@camstack/server 1.1.46 → 1.1.47

package/dist/api/core/auth.router.js

@@ -17,7 +17,9 @@ exports.createAuthRouter = createAuthRouter;
  * to (superseding the removed `auth.listProviders`).
  */
 const zod_1 = require("zod");
+const server_1 = require("@trpc/server");
 const types_1 = require("@camstack/types");
+const share_token_service_js_1 = require("../../core/auth/share-token.service.js");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
 /**
  * The available second-factor kinds a user may satisfy after the
@@ -123,6 +125,63 @@ const PublicLoginMethodSchema = zod_1.z.discriminatedUnion('kind', [
     types_1.RedirectLoginMethodSchema,
     PublicWidgetLoginMethodSchema,
 ]);
+// ── Share tokens (grid-view standalone share links) ──────────────────
+//
+// Wire schemas for the `csv_*` share-token surface. The summary shape
+// deliberately omits `tokenHash` — the raw token is returned exactly
+// once (at mint); afterwards only prefix + scope + timestamps are
+// visible.
+//
+// TTL: a bounded number of seconds, or the EXPLICIT literal `'never'`
+// for a permanently-shared grid (revocation is the kill switch).
+// Omitted → 7-day default; infinite is never a silent default.
+const CreateShareTokenInputSchema = zod_1.z.object({
+    scope: share_token_service_js_1.ShareTokenScopeSchema,
+    ttlSec: zod_1.z
+        .union([
+        zod_1.z.number().int().min(share_token_service_js_1.SHARE_TOKEN_TTL_MIN_SEC).max(share_token_service_js_1.SHARE_TOKEN_TTL_MAX_SEC),
+        zod_1.z.literal('never'),
+    ])
+        .optional(),
+});
+const ShareTokenSummarySchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    userId: zod_1.z.string(),
+    tokenPrefix: zod_1.z.string(),
+    scope: share_token_service_js_1.ShareTokenScopeSchema,
+    createdAt: zod_1.z.number(),
+    /** Epoch ms, or `null` for never-expiring tokens. */
+    expiresAt: zod_1.z.number().nullable(),
+    /** Derived convenience flag so listings surface infinite tokens clearly. */
+    neverExpires: zod_1.z.boolean(),
+    lastUsedAt: zod_1.z.number().optional(),
+});
+function toShareTokenSummary(record) {
+    return {
+        id: record.id,
+        userId: record.userId,
+        tokenPrefix: record.tokenPrefix,
+        scope: record.scope,
+        createdAt: record.createdAt,
+        expiresAt: record.expiresAt,
+        neverExpires: record.expiresAt === null,
+        ...(record.lastUsedAt !== undefined ? { lastUsedAt: record.lastUsedAt } : {}),
+    };
+}
+/**
+ * Share-token management is for REAL user sessions only. Scoped API
+ * tokens (`cst_*`) and share-view principals (`csv_*`) must never mint,
+ * list, or revoke share links — a leaked restricted token would
+ * otherwise be able to widen its own reach.
+ */
+function assertRealUserSession(user) {
+    if (user.isScoped || user.shareView) {
+        throw new server_1.TRPCError({
+            code: 'FORBIDDEN',
+            message: 'Share-token management requires a real user session',
+        });
+    }
+}
 /** Wire shape of the authenticated user returned by `auth.me`. */
 const MeSchema = zod_1.z
     .object({
@@ -138,7 +197,13 @@ const MeSchema = zod_1.z
     agentId: zod_1.z.string().optional(),
 })
     .nullable();
-function createAuthRouter(auth, registry, moleculer = null) {
+function createAuthRouter(auth, registry, moleculer = null, shareTokens = null) {
+    const requireShareTokens = () => {
+        if (!shareTokens) {
+            throw new Error('Share tokens unavailable — service not wired on this node');
+        }
+        return shareTokens;
+    };
     return (0, trpc_middleware_js_1.trpcRouter)({
         login: trpc_middleware_js_1.publicProcedure
             .input(zod_1.z.object({ username: zod_1.z.string(), password: zod_1.z.string() }))
@@ -479,6 +544,57 @@ function createAuthRouter(auth, registry, moleculer = null) {
                 throw new Error('Passkey management is not available');
             return provider.removePasskey({ userId: ctx.user.id, credentialId: input.credentialId });
         }),
+        // ── Share tokens — scoped, TTL'd view tokens for standalone share
+        //    links (grid rework R6). Minted by any REAL user session (admin
+        //    or regular); the resulting `csv_*` token authenticates as a
+        //    restricted `share-view` principal limited to the embed surface
+        //    + its in-scope devices (see `share-view-access.ts`). ──────────
+        createShareToken: trpc_middleware_js_1.protectedProcedure
+            .input(CreateShareTokenInputSchema)
+            .output(zod_1.z.object({ id: zod_1.z.string(), token: zod_1.z.string(), expiresAt: zod_1.z.number().nullable() }))
+            .mutation(async ({ input, ctx }) => {
+            assertRealUserSession(ctx.user);
+            const service = requireShareTokens();
+            const { token, record } = await service.create({
+                userId: ctx.user.id,
+                scope: input.scope,
+                ...(input.ttlSec !== undefined ? { ttlSec: input.ttlSec } : {}),
+            });
+            return { id: record.id, token, expiresAt: record.expiresAt };
+        }),
+        revokeShareToken: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ id: zod_1.z.string().min(1) }))
+            .output(zod_1.z.object({ success: zod_1.z.boolean() }))
+            .mutation(async ({ input, ctx }) => {
+            assertRealUserSession(ctx.user);
+            const service = requireShareTokens();
+            try {
+                const removed = await service.revoke({
+                    id: input.id,
+                    callerUserId: ctx.user.id,
+                    callerIsAdmin: ctx.user.isAdmin,
+                });
+                return { success: removed };
+            }
+            catch (error) {
+                throw new server_1.TRPCError({
+                    code: 'FORBIDDEN',
+                    message: error instanceof Error ? error.message : 'Share token revoke failed',
+                });
+            }
+        }),
+        /** Own tokens for regular users; the full set for admins. */
+        listShareTokens: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.void())
+            .output(zod_1.z.array(ShareTokenSummarySchema))
+            .query(async ({ ctx }) => {
+            assertRealUserSession(ctx.user);
+            const service = requireShareTokens();
+            const records = ctx.user.isAdmin
+                ? await service.listAll()
+                : await service.listForUser(ctx.user.id);
+            return records.map(toShareTokenSummary);
+        }),
         logout: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.void())
             .output(zod_1.z.object({ success: zod_1.z.literal(true) }))
@@ -503,6 +619,10 @@ function createAuthRouter(auth, registry, moleculer = null) {
             if (!registry)
                 return [];
             const out = [];
+            // Defense-in-depth dedupe: a routing bug in a grouped runner once
+            // resolved every provider to the same addon (3× identical magic-link
+            // buttons) — a duplicated contribution id must never render twice.
+            const seenIds = new Set();
             for (const provider of registry.getCollection('login-method')) {
                 let contributions;
                 try {
@@ -512,10 +632,14 @@ function createAuthRouter(auth, registry, moleculer = null) {
                     continue;
                 }
                 for (const raw of contributions) {
+                    if (seenIds.has(raw.id))
+                        continue;
                     if (raw.kind === 'redirect') {
                         const parsed = types_1.RedirectLoginMethodSchema.safeParse(raw);
-                        if (parsed.success)
+                        if (parsed.success) {
                             out.push(parsed.data);
+                            seenIds.add(parsed.data.id);
+                        }
                         continue;
                     }
                     // Widget arm — stamp a public bundleUrl from addonId + bundle.
@@ -523,8 +647,10 @@ function createAuthRouter(auth, registry, moleculer = null) {
                         ...raw,
                         bundleUrl: `/api/addon-widgets/${raw.addonId}/${raw.bundle}?v=${Date.now()}`,
                     });
-                    if (parsed.success)
+                    if (parsed.success) {
                         out.push(parsed.data);
+                        seenIds.add(parsed.data.id);
+                    }
                 }
             }
             return out;

package/dist/api/core/live-events.router.js

@@ -9,6 +9,7 @@ exports.createLiveEventsRouter = createLiveEventsRouter;
  */
 const zod_1 = require("zod");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const share_view_access_js_1 = require("../trpc/share-view-access.js");
 function createLiveEventsRouter(eb, ar) {
     return (0, trpc_middleware_js_1.trpcRouter)({
         recentSystemEvents: trpc_middleware_js_1.protectedProcedure
@@ -21,12 +22,23 @@ function createLiveEventsRouter(eb, ar) {
             .query(({ input }) => eb.getRecent(input ?? {}, input?.limit ?? 50)),
         onEvent: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.object({ category: zod_1.z.string().optional() }))
-            .subscription(({ input }) => {
+            .subscription(({ input, ctx }) => {
+            // Share-view principals get a device-filtered stream: only events
+            // attributable to an in-scope device are pushed (fail closed —
+            // unattributable events are dropped). Everyone else gets the
+            // unfiltered stream, exactly as before.
+            const shareScope = ctx.user.shareView?.scope ?? null;
             return (0, trpc_middleware_js_1.iterableSubscription)((push) => {
                 const filter = {};
                 if (input.category)
                     filter.category = input.category;
-                return eb.subscribe(filter, push);
+                if (!shareScope)
+                    return eb.subscribe(filter, push);
+                const allowedDeviceIds = new Set(shareScope.deviceIds);
+                return eb.subscribe(filter, (evt) => {
+                    if ((0, share_view_access_js_1.liveEventInShareScope)(evt, allowedDeviceIds))
+                        push(evt);
+                });
             });
         }),
         onDeviceEvent: trpc_middleware_js_1.protectedProcedure

package/dist/api/trpc/share-view-access.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkShareViewAccess = checkShareViewAccess;
+exports.liveEventInShareScope = liveEventInShareScope;
+/**
+ * Methods callable WITHOUT a per-device check — their input carries no
+ * deviceId. `live.onEvent` is here because its input is only a category;
+ * the pushed stream is device-filtered separately in the live router.
+ */
+const GRID_VIEW_OPEN_METHODS = new Set([
+    'auth.me',
+    'deviceManager.listAll',
+    'turnProvider.getTurnServers',
+    'live.onEvent',
+]);
+/**
+ * Methods callable ONLY with an in-scope `input.deviceId`. A missing or
+ * non-numeric deviceId is denied (fail closed).
+ */
+const GRID_VIEW_DEVICE_METHODS = new Set([
+    'snapshot.getSnapshot',
+    'pipelineOrchestrator.getCameraMetrics',
+    'webrtcSession.listStreams',
+    'webrtcSession.createSession',
+    'webrtcSession.handleOffer',
+    'webrtcSession.handleAnswer',
+    'webrtcSession.addIceCandidate',
+    'webrtcSession.getIceCandidates',
+    'webrtcSession.getSessionState',
+    'webrtcSession.closeSession',
+]);
+/** Pull `deviceId` off a raw tRPC input without casting. */
+function extractDeviceId(input) {
+    if (input === null || typeof input !== 'object')
+        return null;
+    const candidate = Reflect.get(input, 'deviceId');
+    return typeof candidate === 'number' && Number.isFinite(candidate) ? candidate : null;
+}
+function checkShareViewAccess(scope, path, input) {
+    if (scope.kind !== 'grid-view') {
+        return { ok: false, reason: `Unknown share scope kind '${String(scope.kind)}'` };
+    }
+    if (GRID_VIEW_OPEN_METHODS.has(path)) {
+        return { ok: true };
+    }
+    if (GRID_VIEW_DEVICE_METHODS.has(path)) {
+        const deviceId = extractDeviceId(input);
+        if (deviceId === null) {
+            return { ok: false, reason: `'${path}' requires a numeric deviceId for share-view access` };
+        }
+        if (!scope.deviceIds.includes(deviceId)) {
+            return {
+                ok: false,
+                reason: `Device ${deviceId} is outside this share link's scope`,
+            };
+        }
+        return { ok: true };
+    }
+    return { ok: false, reason: `'${path}' is not available to share-view tokens` };
+}
+/**
+ * Whether a live event belongs to a device inside the share scope.
+ * Matches the device identity two ways (fail closed — no match, no push):
+ *   • `source.id` — device-sourced events (motion, detection, audio);
+ *     tolerates the string-typed ids some emitters use;
+ *   • `data.deviceId` — addon-sourced per-device telemetry
+ *     (e.g. `pipeline.camera-metrics-snapshot`).
+ */
+function liveEventInShareScope(evt, allowedDeviceIds) {
+    const sourceId = evt.source?.id;
+    if (typeof sourceId === 'number' && allowedDeviceIds.has(sourceId))
+        return true;
+    if (typeof sourceId === 'string' && sourceId !== '') {
+        const numeric = Number(sourceId);
+        if (Number.isInteger(numeric) && allowedDeviceIds.has(numeric))
+            return true;
+    }
+    const dataDeviceId = evt.data?.['deviceId'];
+    if (typeof dataDeviceId === 'number' && allowedDeviceIds.has(dataDeviceId))
+        return true;
+    return false;
+}

package/dist/api/trpc/trpc.context.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createMeshTrpcContext = createMeshTrpcContext;
 exports.createTrpcContext = createTrpcContext;
 exports.createWsTrpcContext = createWsTrpcContext;
+const share_token_service_js_1 = require("../../core/auth/share-token.service.js");
 /** Read `req.query` if present (Fastify-only) without losing type safety. */
 function readQuery(req) {
     if (!('query' in req))
@@ -50,9 +51,39 @@ function extractTokenFromRequest(req) {
  * token. Caller (protectedProcedure) decides the failure response
  * (typically UNAUTHORIZED).
  */
-async function resolveUser(token, authService, addonRegistry) {
+async function resolveUser(token, authService, addonRegistry, shareTokens = null) {
     if (!token)
         return null;
+    // Share-token path (`csv_*`): resolve through the ShareTokenService.
+    // The synthetic principal is maximally restricted — non-admin, no
+    // scopes; the `shareView` grant routes it into the fail-closed
+    // allowlist in `protectedProcedure` instead of the scope matcher.
+    if (token.startsWith(share_token_service_js_1.SHARE_TOKEN_PREFIX)) {
+        if (!shareTokens)
+            return null;
+        try {
+            const record = await shareTokens.validate(token);
+            if (!record)
+                return null;
+            return {
+                id: record.userId,
+                // Display label — `share:<prefix>` keeps audit logs readable
+                // without exposing the token hash.
+                username: `share:${record.tokenPrefix}`,
+                isAdmin: false,
+                permissions: {
+                    isAdmin: false,
+                    allowedProviders: '*',
+                    allowedDevices: {},
+                },
+                isApiKey: true,
+                shareView: { tokenId: record.id, scope: record.scope },
+            };
+        }
+        catch {
+            return null;
+        }
+    }
     // Scoped-token path: hit the user-management cap. Synthetic user
     // with `isAdmin: false` so admin-gated procedures bounce while
     // protectedProcedure can still gate by scope match.
@@ -158,10 +189,10 @@ function createMeshTrpcContext() {
     return { user };
 }
 /** Context factory for HTTP tRPC requests (Fastify adapter). */
-async function createTrpcContext(req, authService, addonRegistry) {
+async function createTrpcContext(req, authService, addonRegistry, shareTokens = null) {
     const token = extractTokenFromRequest(req);
     return {
-        user: await resolveUser(token, authService, addonRegistry),
+        user: await resolveUser(token, authService, addonRegistry, shareTokens),
         req,
         getDeviceAncestors: makeAncestorLookup(addonRegistry),
     };
@@ -171,11 +202,11 @@ async function createTrpcContext(req, authService, addonRegistry) {
  * Token is sent via tRPC connectionParams (a JSON message sent right after
  * the WS handshake), which is more reliable than query params through proxies.
  */
-async function createWsTrpcContext(opts, authService, addonRegistry) {
+async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens = null) {
     // 1. connectionParams.token (sent by BackendClient's createWSClient)
     const paramToken = opts.info.connectionParams?.['token'];
     const token = (typeof paramToken === 'string' ? paramToken : null) ?? extractTokenFromRequest(opts.req);
-    const user = await resolveUser(token, authService, addonRegistry);
+    const user = await resolveUser(token, authService, addonRegistry, shareTokens);
     return {
         user,
         req: opts.req,

package/dist/api/trpc/trpc.middleware.js

@@ -10,6 +10,7 @@ const server_1 = require("@trpc/server");
 const superjson_1 = __importDefault(require("superjson"));
 const system_1 = require("@camstack/system");
 const scope_access_js_1 = require("./scope-access.js");
+const share_view_access_js_1 = require("./share-view-access.js");
 const cap_route_error_formatter_js_1 = require("./cap-route-error-formatter.js");
 const t = server_1.initTRPC.context().create({
     transformer: superjson_1.default,
@@ -93,6 +94,18 @@ exports.protectedProcedure = t.procedure.use(async ({ ctx, next, path, getRawInp
     if (!ctx.user) {
         throw new server_1.TRPCError({ code: 'UNAUTHORIZED' });
     }
+    // Share-view principals (`csv_*` tokens) NEVER reach the admin bypass,
+    // the hand-written-route pass-through, or the scope matcher below —
+    // they are gated exclusively by the fail-closed embed-surface allowlist
+    // (`share-view-access.ts`): enumerated methods only, in-scope devices only.
+    if (ctx.user.shareView) {
+        const rawInput = await getRawInput();
+        const result = (0, share_view_access_js_1.checkShareViewAccess)(ctx.user.shareView.scope, path, rawInput);
+        if (!result.ok) {
+            throw new server_1.TRPCError({ code: 'FORBIDDEN', message: result.reason });
+        }
+        return next({ ctx: { ...ctx, user: ctx.user } });
+    }
     // Spread+reassign of `user` narrows downstream ctx from `User | null`
     // to `User` so `adminProcedure` / `agentProcedure` can read fields
     // without re-checking.

package/dist/api/trpc/trpc.router.js

@@ -166,7 +166,7 @@ function buildCapabilityRouters(services) {
         // clusterNodes — fixed core API. Write-side purge for the durable
         // offline-node history (Track A "Forget node"); read side is push-only.
         clusterNodes: (0, cluster_nodes_router_js_1.createClusterNodesRouter)(services.agentRegistry),
-        auth: (0, auth_router_js_1.createAuthRouter)(services.authService, services.capabilityRegistry, services.moleculer),
+        auth: (0, auth_router_js_1.createAuthRouter)(services.authService, services.capabilityRegistry, services.moleculer, services.shareTokenService),
         // NOT MOUNTED — `mount: { kind: 'skip' }` legacy provider shapes
         // (positional args / sync returns) that don't match the codegen
         // routers' {input}-object + Promise<T> contract. The runtime builder

package/dist/core/auth/share-token.service.js

@@ -0,0 +1,235 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ShareTokenService = exports.ShareTokenRecordSchema = exports.ShareTokenScopeSchema = exports.SHARE_TOKEN_MAX_DEVICES = exports.SHARE_TOKEN_TTL_DEFAULT_SEC = exports.SHARE_TOKEN_TTL_MAX_SEC = exports.SHARE_TOKEN_TTL_MIN_SEC = exports.SHARE_TOKEN_PREFIX = void 0;
+/**
+ * ShareTokenService — scoped, TTL'd VIEW tokens for standalone share links
+ * (grid rework R6: the embed page opened by a third party authenticates with
+ * a `csv_*` token carried in the share URL's `#t=` fragment).
+ *
+ * Design mirrors the existing `cst_*` scoped-token mechanism
+ * (`@camstack/system` ScopedTokenManager): a random opaque token, stored
+ * server-side as a SHA-256 hash so a DB leak never exposes live tokens,
+ * validated per request, revocable, with the TTL enforced at verification.
+ *
+ * Differences from `cst_*` tokens — a share token is NOT a user session:
+ *   • it resolves to a RESTRICTED `share-view` principal (see
+ *     `trpc.context.ts`) that can only call the allowlisted embed surface
+ *     (`share-view-access.ts`), never the general cap surface;
+ *   • the scope is a share grant (`kind: 'grid-view'` + deviceIds), not a
+ *     capability/addon grant;
+ *   • expiry is explicit at mint time: a bounded TTL (60s..30d, default
+ *     7d) or the deliberate `ttlSec: 'never'` choice (`expiresAt: null`)
+ *     for permanently-shared grids — revocation stays the kill switch.
+ *
+ * Storage: the hub's settings backend (same SQLite store the scoped tokens
+ * live in, reached directly instead of over the settings-store cap since
+ * this service is hub-resident). Collection: `share_view_tokens`.
+ */
+const crypto = __importStar(require("node:crypto"));
+const zod_1 = require("zod");
+const SHARE_TOKENS_COLLECTION = 'share_view_tokens';
+/** Wire prefix — `csv_` = CamStack Share View (cf. `cst_` scoped tokens). */
+exports.SHARE_TOKEN_PREFIX = 'csv_';
+// ── TTL / scope bounds (enforced at mint, re-checked by the router schema) ──
+exports.SHARE_TOKEN_TTL_MIN_SEC = 60;
+exports.SHARE_TOKEN_TTL_MAX_SEC = 30 * 24 * 60 * 60; // 30 days
+exports.SHARE_TOKEN_TTL_DEFAULT_SEC = 7 * 24 * 60 * 60; // 7 days
+exports.SHARE_TOKEN_MAX_DEVICES = 64;
+/**
+ * What a share token is allowed to see. Discriminated on `kind` so future
+ * share surfaces (single-camera view, recording clip, …) extend the union
+ * without touching verification plumbing.
+ */
+exports.ShareTokenScopeSchema = zod_1.z.object({
+    kind: zod_1.z.literal('grid-view'),
+    deviceIds: zod_1.z.array(zod_1.z.number().int().nonnegative()).min(1).max(exports.SHARE_TOKEN_MAX_DEVICES),
+});
+/** Persisted record — never leaves the server with `tokenHash` attached. */
+exports.ShareTokenRecordSchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    /** The user that minted the share link (owner — may revoke it). */
+    userId: zod_1.z.string(),
+    tokenHash: zod_1.z.string(),
+    /** First 12 chars of the raw token — display/audit label only. */
+    tokenPrefix: zod_1.z.string(),
+    scope: exports.ShareTokenScopeSchema,
+    createdAt: zod_1.z.number(),
+    /** Epoch ms — or `null` for a never-expiring token (explicit choice at mint). */
+    expiresAt: zod_1.z.number().nullable(),
+    lastUsedAt: zod_1.z.number().optional(),
+});
+function parseShareToken(data) {
+    const parsed = exports.ShareTokenRecordSchema.safeParse(data);
+    return parsed.success ? parsed.data : null;
+}
+class ShareTokenService {
+    getStore;
+    logger;
+    constructor(getStore, logger = null) {
+        this.getStore = getStore;
+        this.logger = logger;
+    }
+    store() {
+        const store = this.getStore();
+        if (!store) {
+            throw new Error('Share tokens unavailable — settings backend not ready');
+        }
+        return store;
+    }
+    /**
+     * Mint a new share token. Throws on invalid scope or out-of-bounds TTL
+     * (fail fast — the router's Zod input schema should have caught both).
+     * `ttlSec: 'never'` is the explicit opt-in to a never-expiring token
+     * (`expiresAt: null`); omitted falls back to the 7-day default.
+     * Returns the RAW token exactly once; only its hash is persisted.
+     */
+    async create(input) {
+        const scope = exports.ShareTokenScopeSchema.parse(input.scope);
+        const ttlSec = input.ttlSec ?? exports.SHARE_TOKEN_TTL_DEFAULT_SEC;
+        if (ttlSec !== 'never' &&
+            (!Number.isInteger(ttlSec) ||
+                ttlSec < exports.SHARE_TOKEN_TTL_MIN_SEC ||
+                ttlSec > exports.SHARE_TOKEN_TTL_MAX_SEC)) {
+            throw new Error(`Share token TTL out of bounds — got ${ttlSec}s, allowed ` +
+                `[${exports.SHARE_TOKEN_TTL_MIN_SEC}s, ${exports.SHARE_TOKEN_TTL_MAX_SEC}s] or 'never'`);
+        }
+        const rawToken = `${exports.SHARE_TOKEN_PREFIX}${crypto.randomBytes(32).toString('hex')}`;
+        const now = Date.now();
+        const record = {
+            id: crypto.randomUUID(),
+            userId: input.userId,
+            tokenHash: crypto.createHash('sha256').update(rawToken).digest('hex'),
+            tokenPrefix: rawToken.slice(0, 12),
+            scope,
+            createdAt: now,
+            expiresAt: ttlSec === 'never' ? null : now + ttlSec * 1000,
+        };
+        await this.store().insert({
+            collection: SHARE_TOKENS_COLLECTION,
+            record: { id: record.id, data: { ...record } },
+        });
+        this.logger?.info('Share token minted', {
+            meta: {
+                id: record.id,
+                userId: record.userId,
+                kind: scope.kind,
+                deviceIds: scope.deviceIds,
+                expiresAt: record.expiresAt,
+            },
+        });
+        return { token: rawToken, record };
+    }
+    /**
+     * Resolve a raw `csv_*` token to its record. Returns `null` for:
+     * wrong prefix, unknown token, corrupt record, or expired token.
+     * Never throws on bad input — the auth boundary treats `null` as 401.
+     */
+    async validate(rawToken) {
+        if (!rawToken.startsWith(exports.SHARE_TOKEN_PREFIX))
+            return null;
+        const tokenHash = crypto.createHash('sha256').update(rawToken).digest('hex');
+        const results = await this.store().query({
+            collection: SHARE_TOKENS_COLLECTION,
+            filter: { where: { tokenHash } },
+        });
+        const first = results[0];
+        if (!first)
+            return null;
+        const record = parseShareToken(first.data);
+        if (!record)
+            return null;
+        // `expiresAt: null` = never expires (explicit mint-time choice);
+        // revocation remains the kill switch for those.
+        if (record.expiresAt !== null && Date.now() > record.expiresAt)
+            return null;
+        this.touchLastUsed(record).catch(() => {
+            /* best-effort audit timestamp — never block validation */
+        });
+        return record;
+    }
+    /**
+     * Revoke (delete) a share token. Only the minting user or an admin may
+     * revoke. Returns `false` when the token doesn't exist; throws on a
+     * permission mismatch so the router surfaces a FORBIDDEN.
+     */
+    async revoke(input) {
+        const results = await this.store().query({
+            collection: SHARE_TOKENS_COLLECTION,
+            filter: { where: { id: input.id } },
+        });
+        const first = results[0];
+        if (!first)
+            return false;
+        const record = parseShareToken(first.data);
+        if (!record) {
+            // Corrupt record — delete it regardless (it can never validate).
+            await this.store().delete({ collection: SHARE_TOKENS_COLLECTION, key: input.id });
+            return true;
+        }
+        if (!input.callerIsAdmin && record.userId !== input.callerUserId) {
+            throw new Error('Only the token owner or an admin can revoke a share token');
+        }
+        await this.store().delete({ collection: SHARE_TOKENS_COLLECTION, key: input.id });
+        this.logger?.info('Share token revoked', {
+            meta: { id: record.id, byUserId: input.callerUserId },
+        });
+        return true;
+    }
+    /** Every share token minted by `userId`, expired ones included. */
+    async listForUser(userId) {
+        const results = await this.store().query({
+            collection: SHARE_TOKENS_COLLECTION,
+            filter: { where: { userId } },
+        });
+        return results.map((r) => parseShareToken(r.data)).filter((r) => r !== null);
+    }
+    /** All share tokens (admin listing). */
+    async listAll() {
+        const results = await this.store().query({
+            collection: SHARE_TOKENS_COLLECTION,
+            filter: {},
+        });
+        return results.map((r) => parseShareToken(r.data)).filter((r) => r !== null);
+    }
+    async touchLastUsed(record) {
+        await this.store().update({
+            collection: SHARE_TOKENS_COLLECTION,
+            id: record.id,
+            data: { ...record, lastUsedAt: Date.now() },
+        });
+    }
+}
+exports.ShareTokenService = ShareTokenService;

package/dist/main.js

@@ -50,6 +50,7 @@ const logging_service_1 = require("./core/logging/logging.service");
 const event_bus_service_1 = require("./core/events/event-bus.service");
 const config_service_1 = require("./core/config/config.service");
 const auth_service_1 = require("./core/auth/auth.service");
+const share_token_service_1 = require("./core/auth/share-token.service");
 // Boot-time capability declaration runs over the auto-generated
 // `ALL_CAPABILITY_DEFINITIONS` array — every `*.cap.ts` file that ships
 // with `@camstack/types` is included automatically. Adding a new cap
@@ -348,8 +349,13 @@ async function bootstrap() {
     }
     try {
         const authService = app.get(auth_service_1.AuthService);
+        // Share-view (`csv_*`) tokens — hub-resident mint/verify/revoke over
+        // the settings backend (lazy getter: the backend lands after the
+        // sqlite-storage builtin registers; the service resolves it per call).
+        const shareTokenService = new share_token_service_1.ShareTokenService(() => addonRegistry.getSettingsBackend(), loggingService.createLogger('share-tokens'));
         appRouter = (0, trpc_router_1.buildAppRouter)({
             authService,
+            shareTokenService,
             configService: config,
             featureService: app.get(feature_service_1.FeatureService),
             loggingService,
@@ -371,7 +377,7 @@ async function bootstrap() {
             prefix: '/trpc',
             trpcOptions: {
                 router: appRouter,
-                createContext: ({ req }) => (0, trpc_context_1.createTrpcContext)(req, authService, addonRegistry),
+                createContext: ({ req }) => (0, trpc_context_1.createTrpcContext)(req, authService, addonRegistry, shareTokenService),
                 onError: ({ path: trpcPath, error, }) => {
                     const trpcLogger = app.get(logging_service_1.LoggingService).createLogger('tRPC');
                     trpcLogger.warn('tRPC error', {
@@ -857,7 +863,7 @@ async function bootstrap() {
         (0, ws_1.applyWSSHandler)({
             wss,
             router: appRouter,
-            createContext: (opts) => (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry),
+            createContext: (opts) => (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, shareTokenService),
             onError: ({ path: trpcPath, error, }) => {
                 const trpcLogger = app.get(logging_service_1.LoggingService).createLogger('tRPC:ws');
                 trpcLogger.warn('tRPC error', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.1.46",
+  "version": "1.1.47",
   "private": false,
   "files": [
     "dist",
@@ -23,19 +23,19 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "*",
-    "@camstack/addon-advanced-notifier": "*",
-    "@camstack/addon-auth": "*",
-    "@camstack/addon-decoder-nodeav": "*",
-    "@camstack/addon-notifiers": "*",
-    "@camstack/addon-pipeline": "*",
-    "@camstack/addon-pipeline-orchestrator": "*",
-    "@camstack/addon-post-analysis": "*",
-    "@camstack/sdk": "*",
-    "@camstack/shm-ring": "*",
-    "@camstack/system": "*",
-    "@camstack/types": "*",
-    "@camstack/ui-library": "*",
+    "@camstack/addon-admin-ui": "1.1.42",
+    "@camstack/addon-advanced-notifier": "1.1.21",
+    "@camstack/addon-auth": "1.1.4",
+    "@camstack/addon-decoder-nodeav": "1.1.9",
+    "@camstack/addon-notifiers": "1.1.21",
+    "@camstack/addon-pipeline": "1.1.49",
+    "@camstack/addon-pipeline-orchestrator": "1.1.35",
+    "@camstack/addon-post-analysis": "1.1.23",
+    "@camstack/sdk": "1.1.20",
+    "@camstack/shm-ring": "1.0.20",
+    "@camstack/system": "1.1.39",
+    "@camstack/types": "1.1.36",
+    "@camstack/ui-library": "1.1.31",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/multipart": "^10.0.0",