@lamalibre/create-lamaste 4.6.0 → 4.7.0

package/vendor/serverd/src/routes/onboarding/provision.js

@@ -12,6 +12,7 @@ import { migrateChiselCredentialsIfNeeded } from '../../lib/chisel-users.js';
 import { loadAgentRegistry } from '../../lib/mtls.js';
 import { setChiselRunningPinnedRelease } from '../../lib/chisel-runtime.js';
 import { changeUsers } from '../../lib/directory.js';
+import { ensurePrimaryDomain, syncDomainAccess } from '../../lib/domains.js';
 
 // Module-level state for provisioning
 const emitter = new EventEmitter();
@@ -115,24 +116,16 @@ async function runProvisioning(log) {
         'Authelia is not installed. Run `npx @lamalibre/create-lamaste` on the server to repair the installation.',
       );
     }
-    emitProgress('install-authelia', 'running', 'Writing configuration...');
-
-    const secrets = {
-      jwtSecret: crypto.randomBytes(32).toString('hex'),
-      sessionSecret: crypto.randomBytes(32).toString('hex'),
-      storageEncryptionKey: crypto.randomBytes(32).toString('hex'),
-    };
-    await authelia.writeAutheliaConfig(domain, secrets);
-
     emitProgress('install-authelia', 'running', 'Creating admin user...');
     adminPassword = crypto.randomBytes(16).toString('base64url');
     // Through the users lock, and into the user directory — which reconciles
-    // with users.yml from here on. Authelia starts next, so no restart.
+    // with users.yml from here on. The domain is rendered below, once it
+    // exists.
     const created = await changeUsers(() => authelia.createUser('admin', adminPassword), {
       actor: 'lamaste',
       logger: log,
       creates: ['admin'],
-      restartAuthelia: false,
+      renderDomains: false,
       // Authelia's storage does not exist before its first start.
       autheliaStorage: false,
     });
@@ -140,6 +133,21 @@ async function runProvisioning(log) {
       log.warn({ step: warning.step }, warning.message);
     }
 
+    // The primary domain with the administrator as its member — rendered
+    // into users.yml's groups and Gatekeeper's projection before Authelia
+    // first starts, so its first configuration already admits them (the
+    // configuration it is rendered from is the one written here: nothing to
+    // restart). The panel renders every later change.
+    emitProgress('install-authelia', 'running', 'Writing configuration...');
+    await ensurePrimaryDomain({ logger: log });
+    const secrets = {
+      jwtSecret: crypto.randomBytes(32).toString('hex'),
+      sessionSecret: crypto.randomBytes(32).toString('hex'),
+      storageEncryptionKey: crypto.randomBytes(32).toString('hex'),
+    };
+    await authelia.writeAutheliaConfig(domain, secrets);
+    await syncDomainAccess({ logger: log });
+
     emitProgress('install-authelia', 'running', 'Starting Authelia service...');
     await authelia.startAuthelia();
     emitProgress('install-authelia', 'done', 'Authelia configured and running');
@@ -156,7 +164,7 @@ async function runProvisioning(log) {
     await nginx.writePanelVhost(domain);
 
     emitProgress('configure-nginx', 'running', 'Writing auth vhost...');
-    await nginx.writeAuthVhost(domain);
+    await nginx.writeAuthVhost(domain, { primary: true });
 
     emitProgress('configure-nginx', 'running', 'Writing tunnel vhost...');
     await nginx.writeTunnelVhost(domain);
@@ -166,7 +174,6 @@ async function runProvisioning(log) {
 
     emitProgress('configure-nginx', 'running', 'Enabling sites...');
     await nginx.enableSite('lamalibre-lamaste-panel-domain');
-    await nginx.enableSite('lamalibre-lamaste-auth');
     await nginx.enableSite('lamalibre-lamaste-tunnel');
 
     emitProgress('configure-nginx', 'running', 'Testing nginx configuration...');
@@ -217,6 +224,8 @@ async function runProvisioning(log) {
     // Step 6: Finalize
     emitProgress('finalize', 'running', 'Updating configuration...');
     await updateConfig({ onboarding: { status: 'COMPLETED' } });
+    // Gatekeeper's projection of the domain (Authelia holds it already).
+    await syncDomainAccess({ logger: log });
 
     const result = {
       adminUsername: 'admin',

package/vendor/serverd/src/routes/user-access.js

@@ -4,6 +4,7 @@ import { getConfig } from '../lib/config.js';
 import { ensureSessionSecret } from '../lib/session.js';
 import { createUserSession } from '../lib/user-access-session.js';
 import { findDirectoryUser, reconcileDirectory } from '../lib/directory.js';
+import { isPrimaryMember } from '../lib/domains.js';
 import {
   createGrant,
   listGrants,
@@ -166,6 +167,17 @@ export async function userAccessPublicRoutes(fastify, _opts) {
     if (!username) {
       return reply.code(401).send({ error: 'Authentication required' });
     }
+    // Authelia admits external members on the portal too (its rule for
+    // `auth.<domain>`); desktop user access is for members of the primary
+    // domain only.
+    let holder = await findDirectoryUser(username);
+    if (!holder) {
+      await reconcileDirectory({ actor: 'lamaste', logger: request.log });
+      holder = await findDirectoryUser(username);
+    }
+    if (!holder || holder.status !== 'active' || !(await isPrimaryMember(holder.userId))) {
+      return reply.code(403).send({ error: 'Desktop access is for members of this domain' });
+    }
 
     let query;
     try {
@@ -245,7 +257,7 @@ export async function userAccessPublicRoutes(fastify, _opts) {
         await reconcileDirectory({ actor: 'lamaste', logger: request.log });
         user = await findDirectoryUser(username);
       }
-      if (!user || user.status !== 'active') {
+      if (!user || user.status !== 'active' || !(await isPrimaryMember(user.userId))) {
         throw Object.assign(new Error('Invalid or expired token'), { statusCode: 401 });
       }
       const sessionSecret = await ensureSessionSecret();

package/vendor/gatekeeper/dist/lib/migrations/migrations/gatekeeper/0001_groups.sql

@@ -1,7 +0,0 @@
-CREATE TABLE groups (
-  name         TEXT    PRIMARY KEY,
-  description  TEXT    NOT NULL DEFAULT '',
-  members      TEXT    NOT NULL DEFAULT '[]',   -- JSON array of usernames
-  created_at   TEXT    NOT NULL,
-  created_by   TEXT    NOT NULL DEFAULT 'admin'
-);

package/vendor/gatekeeper/dist/lib/migrations/migrations/gatekeeper/0002_access_grants.sql

@@ -1,14 +0,0 @@
-CREATE TABLE access_grants (
-  grant_id        TEXT    PRIMARY KEY,            -- UUID
-  principal_type  TEXT    NOT NULL,               -- 'user' | 'group'
-  principal_id    TEXT    NOT NULL,
-  resource_type   TEXT    NOT NULL,               -- 'tunnel' | 'plugin' | extensible
-  resource_id     TEXT    NOT NULL,
-  context         TEXT    NOT NULL DEFAULT '{}',  -- JSON object
-  used            INTEGER NOT NULL DEFAULT 0,
-  created_at      TEXT    NOT NULL,
-  used_at         TEXT
-);
-CREATE INDEX idx_grants_principal     ON access_grants(principal_type, principal_id);
-CREATE INDEX idx_grants_resource      ON access_grants(resource_type, resource_id);
-CREATE INDEX idx_grants_used_used_at  ON access_grants(used, used_at);

package/vendor/gatekeeper/dist/lib/migrations/migrations/gatekeeper/0003_access_request_log.sql

@@ -1,9 +0,0 @@
-CREATE TABLE access_request_log (
-  id            INTEGER PRIMARY KEY AUTOINCREMENT,
-  timestamp     TEXT    NOT NULL,
-  username      TEXT    NOT NULL,
-  resource_type TEXT    NOT NULL,
-  resource_id   TEXT    NOT NULL,
-  resource_fqdn TEXT    NOT NULL
-);
-CREATE INDEX idx_access_log_timestamp ON access_request_log(timestamp);