '../../lib/state.js';
 import { readUsersRaw } from '../../lib/authelia.js';
-import { getConfig } from '../../lib/config.js';
+import {
+  MembershipInputSchema,
+  assertAssignableGroups,
+  domainsForNewUser,
+  externalMemberGroupsError,
+  invitationMemberships,
+  invitationSignInDomain,
+} from '../../lib/domains.js';
+import { sendFailure } from '../../lib/app-error.js';
 
 const IdParamSchema = z.object({ id: z.string().uuid() });
 
@@ -19,8 +27,15 @@ const CreateInvitationSchema = z.object({
       'Username must start with a lowercase letter or digit and may contain underscores or hyphens',
     ),
   email: z.string().email(),
-  groups: z.array(z.string()).optional().default([]),
+  // Authelia groups (`admins`, `feria-*`): letters, digits, "-" and "_" —
+  // never for an external member.
+  groups: z.array(z.string()).max(100).optional().default([]),
   expiresInDays: z.number().int().min(1).max(30).optional().default(7),
+  // The domains the user becomes a member of on accepting — a name (a
+  // member) or `{ name, kind }` (an external member reaches only what names
+  // them). Required while the relay has two or more; with one, the user
+  // becomes its member.
+  domains: z.array(MembershipInputSchema).max(50).optional(),
 });
 
 export default async function invitationRoutes(fastify, _opts) {
@@ -37,6 +52,7 @@ export default async function invitationRoutes(fastify, _opts) {
         const enriched = invitations.map((inv) => ({
           ...inv,
           token: undefined,
+          domains: invitationMemberships(inv),
           status: inv.used ? 'accepted' : new Date(inv.expiresAt) < now ? 'expired' : 'pending',
         }));
         return { invitations: enriched };
@@ -55,6 +71,16 @@ export default async function invitationRoutes(fastify, _opts) {
     },
     async (request, reply) => {
       const body = CreateInvitationSchema.parse(request.body);
+      let domains;
+      try {
+        assertAssignableGroups(body.groups);
+        domains = await domainsForNewUser(body.domains, { required: true });
+        if (body.groups.length > 0 && domains.some((m) => m.kind === 'external')) {
+          throw externalMemberGroupsError(400);
+        }
+      } catch (err) {
+        return sendFailure(request, reply, err, 'Failed to read the domains');
+      }
 
       // Check username doesn't already exist in Authelia
       let usersData;
@@ -97,6 +123,7 @@ export default async function invitationRoutes(fastify, _opts) {
           username: body.username,
           email: body.email,
           groups: body.groups,
+          domains,
           createdAt: now.toISOString(),
           expiresAt: expiresAt.toISOString(),
           used: false,
@@ -116,8 +143,10 @@ export default async function invitationRoutes(fastify, _opts) {
 
       const { invitation } = outcome;
       const { token } = invitation;
-      const config = getConfig();
-      const inviteUrl = config.domain ? `https://auth.${config.domain}/invite/${token}` : null;
+      // On the sign-in page of the first domain it names (the invitation
+      // page is served on every domain's auth portal).
+      const inviteDomain = await invitationSignInDomain(invitation);
+      const inviteUrl = inviteDomain ? `https://auth.${inviteDomain}/invite/${token}` : null;
 
       return reply.code(201).send({
         ok: true,

package/vendor/serverd/src/routes/management/plugins.js

@@ -42,6 +42,7 @@ import {
 } from '../../lib/plugin-settings.js';
 import { actorFromRequest, certSerialFromRequest } from '../../lib/actor.js';
 import { recordAudit } from '../../lib/audit.js';
+import { withPluginDomains } from '../../lib/domains.js';
 import {
   readPushInstallConfig,
   readPushInstallSessions,
@@ -337,7 +338,7 @@ export default async function pluginRoutes(fastify, _opts) {
       // (see GET /plugins/:name/settings).
       const plugins = await attachSettingsSummaries(await attachHostings(registry.plugins));
       return {
-        plugins: await Promise.all(plugins.map(withHooks)),
+        plugins: await withPluginDomains(await Promise.all(plugins.map(withHooks))),
         // Every agent's retained data — of uninstalled plugins too, which
         // no entry of `plugins` lists any more.
         retainedData: await listRetainedData(),
@@ -363,7 +364,8 @@ export default async function pluginRoutes(fastify, _opts) {
       }
 
       const [withHosting] = await attachSettingsSummaries(await attachHostings([plugin]));
-      return { plugin: await withHooks(withHosting) };
+      const [shown] = await withPluginDomains([await withHooks(withHosting)]);
+      return { plugin: shown };
     },
   );
 

package/vendor/serverd/src/routes/management/registry-credential.js

@@ -9,7 +9,8 @@
  *
  * `auth.kind` is `token` (a pasted long-lived Feria token) or `oidc` (the
  * panel's own `lamaste-server` client on Authelia: client-credentials grant,
- * Feria login). For `oidc` the client is written to Authelia before the
+ * Feria login; `issuerDomain` names the active domain whose issuer,
+ * `https://auth.<domain>`, the registry trusts — the primary when absent). For `oidc` the client is written to Authelia before the
  * chain is verified; if verification fails it is removed again, and the
  * error says what Feria's `auth.json` needs.
  *
@@ -28,9 +29,12 @@ import {
   clearRegistryCredentialConfig,
   readRegistryCredentialConfig,
   verifyRegistryCredential,
-  writeRegistryCredentialConfig,
+  setRegistryCredential,
 } from '../../lib/registry-credential.js';
-import { syncOidcClients } from '../../lib/plugin-oidc.js';
+import { DomainNameSchema } from '@lamalibre/lamaste';
+import { sendFailure } from '../../lib/app-error.js';
+import { resolveActiveDomain } from '../../lib/domains.js';
+import { syncOidcClients, withRegistryCandidate } from '../../lib/plugin-oidc.js';
 
 const FeriaTokenSchema = z
   .string()
@@ -40,7 +44,7 @@ const FeriaTokenSchema = z
 
 const AuthSchema = z.discriminatedUnion('kind', [
   z.object({ kind: z.literal('token'), token: FeriaTokenSchema }),
-  z.object({ kind: z.literal('oidc') }),
+  z.object({ kind: z.literal('oidc'), issuerDomain: DomainNameSchema.optional() }),
 ]);
 
 const PutSchema = z
@@ -64,9 +68,13 @@ const PutSchema = z
     }
   });
 
-/** The stored `auth` for a request body. */
-function authOf(body) {
-  if (body.auth?.kind === 'oidc') return { kind: 'oidc', clientId: LAMASTE_SERVER_OIDC_CLIENT_ID };
+/** The stored `auth` for a request body (`issuerDomain` resolved against the active domains). */
+async function authOf(body) {
+  if (body.auth?.kind === 'oidc') {
+    const auth = { kind: 'oidc', clientId: LAMASTE_SERVER_OIDC_CLIENT_ID };
+    if (body.auth.issuerDomain === undefined) return auth;
+    return { ...auth, issuerDomain: await resolveActiveDomain(body.auth.issuerDomain) };
+  }
   if (body.auth?.kind === 'token') return { kind: 'token', token: body.auth.token };
   return { kind: 'token', token: body.token };
 }
@@ -90,62 +98,83 @@ export default async function registryCredentialRoutes(fastify) {
     },
     async (request, reply) => {
       const body = PutSchema.parse(request.body);
-      const auth = authOf(body);
+      let auth;
+      try {
+        auth = await authOf(body);
+      } catch (err) {
+        return sendFailure(request, reply, err, 'Failed to read the domains');
+      }
       const candidate = { registryUrl: body.registryUrl, auth };
 
-      // The panel's own client must exist in Authelia (with a secret in the
-      // store) before the chain can be exercised.
-      if (auth.kind === 'oidc') {
-        try {
-          const synced = await syncOidcClients(request.log, {
-            registryAuth: { registryUrl: body.registryUrl },
-          });
-          if (!synced) {
-            return reply.code(503).send({ error: 'Complete onboarding (set a domain) first' });
+      // An oidc candidate is what every sync serves until it is stored or
+      // dropped — the identity tick's too, which would otherwise remove the
+      // panel's client from Authelia under the verification.
+      const registryAuth =
+        auth.kind === 'oidc'
+          ? {
+              registryUrl: body.registryUrl,
+              ...(auth.issuerDomain ? { issuerDomain: auth.issuerDomain } : {}),
+            }
+          : undefined;
+      try {
+        return await withRegistryCandidate(registryAuth, async () => {
+          // The panel's own client must exist in Authelia (with a secret in
+          // the store) before the chain can be exercised.
+          if (registryAuth) {
+            try {
+              if (!(await syncOidcClients(request.log))) {
+                return reply.code(503).send({ error: 'Complete onboarding (set a domain) first' });
+              }
+            } catch (err) {
+              return reply.code(500).send({
+                error: `Could not register the ${LAMASTE_SERVER_OIDC_CLIENT_ID} client in Authelia: ${err.message}`,
+              });
+            }
           }
-        } catch (err) {
-          return reply.code(500).send({
-            error: `Could not register the ${LAMASTE_SERVER_OIDC_CLIENT_ID} client in Authelia: ${err.message}`,
-          });
-        }
-      }
 
-      let verified;
-      try {
-        verified = await verifyRegistryCredential(candidate);
-      } catch (err) {
-        if (auth.kind === 'oidc') {
-          // Leave Authelia as the stored credential says — the candidate is
-          // not kept.
-          await syncOidcClients(request.log).catch((syncErr) =>
-            request.log.warn({ err: syncErr.message }, 'Failed to roll back the OIDC client'),
+          let verified;
+          try {
+            verified = await verifyRegistryCredential(candidate);
+          } catch (err) {
+            const status = err instanceof RegistryCredentialError ? err.statusCode : 502;
+            return reply.code(status).send({ error: err.message });
+          }
+
+          const config = {
+            provider: 'feria',
+            registryUrl: body.registryUrl,
+            scope: body.scope ?? '@lamalibre',
+            auth,
+            owner: verified.owner,
+            configuredAt: new Date().toISOString(),
+          };
+          let warnings;
+          try {
+            warnings = await setRegistryCredential(config, { logger: request.log });
+          } catch (err) {
+            return sendFailure(request, reply, err, 'Failed to store the registry credential');
+          }
+          request.log.info(
+            { registryUrl: body.registryUrl, owner: verified.owner, auth: auth.kind },
+            'Registry credential configured',
           );
-        }
-        const status = err instanceof RegistryCredentialError ? err.statusCode : 502;
-        return reply.code(status).send({ error: err.message });
+          return {
+            configured: true,
+            ...summariseRegistryCredential(config),
+            ...(warnings.length > 0 ? { warnings } : {}),
+          };
+        });
+      } finally {
+        // With the candidate dropped, the stored credential decides whether
+        // Authelia carries the panel's client: the new one once stored, the
+        // previous one after a refusal (the candidate is not kept).
+        await syncOidcClients(request.log).catch((err) =>
+          request.log.warn(
+            { err: err.message },
+            'Failed to sync OIDC clients after the registry credential request',
+          ),
+        );
       }
-
-      const config = {
-        provider: 'feria',
-        registryUrl: body.registryUrl,
-        scope: body.scope ?? '@lamalibre',
-        auth,
-        owner: verified.owner,
-        configuredAt: new Date().toISOString(),
-      };
-      await writeRegistryCredentialConfig(config);
-      // The stored credential now decides whether Authelia carries the client.
-      await syncOidcClients(request.log).catch((err) =>
-        request.log.warn(
-          { err: err.message },
-          'Failed to sync OIDC clients after credential change',
-        ),
-      );
-      request.log.info(
-        { registryUrl: body.registryUrl, owner: verified.owner, auth: auth.kind },
-        'Registry credential configured',
-      );
-      return { configured: true, ...summariseRegistryCredential(config) };
     },
   );