@camstack/server 1.2.129 → 1.2.130

package/dist/api/core/addon-settings.router.js

@@ -28,11 +28,24 @@ exports.createAddonSettingsRouter = createAddonSettingsRouter;
  * the whole per-key set, so a write here deletes every other row of that addon
  * in this table.
  *
- * Exposes four protected procedures consumed by:
- *   1. Forked addons (via the tRPC WSS client in `WorkerBootstrapService`)
- *      to read/write their 3-level settings chain from the worker process.
- *   2. Future UI flows that want to inspect/mutate addon settings through
- *      a single well-typed endpoint.
+ * ## ⚠️ ADMIN-ONLY — every method here is `adminProcedure`
+ *
+ * Reads (`getGlobal` / `getDeviceOverrides`) return RAW, un-redacted addon
+ * config — the same blob that holds notifier tokens, webhook secrets and API
+ * keys; writes (`updateGlobal` / `updateDevice` / `replaceGlobal`) overwrite it
+ * with no schema gate. Before 2026-08-13 these were `protectedProcedure`, so
+ * any authenticated non-admin token could read and rewrite every addon's
+ * config. The `:139` comment claimed "only workers with valid hub tokens can
+ * call this" but nothing enforced it.
+ *
+ * Gating with `adminProcedure` costs the legitimate callers NOTHING: this
+ * router is in `CORE_NAMESPACES` (`core-cap-bridge.ts`), so a forked addon's
+ * `ctx.api.addonSettingsRaw.*` arrives over the trusted core-cap/UDS mesh whose
+ * context is `createMeshTrpcContext` (`isAdmin: true`), and the admin UI is an
+ * admin session. The two consumers:
+ *   1. Forked addons (via `ctx.api` over the mesh) reading/writing their
+ *      3-level settings chain from the worker process.
+ *   2. Admin UI flows inspecting/mutating addon settings.
  *
  * The router is deliberately thin — it does NOT perform schema-based
  * resolver merging (defaults → global → per-device). That happens on the

package/dist/api/core/event-bus-proxy.router.js

@@ -89,6 +89,12 @@ function serializeRecentEvent(e) {
 }
 function createEventBusProxyRouter(eventBus) {
     return (0, trpc_middleware_js_1.trpcRouter)({
+        // ADMIN-ONLY. `emit` injects a fully-attributed SystemEvent onto the hub's
+        // real EventBus — including a spoofable `source` (a fake `device`/`addon`
+        // origin). Forked addons that legitimately emit reach this over the
+        // trusted core-cap/UDS mesh, whose context is `createMeshTrpcContext`
+        // (`isAdmin: true`), so gating it here withholds the surface from
+        // non-admin HTTP/WS principals without blinding a worker.
         emit: trpc_middleware_js_1.adminProcedure
             .input(SystemEventInputSchema)
             .output(zod_1.z.object({ ok: zod_1.z.literal(true) }))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.129",
+  "version": "1.2.130",
   "private": false,
   "files": [
     "dist",
@@ -33,19 +33,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.77",
-    "@camstack/addon-agent-ui": "1.2.20",
-    "@camstack/addon-auth": "1.2.22",
-    "@camstack/addon-decoder-nodeav": "1.2.19",
-    "@camstack/addon-notifiers": "1.2.24",
-    "@camstack/addon-pipeline": "1.2.94",
-    "@camstack/addon-pipeline-orchestrator": "1.2.77",
-    "@camstack/addon-post-analysis": "1.2.92",
-    "@camstack/sdk": "1.2.22",
-    "@camstack/shm-ring": "1.1.19",
-    "@camstack/system": "1.2.103",
-    "@camstack/types": "1.2.86",
-    "@camstack/ui-library": "1.2.58",
+    "@camstack/addon-admin-ui": "1.2.78",
+    "@camstack/addon-agent-ui": "1.2.21",
+    "@camstack/addon-auth": "1.2.23",
+    "@camstack/addon-decoder-nodeav": "1.2.20",
+    "@camstack/addon-notifiers": "1.2.25",
+    "@camstack/addon-pipeline": "1.2.95",
+    "@camstack/addon-pipeline-orchestrator": "1.2.78",
+    "@camstack/addon-post-analysis": "1.2.93",
+    "@camstack/sdk": "1.2.23",
+    "@camstack/shm-ring": "1.1.20",
+    "@camstack/system": "1.2.104",
+    "@camstack/types": "1.2.87",
+    "@camstack/ui-library": "1.2.59",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",