@camstack/server 1.2.131 → 1.2.132

package/dist/core/app-links/well-known-app-links.js

@@ -0,0 +1,66 @@
+"use strict";
+/**
+ * well-known-app-links — the two files a Universal/App Link needs the DOMAIN
+ * to vouch for.
+ *
+ * The viewer app already declares `applinks:<domain>` (iOS) and an
+ * `autoVerify` intent filter (Android) — what was missing is the other half
+ * of the handshake: the domain serving `/.well-known/apple-app-site-association`
+ * and `/.well-known/assetlinks.json`. Modelled on the Zentik notifier, which
+ * runs this exact pair in production.
+ *
+ * The AASA scopes the app to the viewer mount only (`/viewer/camstack/*`):
+ * the hub root also serves the admin UI and data planes, and a tap on those
+ * must stay in the browser.
+ *
+ * Android's verification additionally needs the signing-cert SHA-256
+ * fingerprints, which live in the EAS keystore and cannot be derived here —
+ * they arrive via `CAMSTACK_ANDROID_CERT_SHA256` (comma-separated). Empty is
+ * ACCEPTED and produces a valid file that fails auto-verification (the OS
+ * shows a disambiguation dialog): same trade-off the Zentik file ships with.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAppLinkFiles = buildAppLinkFiles;
+exports.parseCertFingerprints = parseCertFingerprints;
+/** Apple team + bundle ids, mirrored from the viewer's app.config.ts. */
+const APPLE_TEAM_ID = 'C3F24V5NS5';
+const BUNDLE_ID = 'com.apocaliss92.camstack';
+const BUNDLE_ID_DEV = 'com.apocaliss92.camstack.dev';
+/** The only path family the app claims on this domain. */
+const VIEWER_COMPONENT = '/viewer/camstack/*';
+function buildAppLinkFiles(androidCertSha256) {
+    const appIds = [`${APPLE_TEAM_ID}.${BUNDLE_ID}`, `${APPLE_TEAM_ID}.${BUNDLE_ID_DEV}`];
+    return {
+        appleAppSiteAssociation: {
+            applinks: {
+                apps: [],
+                details: [
+                    {
+                        appIDs: appIds,
+                        components: [{ '/': VIEWER_COMPONENT, comment: 'Viewer deep links' }],
+                    },
+                    // Legacy `paths` block for pre-iOS-13 parsers, as Zentik ships.
+                    { appID: appIds[0], paths: [VIEWER_COMPONENT] },
+                ],
+            },
+            webcredentials: { apps: appIds },
+        },
+        assetLinks: [BUNDLE_ID, BUNDLE_ID_DEV].map((pkg) => ({
+            relation: ['delegate_permission/common.handle_all_urls'],
+            target: {
+                namespace: 'android_app',
+                package_name: pkg,
+                sha256_cert_fingerprints: [...androidCertSha256],
+            },
+        })),
+    };
+}
+/** Parse the comma-separated env form; junk and empties dropped. */
+function parseCertFingerprints(raw) {
+    if (raw === undefined)
+        return [];
+    return raw
+        .split(',')
+        .map((s) => s.trim().toUpperCase())
+        .filter((s) => /^[0-9A-F]{2}(:[0-9A-F]{2}){31}$/.test(s));
+}

package/dist/main.js

@@ -75,6 +75,7 @@ const boot_config_1 = require("./boot/boot-config");
 const integration_id_backfill_1 = require("./boot/integration-id-backfill");
 const post_boot_service_1 = require("./boot/post-boot.service");
 const addon_package_service_1 = require("./core/addon/addon-package.service");
+const well_known_app_links_1 = require("./core/app-links/well-known-app-links");
 const addon_registry_service_1 = require("./core/addon/addon-registry.service");
 const addon_bridge_service_1 = require("./core/addon-bridge/addon-bridge.service");
 const addon_pages_service_1 = require("./core/addon-pages/addon-pages.service");
@@ -1127,6 +1128,18 @@ async function bootstrap() {
     // Register UI routes before Fastify starts, but resolve their forked
     // providers after listen. During a cold boot the control plane is therefore
     // immediately reachable while the non-critical UI runners finish starting.
+    // Universal/App Link handshake: the domain's half of the pair the viewer
+    // app already declares (applinks entitlement + autoVerify intent filter).
+    // Unauthenticated by design — Apple's CDN and Android's verifier fetch these
+    // with no cookies; content-type must be application/json and no redirect.
+    {
+        const { appleAppSiteAssociation, assetLinks } = (0, well_known_app_links_1.buildAppLinkFiles)((0, well_known_app_links_1.parseCertFingerprints)(process.env['CAMSTACK_ANDROID_CERT_SHA256']));
+        const aasa = JSON.stringify(appleAppSiteAssociation);
+        const assetlinks = JSON.stringify(assetLinks);
+        fastify.get('/.well-known/apple-app-site-association', async (_request, reply) => reply.type('application/json').send(aasa));
+        fastify.get('/apple-app-site-association', async (_request, reply) => reply.type('application/json').send(aasa));
+        fastify.get('/.well-known/assetlinks.json', async (_request, reply) => reply.type('application/json').send(assetlinks));
+    }
     fastify.get('/viewer', async (_request, reply) => reply.redirect(`${VIEWER_MOUNT}/`));
     fastify.get('/viewer/', async (_request, reply) => reply.redirect(`${VIEWER_MOUNT}/`));
     fastify.get('/webrtc-test.html', async (_request, reply) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.131",
+  "version": "1.2.132",
   "private": false,
   "files": [
     "dist",
@@ -33,14 +33,14 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.79",
+    "@camstack/addon-admin-ui": "1.2.80",
     "@camstack/addon-agent-ui": "1.2.22",
     "@camstack/addon-auth": "1.2.24",
     "@camstack/addon-decoder-nodeav": "1.2.21",
     "@camstack/addon-notifiers": "1.2.26",
     "@camstack/addon-pipeline": "1.2.96",
-    "@camstack/addon-pipeline-orchestrator": "1.2.79",
-    "@camstack/addon-post-analysis": "1.2.94",
+    "@camstack/addon-pipeline-orchestrator": "1.2.80",
+    "@camstack/addon-post-analysis": "1.2.95",
     "@camstack/sdk": "1.2.24",
     "@camstack/shm-ring": "1.1.21",
     "@camstack/system": "1.2.105",