@camstack/server 1.1.53 → 1.1.55

package/dist/api/tarball-manifest.js

@@ -0,0 +1,86 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isTarballFilename = isTarballFilename;
+exports.readTarballManifest = readTarballManifest;
+/**
+ * npm-pack tarball manifest inspection — shared by the addon upload route
+ * (`/api/addons/upload`) and the dev server-deploy upload route
+ * (`/api/server-upload`).
+ */
+const node_child_process_1 = require("node:child_process");
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const TARBALL_EXTENSIONS = ['.tgz', '.tar.gz'];
+function isTarballFilename(filename) {
+    return TARBALL_EXTENSIONS.some((ext) => filename.endsWith(ext));
+}
+/**
+ * Validate an uploaded tarball by extracting its `package.json` and
+ * checking it declares `name` + `version`. Runs BEFORE any install branch
+ * so broken archives are rejected at the gateway instead of failing
+ * mid-extraction downstream (which has no clean rollback).
+ *
+ * The routine writes the buffer to a scratch path and invokes `tar` with
+ * `-xzO` to stream-extract just `package/package.json` to stdout. No full
+ * unpack is needed — npm-pack layout always puts the manifest at that
+ * fixed inner path. Returns null (not throw) on malformed archives so
+ * the caller can surface a precise 400 response.
+ */
+function readTarballManifest(buffer, filename) {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'camstack-tarball-check-'));
+    const tgzPath = path.join(tmpDir, path.basename(filename));
+    try {
+        fs.writeFileSync(tgzPath, buffer);
+        const output = (0, node_child_process_1.execFileSync)('tar', ['-xzO', '-f', tgzPath, 'package/package.json'], {
+            timeout: 5_000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        const parsed = JSON.parse(output.toString('utf8'));
+        if (!parsed || typeof parsed !== 'object')
+            return null;
+        const pkg = parsed;
+        if (typeof pkg['name'] !== 'string' || typeof pkg['version'] !== 'string')
+            return null;
+        return { name: pkg['name'], version: pkg['version'] };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+}

package/dist/api/trpc/share-view-access.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkShareViewAccess = checkShareViewAccess;
+exports.projectListAllForShareScope = projectListAllForShareScope;
 exports.liveEventInShareScope = liveEventInShareScope;
 /**
  * Methods callable WITHOUT a per-device check — their input carries no
@@ -58,6 +59,35 @@ function checkShareViewAccess(scope, path, input) {
     }
     return { ok: false, reason: `'${path}' is not available to share-view tokens` };
 }
+/**
+ * Output filter for `deviceManager.listAll` under a share-view principal:
+ * drop every device outside the token's scope, and project the survivors
+ * onto the whitelisted row (never the raw device — fail closed on fields).
+ * Non-array payloads pass through untouched (the route errored upstream).
+ */
+function projectListAllForShareScope(data, scope) {
+    if (!Array.isArray(data))
+        return data;
+    const allowed = new Set(scope.deviceIds);
+    const rows = [];
+    for (const entry of data) {
+        if (entry === null || typeof entry !== 'object')
+            continue;
+        const id = Reflect.get(entry, 'id');
+        if (typeof id !== 'number' || !allowed.has(id))
+            continue;
+        rows.push({
+            id,
+            name: Reflect.get(entry, 'name'),
+            online: Reflect.get(entry, 'online'),
+            isCamera: Reflect.get(entry, 'isCamera'),
+            type: Reflect.get(entry, 'type'),
+            location: Reflect.get(entry, 'location'),
+            disabled: Reflect.get(entry, 'disabled'),
+        });
+    }
+    return rows;
+}
 /**
  * Whether a live event belongs to a device inside the share scope.
  * Matches the device identity two ways (fail closed — no match, no push):

package/dist/api/trpc/trpc.middleware.js

@@ -104,6 +104,16 @@ exports.protectedProcedure = t.procedure.use(async ({ ctx, next, path, getRawInp
         if (!result.ok) {
             throw new server_1.TRPCError({ code: 'FORBIDDEN', message: result.reason });
         }
+        // `deviceManager.listAll` is allowlisted for the embed's tile names,
+        // but its raw rows describe EVERY device (config incl. credentials).
+        // Project the output down to the in-scope whitelisted rows.
+        if (path === 'deviceManager.listAll') {
+            const out = await next({ ctx: { ...ctx, user: ctx.user } });
+            if (out.ok) {
+                return { ...out, data: (0, share_view_access_js_1.projectListAllForShareScope)(out.data, ctx.user.shareView.scope) };
+            }
+            return out;
+        }
         return next({ ctx: { ...ctx, user: ctx.user } });
     }
     // Spread+reassign of `user` narrows downstream ctx from `User | null`

package/dist/api/upload-auth.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UPLOAD_TRPC_PATH = void 0;
+exports.authorizeUploadRequest = authorizeUploadRequest;
+const scope_access_js_1 = require("./trpc/scope-access.js");
+exports.UPLOAD_TRPC_PATH = 'addons.installPackage';
+/**
+ * Validate a `cst_*` scoped token via the `user-management` cap singleton.
+ * Returns null when the singleton isn't mounted yet (boot race) or the
+ * token doesn't validate. Caller treats both as auth failure.
+ */
+async function validateScopedTokenViaCap(addonRegistry, token) {
+    const capRegistry = addonRegistry.getCapabilityRegistry();
+    // Documented type boundary: the registry returns the provider untyped; the
+    // `user-management` cap's `validateScopedToken` surface is asserted here
+    // (same shape the tRPC middleware relies on).
+    const userMgmt = capRegistry.getSingleton('user-management');
+    if (!userMgmt)
+        return null;
+    return userMgmt.validateScopedToken({ token });
+}
+function isUploadAllowed(scoped) {
+    return (0, scope_access_js_1.checkScopeAccess)(scoped.scopes, exports.UPLOAD_TRPC_PATH).ok;
+}
+/**
+ * Run the full upload auth chain. Returns `{ok: true}` on success, or the
+ * HTTP status + error message the route should reply with:
+ *   - 401 `Unauthorized` when no Authorization header is present,
+ *   - 403 `Forbidden: <reason>` for any recognised-but-insufficient token.
+ */
+async function authorizeUploadRequest(args) {
+    const { authHeader, authService, addonRegistry } = args;
+    if (!authHeader) {
+        return { ok: false, status: 401, error: 'Unauthorized' };
+    }
+    const token = authHeader.replace('Bearer ', '');
+    let authReason;
+    // Try JWT first — fastest path + carries the isAdmin flag directly.
+    try {
+        const payload = authService.verifyToken(token);
+        if (payload.isAdmin) {
+            return { ok: true };
+        }
+        authReason = 'JWT is not admin';
+    }
+    catch {
+        // Not a JWT (or invalid signature) — fall through to scoped-token path.
+    }
+    try {
+        const record = await validateScopedTokenViaCap(addonRegistry, token);
+        if (!record) {
+            authReason = authReason ?? 'token not recognised';
+        }
+        else if (isUploadAllowed(record)) {
+            return { ok: true };
+        }
+        else {
+            authReason = `scoped token lacks create access on '${exports.UPLOAD_TRPC_PATH}'`;
+        }
+    }
+    catch (err) {
+        authReason = `scoped token validation failed: ${err instanceof Error ? err.message : String(err)}`;
+    }
+    return {
+        ok: false,
+        status: 403,
+        error: `Forbidden: ${authReason ?? 'admin or upload-scoped token required'}`,
+    };
+}

package/dist/auth/auth-rate-limit.js

@@ -0,0 +1,76 @@
+"use strict";
+/**
+ * Public-auth rate limiting — fixed window per (bucket, client ip).
+ *
+ * The public auth surface (login, TOTP verify, passkey ceremonies,
+ * handoff redeem, session exchange/upgrade) previously had NO
+ * throttling: unlimited online credential guessing. This module is the
+ * first line of defence — deliberately simple (in-memory fixed window),
+ * because the deployment is a single hub process and the goal is to
+ * blunt brute force, not to be a distributed quota system.
+ *
+ * Pure + clock-injectable so specs drive it directly. The key map is
+ * BOUNDED (`maxKeys`, oldest-window evicted first) so an attacker
+ * rotating spoofed source addresses cannot grow it without limit.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRateLimiter = createRateLimiter;
+exports.clientKeyFromRequest = clientKeyFromRequest;
+function createRateLimiter(options) {
+    const maxKeys = options.maxKeys ?? 10_000;
+    const now = options.now ?? Date.now;
+    const entries = new Map();
+    const evictOldest = () => {
+        let oldestKey = null;
+        let oldestStart = Number.POSITIVE_INFINITY;
+        for (const [key, entry] of entries) {
+            if (entry.windowStart < oldestStart) {
+                oldestStart = entry.windowStart;
+                oldestKey = key;
+            }
+        }
+        if (oldestKey !== null)
+            entries.delete(oldestKey);
+    };
+    return {
+        check(key) {
+            const at = now();
+            const existing = entries.get(key);
+            if (!existing || at - existing.windowStart >= options.windowMs) {
+                if (!entries.has(key) && entries.size >= maxKeys)
+                    evictOldest();
+                entries.set(key, { windowStart: at, count: 1 });
+                return { allowed: true, retryAfterSeconds: 0 };
+            }
+            if (existing.count < options.max) {
+                existing.count += 1;
+                return { allowed: true, retryAfterSeconds: 0 };
+            }
+            const retryAfterSeconds = Math.max(1, Math.ceil((existing.windowStart + options.windowMs - at) / 1000));
+            return { allowed: false, retryAfterSeconds };
+        },
+        size() {
+            return entries.size;
+        },
+    };
+}
+/**
+ * Client key for a tRPC/Fastify request principal: `FastifyRequest.ip`
+ * (proxy-aware when Fastify's `trustProxy` is on) or the raw socket
+ * address for WS-upgrade `IncomingMessage`s. `null` = no originating
+ * request (mesh-internal `createCaller` invocation) — never limited.
+ */
+function clientKeyFromRequest(req) {
+    if (req === null || typeof req !== 'object' || req === undefined)
+        return null;
+    const ip = Reflect.get(req, 'ip');
+    if (typeof ip === 'string' && ip.length > 0)
+        return ip;
+    const socket = Reflect.get(req, 'socket');
+    if (socket !== null && typeof socket === 'object') {
+        const remote = Reflect.get(socket, 'remoteAddress');
+        if (typeof remote === 'string' && remote.length > 0)
+            return remote;
+    }
+    return null;
+}

package/dist/main.js

@@ -80,6 +80,7 @@ const trpc_router_1 = require("./api/trpc/trpc.router");
 const core_cap_bridge_1 = require("./api/trpc/core-cap-bridge");
 const trpc_context_1 = require("./api/trpc/trpc.context");
 const addon_upload_1 = require("./api/addon-upload");
+const server_upload_1 = require("./api/server-upload");
 const auth_whoami_1 = require("./api/auth-whoami");
 const session_cookie_js_1 = require("./auth/session-cookie.js");
 const health_routes_1 = require("./api/health/health.routes");
@@ -231,6 +232,15 @@ async function bootstrap() {
         const uploadLogger = app.get(logging_service_1.LoggingService).createLogger('addon-upload');
         await (0, addon_upload_1.registerAddonUploadRoute)(fastify, uploadAddonBridge, uploadAuthService, uploadMoleculer, uploadAddonRegistry, uploadAddonPackage, uploadLogger);
         console.log('[bootstrap] Addon upload route registered at POST /api/addons/upload');
+        // Dev server-deploy channel gateway (`camstack deploy-server`). MUST be
+        // registered AFTER registerAddonUploadRoute — it reuses the multipart
+        // plugin that route installs on this instance.
+        (0, server_upload_1.registerServerUploadRoute)(fastify, {
+            authService: uploadAuthService,
+            addonRegistry: uploadAddonRegistry,
+            logger: app.get(logging_service_1.LoggingService).createLogger('server-upload'),
+        });
+        console.log('[bootstrap] Server upload route registered at POST /api/server-upload');
         // Companion endpoint: /api/auth/whoami — validates JWT or cst_*
         // scoped tokens, returns the resolved identity + scope summary.
         // Mirrors the addon-upload auth chain so the CLI can ping for
@@ -320,6 +330,7 @@ async function bootstrap() {
             // Read the live flag at request time — flips to true once the tRPC
             // router finishes registering (see `trpcRegistered = true` below).
             isReady: () => trpcRegistered,
+            verifyToken: (token) => app.get(auth_service_1.AuthService).verifyToken(token),
         });
         console.log(`[bootstrap] Health routes registered (hub v${hubVersion})`);
     }
@@ -434,7 +445,7 @@ async function bootstrap() {
                             : 'application/octet-stream';
             const stream = fs.createReadStream(resolved);
             return reply
-                .header('cache-control', addonBundleCacheControl(resolved))
+                .header('cache-control', (0, spa_static_1.addonBundleCacheControl)(resolved))
                 .type(contentType)
                 .send(stream);
         });
@@ -466,7 +477,7 @@ async function bootstrap() {
                             : 'application/octet-stream';
             const stream = fs.createReadStream(resolved);
             return reply
-                .header('cache-control', addonBundleCacheControl(resolved))
+                .header('cache-control', (0, spa_static_1.addonBundleCacheControl)(resolved))
                 .type(contentType)
                 .send(stream);
         });
@@ -940,7 +951,16 @@ async function bootstrap() {
     try {
         const bootAddonRegistry = app.get(addon_registry_service_1.AddonRegistryService);
         const capRegistry = bootAddonRegistry.getCapabilityRegistry();
-        let adminUI = capRegistry?.getSingleton('admin-ui');
+        // HUB-NODE-SCOPED resolution — never the cluster-global singleton.
+        // Agent nodes register the same `admin-ui` cap through their own
+        // agent-ui addon (placement: agent-only), and the cluster-elected
+        // active provider can land on the AGENT's registration depending on
+        // node boot order. Its `getStaticDir()` then answers with a path on
+        // the agent's filesystem — nonexistent here — and the SPA catch-all
+        // silently never registers (every `GET /` 404s until the next
+        // restart re-rolls the election). `getSingletonForNode(cap, 'hub')`
+        // only ever resolves providers hosted on THIS node.
+        let adminUI = capRegistry?.getSingletonForNode('admin-ui', 'hub');
         // CAMSTACK_SKIP_ADMIN_UI_WAIT — bypass the 60s poll. Used by the
         // e2e harness, which doesn't need the SPA served and spawns hubs
         // with strict boot timeouts. Production keeps the poll so cold
@@ -958,7 +978,7 @@ async function bootstrap() {
             const deadline = Date.now() + ADMIN_UI_WAIT_MS;
             while (!adminUI && Date.now() < deadline) {
                 await new Promise((r) => setTimeout(r, POLL_MS));
-                adminUI = capRegistry.getSingleton('admin-ui');
+                adminUI = capRegistry.getSingletonForNode('admin-ui', 'hub');
             }
         }
         if (adminUI) {
@@ -997,7 +1017,6 @@ async function bootstrap() {
                         url.startsWith('/api/') ||
                         url.startsWith('/agent') ||
                         url.startsWith('/health') ||
-                        url.startsWith('/discovery') ||
                         // The viewer SPA owns /viewer/** via its own catch-all (registered
                         // below). Fall through here so admin-ui never serves it — and so
                         // /viewer 404s cleanly when the viewer-ui addon isn't registered.
@@ -1055,7 +1074,10 @@ async function bootstrap() {
     try {
         const bootAddonRegistry = app.get(addon_registry_service_1.AddonRegistryService);
         const capRegistry = bootAddonRegistry.getCapabilityRegistry();
-        let viewerUI = capRegistry?.getSingleton('viewer-ui');
+        // Hub-node-scoped for the same reason as admin-ui above: a remote
+        // node's registration must never win the election for the provider
+        // whose staticDir this process reads from local disk.
+        let viewerUI = capRegistry?.getSingletonForNode('viewer-ui', 'hub');
         const skipViewerUIWait = process.env['CAMSTACK_SKIP_VIEWER_UI_WAIT'] === '1';
         if (!viewerUI && capRegistry && !skipViewerUIWait) {
             // The viewer-ui addon runs in its own forked runner and registers a few
@@ -1066,7 +1088,7 @@ async function bootstrap() {
             const deadline = Date.now() + VIEWER_UI_WAIT_MS;
             while (!viewerUI && Date.now() < deadline) {
                 await new Promise((r) => setTimeout(r, POLL_MS));
-                viewerUI = capRegistry.getSingleton('viewer-ui');
+                viewerUI = capRegistry.getSingletonForNode('viewer-ui', 'hub');
             }
         }
         if (viewerUI) {
@@ -1211,22 +1233,6 @@ function readHubVersion() {
 /**
  * Build an AddonHttpReply wrapper around a Fastify reply.
  */
-/**
- * Cache-Control for an addon MF bundle file. The entry point
- * (`remoteEntry.js` / `widgets.mjs`) has a STABLE filename — only its
- * `?v=` query changes across builds — so it MUST revalidate, otherwise a
- * caching proxy (Cloudflare edge, whose default browser-cache TTL was
- * serving these 4h) keeps handing out a stale entry whose export map
- * lacks the current widgets ("bundle does not export this stableId",
- * tunnel-only). The sibling chunks are CONTENT-HASHED in their filenames
- * (`dist-<hash>.mjs`, `_virtual_mf-<hash>.mjs`), so they are safely
- * immutable. The revalidation cost is a cheap 304 on a ~4KB entry.
- */
-function addonBundleCacheControl(filePath) {
-    const base = path.basename(filePath);
-    const isMfEntry = base === 'remoteEntry.js' || base === 'widgets.mjs';
-    return isMfEntry ? 'no-cache, must-revalidate' : 'public, max-age=31536000, immutable';
-}
 function buildAddonReply(reply) {
     const wrapper = {
         status(code) {