@vibelord/lanes 1.1.1 → 1.3.0

package/payload/lanes/libexec/economy_poll.py

@@ -666,6 +666,7 @@ def main(argv=None):
         report(diagnostics, None, always=True)
         return 0
     control_url(env)   # a malformed URL stops the unit at start, not once per tick
+    L.record_tree('economy', state)   # W9 U0: the unit's tree; `--once`/`--dry-run` (a person's diagnostic) never
     last = None
     while True:
         diagnostics = {}

package/payload/lanes/libexec/enrold.py

@@ -66,11 +66,15 @@ members/ and authorized_keys, so the CLI and this service never interleave:
                             The opt-in lanes-notify service (notify.py, W8 A5) reads them through load_requests and
                             pushes one note per new pending request.
   members/<device>.json     members.py's schema, via invite|request, written through keys.py (save_member, then
-                            write_authorized_keys) — never devices/.
+                            write_authorized_keys) — never devices/. `client_version` (W9 K1, LNS-86) is the
+                            release the body named (client_version(): the redeem's, or on approval the request's);
+                            absent when it named none.
   enrol-mode                {version: 1, mode: request|invite, set_at, set_by}, written by `lanes enrol mode` (enrol.py,
                             through write_mode; `auto` removes it); read on every request, never written here.
   enrol.log                 append-only, one line per attempt: `<UTC> <event> <id> <device> <login> fp=<SHA256:…> <result>`
-                            (`-` for an unknown field). A code is never written anywhere, not even its id half on a miss.
+                            (`-` for an unknown field); every line redeem() writes for its attempt adds ` client=<v>`
+                            when the body named a release (W9 K1). A code is never written anywhere, not even its id
+                            half on a miss.
                             A redeem or approval re-renders the whole block from the members keys.load_members accepts,
                             so a member file it cannot use loses its line (fail closed): each such file is one line
                             `<event> <id> <its device> <login> fp=- dropped-member` before the attempt's own, and the
@@ -132,7 +136,7 @@ ACTIONS = ('approve', 'deny')
 HTML_POLICY = "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'"
 _HEX64 = re.compile(r'[0-9a-f]{64}')
 _REQUEST_ID = re.compile(r'[a-z0-9]{1,32}')
-_CLIENT_VERSION = re.compile(r'[A-Za-z0-9._+-]{1,32}')
+_CLIENT_VERSION = M.CLIENT_VERSION     # a body's client_version: the rule the member record is validated by
 _STAMP = re.compile(r'\d{4}-\d\d-\d\dT\d\d:\d\d:\d\dZ', re.ASCII)
 _LOG_UNSAFE = re.compile(r'[^A-Za-z0-9_.@:+=/-]')
 _SITE_LINE = re.compile(r'^(LANES_[A-Z_]+)=([A-Za-z0-9_.:@/-]*)$')
@@ -294,10 +298,13 @@ def _log_field(value):
     return _LOG_UNSAFE.sub('?', str(value))[:128] if value else '-'
 
 
-def audit(event, ident, device, login, fingerprint, result, now=None):
-    """Append one line to enrol.log (0600). Never raises: a log that cannot be written is said on stderr."""
+def audit(event, ident, device, login, fingerprint, result, now=None, client=None):
+    """Append one line to enrol.log (0600). Never raises: a log that cannot be written is said on stderr. `client`
+    (a redeem attempt's client_version, W9 K1) ends the line as `client=<it>` when given; no field otherwise."""
     line = ' '.join((stamp(time.time() if now is None else now), _log_field(event), _log_field(ident),
                      _log_field(device), _log_field(login), 'fp=' + _log_field(fingerprint), _log_field(result)))
+    if client is not None:
+        line += ' client=' + _log_field(client)
     try:
         L.STATE.mkdir(parents=True, exist_ok=True)
         handle = os.open(log_path(), os.O_WRONLY | os.O_APPEND | os.O_CREAT, 0o600)
@@ -510,14 +517,26 @@ def _block_lacks(path, members, device):
 
 # ------------------------------------------------------------------------------------------------------- redeem
 
+def client_version(value):
+    """The client's release as an enrolment body states it (`client_version`; install.sh sends its VERSION, `dev`
+    without one), else None: a string matching members.CLIENT_VERSION. Anything else (absent, null, a number, a blank,
+    a terminal escape, over 32 characters) is not stored and refuses nothing. One rule for the request file
+    (create_request), the member record (redeem, and an approval from its request) and the redeem audit line."""
+    return value if isinstance(value, str) and _CLIENT_VERSION.fullmatch(value) else None
+
+
 def redeem(fields, caller=None, now=None):
-    """POST /redeem -> (status, payload). `caller` is the TRUSTED tailnet identity (None outside request mode)."""
+    """POST /redeem -> (status, payload). `caller` is the TRUSTED tailnet identity (None outside request mode). Every
+    enrol.log line of the attempt ends `client=<release>` when the body named one (client_version, W9 K1, LNS-86), and
+    the member record keeps it; a line the HTTP layer writes before a body is in hand (rate-limited; a body refused as
+    bad-request, too-large or length-required) carries none."""
     now = time.time() if now is None else now
     caller = caller or NOBODY
+    client = client_version(fields.get('client_version'))
     try:
         device = M.device_name(fields.get('device'))
     except L.LanesError:
-        audit('redeem', None, None, caller.login, None, 'invalid-device', now)
+        audit('redeem', None, None, caller.login, None, 'invalid-device', now, client)
         return 400, {'error': 'invalid-device'}
     try:
         pubkey = K.parse_pubkey(fields['pubkey']) if isinstance(fields.get('pubkey'), str) else None
@@ -526,21 +545,21 @@ def redeem(fields, caller=None, now=None):
     fingerprint = K.fingerprint(pubkey) if pubkey else None
     match = match_invite(fields.get('code'), now)
     if match is None or pubkey is None:
-        audit('redeem', None, device, caller.login, fingerprint, INVALID, now)
+        audit('redeem', None, device, caller.login, fingerprint, INVALID, now, client)
         return 403, {'error': INVALID}
     try:
         with K.members_lock():
-            return _redeem_locked(match, device, pubkey, fingerprint, caller, now)
+            return _redeem_locked(match, device, pubkey, fingerprint, caller, now, client)
     except L.LanesError:                                    # only the lock raises out of _redeem_locked
-        audit('redeem', match[0], device, caller.login, fingerprint, 'busy', now)
+        audit('redeem', match[0], device, caller.login, fingerprint, 'busy', now, client)
         return 503, {'error': 'busy'}
 
 
-def _redeem_locked(match, device, pubkey, fingerprint, caller, now):
+def _redeem_locked(match, device, pubkey, fingerprint, caller, now, client=None):
     invite_id, path, digest = match
     invite = _read_doc(path)
     if invite is None or not invite_live(invite, now) or not hmac.compare_digest(digest, invite['code_sha256']):
-        audit('redeem', None, device, caller.login, fingerprint, INVALID, now)     # used while we waited
+        audit('redeem', None, device, caller.login, fingerprint, INVALID, now, client)     # used while we waited
         return 403, {'error': INVALID}
     try:
         ak, data = _authorized_keys()
@@ -549,19 +568,19 @@ def _redeem_locked(match, device, pubkey, fingerprint, caller, now):
         owner = invite_owner(invite, caller)
         record = K.member_record(device, pubkey, via='invite', now=now, owner=owner,
                                  approved_by=minter_login(invite), invite_id=invite_id,
-                                 workspaces=_workspaces(invite.get('workspaces')),
+                                 workspaces=_workspaces(invite.get('workspaces')), client_version=client,
                                  **({'invited_as': invited_as(invite)} if caller.login else {}))
         original = path.read_bytes()
     except (OSError, L.LanesError) as error:
         print(f'lanes-enrold: redeem {invite_id}: {error}', file=sys.stderr, flush=True)
-        audit('redeem', invite_id, device, caller.login, fingerprint, 'server-error', now)
+        audit('redeem', invite_id, device, caller.login, fingerprint, 'server-error', now, client)
         return 503, {'error': 'server-error'}
     who = owner['login'] if owner else caller.login
     if taken:
-        audit('redeem', invite_id, device, who, fingerprint, 'device-taken', now)
+        audit('redeem', invite_id, device, who, fingerprint, 'device-taken', now, client)
         return 409, {'error': 'device-taken'}
     if any(member['pubkey'] == pubkey for member in members):
-        audit('redeem', invite_id, device, who, fingerprint, 'key-taken', now)
+        audit('redeem', invite_id, device, who, fingerprint, 'key-taken', now, client)
         return 409, {'error': 'key-taken'}
     consumed = dict(invite, redeemed_by={'device': device, 'login': who, 'pubkey_sha256': fingerprint},
                     redeemed_at=stamp(now))
@@ -569,7 +588,7 @@ def _redeem_locked(match, device, pubkey, fingerprint, caller, now):
         L.atomic_write(path, _json_bytes(consumed), mode=0o600)    # used up FIRST: a crash never leaves it reusable
     except OSError as error:
         print(f'lanes-enrold: cannot mark invite {invite_id} used: {error.strerror}', file=sys.stderr, flush=True)
-        audit('redeem', invite_id, device, who, fingerprint, 'server-error', now)
+        audit('redeem', invite_id, device, who, fingerprint, 'server-error', now, client)
         return 503, {'error': 'server-error'}
     report_dropped('redeem', invite_id, who, problems, now)          # the writes below re-render the block
     try:
@@ -583,13 +602,13 @@ def _redeem_locked(match, device, pubkey, fingerprint, caller, now):
                 L.atomic_write(path, original, mode=0o600)
             except OSError as undo:
                 print(f'lanes-enrold: undo of {invite_id} incomplete: {undo.strerror}', file=sys.stderr, flush=True)
-        audit('redeem', invite_id, device, who, fingerprint, 'server-error', now)
+        audit('redeem', invite_id, device, who, fingerprint, 'server-error', now, client)
         return 503, {'error': 'server-error'}
     if owner is None:                                               # said, never silent (DEF-1644)
         print(f'lanes-enrold: invite {invite_id} names no login (no trusted tailnet login, no email address, and its '
               f'name is not a login): members/{device}.json has no owner — `lanes keys owner {device} <login>` '
               'names one', file=sys.stderr, flush=True)
-    audit('redeem', invite_id, device, who, fingerprint, 'ok', now)
+    audit('redeem', invite_id, device, who, fingerprint, 'ok', now, client)
     return 200, {'device': device, 'owner': owner, 'ssh_ready': True}
 
 
@@ -677,8 +696,7 @@ def create_request(fields, caller, now=None):
                    {'login': login, 'name': None, 'email': _address(login)})
     if owner is None:
         return 403, {'error': 'no-identity'}
-    client = fields.get('client_version')
-    client = client if isinstance(client, str) and _CLIENT_VERSION.fullmatch(client) else None
+    client = client_version(fields.get('client_version'))
     try:
         with K.members_lock():
             pending = [r for r in load_requests() if request_state(r, now) == 'pending']
@@ -780,7 +798,7 @@ def _approve_locked(document, approver, now):
     owner = M.validate_owner({'login': document['login'], 'name': document.get('name'),
                               'email': document.get('email')})
     record = K.member_record(device, pubkey, via='request', now=now, owner=owner, approved_by=approver,
-                             request_id=document['id'])
+                             request_id=document['id'], client_version=client_version(document.get('client_version')))
     try:
         K.save_member(record)
     except OSError as error:
@@ -1248,6 +1266,7 @@ def main(argv=None):
         parser.error(f'{port} is not a port number')
     service = Service.from_environ(os.environ)
     server = Server(('127.0.0.1', port), service)
+    L.record_tree('enrold')   # W9 U0: the tree this service runs from (`lanes version`, doctor)
     print(f'lanes-enrold {version()}: listening on 127.0.0.1:{server.server_address[1]}; request mode '
           f'{service.mode_source()}; '
           f'domains {",".join(service.domains)}', file=sys.stderr, flush=True)

package/payload/lanes/libexec/keys.py

@@ -37,6 +37,11 @@ The account's ~/.ssh/authorized_keys carries ONE managed block, re-rendered whol
   * `lanes keys owner <device> <login> [--name NAME] [--email ADDR]` names the person behind a member (`add`/`adopt`
     write owner null): the one change to a record's owner, and how a key added by hand makes its person an
     `/enrol/pending` approver. It writes only the member file — the block carries no owner.
+  * `lanes keys adopt --login LOGIN` (cockpit v3 R2, LNS-75) records {login: LOGIN} as the owner of every member it
+    adopts, in the same write — a machine from before enrolment and its person in one step; a member that exists keeps
+    its owner (`owner` changes that). `main(args, on_owned=…)`: whenever adopt --login or owner names an owner, the
+    caller is told (login, [devices]) after the write and its return value is the exit code — bin/lanes folds those
+    devices' views into the person's profile (users.py); this module never touches devices/ or users/.
 
 `pubkey_sha256` is OpenSSH's own fingerprint form (`SHA256:` + unpadded base64 of the blob's SHA-256): what
 `ssh-keygen -lf` prints and what sshd logs on `Accepted publickey`, so a log line names its device.
@@ -65,7 +70,7 @@ MAX_DEVICE = M.MAX_DEVICE       # bin/lanes device_name()
 MAX_PUBKEY_FILE = 8192
 LOCK_TIMEOUT = 5
 USAGE = ('usage: lanes keys list | lanes keys add <device> <pubkey-file|-> | lanes keys revoke <device> | '
-         'lanes keys adopt [--dry-run] | lanes keys owner <device> <login> [--name NAME] [--email ADDR]')
+         'lanes keys adopt [--dry-run] [--login LOGIN] | lanes keys owner <device> <login> [--name NAME] [--email ADDR]')
 _ED25519_HEAD = struct.pack('>I', len(KEY_TYPE)) + KEY_TYPE.encode() + struct.pack('>I', 32)
 _BASE64 = re.compile(r'[A-Za-z0-9+/]+={0,2}')
 _KEY_TYPE_WORD = re.compile(r'(?:ssh-|ecdsa-|sk-)[A-Za-z0-9@._-]+')
@@ -504,11 +509,11 @@ def cmd_revoke(path, device):
     return 1 if leftovers else 0
 
 
-def plan_adopt(data, members):
+def plan_adopt(data, members, owner=None):
     """(new member records by device, [(pubkey, device)] whose plain outside lines go, [report lines]) for the
     `lanes:<device>` lines outside the block. Taken: a plain (no options) ssh-ed25519 line whose device holds no other
     key and whose key no other device holds; a line for an existing member with the same key is a duplicate and goes.
-    Everything else stays byte for byte and is named."""
+    Everything else stays byte for byte and is named. A new record's owner is `owner` (validated; None = null)."""
     by_device = {m['device']: m for m in members}
     holders = {m['pubkey']: m['device'] for m in members}
     new, drop, report = {}, set(), []
@@ -539,19 +544,24 @@ def plan_adopt(data, members):
         if pubkey in holders:
             report.append(f'kept {where}: that key is already enrolled as {holders[pubkey]}')
             continue
-        new[device] = member_record(device, pubkey)
+        new[device] = member_record(device, pubkey, owner=owner)
         holders[pubkey] = device
         drop.add((pubkey, device))
-        report.append(f'adopted {device} ({fingerprint(pubkey)}) from line {number}')
+        report.append(f'adopted {device} ({fingerprint(pubkey)}) from line {number}'
+                      + (f", owner {owner['login']}" if owner else ''))
     return new, drop, report
 
 
-def cmd_adopt(path, dry_run=False):
+def cmd_adopt(path, dry_run=False, owner=None, on_owned=None):
+    """Move the plain hand-added `lanes:<device>` lines into members/ (owner `owner`, validated by the caller) and the
+    block. -> 0, or on_owned(login, adopted devices)'s answer when `owner` named the owner of any (never on a dry run)."""
+    unowned = ('; --login names the owner of the keys an adopt moves in — a member that exists keeps its own '
+               '(`lanes keys owner <device> <login>` changes it)') if owner else ''
     with members_lock():
         members, problems = load_members()
         _warn_problems(problems)
         data = _read(path)
-        new, drop, report = plan_adopt(data, members)
+        new, drop, report = plan_adopt(data, members, owner)
 
         def goes(raw):
             parsed = parse_line(raw.decode('utf-8', 'surrogateescape'))
@@ -562,7 +572,7 @@ def cmd_adopt(path, dry_run=False):
             for line in report:
                 print('would: ' + line if not line.startswith('adopted') else 'would adopt ' + line[len('adopted '):])
             if not drop:
-                print('nothing to adopt')
+                print('nothing to adopt' + unowned)
             return 0
         for record in new.values():
             save_member(record)                            # the records before their lines (see cmd_revoke)
@@ -573,19 +583,22 @@ def cmd_adopt(path, dry_run=False):
     for line in report:
         print(line)
     if not drop:
-        print('nothing to adopt' + ('; the block was re-rendered from members/' if changed else ''))
+        print('nothing to adopt' + ('; the block was re-rendered from members/' if changed else '') + unowned)
     else:
         print(f'{len(new)} adopted; the lanes-managed block of {path} holds {len(members) + len(new)} key(s); '
               'the file before the first adopt is kept as authorized_keys.bak-<UTC>')
+    if owner and new and on_owned:
+        return on_owned(owner['login'], sorted(new))
     return 0
 
 
-def cmd_owner(device, login, name=None, email=None):
+def cmd_owner(device, login, name=None, email=None, on_owned=None):
     """Name the person behind member `device`: its owner becomes {login, name, email}. The only change to who owns a key
     added by hand (`add`/`adopt` write owner null), and so how its person becomes a `/enrol/pending` approver, which
     matches the tailnet login a member record's owner names (DEF-1643). The record keeps every other field and its
     order; the block carries no owner, so authorized_keys is not touched. Refuses an owner members.py would not store,
-    a device with no record, and a record that does not load (fix it first) — never echoing a value."""
+    a device with no record, and a record that does not load (fix it first) — never echoing a value. Then, also when
+    nothing changed, -> on_owned(login, [device])'s answer (0 without one)."""
     device = device_name(device)
     owner = M.validate_owner({'login': login, 'name': name, 'email': email})
     with members_lock():
@@ -599,14 +612,15 @@ def cmd_owner(device, login, name=None, email=None):
         before = M.valid_owner(current.get('owner'))
         if before == owner:
             print(f"{device} is already owned by {owner['login']}; nothing changed")
-            return 0
-        record = dict(current, owner=owner)
-        if record.get('pubkey_sha256') is None:            # a record written before A2 carries no fingerprint
-            record['pubkey_sha256'] = fingerprint(record['pubkey'])
-        save_member(record)
-    print(f"owner of {device}: {before['login'] if before else 'none'} -> {owner['login']}"
-          + (f" ({owner['name']})" if owner['name'] else ''))
-    return 0
+        else:
+            record = dict(current, owner=owner)
+            if record.get('pubkey_sha256') is None:        # a record written before A2 carries no fingerprint
+                record['pubkey_sha256'] = fingerprint(record['pubkey'])
+            save_member(record)
+    if before != owner:
+        print(f"owner of {device}: {before['login'] if before else 'none'} -> {owner['login']}"
+              + (f" ({owner['name']})" if owner['name'] else ''))
+    return on_owned(owner['login'], [device]) if on_owned else 0
 
 
 def _owner_args(rest):
@@ -621,7 +635,22 @@ def _owner_args(rest):
     return rest[0], rest[1], options.get('--name'), options.get('--email')
 
 
-def main(args):
+def _adopt_args(rest):
+    """[--dry-run] [--login LOGIN], each at most once, in either order -> (dry_run, login or None)."""
+    dry_run, login, index = False, None, 0
+    while index < len(rest):
+        if rest[index] == '--dry-run' and not dry_run:
+            dry_run, index = True, index + 1
+        elif rest[index] == '--login' and login is None and index + 1 < len(rest):
+            login, index = rest[index + 1], index + 2
+        else:
+            raise L.LanesError(USAGE)
+    return dry_run, login
+
+
+def main(args, on_owned=None):
+    """`lanes keys …`. `on_owned(login, devices) -> exit code` is called after adopt --login or owner named an owner
+    (bin/lanes passes its profile fold); None (this module run on its own) calls nothing."""
     path = authorized_keys_path()
     verb, rest = (args[0], args[1:]) if args else (None, [])
     if verb == 'list' and not rest:
@@ -630,10 +659,12 @@ def main(args):
         return cmd_add(path, *rest)
     if verb == 'revoke' and len(rest) == 1:
         return cmd_revoke(path, rest[0])
-    if verb == 'adopt' and rest in ([], ['--dry-run']):
-        return cmd_adopt(path, dry_run=bool(rest))
+    if verb == 'adopt':
+        dry_run, login = _adopt_args(rest)
+        owner = None if login is None else M.validate_owner({'login': login})   # refused before anything is read
+        return cmd_adopt(path, dry_run=dry_run, owner=owner, on_owned=on_owned)
     if verb == 'owner':
-        return cmd_owner(*_owner_args(rest))
+        return cmd_owner(*_owner_args(rest), on_owned=on_owned)
     raise L.LanesError(USAGE)