@camstack/server 1.1.48 → 1.1.50

package/dist/api/core/auth.router.js

@@ -69,6 +69,10 @@ const LoginResultSchema = zod_1.z.object({
 const OptionsJsonSchema = zod_1.z.object({ optionsJSON: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) });
 const FinishRegistrationSchema = zod_1.z.object({ success: zod_1.z.literal(true), credentialId: zod_1.z.string() });
 const FinishAuthenticationSchema = zod_1.z.object({ verified: zod_1.z.boolean() });
+const FinishDiscoverableAuthenticationSchema = zod_1.z.object({
+    verified: zod_1.z.boolean(),
+    userId: zod_1.z.string().nullable(),
+});
 const RemovePasskeySchema = zod_1.z.object({ success: zod_1.z.literal(true) });
 function proxyPasskeyProvider(proxy) {
     const call = async (method, params) => {
@@ -82,6 +86,8 @@ function proxyPasskeyProvider(proxy) {
         finishRegistration: async (input) => FinishRegistrationSchema.parse(await call('finishRegistration', input)),
         beginAuthentication: async (input) => OptionsJsonSchema.parse(await call('beginAuthentication', input)),
         finishAuthentication: async (input) => FinishAuthenticationSchema.parse(await call('finishAuthentication', input)),
+        beginDiscoverableAuthentication: async (input) => OptionsJsonSchema.parse(await call('beginDiscoverableAuthentication', input)),
+        finishDiscoverableAuthentication: async (input) => FinishDiscoverableAuthenticationSchema.parse(await call('finishDiscoverableAuthentication', input)),
         listPasskeys: async (input) => zod_1.z.array(types_1.PasskeySummarySchema).parse(await call('listPasskeys', input)),
         removePasskey: async (input) => RemovePasskeySchema.parse(await call('removePasskey', input)),
     };
@@ -204,6 +210,38 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null)
         }
         return shareTokens;
     };
+    /**
+     * Mint the REAL session JWT for `userId` — the single shared tail of
+     * every successful login leg (TOTP second factor, passkey second
+     * factor, usernameless passkey-first). Re-fetches the user record so
+     * scopes / allowedDevices reflect any admin change made mid-flow —
+     * signing from stale claims could mint a stale-scope session.
+     */
+    const mintSessionForUserId = async (userId) => {
+        const userMgmt = registry?.getSingleton('user-management');
+        if (!userMgmt) {
+            throw new Error('Login unavailable — `user-management` capability not registered');
+        }
+        const fresh = typeof userMgmt.listUsers === 'function'
+            ? (await userMgmt.listUsers()).find((u) => u.id === userId)
+            : null;
+        if (!fresh) {
+            throw new Error('User no longer exists');
+        }
+        const sessionToken = auth.signToken({
+            userId: fresh.id,
+            username: fresh.username,
+            isAdmin: fresh.isAdmin,
+            allowedProviders: fresh.allowedProviders ?? '*',
+            allowedDevices: fresh.allowedDevices ?? {},
+            scopes: fresh.scopes ?? [],
+        });
+        return {
+            token: sessionToken,
+            user: { id: fresh.id, username: fresh.username, isAdmin: fresh.isAdmin },
+            requiresTotp: false,
+        };
+    };
     return (0, trpc_middleware_js_1.trpcRouter)({
         login: trpc_middleware_js_1.publicProcedure
             .input(zod_1.z.object({ username: zod_1.z.string(), password: zod_1.z.string() }))
@@ -309,28 +347,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null)
             if (!verify.valid) {
                 throw new Error('Invalid TOTP code');
             }
-            // Re-fetch the user record so scopes / allowedDevices reflect
-            // any admin change made between the two legs. Without this we
-            // could mint a stale-scope session.
-            const fresh = typeof userMgmt.listUsers === 'function'
-                ? (await userMgmt.listUsers()).find((u) => u.id === claims.userId)
-                : null;
-            if (!fresh) {
-                throw new Error('User no longer exists');
-            }
-            const sessionToken = auth.signToken({
-                userId: fresh.id,
-                username: fresh.username,
-                isAdmin: fresh.isAdmin,
-                allowedProviders: fresh.allowedProviders ?? '*',
-                allowedDevices: fresh.allowedDevices ?? {},
-                scopes: fresh.scopes ?? [],
-            });
-            return {
-                token: sessionToken,
-                user: { id: fresh.id, username: fresh.username, isAdmin: fresh.isAdmin },
-                requiresTotp: false,
-            };
+            return mintSessionForUserId(claims.userId);
         }),
         /**
          * Passkey second leg — step 1 of 2. Accepts the challenge token
@@ -377,29 +394,55 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null)
             if (!result.verified) {
                 throw new Error('Passkey verification failed');
             }
-            const userMgmt = registry?.getSingleton('user-management');
-            if (!userMgmt) {
-                throw new Error('Login unavailable — `user-management` capability not registered');
-            }
-            const fresh = typeof userMgmt.listUsers === 'function'
-                ? (await userMgmt.listUsers()).find((u) => u.id === claims.userId)
-                : null;
-            if (!fresh) {
-                throw new Error('User no longer exists');
-            }
-            const sessionToken = auth.signToken({
-                userId: fresh.id,
-                username: fresh.username,
-                isAdmin: fresh.isAdmin,
-                allowedProviders: fresh.allowedProviders ?? '*',
-                allowedDevices: fresh.allowedDevices ?? {},
-                scopes: fresh.scopes ?? [],
+            return mintSessionForUserId(claims.userId);
+        }),
+        /**
+         * Usernameless (passkey-FIRST) login — step 1 of 2. PUBLIC. Returns
+         * WebAuthn assertion options with an EMPTY `allowCredentials` list
+         * (the standard discoverable-credentials flow): the browser offers
+         * every resident passkey it holds for this RP and the user picks one
+         * — no username, no password. The challenge is minted and stored by
+         * the `user-passkeys` provider, deliberately NOT bound to any user.
+         *
+         * Abuse surface: mirrors `login` — no rate limiting exists on any
+         * public auth procedure today; the challenge store is bounded only
+         * by its 5-min TTL prune.
+         */
+        passkeyLoginBegin: trpc_middleware_js_1.publicProcedure
+            .input(zod_1.z.void())
+            .output(OptionsJsonSchema)
+            .mutation(async () => {
+            const provider = resolvePasskeyProvider(registry, moleculer);
+            if (!provider)
+                throw new Error('Passkey authentication is not available');
+            return provider.beginDiscoverableAuthentication({});
+        }),
+        /**
+         * Usernameless login — step 2 of 2. PUBLIC. Submits the browser
+         * assertion; the provider resolves the credential's OWNER, verifies
+         * the assertion (challenge + public key + counter + required user
+         * verification), and on success we mint the SAME session JWT shape
+         * `auth.login` mints — via the shared `mintSessionForUserId` tail
+         * (fresh user re-fetch for up-to-date scopes).
+         *
+         * NO second-factor bounce: a discoverable passkey assertion with
+         * user verification is already a strong (possession + inherence/
+         * knowledge) factor — enrolled TOTP is irrelevant on this path.
+         */
+        passkeyLoginFinish: trpc_middleware_js_1.publicProcedure
+            .input(zod_1.z.object({ response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) }))
+            .output(LoginResultSchema)
+            .mutation(async ({ input }) => {
+            const provider = resolvePasskeyProvider(registry, moleculer);
+            if (!provider)
+                throw new Error('Passkey authentication is not available');
+            const result = await provider.finishDiscoverableAuthentication({
+                response: input.response,
             });
-            return {
-                token: sessionToken,
-                user: { id: fresh.id, username: fresh.username, isAdmin: fresh.isAdmin },
-                requiresTotp: false,
-            };
+            if (!result.verified || !result.userId) {
+                throw new server_1.TRPCError({ code: 'UNAUTHORIZED', message: 'Passkey verification failed' });
+            }
+            return mintSessionForUserId(result.userId);
         }),
         me: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.void())

package/dist/api/core/live-events.router.js

@@ -10,6 +10,12 @@ exports.createLiveEventsRouter = createLiveEventsRouter;
 const zod_1 = require("zod");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
 const share_view_access_js_1 = require("../trpc/share-view-access.js");
+// The pushed wire shape is `SystemEvent` from @camstack/types — the exact
+// type `EventBusService.subscribe` hands its handlers. It MUST be a type
+// exported from @camstack/types (not a local interface): the AppRouter
+// type expansion (`scripts/generate-api-types.ts`) prints subscription
+// output types by name, and a router-local name is unresolvable from the
+// generated `packages/types/src/generated/addon-api.ts`.
 function createLiveEventsRouter(eb, ar) {
     return (0, trpc_middleware_js_1.trpcRouter)({
         recentSystemEvents: trpc_middleware_js_1.protectedProcedure

package/dist/api/trpc/generated-cap-routers.js

@@ -7523,6 +7523,24 @@ function createCapRouter_userPasskeys(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.finishAuthentication(methodInput);
         }),
+        beginDiscoverableAuthentication: trpc_middleware_js_1.protectedProcedure
+            .input(types_105.userPasskeysCapability.methods.beginDiscoverableAuthentication.input.loose())
+            .output(types_105.userPasskeysCapability.methods.beginDiscoverableAuthentication.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, addonId, ...methodInput } = input;
+            const p = resolveProvider('user-passkeys', nodeId, () => getProvider(ctx, addonId), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.beginDiscoverableAuthentication(methodInput);
+        }),
+        finishDiscoverableAuthentication: trpc_middleware_js_1.protectedProcedure
+            .input(types_105.userPasskeysCapability.methods.finishDiscoverableAuthentication.input.loose())
+            .output(types_105.userPasskeysCapability.methods.finishDiscoverableAuthentication.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, addonId, ...methodInput } = input;
+            const p = resolveProvider('user-passkeys', nodeId, () => getProvider(ctx, addonId), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.finishDiscoverableAuthentication(methodInput);
+        }),
         listPasskeys: trpc_middleware_js_1.adminProcedure
             .input(types_105.userPasskeysCapability.methods.listPasskeys.input.loose())
             .output(types_105.userPasskeysCapability.methods.listPasskeys.output)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.1.48",
+  "version": "1.1.50",
   "private": false,
   "files": [
     "dist",
@@ -23,18 +23,18 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.1.42",
+    "@camstack/addon-admin-ui": "1.1.43",
     "@camstack/addon-advanced-notifier": "1.1.21",
-    "@camstack/addon-auth": "1.1.4",
+    "@camstack/addon-auth": "1.1.5",
     "@camstack/addon-decoder-nodeav": "1.1.9",
     "@camstack/addon-notifiers": "1.1.21",
-    "@camstack/addon-pipeline": "1.1.50",
-    "@camstack/addon-pipeline-orchestrator": "1.1.35",
+    "@camstack/addon-pipeline": "1.1.51",
+    "@camstack/addon-pipeline-orchestrator": "1.1.38",
     "@camstack/addon-post-analysis": "1.1.23",
-    "@camstack/sdk": "1.1.20",
+    "@camstack/sdk": "1.1.21",
     "@camstack/shm-ring": "1.0.21",
     "@camstack/system": "1.1.39",
-    "@camstack/types": "1.1.36",
+    "@camstack/types": "1.1.37",
     "@camstack/ui-library": "1.1.31",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",