@camstack/core 0.1.28 → 0.1.30

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -6253,6 +6253,7 @@ var UserManager = class {
 			role: input.role,
 			allowedProviders: input.allowedProviders ?? "*",
 			allowedDevices: input.allowedDevices ?? {},
+			scopes: input.scopes ?? [],
 			createdAt: now,
 			updatedAt: now
 		};
@@ -6337,7 +6338,7 @@ var UserManager = class {
 		await this.create({
 			username: adminUsername,
 			password: adminPassword,
-			role: "super_admin",
+			role: "admin",
 			allowedProviders: "*",
 			allowedDevices: {}
 		});
@@ -6476,14 +6477,18 @@ var ScopedTokenManager = class {
 		this.updateLastUsed(record.id).catch(() => {});
 		return record;
 	}
-	matchesScope(token, addonId, routePath, capability) {
+	/**
+	* Coarse scope match — checks only `addonId` / `capability` (no
+	* `route-prefix` after the caps-only migration). Used by addon-route
+	* HTTP handlers that need a quick allow/deny before the per-method
+	* `access` check kicks in via `METHOD_ACCESS_MAP` in
+	* `protectedProcedure`.
+	*/
+	matchesScope(token, addonId, capability) {
 		for (const scope of token.scopes) switch (scope.type) {
 			case "addon":
 				if (addonId && scope.target === addonId) return true;
 				break;
-			case "route-prefix":
-				if (routePath && routePath.startsWith(scope.target)) return true;
-				break;
 			case "capability":
 				if (capability && scope.target === capability) return true;
 				break;
@@ -6767,6 +6772,11 @@ var LocalAuthAddon = class extends BaseAddon {
 			this.apiKeyManager = new ApiKeyManager(storageAccess, this.authManager);
 			this.scopedTokenManager = new ScopedTokenManager(store);
 			try {
+				try {
+					await this.migrateLegacyUserRecords(store);
+				} catch (err) {
+					this.ctx.logger.warn("caps-only migration pass failed; legacy super_admin rows may still exist", { meta: { error: err instanceof Error ? err.message : String(err) } });
+				}
 				await this.userManager.ensureAdminExists();
 				const liveUsers = await this.userManager.listAll();
 				const liveIds = new Set(liveUsers.map((u) => u.id));
@@ -6827,6 +6837,11 @@ var LocalAuthAddon = class extends BaseAddon {
 				await this.userManager.resetPassword(input.id, input.newPassword);
 				return { success: true };
 			},
+			setUserScopes: async (input) => {
+				if (!this.userManager) throw new Error("User management not available");
+				await this.userManager.update(input.userId, { scopes: input.scopes });
+				return { success: true };
+			},
 			validateCredentials: async (input) => {
 				if (!this.userManager) return null;
 				return await this.userManager.validateCredentials(input.username, input.password) ?? null;
@@ -6893,6 +6908,32 @@ var LocalAuthAddon = class extends BaseAddon {
 		this.apiKeyManager = null;
 		this.scopedTokenManager = null;
 	}
+	/**
+	* Caps-only auth migration — rewrites legacy `super_admin` rows to
+	* `admin` and backfills the missing `scopes` field with `[]`. Idempotent;
+	* a re-run sees no rows needing changes.
+	*/
+	async migrateLegacyUserRecords(store) {
+		const results = await store.query.query({ collection: "users" });
+		let migrated = 0;
+		for (const row of results) {
+			const data = row.data;
+			const needsRoleRewrite = (typeof data["role"] === "string" ? data["role"] : null) === "super_admin";
+			const needsScopesBackfill = !("scopes" in data);
+			if (!needsRoleRewrite && !needsScopesBackfill) continue;
+			const next = { ...data };
+			if (needsRoleRewrite) next["role"] = "admin";
+			if (needsScopesBackfill) next["scopes"] = [];
+			next["updatedAt"] = Date.now();
+			await store.update.mutate({
+				collection: "users",
+				id: row.id,
+				data: next
+			});
+			migrated++;
+		}
+		if (migrated > 0) this.ctx.logger.info("caps-only auth migration: rewrote legacy user records", { meta: { count: migrated } });
+	}
 };
 //#endregion
 export { LocalAuthAddon, LocalAuthAddon as default, AuthManager as i, ApiKeyManager as n, UserManager as r, ScopedTokenManager as t };