@camstack/core 0.1.21 → 0.1.22

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -6518,6 +6518,39 @@ var ScopedTokenManager = class {
 			}
 		});
 	}
+	/**
+	* One-shot migration: drop tokens whose owner can't be resolved.
+	*
+	* Two ways a token can end up orphan:
+	*   • Pre-fix tokens minted via the CLI were owned by the literal
+	*     string `"system"` (provider hardcode, fixed 2026-05-11).
+	*   • A user gets deleted but their tokens were not cascade-revoked.
+	*
+	* Either way the UI's `listScopedTokens({ userId: u.id })` never
+	* returns them, so the operator can't revoke through the normal flow.
+	* We sweep both classes by passing the live user-id set in.
+	*
+	* Idempotent: if no orphans exist the method is a no-op.
+	* Returns the number of tokens removed.
+	*/
+	async cleanupOrphans(validUserIds) {
+		const all = await this.store.query.query({
+			collection: TOKENS_COLLECTION,
+			filter: {}
+		});
+		let removed = 0;
+		for (const entry of all) {
+			const record = parseToken(entry.data);
+			if (record.userId === "system" || !validUserIds.has(record.userId)) {
+				await this.store.delete.mutate({
+					collection: TOKENS_COLLECTION,
+					key: record.id
+				});
+				removed++;
+			}
+		}
+		return removed;
+	}
 };
 //#endregion
 //#region src/builtins/local-auth/auth-schema.ts
@@ -6735,6 +6768,10 @@ var LocalAuthAddon = class extends BaseAddon {
 			this.scopedTokenManager = new ScopedTokenManager(store);
 			try {
 				await this.userManager.ensureAdminExists();
+				const liveUsers = await this.userManager.listAll();
+				const liveIds = new Set(liveUsers.map((u) => u.id));
+				const removed = await this.scopedTokenManager.cleanupOrphans(liveIds);
+				if (removed > 0) this.ctx.logger.warn(`cleaned up ${removed} orphan scoped-token(s) on boot`);
 			} catch (err) {
 				const detail = err instanceof Error ? err.message : String(err);
 				throw new Error(`local-auth bootstrap failed: ensureAdminExists threw before \`user-management\` could be registered. Most likely a \`users\` collection schema mismatch in the settings-store. Underlying: ${detail}`, { cause: err });