@camstack/server 1.2.105 → 1.2.107

package/dist/api/core/auth.router.js

@@ -1,7 +1,4 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.EXCHANGE_SESSION_HEADER = void 0;
-exports.createAuthRouter = createAuthRouter;
 /**
  * Auth router — core API for login/logout/me.
  *
@@ -17,15 +14,18 @@ exports.createAuthRouter = createAuthRouter;
  * collection — the single, generic mechanism every auth addon contributes
  * to (superseding the removed `auth.listProviders`).
  */
-const zod_1 = require("zod");
-const server_1 = require("@trpc/server");
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXCHANGE_SESSION_HEADER = void 0;
+exports.createAuthRouter = createAuthRouter;
 const types_1 = require("@camstack/types");
-const share_token_service_js_1 = require("../../core/auth/share-token.service.js");
-const handoff_code_service_js_1 = require("../../core/auth/handoff-code.service.js");
+const server_1 = require("@trpc/server");
+const zod_1 = require("zod");
+const auth_rate_limit_js_1 = require("../../auth/auth-rate-limit.js");
 const session_cookie_js_1 = require("../../auth/session-cookie.js");
-const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const handoff_code_service_js_1 = require("../../core/auth/handoff-code.service.js");
+const share_token_service_js_1 = require("../../core/auth/share-token.service.js");
 const principal_visibility_js_1 = require("../trpc/principal-visibility.js");
-const auth_rate_limit_js_1 = require("../../auth/auth-rate-limit.js");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
 // ── Public-auth rate limiting ────────────────────────────────────────
 // The public surface below (credential validation, passkey ceremonies,
 // one-time-code redemption) had NO throttling — unlimited online
@@ -274,6 +274,35 @@ function readRequestHeader(req, name) {
         return value[0] ?? null;
     return null;
 }
+/** Per-access device reach summary (counts, never id lists). */
+const DeviceReachSummarySchema = zod_1.z.object({
+    all: zod_1.z.boolean(),
+    deviceCount: zod_1.z.number().int(),
+});
+/** One capability/addon grant flattened for the UI. */
+const ScopeGrantSummarySchema = zod_1.z.object({
+    name: zod_1.z.string(),
+    access: zod_1.z.array(types_1.MethodAccessSchema).readonly(),
+});
+/**
+ * The caller's RESOLVED effective scope (scope model v3). Selectors are
+ * expanded against the live fleet to counts/flags — never raw id lists — so
+ * the viewer (F3/F4) can HIDE out-of-scope surfaces from a single probe. A
+ * non-admin with zero grants reports zero everything (born with no access).
+ */
+const EffectiveScopeSchema = zod_1.z.object({
+    isAdmin: zod_1.z.boolean(),
+    allDevicesViewable: zod_1.z.boolean(),
+    viewableDeviceCount: zod_1.z.number().int(),
+    device: zod_1.z.object({
+        view: DeviceReachSummarySchema,
+        create: DeviceReachSummarySchema,
+        delete: DeviceReachSummarySchema,
+    }),
+    system: zod_1.z.array(types_1.MethodAccessSchema).readonly(),
+    capabilities: zod_1.z.array(ScopeGrantSummarySchema).readonly(),
+    addons: zod_1.z.array(ScopeGrantSummarySchema).readonly(),
+});
 /** Wire shape of the authenticated user returned by `auth.me`. */
 const MeSchema = zod_1.z
     .object({
@@ -287,6 +316,11 @@ const MeSchema = zod_1.z
     }),
     isApiKey: zod_1.z.boolean(),
     agentId: zod_1.z.string().optional(),
+    /**
+     * The caller's resolved effective scope. Absent only on the (unreachable
+     * here — `me` is `protected`) null-principal branch.
+     */
+    scope: EffectiveScopeSchema.optional(),
 })
     .nullable();
 function createAuthRouter(auth, registry, moleculer = null, shareTokens = null, handoffCodes = new handoff_code_service_js_1.HandoffCodeService()) {
@@ -693,7 +727,44 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         me: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.void())
             .output(MeSchema)
-            .query(({ ctx }) => ctx.user),
+            .query(({ ctx }) => {
+            if (!ctx.user)
+                return null;
+            // Resolve the effective scope against the live fleet so the viewer can
+            // hide surfaces from a single probe (F1 #5). Admins summarise to
+            // "everything"; a scoped principal's selectors expand to counts.
+            const fleet = ctx.deviceFleet?.() ?? [];
+            const scope = (0, types_1.summarizeEffectiveScope)(ctx.user.scopes ?? [], fleet, ctx.user.isAdmin);
+            return { ...ctx.user, scope };
+        }),
+        /**
+         * Resolve a PROPOSED grant set the same way `me` resolves the caller's
+         * own — so the Users page can show "12 devices viewable, 2 actionable"
+         * BEFORE saving, and the number it shows is the number the matcher will
+         * enforce.
+         *
+         * Deliberately the same two lines as `me` (`summarizeEffectiveScope`
+         * over `ctx.deviceFleet()`) rather than a second derivation in the admin
+         * UI. A preview computed client-side from the same selectors would be a
+         * hand-copied scope check, and those drift (D103) — a preview that
+         * disagrees with enforcement is worse than none, because it is trusted.
+         *
+         * Admin-gated: only an admin edits another user's scopes
+         * (`user-management.setUserScopes` is `auth: 'admin'`), and the fleet
+         * size / room labels this leaks are admin-visible already. It reads
+         * nothing off the caller, so it is not a self-scope oracle.
+         *
+         * `isAdmin` previews the admin BYPASS — with it set, grants are ignored
+         * and the answer is "everything", which is what the panel must show
+         * when the operator ticks the Admin box.
+         */
+        previewScope: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({
+            scopes: zod_1.z.array(types_1.TokenScopeSchema),
+            isAdmin: zod_1.z.boolean().default(false),
+        }))
+            .output(EffectiveScopeSchema)
+            .query(({ ctx, input }) => (0, types_1.summarizeEffectiveScope)(input.scopes, ctx.deviceFleet?.() ?? [], input.isAdmin)),
         // ── Self-service profile operations ───────────────────────────────
         //
         // These route through the `user-management` capability provider but
@@ -895,7 +966,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 ? input.scope
                 : {
                     ...input.scope,
-                    deviceIds: (0, principal_visibility_js_1.filterViewableDeviceIds)(ctx.user.scopes ?? [], input.scope.deviceIds, ctx.getDeviceAncestors),
+                    deviceIds: (0, principal_visibility_js_1.filterViewableDeviceIds)(ctx.user.scopes ?? [], input.scope.deviceIds, ctx.deviceScopeLookup),
                 };
             if (scope.deviceIds.length === 0) {
                 throw new server_1.TRPCError({

package/dist/api/core/live-events.router.js

@@ -33,7 +33,7 @@ function createLiveEventsRouter(eb, ar) {
             // for admins and broad category-view operators (no filtering), or a
             // per-event predicate that keeps only events for devices the caller may
             // view. (Share-view tokens cannot reach this method — not allowlisted.)
-            const keep = (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.getDeviceAncestors);
+            const keep = (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.deviceScopeLookup);
             return keep ? recent.filter((evt) => keep(evt)) : recent;
         }),
         onEvent: trpc_middleware_js_1.protectedProcedure
@@ -47,7 +47,7 @@ function createLiveEventsRouter(eb, ar) {
             // view (F0.5); admins and broad category-view operators are unfiltered.
             const scopedKeep = shareScope
                 ? null
-                : (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.getDeviceAncestors);
+                : (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.deviceScopeLookup);
             return (0, trpc_middleware_js_1.iterableSubscription)((push) => {
                 const filter = {};
                 if (input.category)

package/dist/api/core/system-events.router.js

@@ -91,13 +91,13 @@ function createSystemEventsRouter(eb) {
             }, input.limit);
             // SECURITY (F0.5): filter the history to what a device-restricted scoped
             // token may view. null ⇒ admin / broad category-view operator ⇒ unfiltered.
-            const keep = (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.getDeviceAncestors);
+            const keep = (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.deviceScopeLookup);
             return (keep ? recent.filter((evt) => keep(evt)) : recent).map(serialize);
         }),
         subscribe: trpc_middleware_js_1.protectedProcedure.input(SubscribeInputSchema).subscription(({ input, ctx }) => {
             // SECURITY (F0.5): a device-restricted scoped token must not receive every
             // camera's live events. Same projection as `getRecent`.
-            const keep = (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.getDeviceAncestors);
+            const keep = (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.deviceScopeLookup);
             return (0, trpc_middleware_js_1.iterableSubscription)((push) => {
                 return eb.subscribe({
                     ...(input.source ? { source: input.source } : {}),

package/dist/api/trpc/generated-cap-routers.js

@@ -7310,7 +7310,7 @@ function createCapRouter_recording(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.applyDeviceSettingsPatch(methodInput);
         }),
-        getAvailability: trpc_middleware_js_1.adminProcedure
+        getAvailability: trpc_middleware_js_1.protectedProcedure
             .input(types_92.recordingCapability.methods.getAvailability.input.loose())
             .output(types_92.recordingCapability.methods.getAvailability.output)
             .query(async ({ input, ctx }) => {
@@ -7319,7 +7319,7 @@ function createCapRouter_recording(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.getAvailability(methodInput);
         }),
-        getDaysWithRecordings: trpc_middleware_js_1.adminProcedure
+        getDaysWithRecordings: trpc_middleware_js_1.protectedProcedure
             .input(types_92.recordingCapability.methods.getDaysWithRecordings.input.loose())
             .output(types_92.recordingCapability.methods.getDaysWithRecordings.output)
             .query(async ({ input, ctx }) => {
@@ -7328,7 +7328,7 @@ function createCapRouter_recording(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.getDaysWithRecordings(methodInput);
         }),
-        getPlaybackManifest: trpc_middleware_js_1.adminProcedure
+        getPlaybackManifest: trpc_middleware_js_1.protectedProcedure
             .input(types_92.recordingCapability.methods.getPlaybackManifest.input.loose())
             .output(types_92.recordingCapability.methods.getPlaybackManifest.output)
             .query(async ({ input, ctx }) => {

package/dist/api/trpc/principal-visibility.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.callerCanViewDevice = callerCanViewDevice;
 exports.isBroadEventViewer = isBroadEventViewer;
 exports.filterViewableDeviceIds = filterViewableDeviceIds;
+exports.hasUnrestrictedDeviceView = hasUnrestrictedDeviceView;
+exports.projectListAllForPrincipal = projectListAllForPrincipal;
 exports.scopedEventVisibility = scopedEventVisibility;
 /**
  * Non-admin principal device visibility — the shared answer to "which cameras
@@ -26,7 +28,9 @@ exports.scopedEventVisibility = scopedEventVisibility;
  * pattern as `scope-access.ts` / `share-view-access.ts`).
  */
 const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
 const scope_access_js_1 = require("./scope-access.js");
+const share_view_access_js_1 = require("./share-view-access.js");
 /**
  * Canonical "view this camera" probe. `snapshot.getSnapshot` is a device-scope,
  * `view`-access method every viewer surface needs (the grid-embed cold-start
@@ -48,8 +52,8 @@ assertProbeExists();
  * `device:[parent]` → child inheritance through the ancestor walk, exactly as
  * the per-camera middleware does.
  */
-function callerCanViewDevice(scopes, deviceId, getDeviceAncestors) {
-    return (0, scope_access_js_1.checkScopeAccess)(scopes, DEVICE_VIEW_PROBE, { deviceId }, getDeviceAncestors).ok;
+function callerCanViewDevice(scopes, deviceId, lookup) {
+    return (0, scope_access_js_1.checkScopeAccess)(scopes, DEVICE_VIEW_PROBE, { deviceId }, lookup).ok;
 }
 /**
  * A scoped principal sees the WHOLE event/telemetry firehose when it holds any
@@ -72,8 +76,8 @@ function isBroadEventViewer(scopes) {
  * share minting: an admin passes `isAdmin` and skips this; a non-admin gets the
  * intersection, and the router refuses when it is empty.
  */
-function filterViewableDeviceIds(scopes, requested, getDeviceAncestors) {
-    return requested.filter((id) => callerCanViewDevice(scopes, id, getDeviceAncestors));
+function filterViewableDeviceIds(scopes, requested, lookup) {
+    return requested.filter((id) => callerCanViewDevice(scopes, id, lookup));
 }
 /** The device identity an event is attributable to, or null when it carries
  *  none. Mirrors `liveEventInShareScope`'s matching (source.id, source.deviceId,
@@ -95,6 +99,39 @@ function eventDeviceId(evt) {
         return dataDeviceId;
     return null;
 }
+/**
+ * True when the principal's device reach is UNRESTRICTED at view — admin, a
+ * `category:device[view]` grant, or a device grant with an `all` selector.
+ * Such a caller enumerates the fleet unprojected, exactly as before.
+ */
+function hasUnrestrictedDeviceView(isAdmin, scopes) {
+    if (isAdmin)
+        return true;
+    return scopes.some((s) => s.access.includes('view') &&
+        ((s.type === 'category' && s.target === 'device') ||
+            (s.type === 'device' && s.selector.kind === 'all')));
+}
+/**
+ * Cut a `deviceManager.listAll` payload to the devices this principal may VIEW
+ * (F1 #4 — "enumerate only mine").
+ *
+ * A device outside the scope is INVISIBLE in enumerations (operator decision),
+ * not merely un-openable: returning it would leak the deployment's camera
+ * names, locations and online state to a token granted one camera.
+ *
+ * Reuses `resolveViewableDeviceIds` (the same selector engine the matcher
+ * uses, so enumeration and by-id access can never disagree) and
+ * `projectListAllForDeviceIds` (the same row whitelist the share path uses, so
+ * neither surface can forget that `config` carries credentials).
+ *
+ * A caller with unrestricted reach is returned the payload untouched.
+ */
+function projectListAllForPrincipal(data, isAdmin, scopes, fleet) {
+    if (hasUnrestrictedDeviceView(isAdmin, scopes))
+        return data;
+    const viewable = (0, types_1.resolveViewableDeviceIds)(scopes, fleet, 'view');
+    return (0, share_view_access_js_1.projectListAllForDeviceIds)(data, viewable);
+}
 /**
  * Build the event-stream predicate for a NON-share principal (F0.5).
  *
@@ -107,7 +144,7 @@ function eventDeviceId(evt) {
  * Share-view (`csv_*`) principals are NOT handled here — they keep their own,
  * stricter `liveEventInShareScope` filter, applied by the routers first.
  */
-function scopedEventVisibility(user, getDeviceAncestors) {
+function scopedEventVisibility(user, lookup) {
     if (user.isAdmin)
         return null;
     const scopes = user.scopes ?? [];
@@ -117,6 +154,6 @@ function scopedEventVisibility(user, getDeviceAncestors) {
         const id = eventDeviceId(evt);
         if (id === null)
             return false;
-        return callerCanViewDevice(scopes, id, getDeviceAncestors);
+        return callerCanViewDevice(scopes, id, lookup);
     };
 }

package/dist/api/trpc/scope-access.js

@@ -1,30 +1,35 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEVICE_ENUMERATION_METHODS = void 0;
 exports.checkScopeAccess = checkScopeAccess;
 /**
  * Pure scope-access matcher.
  *
  * Extracted from `trpc.middleware.ts` so the spec can exercise it
  * without spinning up the tRPC initTRPC machinery. The function is
- * stateless aside from an optional device-ancestor lookup callback.
+ * stateless aside from an optional {@link DeviceScopeLookup}.
  *
- * Algorithm (v2 — four scope types):
+ * Algorithm (v3 — four scope types):
  *   1. Look the tRPC `path` up in `METHOD_ACCESS_MAP`. Unknown =
  *      FORBIDDEN (codegen drift; fail closed).
  *   2. For each scope on the caller, check if it matches:
  *      - `category`   — scope.target matches meta.capScope ('device'|'system')
  *      - `capability` — scope.target matches meta.capName exactly
  *      - `addon`      — scope.target matches meta.addonId (when set)
- *      - `device`     — input.deviceId (OR any of its ancestor deviceIds
- *                       via `getDeviceAncestors`) is in scope.targets.
- *                       Auto-inheritance means granting a Reolink camera
- *                       implicitly grants its siren / floodlight / PIR
- *                       child accessories without re-listing them.
+ *      - `device`     — the request's `input.deviceId` is covered by the
+ *                       grant's v3 `selector` (all / ids / types / locations),
+ *                       resolved against the device's persisted type/location
+ *                       via {@link DeviceScopeLookup}. When the grant inherits
+ *                       (view by default, or `includeLinked`), an ANCESTOR
+ *                       match also covers the device — granting a Reolink
+ *                       camera implicitly grants its siren / floodlight / PIR
+ *                       children without re-listing them.
  *   3. On a target match, accept iff `scope.access` includes the
  *      method's required `access` flavour.
  *   4. No matching scope → FORBIDDEN with a human-readable reason.
  */
 const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
 /**
  * Pull `deviceId` off a tRPC request input. Device-scope cap methods
  * uniformly take `{deviceId: number, ...}` per the DeviceProxy contract,
@@ -38,25 +43,145 @@ function extractDeviceId(input) {
     return typeof candidate === 'number' ? candidate : null;
 }
 /**
- * Build the set of deviceIds that count as "this request" for the
- * device-scope match: the deviceId itself plus every ancestor (so a
- * scope on the parent camera covers accessory children).
+ * The device candidates a request is matched against: the deviceId itself
+ * plus (when the grant inherits) its ancestors, each carrying the metadata a
+ * v3 selector needs. A parent camera whose grant inherits therefore covers an
+ * accessory child, because the child's request tests the grant against the
+ * PARENT's metadata too.
  */
-function effectiveDeviceIds(deviceId, getAncestors) {
-    if (!getAncestors)
-        return [String(deviceId)];
-    const out = new Set([String(deviceId)]);
-    for (const ancestor of getAncestors(deviceId))
-        out.add(String(ancestor));
-    return [...out];
+function candidateMetas(deviceId, lookup) {
+    const toMeta = (id) => ({
+        id,
+        type: lookup?.getType(id) ?? '',
+        location: lookup?.getLocation(id) ?? null,
+        parentDeviceId: null,
+    });
+    if (!lookup)
+        return [toMeta(deviceId)];
+    const out = [toMeta(deviceId)];
+    for (const ancestor of lookup.getAncestors(deviceId))
+        out.push(toMeta(ancestor));
+    return out;
 }
-function checkScopeAccess(scopes, path, input, getDeviceAncestors) {
+/** Whether a v3 `device` grant covers this request. Direct selector match on
+ *  the device, or — when the grant inherits at this access — a match on an
+ *  ancestor. */
+function deviceScopeCovers(scope, access, candidates) {
+    const inherit = (0, types_1.scopeInherits)(scope, access);
+    return candidates.some((cand, index) => {
+        // index 0 is the device itself (always eligible); ancestors only when the
+        // grant inherits.
+        if (index > 0 && !inherit)
+            return false;
+        return (0, types_1.deviceSelectorMatches)(scope.selector, cand);
+    });
+}
+/** Render a device selector for the human-readable denial reason. */
+function describeSelector(scope) {
+    const sel = scope.selector;
+    switch (sel.kind) {
+        case 'all':
+            return 'all';
+        case 'ids':
+            return `ids:${sel.ids.join(',')}`;
+        case 'types':
+            return `types:${sel.types.join(',')}`;
+        case 'locations':
+            return `locations:${sel.locations.join(',')}`;
+    }
+}
+/**
+ * Methods that ENUMERATE devices rather than naming one — "which devices are
+ * mine". A `device`-selector grant may reach these, and it is safe ONLY
+ * because every one of them has its response cut to the caller's viewable set
+ * before it leaves the server (`projectListAllForPrincipal`, applied in
+ * `trpc.middleware.ts`).
+ *
+ * Adding a path here WITHOUT adding its projection hands the whole fleet to a
+ * one-camera token. The pairing is asserted by
+ * `scoped-list-projection.spec.ts`.
+ */
+exports.DEVICE_ENUMERATION_METHODS = new Set(['deviceManager.listAll']);
+/**
+ * Every deviceId a request NAMES, per the codegen'd
+ * {@link METHOD_DEVICE_SELECTORS}. Absent / null / malformed values are
+ * skipped: an optional `deviceId` that was not sent references no device, and
+ * `linkDeviceId: null` means "clear the link".
+ */
+function referencedDeviceIds(path, input) {
+    const fields = types_1.METHOD_DEVICE_SELECTORS[path];
+    if (!fields || input === null || typeof input !== 'object')
+        return [];
+    const out = [];
+    for (const field of fields) {
+        const raw = Reflect.get(input, field.name);
+        if (raw === undefined || raw === null)
+            continue;
+        if (field.form === 'single') {
+            if (typeof raw === 'number' && Number.isFinite(raw))
+                out.push(raw);
+            continue;
+        }
+        if (!Array.isArray(raw))
+            continue;
+        for (const item of raw) {
+            if (typeof item === 'number' && Number.isFinite(item))
+                out.push(item);
+        }
+    }
+    return out;
+}
+/**
+ * True when the caller's device reach at `access` is UNRESTRICTED — admin-like
+ * breadth expressed as `category:device[access]` or a `device` grant whose
+ * selector is `all`. Such a caller is unaffected by the device-reference gate.
+ */
+function hasUnrestrictedDeviceReach(scopes, access) {
+    return scopes.some((s) => s.access.includes(access) &&
+        ((s.type === 'category' && s.target === 'device') ||
+            (s.type === 'device' && s.selector.kind === 'all')));
+}
+/**
+ * The device-reference gate for SYSTEM-scope cap methods (F1 #3).
+ *
+ * ~124 system-scope methods take a deviceId (`recording.getPlaybackManifest`,
+ * `faceGallery.*`, `pipelineOrchestrator.*`, …) and were never device-filtered:
+ * the matcher only extracted a deviceId when the CAP was `scope: 'device'`. So
+ * a non-admin holding `category:system[view]` could read ANY camera's
+ * recordings or faces regardless of the cameras they were granted. This closes
+ * that.
+ *
+ * Applied ONLY to system-scope caps, and only ON TOP of an already-passing
+ * cap-level grant — it never grants anything, it only subtracts. Device-scope
+ * caps are deliberately untouched: there the `device` scope branch IS the
+ * device check, and `capability:<name>` grants over device caps are
+ * cross-device by documented design (the `events` cap, which the
+ * `event-listener` preset depends on, is one). Making capability grants
+ * device-restricted on device caps too is a separate, operator-visible
+ * decision — not smuggled in here.
+ */
+function deviceRefsSatisfied(scopes, path, input, access, lookup) {
+    const refs = referencedDeviceIds(path, input);
+    if (refs.length === 0)
+        return { ok: true };
+    if (hasUnrestrictedDeviceReach(scopes, access))
+        return { ok: true };
+    const grants = scopes.filter((s) => s.type === 'device' && s.access.includes(access));
+    for (const deviceId of refs) {
+        const candidates = candidateMetas(deviceId, lookup);
+        const covered = grants.some((g) => deviceScopeCovers(g, access, candidates));
+        if (!covered)
+            return { ok: false, deviceId };
+    }
+    return { ok: true };
+}
+function checkScopeAccess(scopes, path, input, lookup) {
     const meta = system_1.METHOD_ACCESS_MAP[path];
     if (!meta) {
         return { ok: false, reason: `Unknown method '${path}' — codegen drift` };
     }
     const deviceId = meta.capScope === 'device' ? extractDeviceId(input) : null;
-    const deviceChain = deviceId !== null ? effectiveDeviceIds(deviceId, getDeviceAncestors) : [];
+    const candidates = deviceId !== null ? candidateMetas(deviceId, lookup) : [];
     for (const s of scopes) {
         let targetMatches = false;
         switch (s.type) {
@@ -70,22 +195,43 @@ function checkScopeAccess(scopes, path, input, getDeviceAncestors) {
                 targetMatches = meta.addonId !== null && s.target === meta.addonId;
                 break;
             case 'device':
-                // Match if the request's device — or any of its ancestors — is
-                // in the grant's target list. Accessory children inherit the
-                // parent's scope without re-enumeration.
-                targetMatches = deviceChain.some((id) => s.targets.includes(id));
+                // A device grant matches either:
+                //  • a request naming a device, when the v3 selector covers it (or an
+                //    ancestor — accessory inheritance, gated by `includeLinked`); or
+                //  • a DEVICE ENUMERATION method, which names no device precisely
+                //    because it asks "which are mine". Those are safe to reach ONLY
+                //    because the RESPONSE is cut to the caller's set (see
+                //    `DEVICE_ENUMERATION_METHODS`); without that projection this
+                //    branch would hand the whole fleet to a one-camera token.
+                targetMatches =
+                    deviceId !== null
+                        ? deviceScopeCovers(s, meta.access, candidates)
+                        : exports.DEVICE_ENUMERATION_METHODS.has(path);
                 break;
         }
         if (!targetMatches)
             continue;
-        if (s.access.includes(meta.access))
-            return { ok: true, access: meta.access };
+        if (!s.access.includes(meta.access))
+            continue;
+        // Cap-level grant passes. A SYSTEM-scope method that NAMES devices must
+        // additionally be covered on each of them — otherwise `category:system`
+        // reads every camera's recordings (F1 #3).
+        if (meta.capScope === 'system') {
+            const refs = deviceRefsSatisfied(scopes, path, input, meta.access, lookup);
+            if (!refs.ok) {
+                return {
+                    ok: false,
+                    reason: `Device ${refs.deviceId} is outside your device scope (referenced by '${path}')`,
+                };
+            }
+        }
+        return { ok: true, access: meta.access };
     }
     return {
         ok: false,
         reason: `No scope grants ${meta.access} on '${meta.capName}' (${meta.capScope}-scope cap${deviceId !== null ? `, device=${deviceId}` : ''}). Have: ${scopes
             .map((s) => {
-            const target = s.type === 'device' ? `[${s.targets.join(',')}]` : s.target;
+            const target = s.type === 'device' ? `[${describeSelector(s)}]` : s.target;
             return `${s.type}:${target}[${s.access.join(',')}]`;
         })
             .join(', ') || '(none)'}`,

package/dist/api/trpc/share-view-access.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SHARE_SCOPE_PROJECTED_METHODS = void 0;
 exports.checkShareViewAccess = checkShareViewAccess;
 exports.projectListAllForShareScope = projectListAllForShareScope;
+exports.projectListAllForDeviceIds = projectListAllForDeviceIds;
 exports.projectShareScopeRows = projectShareScopeRows;
 exports.liveEventInShareScope = liveEventInShareScope;
 /**
@@ -156,9 +157,21 @@ function checkShareViewAccess(scope, path, input) {
  * Non-array payloads pass through untouched (the route errored upstream).
  */
 function projectListAllForShareScope(data, scope) {
+    return projectListAllForDeviceIds(data, new Set(scope.deviceIds));
+}
+/**
+ * The projection ENGINE: drop every `listAll` row whose id is not in
+ * `allowed`, and project the survivors onto the whitelisted row.
+ *
+ * Shared by the `csv_*` share path ({@link projectListAllForShareScope}) and
+ * the scoped-principal path (`projectListAllForPrincipal` in
+ * `principal-visibility.ts`) so enumeration is cut ONE way. Two projectors
+ * would be two chances to forget `config` — which carries the camera
+ * credentials in plaintext.
+ */
+function projectListAllForDeviceIds(data, allowed) {
     if (!Array.isArray(data))
         return data;
-    const allowed = new Set(scope.deviceIds);
     const rows = [];
     for (const entry of data) {
         if (entry === null || typeof entry !== 'object')

package/dist/api/trpc/trpc.context.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createMeshTrpcContext = createMeshTrpcContext;
 exports.createTrpcContext = createTrpcContext;
 exports.createWsTrpcContext = createWsTrpcContext;
+const types_1 = require("@camstack/types");
 const share_token_service_js_1 = require("../../core/auth/share-token.service.js");
 const trpc_error_principal_js_1 = require("./trpc-error-principal.js");
 /** Read `req.query` if present (Fastify-only) without losing type safety. */
@@ -109,7 +110,9 @@ async function resolveUser(token, authService, addonRegistry, shareTokens = null
                 },
                 isApiKey: true,
                 isScoped: true,
-                scopes: record.scopes,
+                // Migrate any v2 `device:targets` grant to a v3 selector at the
+                // boundary so the enforcement matcher only ever sees v3.
+                scopes: (0, types_1.normalizeTokenScopes)(record.scopes),
             };
         }
         catch {
@@ -144,8 +147,10 @@ async function resolveUser(token, authService, addonRegistry, shareTokens = null
             isApiKey: payload.type === 'api_key',
             agentId: payload.agentId,
             // Scopes are baked into the JWT at login; the middleware uses
-            // them to gate every call until the user re-logs.
-            ...(payload.scopes !== undefined ? { scopes: payload.scopes } : {}),
+            // them to gate every call until the user re-logs. Normalised at the
+            // boundary — a v2 `device:targets` JWT (issued before the v3 model)
+            // migrates to a selector here, so a pre-v3 token keeps working.
+            ...(payload.scopes !== undefined ? { scopes: (0, types_1.normalizeTokenScopes)(payload.scopes) } : {}),
             ...(credential.credential !== undefined ? { credential: credential.credential } : {}),
             ...(credential.sessionId !== undefined ? { oauthSessionId: credential.sessionId } : {}),
         };
@@ -166,8 +171,12 @@ async function resolveUser(token, authService, addonRegistry, shareTokens = null
  * provide silently did nothing (0/6 providers inherited). The mirror is warmed
  * off the event path and read synchronously here.
  */
-function makeAncestorLookup(addonRegistry) {
-    return (deviceId) => addonRegistry.getPersistedAncestors(deviceId);
+function makeDeviceScopeLookup(addonRegistry) {
+    return {
+        getAncestors: (deviceId) => addonRegistry.getPersistedAncestors(deviceId),
+        getType: (deviceId) => addonRegistry.getPersistedType(deviceId),
+        getLocation: (deviceId) => addonRegistry.getPersistedLocation(deviceId),
+    };
 }
 /**
  * Context factory for hub-internal calls originating from the trusted
@@ -195,7 +204,8 @@ async function createTrpcContext(req, authService, addonRegistry, shareTokens =
     return {
         user: await resolveUser(token, authService, addonRegistry, shareTokens),
         req,
-        getDeviceAncestors: makeAncestorLookup(addonRegistry),
+        deviceScopeLookup: makeDeviceScopeLookup(addonRegistry),
+        deviceFleet: () => addonRegistry.getPersistedDeviceList(),
     };
 }
 /**
@@ -211,6 +221,7 @@ async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens
     return {
         user,
         req: opts.req,
-        getDeviceAncestors: makeAncestorLookup(addonRegistry),
+        deviceScopeLookup: makeDeviceScopeLookup(addonRegistry),
+        deviceFleet: () => addonRegistry.getPersistedDeviceList(),
     };
 }

package/dist/api/trpc/trpc.middleware.js

@@ -11,6 +11,7 @@ const server_1 = require("@trpc/server");
 const superjson_1 = __importDefault(require("superjson"));
 const cap_route_error_formatter_js_1 = require("./cap-route-error-formatter.js");
 const device_config_secret_redaction_js_1 = require("./device-config-secret-redaction.js");
+const principal_visibility_js_1 = require("./principal-visibility.js");
 const scope_access_js_1 = require("./scope-access.js");
 const share_view_access_js_1 = require("./share-view-access.js");
 const t = server_1.initTRPC.context().create({
@@ -150,7 +151,7 @@ exports.protectedProcedure = t.procedure.use(async ({ ctx, next, path, getRawInp
         // The `getDeviceAncestors` hook lets the matcher walk parent → child
         // accessory inheritance (grant on Reolink also covers its siren / PIR).
         const rawInput = await getRawInput();
-        const result = (0, scope_access_js_1.checkScopeAccess)(ctx.user.scopes ?? [], path, rawInput, ctx.getDeviceAncestors);
+        const result = (0, scope_access_js_1.checkScopeAccess)(ctx.user.scopes ?? [], path, rawInput, ctx.deviceScopeLookup);
         if (!result.ok) {
             throw new server_1.TRPCError({ code: 'FORBIDDEN', message: result.reason });
         }
@@ -164,7 +165,20 @@ exports.protectedProcedure = t.procedure.use(async ({ ctx, next, path, getRawInp
     // orchestrator, the drivers that must actually connect) are unaffected.
     const redactConfigSecrets = device_config_secret_redaction_js_1.NON_ADMIN_CONFIG_REDACTED_METHODS.get(path);
     const out = await next({ ctx: { ...ctx, user: ctx.user } });
-    if (redactConfigSecrets && out.ok) {
+    if (!out.ok)
+        return out;
+    // A device-scoped principal ENUMERATES only its own devices (F1 #4). The
+    // matcher lets a `device`-selector grant reach `deviceManager.listAll`
+    // precisely because the answer is cut here; without this the grant would
+    // hand back the whole fleet — names, locations, online state.
+    if (scope_access_js_1.DEVICE_ENUMERATION_METHODS.has(path)) {
+        const projected = (0, principal_visibility_js_1.projectListAllForPrincipal)(out.data, ctx.user.isAdmin, ctx.user.scopes ?? [], ctx.deviceFleet?.() ?? []);
+        return {
+            ...out,
+            data: redactConfigSecrets ? redactConfigSecrets(projected) : projected,
+        };
+    }
+    if (redactConfigSecrets) {
         return { ...out, data: redactConfigSecrets(out.data) };
     }
     return out;

package/dist/core/addon/addon-registry.service.js

@@ -1077,6 +1077,14 @@ class AddonRegistryService {
     // readable mirror of that parentage, refreshed OFF the request path on every
     // device-meta lifecycle event — never a per-call DB query.
     deviceParentMirror = new Map();
+    /**
+     * Hub-process mirror of each device's persisted `type` + `location`, warmed
+     * from the same `listAll({projection:'slim'})` sweep as the parent mirror.
+     * Backs the v3 scope-model `types` / `locations` selectors: the enforcement
+     * matcher resolves a selector against a device's type/location synchronously,
+     * off the request path (D49). Empty for a device the hub has never heard of.
+     */
+    deviceMetaMirror = new Map();
     /** Parent of a device: the persisted mirror first (covers forked devices),
      *  falling back to the live hub registry (covers a hub-local device before the
      *  first mirror warm). null when top-level or unknown. */
@@ -1086,6 +1094,38 @@ class AddonRegistryService {
             return mirrored;
         return this.deviceRegistry.getById(deviceId)?.parentDeviceId ?? null;
     }
+    /** Persisted `DeviceType` string of a device, or null when unknown. Mirror
+     *  first (covers forked devices), then the live hub registry. */
+    getPersistedType = (deviceId) => {
+        const mirrored = this.deviceMetaMirror.get(deviceId);
+        if (mirrored !== undefined)
+            return mirrored.type;
+        return this.deviceRegistry.getById(deviceId)?.type ?? null;
+    };
+    /** Persisted operator `location` label of a device, or null when unset/unknown. */
+    getPersistedLocation = (deviceId) => {
+        const mirrored = this.deviceMetaMirror.get(deviceId);
+        if (mirrored !== undefined)
+            return mirrored.location;
+        return this.deviceRegistry.getById(deviceId)?.location ?? null;
+    };
+    /**
+     * The whole persisted fleet, slim — id + type + location + parentDeviceId.
+     * Fuels the FLEET-wide selector expansion (response projection + `auth.me`
+     * counts). Read synchronously off the mirror, never a per-call DB query.
+     */
+    getPersistedDeviceList = () => {
+        const out = [];
+        for (const [id, m] of this.deviceMetaMirror) {
+            out.push({
+                id,
+                type: m.type,
+                location: m.location,
+                parentDeviceId: this.deviceParentMirror.get(id) ?? null,
+            });
+        }
+        return out;
+    };
     /**
      * Ancestor chain (parent, grandparent, …) of a device, bounded to 8 hops
      * (defence-in-depth against a corrupt registry cycle). Synchronous — it is
@@ -1131,18 +1171,30 @@ class AddonRegistryService {
             const rows = await api.deviceManager.listAll.query({ projection: 'slim' });
             if (!Array.isArray(rows))
                 return;
-            const next = new Map();
+            const nextParents = new Map();
+            const nextMeta = new Map();
             for (const row of rows) {
                 if (row === null || typeof row !== 'object')
                     continue;
                 const id = Reflect.get(row, 'id');
+                if (typeof id !== 'number')
+                    continue;
                 const parent = Reflect.get(row, 'parentDeviceId');
-                if (typeof id === 'number' && typeof parent === 'number')
-                    next.set(id, parent);
+                if (typeof parent === 'number')
+                    nextParents.set(id, parent);
+                const type = Reflect.get(row, 'type');
+                const location = Reflect.get(row, 'location');
+                nextMeta.set(id, {
+                    type: typeof type === 'string' ? type : '',
+                    location: typeof location === 'string' ? location : null,
+                });
             }
             this.deviceParentMirror.clear();
-            for (const [k, v] of next)
+            for (const [k, v] of nextParents)
                 this.deviceParentMirror.set(k, v);
+            this.deviceMetaMirror.clear();
+            for (const [k, v] of nextMeta)
+                this.deviceMetaMirror.set(k, v);
         }
         catch (err) {
             this.logger.debug('device-parent mirror refresh failed — keeping previous', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.105",
+  "version": "1.2.107",
   "private": false,
   "files": [
     "dist",
@@ -33,19 +33,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.54",
+    "@camstack/addon-admin-ui": "1.2.56",
     "@camstack/addon-agent-ui": "1.2.17",
     "@camstack/addon-auth": "1.2.18",
     "@camstack/addon-decoder-nodeav": "1.2.16",
     "@camstack/addon-notifiers": "1.2.21",
     "@camstack/addon-pipeline": "1.2.74",
-    "@camstack/addon-pipeline-orchestrator": "1.2.53",
-    "@camstack/addon-post-analysis": "1.2.71",
+    "@camstack/addon-pipeline-orchestrator": "1.2.54",
+    "@camstack/addon-post-analysis": "1.2.72",
     "@camstack/sdk": "1.2.18",
     "@camstack/shm-ring": "1.1.16",
     "@camstack/system": "1.2.88",
-    "@camstack/types": "1.2.68",
-    "@camstack/ui-library": "1.2.46",
+    "@camstack/types": "1.2.69",
+    "@camstack/ui-library": "1.2.48",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",