@camstack/server 1.1.61 → 1.1.63

package/dist/api/core/auth.router.js

@@ -176,12 +176,14 @@ async function passkeySecondFactorOptedIn(userId, provider) {
 //
 // The PUBLIC `listLoginMethods` procedure walks the `login-method`
 // collection and returns the union that the login page renders directly:
-// `redirect` buttons (OIDC / magic-link) + pre-auth `widget`s (passkey).
+// `redirect` buttons (OIDC / magic-link), native `passkey` ceremonies, and
+// (generic mechanism, unused by shipped addons) pre-auth `widget`s.
 // The widget arm is enriched server-side with a public `bundleUrl` from
 // `addonId` + `bundle`, so the addon never encodes the static-route
 // scheme. The version is a PATH prefix (`v<…>/`), not a `?v=` query, so the
 // bundle's relative sibling imports inherit it and a CDN busts the WHOLE
-// bundle atomically on deploy (see the stamping site below).
+// bundle atomically on deploy (see the stamping site below). `redirect` and
+// `passkey` arms pass through untouched — no server-side enrichment needed.
 const PublicWidgetLoginMethodSchema = types_1.WidgetLoginMethodSchema.extend({
     bundleUrl: zod_1.z.string(),
 });
@@ -191,6 +193,7 @@ const AUTH_BUNDLE_VERSION = String(Date.now());
 const PublicLoginMethodSchema = zod_1.z.discriminatedUnion('kind', [
     types_1.RedirectLoginMethodSchema,
     PublicWidgetLoginMethodSchema,
+    types_1.PasskeyLoginMethodSchema,
 ]);
 // ── Share tokens (grid-view standalone share links) ──────────────────
 //
@@ -965,6 +968,16 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                         }
                         continue;
                     }
+                    if (raw.kind === 'passkey') {
+                        // Native ceremony — passes through untouched, no server-side
+                        // enrichment (rpId/origin are already stamped by the addon).
+                        const parsed = types_1.PasskeyLoginMethodSchema.safeParse(raw);
+                        if (parsed.success) {
+                            out.push(parsed.data);
+                            seenIds.add(parsed.data.id);
+                        }
+                        continue;
+                    }
                     // Widget arm — stamp a public bundleUrl with the version in the
                     // PATH, not a `?v=` query. Module-Federation bundles import their
                     // fixed-name siblings (`./_stub.js`) by RELATIVE url, which never

package/dist/api/trpc/client-ip.js

@@ -1,7 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractClientIp = extractClientIp;
+exports.extractCfConnectingIp = extractCfConnectingIp;
+exports.extractPeerIp = extractPeerIp;
 exports.extractUserAgent = extractUserAgent;
+exports.ipClass = ipClass;
+exports.classifyClient = classifyClient;
+exports.classifyClientRequest = classifyClientRequest;
+exports.deriveRelayOnly = deriveRelayOnly;
 exports.isRemoteClientIp = isRemoteClientIp;
 /**
  * Best-effort extraction of the originating client IP from a tRPC
@@ -38,6 +44,44 @@ function extractClientIp(req) {
     }
     return null;
 }
+/**
+ * Best-effort read of Cloudflare's `CF-Connecting-IP` request header. When
+ * the hub is reached through a Cloudflare Tunnel, the local `cloudflared`
+ * connector originates the request from LOOPBACK, so the socket peer (and
+ * usually `req.ip`) is `127.0.0.1` — a genuinely-remote viewer would
+ * otherwise be misclassified LAN. Cloudflare stamps the real client address
+ * in `CF-Connecting-IP` on every tunneled request.
+ *
+ * SECURITY: this header is trivially spoofable by any client that can reach
+ * the hub directly (it's just an HTTP header). It is therefore trusted ONLY
+ * when the immediate socket peer is loopback/LAN — see `classifyClient`. A
+ * direct internet client that forges the header still classifies by its own
+ * (remote) peer address. Returns `null` when absent.
+ */
+function extractCfConnectingIp(req) {
+    if (!req)
+        return null;
+    const raw = req.headers['cf-connecting-ip'];
+    const value = Array.isArray(raw) ? raw[0] : raw;
+    if (typeof value === 'string' && value.length > 0)
+        return normalizeIp(value.trim());
+    return null;
+}
+/**
+ * Immediate socket peer address (never the `X-Forwarded-For` / `req.ip`
+ * proxy-resolved value). Used only to gate `CF-Connecting-IP` trust: the
+ * header is honoured solely when the request physically arrived from a
+ * loopback/LAN peer (the local `cloudflared` connector). Returns `null` when
+ * no socket is present (mesh-originated calls).
+ */
+function extractPeerIp(req) {
+    if (!req)
+        return null;
+    const remote = req.socket?.remoteAddress;
+    if (typeof remote === 'string' && remote.length > 0)
+        return normalizeIp(remote);
+    return null;
+}
 /**
  * Best-effort read of the originating client's `User-Agent` header. Both
  * request shapes in the union (`FastifyRequest` and the raw WS-transport
@@ -71,33 +115,81 @@ function normalizeIp(ip) {
     return out;
 }
 /**
- * True when the address is NOT in a private / loopback / link-local /
- * Tailscale range — i.e. an internet (remote) viewer. Covers IPv4
- * (10/8, 172.16/12, 192.168/16, 127/8, 100.64/10 Tailscale CGNAT) and
- * IPv6 (::1, fc00::/7 unique-local, fe80::/10 link-local — fd7a::/16
- * Tailscale ULA is a subset of fc00::/7 and is therefore already
- * covered).
- *
- * Tailscale clients (the 100.64.0.0/10 CGNAT overlay or the fd7a::/16
- * ULA overlay) are deliberately classified LOCAL: over the Tailscale
- * mesh BOTH peers sit on the 100.x / fd7a:: overlay and are mutually
- * reachable, so the broker offers ALL candidates (host/srflx/relay)
- * — including the hub's Tailscale host candidate — and a direct
- * host↔host pair wins ICE with native (non-re-encoded) media. Forcing
- * relay-only for Tailscale would push them onto the broken relay path.
- *
- * Unparseable or null addresses return `false` (treated as LAN — the
- * safe default that preserves the existing direct path).
+ * Classify a single already-normalised IP literal. Null / unparseable →
+ * `'lan'` (the safe default that keeps the low-latency direct path).
  */
-function isRemoteClientIp(ip) {
+function ipClass(ip) {
     if (!ip)
-        return false;
-    if (ip.includes(':'))
-        return !isPrivateIpv6(ip);
-    if (isIpv4(ip))
-        return !isPrivateIpv4(ip);
+        return 'lan';
+    if (ip.includes(':')) {
+        if (isTailscaleIpv6(ip))
+            return 'vpn';
+        if (isPrivateIpv6(ip))
+            return 'lan';
+        return 'remote';
+    }
+    if (isIpv4(ip)) {
+        if (isTailscaleIpv4(ip))
+            return 'vpn';
+        if (isPrivateIpv4(ip))
+            return 'lan';
+        return 'remote';
+    }
     // Not a recognisable IP literal — be conservative, treat as LAN.
-    return false;
+    return 'lan';
+}
+/**
+ * Classify a viewer from the resolved request signals.
+ *
+ * `cfConnectingIp` (Cloudflare Tunnel's real-client header) is honoured ONLY
+ * when `peerIsLocal` — i.e. the request physically arrived from the local
+ * `cloudflared` connector on loopback/LAN. On that path the socket peer is
+ * loopback and cannot itself reveal the viewer, so the header is the only
+ * trustworthy signal; classify by ITS value. When the peer is NOT local the
+ * header is ignored (a direct internet client could forge it) and we classify
+ * by the proxy-resolved `clientIp`.
+ */
+function classifyClient(args) {
+    if (args.peerIsLocal && args.cfConnectingIp)
+        return ipClass(args.cfConnectingIp);
+    return ipClass(args.clientIp);
+}
+/**
+ * Classify a live tRPC request. Returns `null` for a mesh-originated call
+ * (no HTTP request) so the caller leaves the session input untouched rather
+ * than forcing a policy. Composes `extractClientIp` (proxy-aware), the
+ * `CF-Connecting-IP` header, and the immediate socket peer (CF trust gate).
+ */
+function classifyClientRequest(req) {
+    if (!req)
+        return null;
+    const clientIp = extractClientIp(req);
+    const cfConnectingIp = extractCfConnectingIp(req);
+    const peerIp = extractPeerIp(req);
+    const peerIsLocal = peerIp !== null && ipClass(peerIp) !== 'remote';
+    return classifyClient({ clientIp, cfConnectingIp, peerIsLocal });
+}
+/**
+ * Derive the broker's `relayOnly` ICE override from the client class:
+ *   - `remote` → true  (CGNAT/4G/internet peer only offers a relay candidate;
+ *                        a forced relay↔relay path avoids werift nominating a
+ *                        dead host/hairpin-srflx pair).
+ *   - `vpn`    → false (the Tailscale tunnel already carries native media on a
+ *                        direct overlay host pair; forcing TURN would be worse).
+ *   - `lan`    → false (low-latency direct host/srflx path).
+ */
+function deriveRelayOnly(clientClass) {
+    return clientClass === 'remote';
+}
+/**
+ * True when the address is a genuinely-remote (internet) viewer — i.e. NOT
+ * lan and NOT vpn. Retained for callers that want the boolean; defined in
+ * terms of `ipClass` so the classification stays single-sourced. Tailscale
+ * (`'vpn'`) is NOT remote (kept on the direct overlay path). Unparseable /
+ * null → false (safe LAN default).
+ */
+function isRemoteClientIp(ip) {
+    return ipClass(ip) === 'remote';
 }
 function isIpv4(ip) {
     const parts = ip.split('.');
@@ -110,6 +202,14 @@ function isIpv4(ip) {
         return n >= 0 && n <= 255;
     });
 }
+/** 100.64.0.0/10 — Tailscale CGNAT overlay (100.64.0.0 – 100.127.255.255). */
+function isTailscaleIpv4(ip) {
+    const parts = ip.split('.').map((p) => Number.parseInt(p, 10));
+    const [a, b] = parts;
+    if (a === undefined || b === undefined)
+        return false;
+    return a === 100 && b >= 64 && b <= 127;
+}
 function isPrivateIpv4(ip) {
     const parts = ip.split('.').map((p) => Number.parseInt(p, 10));
     const [a, b] = parts;
@@ -125,13 +225,16 @@ function isPrivateIpv4(ip) {
         return true; // 192.168.0.0/16
     if (a === 169 && b === 254)
         return true; // 169.254.0.0/16 link-local
-    // 100.64.0.0/10 — Tailscale CGNAT overlay (100.64.0.0 – 100.127.255.255).
-    // Both Tailscale peers are mutually reachable on this overlay, so treat
-    // it as local (direct host↔host pair, no relay).
-    if (a === 100 && b >= 64 && b <= 127)
-        return true;
     return false;
 }
+/**
+ * fd7a:115c:a1e0::/48 — Tailscale IPv6 ULA overlay (source: Tailscale docs).
+ * A strict subset of fc00::/7; checked BEFORE the generic-ULA test so a
+ * tailnet client on the hub's own v6 address classifies `'vpn'`, not `'lan'`.
+ */
+function isTailscaleIpv6(ip) {
+    return ip.toLowerCase().startsWith('fd7a:115c:a1e0:');
+}
 function isPrivateIpv6(ip) {
     const lower = ip.toLowerCase();
     if (lower === '::1')

package/dist/api/trpc/generated-cap-mounts.js

@@ -2,7 +2,7 @@
 // AUTO-GENERATED by scripts/generate-cap-mounts.ts — DO NOT EDIT
 // Re-run: npx tsx scripts/generate-cap-mounts.ts
 //
-// Mounted: 135    Skipped (legacy): 3
+// Mounted: 138    Skipped (legacy): 3
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LEGACY_SHAPE_SKIP = void 0;
 exports.mountAllCaps = mountAllCaps;
@@ -205,6 +205,30 @@ function mountAllCaps(services) {
         integrations: (0, generated_cap_routers_js_1.createCapRouter_integrations)((_ctx) => reg?.getSingleton('integrations') ?? null, remoteCapProxy),
         intercom: (0, generated_cap_routers_js_1.createCapRouter_intercom)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'intercom'), remoteCapProxy),
         lawnMowerControl: (0, generated_cap_routers_js_1.createCapRouter_lawnMowerControl)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'lawn-mower-control'), remoteCapProxy),
+        llm: (0, generated_cap_routers_js_1.createCapRouter_llm)((_ctx, addonId) => {
+            if (!reg)
+                return null;
+            if (addonId !== undefined) {
+                return reg.getProviderByAddonId('llm', addonId);
+            }
+            const entries = reg.getCollectionEntries('llm');
+            if (entries.length === 0)
+                return null;
+            const providers = entries.map(([, p]) => p);
+            const first = providers[0];
+            return {
+                ...first,
+                listProfileKinds: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'listProfileKinds'),
+                listProfiles: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'listProfiles'),
+                listModels: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'listModels'),
+                getDefaults: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'getDefaults'),
+                getUsage: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'getUsage'),
+                listModelCatalog: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'listModelCatalog'),
+                listRuntimeNodes: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'listRuntimeNodes'),
+                listNodeModels: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'listNodeModels'),
+            };
+        }, remoteCapProxy),
+        llmRuntime: (0, generated_cap_routers_js_1.createCapRouter_llmRuntime)((_ctx) => reg?.getSingleton('llm-runtime') ?? null, remoteCapProxy),
         localNetwork: (0, generated_cap_routers_js_1.createCapRouter_localNetwork)((_ctx) => reg?.getSingleton('local-network') ?? null, remoteCapProxy),
         lockControl: (0, generated_cap_routers_js_1.createCapRouter_lockControl)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'lock-control'), remoteCapProxy),
         loginMethod: (0, generated_cap_routers_js_1.createCapRouter_loginMethod)((_ctx, addonId) => {
@@ -326,6 +350,7 @@ function mountAllCaps(services) {
         ptzAutotrack: (0, generated_cap_routers_js_1.createCapRouter_ptzAutotrack)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'ptz-autotrack'), remoteCapProxy),
         reboot: (0, generated_cap_routers_js_1.createCapRouter_reboot)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'reboot'), remoteCapProxy),
         recording: (0, generated_cap_routers_js_1.createCapRouter_recording)((_ctx) => reg?.getSingleton('recording') ?? null, remoteCapProxy),
+        sceneMonitor: (0, generated_cap_routers_js_1.createCapRouter_sceneMonitor)((_ctx) => reg?.getSingleton('scene-monitor') ?? null, remoteCapProxy),
         scriptRunner: (0, generated_cap_routers_js_1.createCapRouter_scriptRunner)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'script-runner'), remoteCapProxy),
         serverManagement: (0, generated_cap_routers_js_1.createCapRouter_serverManagement)((_ctx) => reg?.getSingleton('server-management') ??
             null, remoteCapProxy),