@camstack/core 0.1.29 → 0.1.30

package/dist/auth/scoped-token-manager.d.ts

@@ -10,7 +10,14 @@ export declare class ScopedTokenManager {
         record: ScopedToken;
     }>;
     validate(rawToken: string): Promise<ScopedToken | null>;
-    matchesScope(token: ScopedToken, addonId?: string, routePath?: string, capability?: string): boolean;
+    /**
+     * Coarse scope match — checks only `addonId` / `capability` (no
+     * `route-prefix` after the caps-only migration). Used by addon-route
+     * HTTP handlers that need a quick allow/deny before the per-method
+     * `access` check kicks in via `METHOD_ACCESS_MAP` in
+     * `protectedProcedure`.
+     */
+    matchesScope(token: ScopedToken, addonId?: string, capability?: string): boolean;
     revoke(tokenId: string): Promise<void>;
     listForUser(userId: string): Promise<ScopedToken[]>;
     updateLastUsed(tokenId: string): Promise<void>;

package/dist/auth/scoped-token-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scoped-token-manager.d.ts","sourceRoot":"","sources":["../../src/auth/scoped-token-manager.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAUnF;;GAEG;AACH,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,mBAAmB;IAEjD,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,UAAU,EAAE,EACpB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,CAAC;IAsB5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAY7D,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO;IAW9F,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAKnD,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpD;;;;;;;;;;;;;;OAcG;IACG,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;CAYzE"}
+{"version":3,"file":"scoped-token-manager.d.ts","sourceRoot":"","sources":["../../src/auth/scoped-token-manager.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAUnF;;GAEG;AACH,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,mBAAmB;IAEjD,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,UAAU,EAAE,EACpB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,CAAC;IAsB5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAY7D;;;;;;OAMG;IACH,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO;IAU1E,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAKnD,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpD;;;;;;;;;;;;;;OAcG;IACG,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;CAYzE"}

package/dist/auth/user-manager.d.ts

@@ -1,5 +1,5 @@
 import { AuthManager } from './auth-manager.js';
-import { UserRecord, UserRole, SettingsStoreClient } from '@camstack/types';
+import { UserRecord, UserRole, TokenScope, SettingsStoreClient } from '@camstack/types';
 export type { UserRecord };
 interface CreateUserInput {
     username: string;
@@ -7,8 +7,9 @@ interface CreateUserInput {
     role: UserRole;
     allowedProviders?: string[] | '*';
     allowedDevices?: Record<string, string[] | '*'>;
+    scopes?: TokenScope[];
 }
-type UpdatableUserFields = Partial<Pick<UserRecord, 'role' | 'allowedProviders' | 'allowedDevices'>>;
+type UpdatableUserFields = Partial<Pick<UserRecord, 'role' | 'allowedProviders' | 'allowedDevices' | 'scopes'>>;
 export interface UserStorageAccess {
     getStore(): SettingsStoreClient;
 }

package/dist/auth/user-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-manager.d.ts","sourceRoot":"","sources":["../../src/auth/user-manager.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAGhF,YAAY,EAAE,UAAU,EAAE,CAAA;AAE1B,UAAU,eAAe;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,QAAQ,CAAA;IACd,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,CAAA;IACjC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,CAAA;CAChD;AAED,KAAK,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,GAAG,gBAAgB,CAAC,CAAC,CAAA;AAIpG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,IAAI,mBAAmB,CAAA;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,CAAA;CACxB;AAMD,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,aAAa,EAAE,iBAAiB,EAChC,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,gBAAgB;IAG3C,OAAO,KAAK,KAAK,GAEhB;IAEK,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;IAqBnD,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAM5D,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAMhD,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAOnF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC;IAStD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAM5D,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjC,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO7D,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;CAkBzC"}
+{"version":3,"file":"user-manager.d.ts","sourceRoot":"","sources":["../../src/auth/user-manager.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAG5F,YAAY,EAAE,UAAU,EAAE,CAAA;AAE1B,UAAU,eAAe;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,QAAQ,CAAA;IACd,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,CAAA;IACjC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,CAAA;IAC/C,MAAM,CAAC,EAAE,UAAU,EAAE,CAAA;CACtB;AAED,KAAK,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,QAAQ,CAAC,CAAC,CAAA;AAI/G,MAAM,WAAW,iBAAiB;IAChC,QAAQ,IAAI,mBAAmB,CAAA;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,CAAA;CACxB;AAMD,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,aAAa,EAAE,iBAAiB,EAChC,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,gBAAgB;IAG3C,OAAO,KAAK,KAAK,GAEhB;IAEK,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;IAsBnD,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAM5D,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAMhD,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAOnF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC;IAStD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAM5D,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjC,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO7D,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;CAqBzC"}

package/dist/builtins/local-auth/local-auth.addon.d.ts

@@ -12,6 +12,12 @@ export declare class LocalAuthAddon extends BaseAddon<LocalAuthConfig> {
     constructor();
     protected onInitialize(): Promise<ProviderRegistration[]>;
     protected onShutdown(): Promise<void>;
+    /**
+     * Caps-only auth migration — rewrites legacy `super_admin` rows to
+     * `admin` and backfills the missing `scopes` field with `[]`. Idempotent;
+     * a re-run sees no rows needing changes.
+     */
+    private migrateLegacyUserRecords;
 }
 export default LocalAuthAddon;
 //# sourceMappingURL=local-auth.addon.d.ts.map

package/dist/builtins/local-auth/local-auth.addon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-auth.addon.d.ts","sourceRoot":"","sources":["../../../src/builtins/local-auth/local-auth.addon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAA2B,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACpF,OAAO,EAAE,SAAS,EAAoD,MAAM,iBAAiB,CAAA;AA4B7F,UAAU,eAAe;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,qBAAa,cAAe,SAAQ,SAAS,CAAC,eAAe,CAAC;IAC5D,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,aAAa,CAA6B;IAClD,OAAO,CAAC,kBAAkB,CAAkC;;cAI5C,YAAY,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;cAwM/C,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAM5C;AAED,eAAe,cAAc,CAAA"}
+{"version":3,"file":"local-auth.addon.d.ts","sourceRoot":"","sources":["../../../src/builtins/local-auth/local-auth.addon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAA2B,oBAAoB,EAAuB,MAAM,iBAAiB,CAAA;AACzG,OAAO,EAAE,SAAS,EAAoD,MAAM,iBAAiB,CAAA;AA4B7F,UAAU,eAAe;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,qBAAa,cAAe,SAAQ,SAAS,CAAC,eAAe,CAAC;IAC5D,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,aAAa,CAA6B;IAClD,OAAO,CAAC,kBAAkB,CAAkC;;cAI5C,YAAY,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;cAmO/C,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAO3C;;;;OAIG;YACW,wBAAwB;CAwBvC;AAED,eAAe,cAAc,CAAA"}

package/dist/builtins/local-auth/local-auth.addon.js

@@ -6258,6 +6258,7 @@ var UserManager = class {
 			role: input.role,
 			allowedProviders: input.allowedProviders ?? "*",
 			allowedDevices: input.allowedDevices ?? {},
+			scopes: input.scopes ?? [],
 			createdAt: now,
 			updatedAt: now
 		};
@@ -6342,7 +6343,7 @@ var UserManager = class {
 		await this.create({
 			username: adminUsername,
 			password: adminPassword,
-			role: "super_admin",
+			role: "admin",
 			allowedProviders: "*",
 			allowedDevices: {}
 		});
@@ -6481,14 +6482,18 @@ var ScopedTokenManager = class {
 		this.updateLastUsed(record.id).catch(() => {});
 		return record;
 	}
-	matchesScope(token, addonId, routePath, capability) {
+	/**
+	* Coarse scope match — checks only `addonId` / `capability` (no
+	* `route-prefix` after the caps-only migration). Used by addon-route
+	* HTTP handlers that need a quick allow/deny before the per-method
+	* `access` check kicks in via `METHOD_ACCESS_MAP` in
+	* `protectedProcedure`.
+	*/
+	matchesScope(token, addonId, capability) {
 		for (const scope of token.scopes) switch (scope.type) {
 			case "addon":
 				if (addonId && scope.target === addonId) return true;
 				break;
-			case "route-prefix":
-				if (routePath && routePath.startsWith(scope.target)) return true;
-				break;
 			case "capability":
 				if (capability && scope.target === capability) return true;
 				break;
@@ -6772,6 +6777,11 @@ var LocalAuthAddon = class extends _camstack_types.BaseAddon {
 			this.apiKeyManager = new ApiKeyManager(storageAccess, this.authManager);
 			this.scopedTokenManager = new ScopedTokenManager(store);
 			try {
+				try {
+					await this.migrateLegacyUserRecords(store);
+				} catch (err) {
+					this.ctx.logger.warn("caps-only migration pass failed; legacy super_admin rows may still exist", { meta: { error: err instanceof Error ? err.message : String(err) } });
+				}
 				await this.userManager.ensureAdminExists();
 				const liveUsers = await this.userManager.listAll();
 				const liveIds = new Set(liveUsers.map((u) => u.id));
@@ -6832,6 +6842,11 @@ var LocalAuthAddon = class extends _camstack_types.BaseAddon {
 				await this.userManager.resetPassword(input.id, input.newPassword);
 				return { success: true };
 			},
+			setUserScopes: async (input) => {
+				if (!this.userManager) throw new Error("User management not available");
+				await this.userManager.update(input.userId, { scopes: input.scopes });
+				return { success: true };
+			},
 			validateCredentials: async (input) => {
 				if (!this.userManager) return null;
 				return await this.userManager.validateCredentials(input.username, input.password) ?? null;
@@ -6898,6 +6913,32 @@ var LocalAuthAddon = class extends _camstack_types.BaseAddon {
 		this.apiKeyManager = null;
 		this.scopedTokenManager = null;
 	}
+	/**
+	* Caps-only auth migration — rewrites legacy `super_admin` rows to
+	* `admin` and backfills the missing `scopes` field with `[]`. Idempotent;
+	* a re-run sees no rows needing changes.
+	*/
+	async migrateLegacyUserRecords(store) {
+		const results = await store.query.query({ collection: "users" });
+		let migrated = 0;
+		for (const row of results) {
+			const data = row.data;
+			const needsRoleRewrite = (typeof data["role"] === "string" ? data["role"] : null) === "super_admin";
+			const needsScopesBackfill = !("scopes" in data);
+			if (!needsRoleRewrite && !needsScopesBackfill) continue;
+			const next = { ...data };
+			if (needsRoleRewrite) next["role"] = "admin";
+			if (needsScopesBackfill) next["scopes"] = [];
+			next["updatedAt"] = Date.now();
+			await store.update.mutate({
+				collection: "users",
+				id: row.id,
+				data: next
+			});
+			migrated++;
+		}
+		if (migrated > 0) this.ctx.logger.info("caps-only auth migration: rewrote legacy user records", { meta: { count: migrated } });
+	}
 };
 //#endregion
 exports.ApiKeyManager = ApiKeyManager;