@camstack/server 1.0.0 → 1.0.1

package/src/api/core/__tests__/auth-router-totp.spec.ts

@@ -1,297 +0,0 @@
-/* eslint-disable @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-argument, @typescript-eslint/no-unsafe-return -- mock factories cross typed boundaries */
-import { describe, it, expect, beforeEach, vi } from 'vitest'
-import { createAuthRouter } from '../auth.router.js'
-import { AuthService } from '../../../core/auth/auth.service.js'
-
-/**
- * Two-phase TOTP login flow tests for `auth.router`. Focus on the
- * cap-router contracts the SDK + admin-ui depend on:
- *
- *   • `login` returns `requiresTotp: true` + a short-lived challenge
- *     token when the user has TOTP enrolled.
- *   • `login` returns a regular session token when the user has NO
- *     TOTP (backwards compat).
- *   • `loginVerifyTotp` validates the challenge token + code and
- *     mints the real session JWT.
- *   • Failure paths: wrong code, expired/forged challenge, missing
- *     user, missing user-management cap.
- */
-
-interface MockUser {
-  id: string
-  username: string
-  isAdmin: boolean
-  passwordHash: string
-  allowedProviders: string | string[]
-  allowedDevices: Record<string, unknown>
-  scopes: unknown[]
-}
-
-interface MockUserManagement {
-  validateCredentials: ReturnType<typeof vi.fn>
-  getTotpStatus: ReturnType<typeof vi.fn>
-  verifyTotp: ReturnType<typeof vi.fn>
-  listUsers: ReturnType<typeof vi.fn>
-}
-
-function makeUser(overrides: Partial<MockUser> = {}): MockUser {
-  return {
-    id: 'u-1',
-    username: 'alice',
-    isAdmin: false,
-    passwordHash: 'hashed',
-    allowedProviders: '*',
-    allowedDevices: {},
-    scopes: [],
-    ...overrides,
-  }
-}
-
-function makeUserMgmt(overrides: Partial<MockUserManagement> = {}): MockUserManagement {
-  return {
-    validateCredentials: vi.fn(),
-    getTotpStatus: vi.fn(async () => ({ enabled: false, confirmedAt: null })),
-    verifyTotp: vi.fn(async () => ({ valid: true })),
-    listUsers: vi.fn(async () => [makeUser()]),
-    ...overrides,
-  }
-}
-
-function makeConfig(overrides: Record<string, unknown> = {}): {
-  get<T>(p: string): T
-  update(s: string, d: Record<string, unknown>): void
-} {
-  const store: Record<string, unknown> = { 'auth.jwtSecret': 'unit-test-secret', ...overrides }
-  return {
-    get<T>(path: string): T {
-      return store[path] as T
-    },
-    update(_section: string, _data: Record<string, unknown>): void {
-      /* no-op */
-    },
-  }
-}
-
-function makeRegistry(userMgmt: MockUserManagement): {
-  getSingleton: (name: string) => unknown | null
-} {
-  return {
-    getSingleton: (name: string) => (name === 'user-management' ? userMgmt : null),
-  }
-}
-
-/** Invoke a tRPC procedure directly via the router's internal API. */
-async function callProc(
-  router: ReturnType<typeof createAuthRouter>,
-  name: 'login' | 'loginVerifyTotp',
-  input: unknown,
-): Promise<unknown> {
-  const caller = router.createCaller({} as never)
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  const fn = (caller as any)[name]
-  return fn(input)
-}
-
-describe('auth.router — TOTP gate', () => {
-  let auth: AuthService
-  let userMgmt: MockUserManagement
-  let registry: ReturnType<typeof makeRegistry>
-
-  beforeEach(() => {
-    auth = new AuthService(makeConfig() as never)
-    userMgmt = makeUserMgmt()
-    registry = makeRegistry(userMgmt)
-  })
-
-  describe('login (phase 1)', () => {
-    it('returns a regular session token + requiresTotp:false when user has NO TOTP', async () => {
-      const u = makeUser()
-      userMgmt.validateCredentials.mockResolvedValueOnce(u)
-      userMgmt.getTotpStatus.mockResolvedValueOnce({ enabled: false, confirmedAt: null })
-
-      const router = createAuthRouter(auth, registry as never)
-      const result = (await callProc(router, 'login', { username: 'alice', password: 'pw' })) as {
-        token: string
-        user: { id: string; username: string; isAdmin: boolean }
-        requiresTotp?: boolean
-      }
-
-      expect(result.requiresTotp).toBe(false)
-      expect(result.user).toEqual({ id: 'u-1', username: 'alice', isAdmin: false })
-      // The token verifies as a regular session token (NOT a challenge).
-      const verified = auth.verifyToken(result.token)
-      expect(verified.userId).toBe('u-1')
-      // verifyTotpChallengeToken should NOT recognize a regular session token.
-      expect(auth.verifySsoBridgeToken(result.token)).toBeNull()
-    })
-
-    it('returns a challenge token + requiresTotp:true when user HAS TOTP', async () => {
-      const u = makeUser()
-      userMgmt.validateCredentials.mockResolvedValueOnce(u)
-      userMgmt.getTotpStatus.mockResolvedValueOnce({ enabled: true, confirmedAt: Date.now() })
-
-      const router = createAuthRouter(auth, registry as never)
-      const result = (await callProc(router, 'login', { username: 'alice', password: 'pw' })) as {
-        token: string
-        user: { id: string; username: string; isAdmin: boolean }
-        requiresTotp?: boolean
-      }
-
-      expect(result.requiresTotp).toBe(true)
-      // The challenge token MUST NOT verify as a session JWT — it has
-      // `kind: 'totp-challenge'` and the standard verifyToken expects
-      // the session shape (it'd throw or return garbage).
-      const challengeClaims = auth.verifyTotpChallengeToken(result.token)
-      expect(challengeClaims).not.toBeNull()
-      expect(challengeClaims!.userId).toBe('u-1')
-      expect(challengeClaims!.isAdmin).toBe(false)
-    })
-
-    it('rejects invalid credentials', async () => {
-      userMgmt.validateCredentials.mockResolvedValueOnce(null)
-      const router = createAuthRouter(auth, registry as never)
-      await expect(
-        callProc(router, 'login', { username: 'alice', password: 'wrong' }),
-      ).rejects.toThrow('Invalid credentials')
-    })
-
-    it('throws when user-management cap is unregistered (boot failure)', async () => {
-      const emptyRegistry = { getSingleton: () => null } as never
-      const router = createAuthRouter(auth, emptyRegistry)
-      await expect(
-        callProc(router, 'login', { username: 'alice', password: 'pw' }),
-      ).rejects.toThrow(/user-management.*capability not registered/)
-    })
-
-    it('falls through to session-token branch when getTotpStatus method is absent (older user-mgmt builds)', async () => {
-      const u = makeUser()
-      const legacyMgmt = {
-        validateCredentials: vi.fn().mockResolvedValueOnce(u),
-        // getTotpStatus deliberately undefined
-        verifyTotp: vi.fn(),
-        listUsers: vi.fn(),
-      }
-      const router = createAuthRouter(auth, makeRegistry(legacyMgmt as never) as never)
-      const result = (await callProc(router, 'login', { username: 'alice', password: 'pw' })) as {
-        requiresTotp?: boolean
-      }
-      expect(result.requiresTotp).toBe(false)
-    })
-  })
-
-  describe('loginVerifyTotp (phase 2)', () => {
-    it('mints the real session JWT when challenge + code are both valid', async () => {
-      const u = makeUser({ scopes: [{ type: 'category', target: 'storage', access: ['view'] }] })
-      userMgmt.verifyTotp.mockResolvedValueOnce({ valid: true })
-      userMgmt.listUsers.mockResolvedValueOnce([u])
-
-      const challengeToken = auth.signTotpChallengeToken({
-        userId: u.id,
-        username: u.username,
-        isAdmin: u.isAdmin,
-      })
-
-      const router = createAuthRouter(auth, registry as never)
-      const result = (await callProc(router, 'loginVerifyTotp', {
-        challengeToken,
-        code: '123456',
-      })) as {
-        token: string
-        user: { id: string; username: string; isAdmin: boolean }
-        requiresTotp?: boolean
-      }
-
-      expect(result.requiresTotp).toBe(false)
-      expect(result.user.id).toBe('u-1')
-      // Session JWT verifies + carries the user's scopes snapshot.
-      const decoded = auth.verifyToken(result.token)
-      expect(decoded.userId).toBe('u-1')
-    })
-
-    it('rejects an invalid/expired challenge token', async () => {
-      const router = createAuthRouter(auth, registry as never)
-      await expect(
-        callProc(router, 'loginVerifyTotp', { challengeToken: 'not.a.real.jwt', code: '123456' }),
-      ).rejects.toThrow(/Invalid or expired TOTP challenge/)
-    })
-
-    it('rejects a forged challenge token (signed with wrong secret)', async () => {
-      const other = new AuthService(makeConfig({ 'auth.jwtSecret': 'attacker-secret' }) as never)
-      const forged = other.signTotpChallengeToken({
-        userId: 'u-1',
-        username: 'alice',
-        isAdmin: true,
-      })
-      const router = createAuthRouter(auth, registry as never)
-      await expect(
-        callProc(router, 'loginVerifyTotp', { challengeToken: forged, code: '000000' }),
-      ).rejects.toThrow(/Invalid or expired TOTP challenge/)
-    })
-
-    it('rejects a session token reused as a challenge token (wrong kind)', async () => {
-      const sessionTok = auth.signToken({
-        userId: 'u-1',
-        username: 'alice',
-        isAdmin: true,
-        allowedProviders: '*',
-        allowedDevices: {},
-      })
-      const router = createAuthRouter(auth, registry as never)
-      await expect(
-        callProc(router, 'loginVerifyTotp', { challengeToken: sessionTok, code: '000000' }),
-      ).rejects.toThrow(/Invalid or expired TOTP challenge/)
-    })
-
-    it('rejects a wrong 6-digit code', async () => {
-      userMgmt.verifyTotp.mockResolvedValueOnce({ valid: false })
-      const challengeToken = auth.signTotpChallengeToken({
-        userId: 'u-1',
-        username: 'alice',
-        isAdmin: false,
-      })
-      const router = createAuthRouter(auth, registry as never)
-      await expect(
-        callProc(router, 'loginVerifyTotp', { challengeToken, code: '000000' }),
-      ).rejects.toThrow(/Invalid TOTP code/)
-    })
-
-    it('rejects when the user vanishes between legs (deleted concurrently)', async () => {
-      userMgmt.verifyTotp.mockResolvedValueOnce({ valid: true })
-      // The fresh listUsers() call returns nothing — user was deleted.
-      userMgmt.listUsers.mockResolvedValueOnce([])
-      const challengeToken = auth.signTotpChallengeToken({
-        userId: 'ghost',
-        username: 'alice',
-        isAdmin: false,
-      })
-      const router = createAuthRouter(auth, registry as never)
-      await expect(
-        callProc(router, 'loginVerifyTotp', { challengeToken, code: '123456' }),
-      ).rejects.toThrow(/User no longer exists/)
-    })
-
-    it('uses the FRESHLY fetched user record (scope changes pick up immediately)', async () => {
-      // Issue challenge for u-1 with empty scopes (the in-token snapshot).
-      const challengeToken = auth.signTotpChallengeToken({
-        userId: 'u-1',
-        username: 'alice',
-        isAdmin: false,
-      })
-      // Between the two legs, an admin granted u-1 a new scope.
-      userMgmt.verifyTotp.mockResolvedValueOnce({ valid: true })
-      userMgmt.listUsers.mockResolvedValueOnce([
-        makeUser({ scopes: [{ type: 'category', target: 'addon', access: ['view'] }] }),
-      ])
-      const router = createAuthRouter(auth, registry as never)
-      const result = (await callProc(router, 'loginVerifyTotp', {
-        challengeToken,
-        code: '123456',
-      })) as { token: string }
-      const decoded = auth.verifyToken(result.token)
-      // The fresh scope is in the minted session JWT, not the snapshot
-      // from the (potentially stale) password leg.
-      const scopes = (decoded as { scopes?: unknown[] }).scopes
-      expect(scopes).toHaveLength(1)
-    })
-  })
-})

package/src/api/core/__tests__/integration-markers.spec.ts

@@ -1,10 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { INTEGRATION_CAP_MARKERS } from '../cap-providers.js'
-
-describe('integration cap markers', () => {
-  it('recognises device-adoption (not the old ha-discovery)', () => {
-    expect(INTEGRATION_CAP_MARKERS.has('device-adoption')).toBe(true)
-    expect(INTEGRATION_CAP_MARKERS.has('ha-discovery')).toBe(false)
-    expect(INTEGRATION_CAP_MARKERS.has('device-provider')).toBe(true)
-  })
-})

package/src/api/core/addon-settings.router.ts

@@ -1,127 +0,0 @@
-/**
- * Addon settings router — raw DB proxy for the common settings API.
- *
- * Exposes four protected procedures consumed by:
- *   1. Forked addons (via the tRPC WSS client in `WorkerBootstrapService`)
- *      to read/write their 3-level settings chain from the worker process.
- *   2. Future UI flows that want to inspect/mutate addon settings through
- *      a single well-typed endpoint.
- *
- * The router is deliberately thin — it does NOT perform schema-based
- * resolver merging (defaults → global → per-device). That happens on the
- * consumer side where the addon's `ConfigUISchema` is available:
- *   - In-process addons: handled by `SettingsResolverService.createView()`
- *     wired into `AddonContext.settings` during `createAddonContext()`.
- *   - Forked addons: handled by the `AddonSettingsView` constructed inside
- *     `WorkerBootstrapService`, which has access to the worker's local
- *     addon schema.
- *
- * Introduced in session 5 Sprint 3a (worker-bootstrap cap-aware wiring).
- */
-import { z } from 'zod'
-import type { ConfigService } from '../../core/config/config.service.js'
-import { trpcRouter, protectedProcedure } from '../trpc/trpc.middleware.js'
-
-const AddonSettingsRecordSchema = z.record(z.string(), z.unknown())
-
-const AddonIdInputSchema = z.object({
-  addonId: z.string(),
-})
-
-const AddonDeviceInputSchema = z.object({
-  addonId: z.string(),
-  deviceId: z.string(),
-})
-
-const UpdateGlobalInputSchema = z.object({
-  addonId: z.string(),
-  field: z.string(),
-  value: z.unknown(),
-})
-
-const UpdateDeviceInputSchema = z.object({
-  addonId: z.string(),
-  deviceId: z.string(),
-  field: z.string(),
-  value: z.unknown(),
-})
-
-const SuccessSchema = z.object({ success: z.literal(true) })
-
-const ReplaceGlobalInputSchema = z.object({
-  addonId: z.string(),
-  config: z.record(z.string(), z.unknown()),
-})
-
-export function createAddonSettingsRouter(cfg: ConfigService) {
-  return trpcRouter({
-    /**
-     * Read the addon-global settings record for the given addon.
-     * Returns the raw stored values (no defaults, no device overrides).
-     */
-    getGlobal: protectedProcedure
-      .input(AddonIdInputSchema)
-      .output(AddonSettingsRecordSchema)
-      .query(({ input }) => cfg.getAddonConfig(input.addonId)),
-
-    /**
-     * Read the per-device override record for the given addon × device.
-     * Returns the raw stored values (schema filtering happens on the
-     * consumer side at merge time).
-     */
-    getDeviceOverrides: protectedProcedure
-      .input(AddonDeviceInputSchema)
-      .output(AddonSettingsRecordSchema)
-      .query(({ input }) => cfg.getAddonDevice(input.addonId, input.deviceId)),
-
-    /**
-     * Update a single field in the addon-global settings record.
-     * Reads the current record, merges the new value, and writes back
-     * via `setAddonConfig` (bulk replace). Intended for small per-field
-     * writes from addon code; bulk updates should use a dedicated admin
-     * endpoint (not exposed here).
-     */
-    updateGlobal: protectedProcedure
-      .input(UpdateGlobalInputSchema)
-      .output(SuccessSchema)
-      .mutation(({ input }) => {
-        const current = cfg.getAddonConfig(input.addonId)
-        cfg.setAddonConfig(input.addonId, { ...current, [input.field]: input.value })
-        return { success: true as const }
-      }),
-
-    /**
-     * Update a single field in the per-device override record for the
-     * given addon × device. Merges with the existing overrides and
-     * writes back via `setAddonDevice`. Scope enforcement (dropping
-     * fields not declared as `scope: 'device'`) is the consumer's
-     * responsibility — we preserve the raw shape at this layer so the
-     * resolver contract remains symmetric with `getDeviceOverrides`.
-     */
-    updateDevice: protectedProcedure
-      .input(UpdateDeviceInputSchema)
-      .output(SuccessSchema)
-      .mutation(({ input }) => {
-        const current = cfg.getAddonDevice(input.addonId, input.deviceId)
-        cfg.setAddonDevice(input.addonId, input.deviceId, {
-          ...current,
-          [input.field]: input.value,
-        })
-        return { success: true as const }
-      }),
-
-    /**
-     * Replace the entire addon-global settings record in one call.
-     * Used by forked workers for `context.config.setAll()`. Unlike
-     * `updateGlobal` (single-field merge), this overwrites the full record.
-     * Admin-level write: only workers with valid hub tokens can call this.
-     */
-    replaceGlobal: protectedProcedure
-      .input(ReplaceGlobalInputSchema)
-      .output(SuccessSchema)
-      .mutation(({ input }) => {
-        cfg.setAddonConfig(input.addonId, input.config)
-        return { success: true as const }
-      }),
-  })
-}

package/src/api/core/agents.router.ts

@@ -1,86 +0,0 @@
-/**
- * Agents router — fixed core API (not a capability).
- *
- * Thin binding over AgentRegistryService which now delegates to Moleculer
- * for node discovery and health. Only role-assignment management and
- * node listing remain; protocol endpoints (register, heartbeat, task
- * dispatch) are handled natively by the Moleculer service mesh.
- */
-import { z } from 'zod'
-import type { AgentRegistryService } from '../../core/agent/agent-registry.service.js'
-import type { MoleculerService } from '../../core/moleculer/moleculer.service.js'
-import { trpcRouter, adminProcedure } from '../trpc/trpc.middleware.js'
-
-const AgentRoleSchema = z.enum(['decoder', 'transcoder', 'detector', 'recorder'])
-
-export function createAgentsRouter(ar: AgentRegistryService, moleculer: MoleculerService) {
-  return trpcRouter({
-    // ── Node listing (replaces listAgents / listConnected) ────────────
-    listNodes: adminProcedure.input(z.void()).query(async () => {
-      const items = await ar.listNodes()
-      // Spread to mutable copies: AgentListItem uses readonly arrays; Zod output schema uses mutable.
-      return items.map((a) => ({
-        ...a,
-        info: {
-          ...a.info,
-          capabilities: [...a.info.capabilities],
-        },
-        status: {
-          ...a.status,
-          fps: { ...a.status.fps },
-          errors: [...a.status.errors],
-        },
-        subProcesses: [...a.subProcesses],
-      }))
-    }),
-
-    // ── Capability discovery (via Moleculer service list) ─────────────
-    getAgentCapabilities: adminProcedure.input(z.void()).query(async () => {
-      // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-member-access -- moleculer.broker.call typing chain unresolvable; runtime shape validated by the cast below
-      const services = (await moleculer.broker.call('$node.services', {})) as Array<{
-        name: string
-      }>
-      const capSet = new Set<string>()
-      for (const svc of services) {
-        if (svc.name.startsWith('$')) continue
-        capSet.add(svc.name)
-      }
-      return [...capSet].toSorted()
-    }),
-
-    // ── Role assignments ──────────────────────────────────────────────
-    getAssignments: adminProcedure
-      .input(z.object({ cameraId: z.number().optional() }))
-      .query(({ input }) => ar.getAssignments(input.cameraId)),
-
-    setAssignment: adminProcedure
-      .input(
-        z.object({
-          cameraId: z.number(),
-          role: AgentRoleSchema,
-          agentId: z.string(),
-          priority: z.enum(['primary', 'backup', 'overflow']),
-          rtspUrl: z.string().optional(),
-        }),
-      )
-      .mutation(({ input }) => ar.setAssignment(input as never)),
-
-    removeAssignment: adminProcedure
-      .input(
-        z.object({
-          cameraId: z.number(),
-          role: AgentRoleSchema,
-        }),
-      )
-      .mutation(({ input }) => ar.removeAssignment(input.cameraId, input.role as never)),
-
-    activateBackup: adminProcedure
-      .input(
-        z.object({
-          cameraId: z.number(),
-          role: AgentRoleSchema,
-        }),
-      )
-      .mutation(({ input }) => ar.activateBackup(input.cameraId, input.role as never)),
-  })
-}