@camstack/server 1.2.118 → 1.2.119

package/dist/api/trpc/principal-visibility.js

@@ -5,6 +5,7 @@ exports.isBroadEventViewer = isBroadEventViewer;
 exports.filterViewableDeviceIds = filterViewableDeviceIds;
 exports.hasUnrestrictedDeviceView = hasUnrestrictedDeviceView;
 exports.projectListAllForPrincipal = projectListAllForPrincipal;
+exports.projectBatchForPrincipal = projectBatchForPrincipal;
 exports.scopedEventVisibility = scopedEventVisibility;
 /**
  * Non-admin principal device visibility — the shared answer to "which cameras
@@ -132,6 +133,39 @@ function projectListAllForPrincipal(data, isAdmin, scopes, fleet) {
     const viewable = (0, types_1.resolveViewableDeviceIds)(scopes, fleet, 'view');
     return (0, share_view_access_js_1.projectListAllForDeviceIds)(data, viewable);
 }
+/**
+ * Cut a DEVICE_BATCH_METHODS response to the devices the caller may view.
+ *
+ * Those methods answer "for THESE devices" where the request named the set
+ * in an array (`deviceIds`, `targets[].deviceId`) — a shape the per-device
+ * matcher cannot gate, so the answer is filtered here instead. Every one of
+ * their rows carries a `deviceId` (snapshot overview/links rows, batched
+ * event-kind rows) or nests the rows one level down (`listRecentTracks` →
+ * `{ tracks, nextCursor }`, tracks carry `deviceId`). A row without a
+ * readable `deviceId` is DROPPED — fail closed, same as the event filter.
+ *
+ * A caller with unrestricted device reach gets the payload untouched.
+ */
+function projectBatchForPrincipal(data, isAdmin, scopes, fleet) {
+    if (hasUnrestrictedDeviceView(isAdmin, scopes))
+        return data;
+    const viewable = (0, types_1.resolveViewableDeviceIds)(scopes, fleet, 'view');
+    const rowVisible = (row) => {
+        if (row === null || typeof row !== 'object')
+            return false;
+        const id = row['deviceId'];
+        return typeof id === 'number' && viewable.has(id);
+    };
+    if (Array.isArray(data))
+        return data.filter(rowVisible);
+    if (data !== null && typeof data === 'object') {
+        const tracks = data['tracks'];
+        if (Array.isArray(tracks)) {
+            return { ...data, tracks: tracks.filter(rowVisible) };
+        }
+    }
+    return data;
+}
 /**
  * Build the event-stream predicate for a NON-share principal (F0.5).
  *

package/dist/api/trpc/scope-access.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEVICE_ENUMERATION_METHODS = void 0;
+exports.DEVICE_BATCH_METHODS = exports.DEVICE_ENUMERATION_METHODS = void 0;
 exports.checkScopeAccess = checkScopeAccess;
 /**
  * Pure scope-access matcher.
@@ -102,6 +102,31 @@ function describeSelector(scope) {
  * `scoped-list-projection.spec.ts`.
  */
 exports.DEVICE_ENUMERATION_METHODS = new Set(['deviceManager.listAll']);
+/**
+ * Device-scope methods that name their devices in BATCHES — an array of
+ * deviceIds, or a positional targets array — instead of the single
+ * top-level `deviceId` the `DeviceProxy` contract gives every other
+ * device-scope method. `extractDeviceId` finds nothing in their input, so
+ * without this set a device-granted caller could never reach them at all
+ * (live regression, 2026-08-15: a non-admin viewer with `device:[all]`
+ * received no snapshots and no events — `snapshot.getSnapshotLinks`,
+ * `snapshot.getSnapshotOverview`, `listRecentTracks` and
+ * `listEventKindsBatch` all failed closed).
+ *
+ * Same safety contract as {@link DEVICE_ENUMERATION_METHODS}, enforced by
+ * the same middleware block: the RESPONSE is cut to the caller's viewable
+ * set (`projectBatchForPrincipal`) before it leaves the server, so a
+ * one-camera token can ask about the whole fleet and still only receive its
+ * own rows. Adding a path here WITHOUT a projector in
+ * `projectBatchForPrincipal` hands out the unfiltered answer — the pairing
+ * is asserted by `scoped-list-projection.spec.ts`.
+ */
+exports.DEVICE_BATCH_METHODS = new Set([
+    'snapshot.getSnapshotOverview',
+    'snapshot.getSnapshotLinks',
+    'pipelineAnalytics.listRecentTracks',
+    'pipelineAnalytics.listEventKindsBatch',
+]);
 /**
  * Every deviceId a request NAMES, per the codegen'd
  * {@link METHOD_DEVICE_SELECTORS}. Absent / null / malformed values are
@@ -206,7 +231,7 @@ function checkScopeAccess(scopes, path, input, lookup) {
                 targetMatches =
                     deviceId !== null
                         ? deviceScopeCovers(s, meta.access, candidates)
-                        : exports.DEVICE_ENUMERATION_METHODS.has(path);
+                        : exports.DEVICE_ENUMERATION_METHODS.has(path) || exports.DEVICE_BATCH_METHODS.has(path);
                 break;
         }
         if (!targetMatches)

package/dist/api/trpc/trpc.context.js

@@ -6,6 +6,49 @@ exports.createWsTrpcContext = createWsTrpcContext;
 const types_1 = require("@camstack/types");
 const share_token_service_js_1 = require("../../core/auth/share-token.service.js");
 const trpc_error_principal_js_1 = require("./trpc-error-principal.js");
+/**
+ * Live-scope refresh memo (see the JWT branch of `resolveUser`).
+ *
+ * The JWT embeds scopes at login, so an admin's scope edit used to reach a
+ * live session only at the next login — a user granted cameras while logged
+ * in saw NONE until they signed out and back in (2026-08-15, user report).
+ * The store is therefore re-read per user, but memoized: a scope change
+ * propagates within {@link SCOPE_REFRESH_TTL_MS} and a busy session costs at
+ * most one store read per TTL window, not one per request.
+ */
+const SCOPE_REFRESH_TTL_MS = 30_000;
+const SCOPE_REFRESH_MISS_TTL_MS = 5_000;
+const liveScopeMemo = new Map();
+async function refreshScopesFromStore(userId, addonRegistry) {
+    const cached = liveScopeMemo.get(userId);
+    const now = Date.now();
+    if (cached &&
+        now - cached.at < (cached.scopes === null ? SCOPE_REFRESH_MISS_TTL_MS : SCOPE_REFRESH_TTL_MS)) {
+        return cached.scopes;
+    }
+    let scopes = null;
+    try {
+        const userMgmt = addonRegistry.getCapabilityRegistry().getSingleton('user-management');
+        const fresh = typeof userMgmt?.listUsers === 'function'
+            ? (await userMgmt.listUsers()).find((u) => u.id === userId)
+            : null;
+        if (fresh)
+            scopes = (0, types_1.normalizeTokenScopes)(fresh.scopes ?? []);
+    }
+    catch {
+        scopes = null;
+    }
+    liveScopeMemo.set(userId, { at: now, scopes });
+    // Bound the map: sessions come and go, entries are tiny, and a missed
+    // sweep would grow it by one row per distinct user per TTL window.
+    if (liveScopeMemo.size > 512) {
+        for (const [key, entry] of liveScopeMemo) {
+            if (now - entry.at > SCOPE_REFRESH_TTL_MS * 4)
+                liveScopeMemo.delete(key);
+        }
+    }
+    return scopes;
+}
 /** Read `req.query` if present (Fastify-only) without losing type safety. */
 function readQuery(req) {
     if (!('query' in req))
@@ -150,7 +193,22 @@ async function resolveUser(token, authService, addonRegistry, shareTokens = null
             // them to gate every call until the user re-logs. Normalised at the
             // boundary — a v2 `device:targets` JWT (issued before the v3 model)
             // migrates to a selector here, so a pre-v3 token keeps working.
+            //
+            // …but a login-time snapshot is exactly the bug: an admin editing a
+            // user's scopes expects the change to APPLY, and the live session
+            // kept gating on the old set until re-login (2026-08-15: a user
+            // granted the whole fleet kept seeing zero cameras). For non-admin
+            // JWT principals the store's current scopes win when readable
+            // (memoized — see above); the JWT's copy is the fallback when the
+            // user-management cap is unreachable, so a store hiccup never
+            // locks anybody out mid-request.
             ...(payload.scopes !== undefined ? { scopes: (0, types_1.normalizeTokenScopes)(payload.scopes) } : {}),
+            ...(!payload.isAdmin
+                ? await (async () => {
+                    const fresh = await refreshScopesFromStore(payload.userId ?? payload.keyId ?? 'unknown', addonRegistry);
+                    return fresh !== null ? { scopes: fresh } : {};
+                })()
+                : {}),
             ...(credential.credential !== undefined ? { credential: credential.credential } : {}),
             ...(credential.sessionId !== undefined ? { oauthSessionId: credential.sessionId } : {}),
         };

package/dist/api/trpc/trpc.middleware.js

@@ -178,6 +178,17 @@ exports.protectedProcedure = t.procedure.use(async ({ ctx, next, path, getRawInp
             data: redactConfigSecrets ? redactConfigSecrets(projected) : projected,
         };
     }
+    // Batch device methods (`deviceIds[]` / `targets[]` inputs — the snapshot
+    // overview/links and the merged events feed) are reachable on a device
+    // grant precisely because their answer is cut to the caller's viewable
+    // set here. Reachability without this projection would be the leak.
+    if (scope_access_js_1.DEVICE_BATCH_METHODS.has(path)) {
+        const projected = (0, principal_visibility_js_1.projectBatchForPrincipal)(out.data, ctx.user.isAdmin, ctx.user.scopes ?? [], ctx.deviceFleet?.() ?? []);
+        return {
+            ...out,
+            data: redactConfigSecrets ? redactConfigSecrets(projected) : projected,
+        };
+    }
     if (redactConfigSecrets) {
         return { ...out, data: redactConfigSecrets(out.data) };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.118",
+  "version": "1.2.119",
   "private": false,
   "files": [
     "dist",