@camstack/server 1.2.119 → 1.2.120

package/dist/api/trpc/principal-visibility.js

@@ -5,7 +5,6 @@ exports.isBroadEventViewer = isBroadEventViewer;
 exports.filterViewableDeviceIds = filterViewableDeviceIds;
 exports.hasUnrestrictedDeviceView = hasUnrestrictedDeviceView;
 exports.projectListAllForPrincipal = projectListAllForPrincipal;
-exports.projectBatchForPrincipal = projectBatchForPrincipal;
 exports.scopedEventVisibility = scopedEventVisibility;
 /**
  * Non-admin principal device visibility — the shared answer to "which cameras
@@ -133,39 +132,6 @@ function projectListAllForPrincipal(data, isAdmin, scopes, fleet) {
     const viewable = (0, types_1.resolveViewableDeviceIds)(scopes, fleet, 'view');
     return (0, share_view_access_js_1.projectListAllForDeviceIds)(data, viewable);
 }
-/**
- * Cut a DEVICE_BATCH_METHODS response to the devices the caller may view.
- *
- * Those methods answer "for THESE devices" where the request named the set
- * in an array (`deviceIds`, `targets[].deviceId`) — a shape the per-device
- * matcher cannot gate, so the answer is filtered here instead. Every one of
- * their rows carries a `deviceId` (snapshot overview/links rows, batched
- * event-kind rows) or nests the rows one level down (`listRecentTracks` →
- * `{ tracks, nextCursor }`, tracks carry `deviceId`). A row without a
- * readable `deviceId` is DROPPED — fail closed, same as the event filter.
- *
- * A caller with unrestricted device reach gets the payload untouched.
- */
-function projectBatchForPrincipal(data, isAdmin, scopes, fleet) {
-    if (hasUnrestrictedDeviceView(isAdmin, scopes))
-        return data;
-    const viewable = (0, types_1.resolveViewableDeviceIds)(scopes, fleet, 'view');
-    const rowVisible = (row) => {
-        if (row === null || typeof row !== 'object')
-            return false;
-        const id = row['deviceId'];
-        return typeof id === 'number' && viewable.has(id);
-    };
-    if (Array.isArray(data))
-        return data.filter(rowVisible);
-    if (data !== null && typeof data === 'object') {
-        const tracks = data['tracks'];
-        if (Array.isArray(tracks)) {
-            return { ...data, tracks: tracks.filter(rowVisible) };
-        }
-    }
-    return data;
-}
 /**
  * Build the event-stream predicate for a NON-share principal (F0.5).
  *

package/dist/api/trpc/scope-access.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEVICE_BATCH_METHODS = exports.DEVICE_ENUMERATION_METHODS = void 0;
+exports.DEVICE_ENUMERATION_METHODS = void 0;
 exports.checkScopeAccess = checkScopeAccess;
 /**
  * Pure scope-access matcher.
@@ -102,31 +102,6 @@ function describeSelector(scope) {
  * `scoped-list-projection.spec.ts`.
  */
 exports.DEVICE_ENUMERATION_METHODS = new Set(['deviceManager.listAll']);
-/**
- * Device-scope methods that name their devices in BATCHES — an array of
- * deviceIds, or a positional targets array — instead of the single
- * top-level `deviceId` the `DeviceProxy` contract gives every other
- * device-scope method. `extractDeviceId` finds nothing in their input, so
- * without this set a device-granted caller could never reach them at all
- * (live regression, 2026-08-15: a non-admin viewer with `device:[all]`
- * received no snapshots and no events — `snapshot.getSnapshotLinks`,
- * `snapshot.getSnapshotOverview`, `listRecentTracks` and
- * `listEventKindsBatch` all failed closed).
- *
- * Same safety contract as {@link DEVICE_ENUMERATION_METHODS}, enforced by
- * the same middleware block: the RESPONSE is cut to the caller's viewable
- * set (`projectBatchForPrincipal`) before it leaves the server, so a
- * one-camera token can ask about the whole fleet and still only receive its
- * own rows. Adding a path here WITHOUT a projector in
- * `projectBatchForPrincipal` hands out the unfiltered answer — the pairing
- * is asserted by `scoped-list-projection.spec.ts`.
- */
-exports.DEVICE_BATCH_METHODS = new Set([
-    'snapshot.getSnapshotOverview',
-    'snapshot.getSnapshotLinks',
-    'pipelineAnalytics.listRecentTracks',
-    'pipelineAnalytics.listEventKindsBatch',
-]);
 /**
  * Every deviceId a request NAMES, per the codegen'd
  * {@link METHOD_DEVICE_SELECTORS}. Absent / null / malformed values are
@@ -150,6 +125,15 @@ function referencedDeviceIds(path, input) {
         if (!Array.isArray(raw))
             continue;
         for (const item of raw) {
+            if (field.form === 'object-array') {
+                // `targets[].deviceId` & co. — one nesting level, by design.
+                if (item !== null && typeof item === 'object') {
+                    const nested = Reflect.get(item, field.itemField ?? 'deviceId');
+                    if (typeof nested === 'number' && Number.isFinite(nested))
+                        out.push(nested);
+                }
+                continue;
+            }
             if (typeof item === 'number' && Number.isFinite(item))
                 out.push(item);
         }
@@ -206,7 +190,6 @@ function checkScopeAccess(scopes, path, input, lookup) {
         return { ok: false, reason: `Unknown method '${path}' — codegen drift` };
     }
     const deviceId = meta.capScope === 'device' ? extractDeviceId(input) : null;
-    const candidates = deviceId !== null ? candidateMetas(deviceId, lookup) : [];
     for (const s of scopes) {
         let targetMatches = false;
         switch (s.type) {
@@ -219,20 +202,28 @@ function checkScopeAccess(scopes, path, input, lookup) {
             case 'addon':
                 targetMatches = meta.addonId !== null && s.target === meta.addonId;
                 break;
-            case 'device':
+            case 'device': {
                 // A device grant matches either:
-                //  • a request naming a device, when the v3 selector covers it (or an
-                //    ancestor — accessory inheritance, gated by `includeLinked`); or
+                //  • a request NAMING devices — in ANY shape the selector codegen
+                //    recorded (top-level `deviceId`, `deviceIds[]`, or one-level
+                //    nested `targets[].deviceId`) — when the v3 selector covers
+                //    EVERY referenced device (or an ancestor, when the grant
+                //    inherits). A single uncovered reference fails the call closed:
+                //    the viewer's batches are built from its already-projected
+                //    camera list, so a legit client never trips this, and a
+                //    one-camera token cannot launder the fleet through an array.
                 //  • a DEVICE ENUMERATION method, which names no device precisely
                 //    because it asks "which are mine". Those are safe to reach ONLY
                 //    because the RESPONSE is cut to the caller's set (see
                 //    `DEVICE_ENUMERATION_METHODS`); without that projection this
                 //    branch would hand the whole fleet to a one-camera token.
+                const refs = meta.capScope === 'device' ? referencedDeviceIds(path, input) : [];
                 targetMatches =
-                    deviceId !== null
-                        ? deviceScopeCovers(s, meta.access, candidates)
-                        : exports.DEVICE_ENUMERATION_METHODS.has(path) || exports.DEVICE_BATCH_METHODS.has(path);
+                    refs.length > 0
+                        ? refs.every((id) => deviceScopeCovers(s, meta.access, candidateMetas(id, lookup)))
+                        : exports.DEVICE_ENUMERATION_METHODS.has(path);
                 break;
+            }
         }
         if (!targetMatches)
             continue;

package/dist/api/trpc/trpc.middleware.js

@@ -178,17 +178,11 @@ exports.protectedProcedure = t.procedure.use(async ({ ctx, next, path, getRawInp
             data: redactConfigSecrets ? redactConfigSecrets(projected) : projected,
         };
     }
-    // Batch device methods (`deviceIds[]` / `targets[]` inputs — the snapshot
-    // overview/links and the merged events feed) are reachable on a device
-    // grant precisely because their answer is cut to the caller's viewable
-    // set here. Reachability without this projection would be the leak.
-    if (scope_access_js_1.DEVICE_BATCH_METHODS.has(path)) {
-        const projected = (0, principal_visibility_js_1.projectBatchForPrincipal)(out.data, ctx.user.isAdmin, ctx.user.scopes ?? [], ctx.deviceFleet?.() ?? []);
-        return {
-            ...out,
-            data: redactConfigSecrets ? redactConfigSecrets(projected) : projected,
-        };
-    }
+    // Batch device methods (`deviceIds[]` / `targets[].deviceId` inputs — the
+    // snapshot overview/links and the merged events feed) need no response
+    // projection: the matcher already required EVERY device the request names
+    // to be covered (see `referencedDeviceIds`), so the answer can only
+    // contain rows the caller is entitled to.
     if (redactConfigSecrets) {
         return { ...out, data: redactConfigSecrets(out.data) };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.119",
+  "version": "1.2.120",
   "private": false,
   "files": [
     "dist",
@@ -44,7 +44,7 @@
     "@camstack/sdk": "1.2.19",
     "@camstack/shm-ring": "1.1.16",
     "@camstack/system": "1.2.96",
-    "@camstack/types": "1.2.78",
+    "@camstack/types": "1.2.79",
     "@camstack/ui-library": "1.2.54",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",