@camstack/server 1.1.53 → 1.1.54

package/dist/api/health/health.routes.js

@@ -21,7 +21,9 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildHubHealth = buildHubHealth;
+exports.isAuthorizedHealthRequest = isAuthorizedHealthRequest;
 exports.registerHealthRoutes = registerHealthRoutes;
+const session_cookie_js_1 = require("../../auth/session-cookie.js");
 const AGENT_HEALTH_TIMEOUT_MS = 3_000;
 function nowIso() {
     return new Date().toISOString();
@@ -68,23 +70,64 @@ async function fetchAgentHealth(deps, nodeId) {
         };
     }
 }
+/**
+ * True when the request carries a valid SESSION-grade credential: a Bearer
+ * JWT or the httpOnly session cookie. Health details expose topology
+ * (agent ids, versions, pids) — public probes get only `{ok}`.
+ * Pure over (headers, verifier) so the spec exercises it directly.
+ */
+function isAuthorizedHealthRequest(headers, verifyToken) {
+    const bearer = headers.authorization?.startsWith('Bearer ')
+        ? headers.authorization.slice('Bearer '.length)
+        : null;
+    const cookieToken = (0, session_cookie_js_1.readSessionCookieFromHeader)(headers.cookie);
+    for (const token of [bearer, cookieToken]) {
+        if (!token)
+            continue;
+        try {
+            if ((0, session_cookie_js_1.isSessionGradeJwtPayload)(verifyToken(token)))
+                return true;
+        }
+        catch {
+            /* invalid/expired — try the next credential */
+        }
+    }
+    return false;
+}
 function registerHealthRoutes(fastify, deps) {
+    const authorized = (req) => isAuthorizedHealthRequest({
+        ...(typeof req.headers.authorization === 'string'
+            ? { authorization: req.headers.authorization }
+            : {}),
+        ...(typeof req.headers.cookie === 'string' ? { cookie: req.headers.cookie } : {}),
+    }, deps.verifyToken);
+    // PUBLIC probe: liveness only. Everything beyond `ok` (version, uptime,
+    // pid, agent topology) moved to the AUTHENTICATED /health/details — a
+    // public endpoint must not enumerate the deployment.
     fastify.get('/health', async (_req, reply) => {
+        const ok = deps.isReady();
+        if (!ok)
+            reply.status(503);
+        return { ok };
+    });
+    // AUTHENTICATED detailed health — the payload /health used to return.
+    fastify.get('/health/details', async (req, reply) => {
+        if (!authorized(req))
+            return reply.status(401).send({ ok: false, error: 'unauthorized' });
         const health = await buildHubHealth(deps);
         if (!health.ok)
             reply.status(503);
         return health;
     });
-    // Zero-config LAN discovery — unauthenticated, always 200. See DiscoveryInfo.
-    fastify.get('/discovery', async () => {
-        const name = process.env['CAMSTACK_HUB_NAME'] ?? 'CamStack Hub';
-        return { service: 'camstack-hub', nodeId: 'hub', version: deps.hubVersion, name };
-    });
-    fastify.get('/health/agents', async () => {
+    fastify.get('/health/agents', async (req, reply) => {
+        if (!authorized(req))
+            return reply.status(401).send({ ok: false, error: 'unauthorized' });
         const nodes = deps.agentRegistry.listNodeLiveness();
         return { agents: nodes.filter((n) => !n.isHub && n.isOnline).map((n) => n.id) };
     });
     fastify.get('/health/agents/:nodeId', async (req, reply) => {
+        if (!authorized(req))
+            return reply.status(401).send({ ok: false, error: 'unauthorized' });
         const { nodeId } = req.params;
         if (!nodeId) {
             return reply.status(400).send({ ok: false, error: 'nodeId required' });
@@ -95,7 +138,9 @@ function registerHealthRoutes(fastify, deps) {
         }
         return result;
     });
-    fastify.get('/health/cluster', async () => {
+    fastify.get('/health/cluster', async (req, reply) => {
+        if (!authorized(req))
+            return reply.status(401).send({ ok: false, error: 'unauthorized' });
         const hub = await buildHubHealth(deps);
         // Enumeration only (fan-out-free); the $agent.health fan-out below is intentional.
         const nodes = deps.agentRegistry.listNodeLiveness();

package/dist/main.js

@@ -320,6 +320,7 @@ async function bootstrap() {
             // Read the live flag at request time — flips to true once the tRPC
             // router finishes registering (see `trpcRegistered = true` below).
             isReady: () => trpcRegistered,
+            verifyToken: (token) => app.get(auth_service_1.AuthService).verifyToken(token),
         });
         console.log(`[bootstrap] Health routes registered (hub v${hubVersion})`);
     }
@@ -997,7 +998,6 @@ async function bootstrap() {
                         url.startsWith('/api/') ||
                         url.startsWith('/agent') ||
                         url.startsWith('/health') ||
-                        url.startsWith('/discovery') ||
                         // The viewer SPA owns /viewer/** via its own catch-all (registered
                         // below). Fall through here so admin-ui never serves it — and so
                         // /viewer 404s cleanly when the viewer-ui addon isn't registered.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.1.53",
+  "version": "1.1.54",
   "private": false,
   "files": [
     "dist",
@@ -23,13 +23,13 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.1.45",
+    "@camstack/addon-admin-ui": "1.1.46",
     "@camstack/addon-advanced-notifier": "1.1.21",
     "@camstack/addon-auth": "1.1.6",
     "@camstack/addon-decoder-nodeav": "1.1.9",
     "@camstack/addon-notifiers": "1.1.21",
     "@camstack/addon-pipeline": "1.1.51",
-    "@camstack/addon-pipeline-orchestrator": "1.1.39",
+    "@camstack/addon-pipeline-orchestrator": "1.1.40",
     "@camstack/addon-post-analysis": "1.1.23",
     "@camstack/sdk": "1.1.22",
     "@camstack/shm-ring": "1.0.21",