@camstack/server 1.2.133 → 1.2.134

package/dist/api/trpc/trpc.context.js

@@ -178,6 +178,10 @@ async function resolveUser(token, authService, addonRegistry, shareTokens = null
         // and until this was carried onto the principal a refusal of one was
         // indistinguishable in the logs from a refusal of a browser session.
         const credential = (0, trpc_error_principal_js_1.readCredentialIdentity)(payload);
+        // What the token IS decides WHERE its scopes come from. A `session` JWT is
+        // governed by its user's record; anything else carries its own grant and
+        // must keep it — see the live-scope note on the spread below.
+        const principal = (0, types_1.classifyBearerPrincipal)(payload);
         return {
             id: payload.userId ?? payload.keyId ?? 'unknown',
             username: payload.username ?? 'unknown',
@@ -198,12 +202,21 @@ async function resolveUser(token, authService, addonRegistry, shareTokens = null
             // user's scopes expects the change to APPLY, and the live session
             // kept gating on the old set until re-login (2026-08-15: a user
             // granted the whole fleet kept seeing zero cameras). For non-admin
-            // JWT principals the store's current scopes win when readable
+            // SESSION principals the store's current scopes win when readable
             // (memoized — see above); the JWT's copy is the fallback when the
             // user-management cap is unreachable, so a store hiccup never
             // locks anybody out mid-request.
+            //
+            // `session` ONLY, and that word is the whole fix. An ACCOUNT-LINK token
+            // is governed by the grant the operator consented to, not by the linking
+            // user's record: it always carries `isAdmin: false` (`oauth-grants.ts`
+            // → `baseClaims`) and its owner is normally an admin, whose record is
+            // deliberately unscoped — so the refresh replaced a six-scope Home
+            // Assistant grant with `[]` and the hub refused the component's first
+            // call with `Have: (none)` (2026-08-19). The user store knows nothing
+            // about a link and must not get a vote on one.
             ...(payload.scopes !== undefined ? { scopes: (0, types_1.normalizeTokenScopes)(payload.scopes) } : {}),
-            ...(!payload.isAdmin
+            ...(!payload.isAdmin && principal.kind === 'session'
                 ? await (async () => {
                     const fresh = await refreshScopesFromStore(payload.userId ?? payload.keyId ?? 'unknown', addonRegistry);
                     return fresh !== null ? { scopes: fresh } : {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.133",
+  "version": "1.2.134",
   "private": false,
   "files": [
     "dist",
@@ -33,19 +33,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.81",
-    "@camstack/addon-agent-ui": "1.2.23",
-    "@camstack/addon-auth": "1.2.25",
+    "@camstack/addon-admin-ui": "1.2.83",
+    "@camstack/addon-agent-ui": "1.2.24",
+    "@camstack/addon-auth": "1.2.26",
     "@camstack/addon-decoder-nodeav": "1.2.22",
     "@camstack/addon-notifiers": "1.2.27",
-    "@camstack/addon-pipeline": "1.2.97",
-    "@camstack/addon-pipeline-orchestrator": "1.2.81",
-    "@camstack/addon-post-analysis": "1.2.96",
+    "@camstack/addon-pipeline": "1.2.98",
+    "@camstack/addon-pipeline-orchestrator": "1.2.83",
+    "@camstack/addon-post-analysis": "1.2.98",
     "@camstack/sdk": "1.2.25",
     "@camstack/shm-ring": "1.1.22",
     "@camstack/system": "1.2.106",
-    "@camstack/types": "1.2.89",
-    "@camstack/ui-library": "1.2.61",
+    "@camstack/types": "1.2.90",
+    "@camstack/ui-library": "1.2.62",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",