@camstack/server 1.1.54 → 1.1.56

package/dist/api/trpc/trpc.middleware.js

@@ -104,6 +104,16 @@ exports.protectedProcedure = t.procedure.use(async ({ ctx, next, path, getRawInp
         if (!result.ok) {
             throw new server_1.TRPCError({ code: 'FORBIDDEN', message: result.reason });
         }
+        // `deviceManager.listAll` is allowlisted for the embed's tile names,
+        // but its raw rows describe EVERY device (config incl. credentials).
+        // Project the output down to the in-scope whitelisted rows.
+        if (path === 'deviceManager.listAll') {
+            const out = await next({ ctx: { ...ctx, user: ctx.user } });
+            if (out.ok) {
+                return { ...out, data: (0, share_view_access_js_1.projectListAllForShareScope)(out.data, ctx.user.shareView.scope) };
+            }
+            return out;
+        }
         return next({ ctx: { ...ctx, user: ctx.user } });
     }
     // Spread+reassign of `user` narrows downstream ctx from `User | null`

package/dist/api/upload-auth.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UPLOAD_TRPC_PATH = void 0;
+exports.authorizeUploadRequest = authorizeUploadRequest;
+const scope_access_js_1 = require("./trpc/scope-access.js");
+exports.UPLOAD_TRPC_PATH = 'addons.installPackage';
+/**
+ * Validate a `cst_*` scoped token via the `user-management` cap singleton.
+ * Returns null when the singleton isn't mounted yet (boot race) or the
+ * token doesn't validate. Caller treats both as auth failure.
+ */
+async function validateScopedTokenViaCap(addonRegistry, token) {
+    const capRegistry = addonRegistry.getCapabilityRegistry();
+    // Documented type boundary: the registry returns the provider untyped; the
+    // `user-management` cap's `validateScopedToken` surface is asserted here
+    // (same shape the tRPC middleware relies on).
+    const userMgmt = capRegistry.getSingleton('user-management');
+    if (!userMgmt)
+        return null;
+    return userMgmt.validateScopedToken({ token });
+}
+function isUploadAllowed(scoped) {
+    return (0, scope_access_js_1.checkScopeAccess)(scoped.scopes, exports.UPLOAD_TRPC_PATH).ok;
+}
+/**
+ * Run the full upload auth chain. Returns `{ok: true}` on success, or the
+ * HTTP status + error message the route should reply with:
+ *   - 401 `Unauthorized` when no Authorization header is present,
+ *   - 403 `Forbidden: <reason>` for any recognised-but-insufficient token.
+ */
+async function authorizeUploadRequest(args) {
+    const { authHeader, authService, addonRegistry } = args;
+    if (!authHeader) {
+        return { ok: false, status: 401, error: 'Unauthorized' };
+    }
+    const token = authHeader.replace('Bearer ', '');
+    let authReason;
+    // Try JWT first — fastest path + carries the isAdmin flag directly.
+    try {
+        const payload = authService.verifyToken(token);
+        if (payload.isAdmin) {
+            return { ok: true };
+        }
+        authReason = 'JWT is not admin';
+    }
+    catch {
+        // Not a JWT (or invalid signature) — fall through to scoped-token path.
+    }
+    try {
+        const record = await validateScopedTokenViaCap(addonRegistry, token);
+        if (!record) {
+            authReason = authReason ?? 'token not recognised';
+        }
+        else if (isUploadAllowed(record)) {
+            return { ok: true };
+        }
+        else {
+            authReason = `scoped token lacks create access on '${exports.UPLOAD_TRPC_PATH}'`;
+        }
+    }
+    catch (err) {
+        authReason = `scoped token validation failed: ${err instanceof Error ? err.message : String(err)}`;
+    }
+    return {
+        ok: false,
+        status: 403,
+        error: `Forbidden: ${authReason ?? 'admin or upload-scoped token required'}`,
+    };
+}

package/dist/auth/auth-rate-limit.js

@@ -0,0 +1,76 @@
+"use strict";
+/**
+ * Public-auth rate limiting — fixed window per (bucket, client ip).
+ *
+ * The public auth surface (login, TOTP verify, passkey ceremonies,
+ * handoff redeem, session exchange/upgrade) previously had NO
+ * throttling: unlimited online credential guessing. This module is the
+ * first line of defence — deliberately simple (in-memory fixed window),
+ * because the deployment is a single hub process and the goal is to
+ * blunt brute force, not to be a distributed quota system.
+ *
+ * Pure + clock-injectable so specs drive it directly. The key map is
+ * BOUNDED (`maxKeys`, oldest-window evicted first) so an attacker
+ * rotating spoofed source addresses cannot grow it without limit.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRateLimiter = createRateLimiter;
+exports.clientKeyFromRequest = clientKeyFromRequest;
+function createRateLimiter(options) {
+    const maxKeys = options.maxKeys ?? 10_000;
+    const now = options.now ?? Date.now;
+    const entries = new Map();
+    const evictOldest = () => {
+        let oldestKey = null;
+        let oldestStart = Number.POSITIVE_INFINITY;
+        for (const [key, entry] of entries) {
+            if (entry.windowStart < oldestStart) {
+                oldestStart = entry.windowStart;
+                oldestKey = key;
+            }
+        }
+        if (oldestKey !== null)
+            entries.delete(oldestKey);
+    };
+    return {
+        check(key) {
+            const at = now();
+            const existing = entries.get(key);
+            if (!existing || at - existing.windowStart >= options.windowMs) {
+                if (!entries.has(key) && entries.size >= maxKeys)
+                    evictOldest();
+                entries.set(key, { windowStart: at, count: 1 });
+                return { allowed: true, retryAfterSeconds: 0 };
+            }
+            if (existing.count < options.max) {
+                existing.count += 1;
+                return { allowed: true, retryAfterSeconds: 0 };
+            }
+            const retryAfterSeconds = Math.max(1, Math.ceil((existing.windowStart + options.windowMs - at) / 1000));
+            return { allowed: false, retryAfterSeconds };
+        },
+        size() {
+            return entries.size;
+        },
+    };
+}
+/**
+ * Client key for a tRPC/Fastify request principal: `FastifyRequest.ip`
+ * (proxy-aware when Fastify's `trustProxy` is on) or the raw socket
+ * address for WS-upgrade `IncomingMessage`s. `null` = no originating
+ * request (mesh-internal `createCaller` invocation) — never limited.
+ */
+function clientKeyFromRequest(req) {
+    if (req === null || typeof req !== 'object' || req === undefined)
+        return null;
+    const ip = Reflect.get(req, 'ip');
+    if (typeof ip === 'string' && ip.length > 0)
+        return ip;
+    const socket = Reflect.get(req, 'socket');
+    if (socket !== null && typeof socket === 'object') {
+        const remote = Reflect.get(socket, 'remoteAddress');
+        if (typeof remote === 'string' && remote.length > 0)
+            return remote;
+    }
+    return null;
+}

package/dist/main.js

@@ -80,6 +80,7 @@ const trpc_router_1 = require("./api/trpc/trpc.router");
 const core_cap_bridge_1 = require("./api/trpc/core-cap-bridge");
 const trpc_context_1 = require("./api/trpc/trpc.context");
 const addon_upload_1 = require("./api/addon-upload");
+const server_upload_1 = require("./api/server-upload");
 const auth_whoami_1 = require("./api/auth-whoami");
 const session_cookie_js_1 = require("./auth/session-cookie.js");
 const health_routes_1 = require("./api/health/health.routes");
@@ -231,6 +232,15 @@ async function bootstrap() {
         const uploadLogger = app.get(logging_service_1.LoggingService).createLogger('addon-upload');
         await (0, addon_upload_1.registerAddonUploadRoute)(fastify, uploadAddonBridge, uploadAuthService, uploadMoleculer, uploadAddonRegistry, uploadAddonPackage, uploadLogger);
         console.log('[bootstrap] Addon upload route registered at POST /api/addons/upload');
+        // Dev server-deploy channel gateway (`camstack deploy-server`). MUST be
+        // registered AFTER registerAddonUploadRoute — it reuses the multipart
+        // plugin that route installs on this instance.
+        (0, server_upload_1.registerServerUploadRoute)(fastify, {
+            authService: uploadAuthService,
+            addonRegistry: uploadAddonRegistry,
+            logger: app.get(logging_service_1.LoggingService).createLogger('server-upload'),
+        });
+        console.log('[bootstrap] Server upload route registered at POST /api/server-upload');
         // Companion endpoint: /api/auth/whoami — validates JWT or cst_*
         // scoped tokens, returns the resolved identity + scope summary.
         // Mirrors the addon-upload auth chain so the CLI can ping for
@@ -435,7 +445,7 @@ async function bootstrap() {
                             : 'application/octet-stream';
             const stream = fs.createReadStream(resolved);
             return reply
-                .header('cache-control', addonBundleCacheControl(resolved))
+                .header('cache-control', (0, spa_static_1.addonBundleCacheControl)(resolved))
                 .type(contentType)
                 .send(stream);
         });
@@ -467,7 +477,7 @@ async function bootstrap() {
                             : 'application/octet-stream';
             const stream = fs.createReadStream(resolved);
             return reply
-                .header('cache-control', addonBundleCacheControl(resolved))
+                .header('cache-control', (0, spa_static_1.addonBundleCacheControl)(resolved))
                 .type(contentType)
                 .send(stream);
         });
@@ -941,7 +951,16 @@ async function bootstrap() {
     try {
         const bootAddonRegistry = app.get(addon_registry_service_1.AddonRegistryService);
         const capRegistry = bootAddonRegistry.getCapabilityRegistry();
-        let adminUI = capRegistry?.getSingleton('admin-ui');
+        // HUB-NODE-SCOPED resolution — never the cluster-global singleton.
+        // Agent nodes register the same `admin-ui` cap through their own
+        // agent-ui addon (placement: agent-only), and the cluster-elected
+        // active provider can land on the AGENT's registration depending on
+        // node boot order. Its `getStaticDir()` then answers with a path on
+        // the agent's filesystem — nonexistent here — and the SPA catch-all
+        // silently never registers (every `GET /` 404s until the next
+        // restart re-rolls the election). `getSingletonForNode(cap, 'hub')`
+        // only ever resolves providers hosted on THIS node.
+        let adminUI = capRegistry?.getSingletonForNode('admin-ui', 'hub');
         // CAMSTACK_SKIP_ADMIN_UI_WAIT — bypass the 60s poll. Used by the
         // e2e harness, which doesn't need the SPA served and spawns hubs
         // with strict boot timeouts. Production keeps the poll so cold
@@ -959,7 +978,7 @@ async function bootstrap() {
             const deadline = Date.now() + ADMIN_UI_WAIT_MS;
             while (!adminUI && Date.now() < deadline) {
                 await new Promise((r) => setTimeout(r, POLL_MS));
-                adminUI = capRegistry.getSingleton('admin-ui');
+                adminUI = capRegistry.getSingletonForNode('admin-ui', 'hub');
             }
         }
         if (adminUI) {
@@ -1055,7 +1074,10 @@ async function bootstrap() {
     try {
         const bootAddonRegistry = app.get(addon_registry_service_1.AddonRegistryService);
         const capRegistry = bootAddonRegistry.getCapabilityRegistry();
-        let viewerUI = capRegistry?.getSingleton('viewer-ui');
+        // Hub-node-scoped for the same reason as admin-ui above: a remote
+        // node's registration must never win the election for the provider
+        // whose staticDir this process reads from local disk.
+        let viewerUI = capRegistry?.getSingletonForNode('viewer-ui', 'hub');
         const skipViewerUIWait = process.env['CAMSTACK_SKIP_VIEWER_UI_WAIT'] === '1';
         if (!viewerUI && capRegistry && !skipViewerUIWait) {
             // The viewer-ui addon runs in its own forked runner and registers a few
@@ -1066,7 +1088,7 @@ async function bootstrap() {
             const deadline = Date.now() + VIEWER_UI_WAIT_MS;
             while (!viewerUI && Date.now() < deadline) {
                 await new Promise((r) => setTimeout(r, POLL_MS));
-                viewerUI = capRegistry.getSingleton('viewer-ui');
+                viewerUI = capRegistry.getSingletonForNode('viewer-ui', 'hub');
             }
         }
         if (viewerUI) {
@@ -1211,22 +1233,6 @@ function readHubVersion() {
 /**
  * Build an AddonHttpReply wrapper around a Fastify reply.
  */
-/**
- * Cache-Control for an addon MF bundle file. The entry point
- * (`remoteEntry.js` / `widgets.mjs`) has a STABLE filename — only its
- * `?v=` query changes across builds — so it MUST revalidate, otherwise a
- * caching proxy (Cloudflare edge, whose default browser-cache TTL was
- * serving these 4h) keeps handing out a stale entry whose export map
- * lacks the current widgets ("bundle does not export this stableId",
- * tunnel-only). The sibling chunks are CONTENT-HASHED in their filenames
- * (`dist-<hash>.mjs`, `_virtual_mf-<hash>.mjs`), so they are safely
- * immutable. The revalidation cost is a cheap 304 on a ~4KB entry.
- */
-function addonBundleCacheControl(filePath) {
-    const base = path.basename(filePath);
-    const isMfEntry = base === 'remoteEntry.js' || base === 'widgets.mjs';
-    return isMfEntry ? 'no-cache, must-revalidate' : 'public, max-age=31536000, immutable';
-}
 function buildAddonReply(reply) {
     const wrapper = {
         status(code) {