@camstack/server 1.2.118 → 1.2.120

package/dist/api/trpc/scope-access.js

@@ -125,6 +125,15 @@ function referencedDeviceIds(path, input) {
         if (!Array.isArray(raw))
             continue;
         for (const item of raw) {
+            if (field.form === 'object-array') {
+                // `targets[].deviceId` & co. — one nesting level, by design.
+                if (item !== null && typeof item === 'object') {
+                    const nested = Reflect.get(item, field.itemField ?? 'deviceId');
+                    if (typeof nested === 'number' && Number.isFinite(nested))
+                        out.push(nested);
+                }
+                continue;
+            }
             if (typeof item === 'number' && Number.isFinite(item))
                 out.push(item);
         }
@@ -181,7 +190,6 @@ function checkScopeAccess(scopes, path, input, lookup) {
         return { ok: false, reason: `Unknown method '${path}' — codegen drift` };
     }
     const deviceId = meta.capScope === 'device' ? extractDeviceId(input) : null;
-    const candidates = deviceId !== null ? candidateMetas(deviceId, lookup) : [];
     for (const s of scopes) {
         let targetMatches = false;
         switch (s.type) {
@@ -194,20 +202,28 @@ function checkScopeAccess(scopes, path, input, lookup) {
             case 'addon':
                 targetMatches = meta.addonId !== null && s.target === meta.addonId;
                 break;
-            case 'device':
+            case 'device': {
                 // A device grant matches either:
-                //  • a request naming a device, when the v3 selector covers it (or an
-                //    ancestor — accessory inheritance, gated by `includeLinked`); or
+                //  • a request NAMING devices — in ANY shape the selector codegen
+                //    recorded (top-level `deviceId`, `deviceIds[]`, or one-level
+                //    nested `targets[].deviceId`) — when the v3 selector covers
+                //    EVERY referenced device (or an ancestor, when the grant
+                //    inherits). A single uncovered reference fails the call closed:
+                //    the viewer's batches are built from its already-projected
+                //    camera list, so a legit client never trips this, and a
+                //    one-camera token cannot launder the fleet through an array.
                 //  • a DEVICE ENUMERATION method, which names no device precisely
                 //    because it asks "which are mine". Those are safe to reach ONLY
                 //    because the RESPONSE is cut to the caller's set (see
                 //    `DEVICE_ENUMERATION_METHODS`); without that projection this
                 //    branch would hand the whole fleet to a one-camera token.
+                const refs = meta.capScope === 'device' ? referencedDeviceIds(path, input) : [];
                 targetMatches =
-                    deviceId !== null
-                        ? deviceScopeCovers(s, meta.access, candidates)
+                    refs.length > 0
+                        ? refs.every((id) => deviceScopeCovers(s, meta.access, candidateMetas(id, lookup)))
                         : exports.DEVICE_ENUMERATION_METHODS.has(path);
                 break;
+            }
         }
         if (!targetMatches)
             continue;

package/dist/api/trpc/trpc.context.js

@@ -6,6 +6,49 @@ exports.createWsTrpcContext = createWsTrpcContext;
 const types_1 = require("@camstack/types");
 const share_token_service_js_1 = require("../../core/auth/share-token.service.js");
 const trpc_error_principal_js_1 = require("./trpc-error-principal.js");
+/**
+ * Live-scope refresh memo (see the JWT branch of `resolveUser`).
+ *
+ * The JWT embeds scopes at login, so an admin's scope edit used to reach a
+ * live session only at the next login — a user granted cameras while logged
+ * in saw NONE until they signed out and back in (2026-08-15, user report).
+ * The store is therefore re-read per user, but memoized: a scope change
+ * propagates within {@link SCOPE_REFRESH_TTL_MS} and a busy session costs at
+ * most one store read per TTL window, not one per request.
+ */
+const SCOPE_REFRESH_TTL_MS = 30_000;
+const SCOPE_REFRESH_MISS_TTL_MS = 5_000;
+const liveScopeMemo = new Map();
+async function refreshScopesFromStore(userId, addonRegistry) {
+    const cached = liveScopeMemo.get(userId);
+    const now = Date.now();
+    if (cached &&
+        now - cached.at < (cached.scopes === null ? SCOPE_REFRESH_MISS_TTL_MS : SCOPE_REFRESH_TTL_MS)) {
+        return cached.scopes;
+    }
+    let scopes = null;
+    try {
+        const userMgmt = addonRegistry.getCapabilityRegistry().getSingleton('user-management');
+        const fresh = typeof userMgmt?.listUsers === 'function'
+            ? (await userMgmt.listUsers()).find((u) => u.id === userId)
+            : null;
+        if (fresh)
+            scopes = (0, types_1.normalizeTokenScopes)(fresh.scopes ?? []);
+    }
+    catch {
+        scopes = null;
+    }
+    liveScopeMemo.set(userId, { at: now, scopes });
+    // Bound the map: sessions come and go, entries are tiny, and a missed
+    // sweep would grow it by one row per distinct user per TTL window.
+    if (liveScopeMemo.size > 512) {
+        for (const [key, entry] of liveScopeMemo) {
+            if (now - entry.at > SCOPE_REFRESH_TTL_MS * 4)
+                liveScopeMemo.delete(key);
+        }
+    }
+    return scopes;
+}
 /** Read `req.query` if present (Fastify-only) without losing type safety. */
 function readQuery(req) {
     if (!('query' in req))
@@ -150,7 +193,22 @@ async function resolveUser(token, authService, addonRegistry, shareTokens = null
             // them to gate every call until the user re-logs. Normalised at the
             // boundary — a v2 `device:targets` JWT (issued before the v3 model)
             // migrates to a selector here, so a pre-v3 token keeps working.
+            //
+            // …but a login-time snapshot is exactly the bug: an admin editing a
+            // user's scopes expects the change to APPLY, and the live session
+            // kept gating on the old set until re-login (2026-08-15: a user
+            // granted the whole fleet kept seeing zero cameras). For non-admin
+            // JWT principals the store's current scopes win when readable
+            // (memoized — see above); the JWT's copy is the fallback when the
+            // user-management cap is unreachable, so a store hiccup never
+            // locks anybody out mid-request.
             ...(payload.scopes !== undefined ? { scopes: (0, types_1.normalizeTokenScopes)(payload.scopes) } : {}),
+            ...(!payload.isAdmin
+                ? await (async () => {
+                    const fresh = await refreshScopesFromStore(payload.userId ?? payload.keyId ?? 'unknown', addonRegistry);
+                    return fresh !== null ? { scopes: fresh } : {};
+                })()
+                : {}),
             ...(credential.credential !== undefined ? { credential: credential.credential } : {}),
             ...(credential.sessionId !== undefined ? { oauthSessionId: credential.sessionId } : {}),
         };

package/dist/api/trpc/trpc.middleware.js

@@ -178,6 +178,11 @@ exports.protectedProcedure = t.procedure.use(async ({ ctx, next, path, getRawInp
             data: redactConfigSecrets ? redactConfigSecrets(projected) : projected,
         };
     }
+    // Batch device methods (`deviceIds[]` / `targets[].deviceId` inputs — the
+    // snapshot overview/links and the merged events feed) need no response
+    // projection: the matcher already required EVERY device the request names
+    // to be covered (see `referencedDeviceIds`), so the answer can only
+    // contain rows the caller is entitled to.
     if (redactConfigSecrets) {
         return { ...out, data: redactConfigSecrets(out.data) };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.118",
+  "version": "1.2.120",
   "private": false,
   "files": [
     "dist",
@@ -44,7 +44,7 @@
     "@camstack/sdk": "1.2.19",
     "@camstack/shm-ring": "1.1.16",
     "@camstack/system": "1.2.96",
-    "@camstack/types": "1.2.78",
+    "@camstack/types": "1.2.79",
     "@camstack/ui-library": "1.2.54",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",