@camstack/server 1.2.133 → 1.2.135

package/dist/api/trpc/trpc.context.js

@@ -93,10 +93,11 @@ function extractTokenFromRequest(req) {
  * its REST auth chain).
  *
  * Returns `null` for: missing token, malformed JWT, unknown scoped
- * token. Caller (protectedProcedure) decides the failure response
- * (typically UNAUTHORIZED).
+ * token, and a JWT that is not an ACCESS CREDENTIAL (see the classifier
+ * branch below). Caller (protectedProcedure) decides the failure
+ * response (typically UNAUTHORIZED).
  */
-async function resolveUser(token, authService, addonRegistry, shareTokens = null) {
+async function resolveUser(token, authService, addonRegistry, shareTokens = null, logger = null) {
     if (!token)
         return null;
     // Share-token path (`csv_*`): resolve through the ShareTokenService.
@@ -174,6 +175,38 @@ async function resolveUser(token, authService, addonRegistry, shareTokens = null
         if (typeof payload.isAdmin !== 'boolean') {
             return null;
         }
+        // What the token IS decides both WHETHER it authenticates at all and
+        // WHERE its scopes come from.
+        const principal = (0, types_1.classifyBearerPrincipal)(payload);
+        // ── The allowlist ────────────────────────────────────────────────
+        // Every token this hub mints verifies under the same `auth.jwtSecret`, so
+        // `verifyToken` succeeding means "we minted this", never "this is an API
+        // credential" (D103). Exactly two kinds are credentials here:
+        //
+        //   • `session` — no `kind` claim: `auth.login`'s JWT, the SSO-minted
+        //     session from `/api/auth/sso/finish`, a `type: 'service'` agent
+        //     token, a `type: 'api_key'` token.
+        //   • `integration` — `provider: 'oauth-access'`: the account-link
+        //     credential a component (Home Assistant) calls `/trpc` with.
+        //
+        // Everything else is minted for ONE hand-off step and is refused: an
+        // `oauth-code` is single-use, lives 60s and travels in a browser redirect
+        // URL (history, referrers, proxy logs); an `oauth-refresh` belongs to
+        // `POST /oauth/token`; an `oidc`/`magic-link` bridge belongs to
+        // `?bridge=` on `/api/auth/sso/finish`; a `totp-challenge` is login leg 1.
+        // `/addon/:addonId/*` has refused these since D103 — this closes the same
+        // hole on the other surface.
+        //
+        // The TOTP login is unaffected BY CONSTRUCTION: `loginVerifyTotp` takes
+        // the challenge as procedure INPUT on a public rate-limited procedure, and
+        // neither the SDK (`login()` calls `setToken` only when
+        // `!requiresSecondFactor`) nor the admin UI ever puts it in a header.
+        if (principal.kind === 'not-a-credential') {
+            logger?.warn('trpc: refused a bearer that is not an API credential', {
+                meta: { reason: principal.reason, userId: payload.userId ?? payload.keyId ?? 'unknown' },
+            });
+            return null;
+        }
         // What the token says it IS. An `oauth-access` token is an account link,
         // and until this was carried onto the principal a refusal of one was
         // indistinguishable in the logs from a refusal of a browser session.
@@ -198,12 +231,21 @@ async function resolveUser(token, authService, addonRegistry, shareTokens = null
             // user's scopes expects the change to APPLY, and the live session
             // kept gating on the old set until re-login (2026-08-15: a user
             // granted the whole fleet kept seeing zero cameras). For non-admin
-            // JWT principals the store's current scopes win when readable
+            // SESSION principals the store's current scopes win when readable
             // (memoized — see above); the JWT's copy is the fallback when the
             // user-management cap is unreachable, so a store hiccup never
             // locks anybody out mid-request.
+            //
+            // `session` ONLY, and that word is the whole fix. An ACCOUNT-LINK token
+            // is governed by the grant the operator consented to, not by the linking
+            // user's record: it always carries `isAdmin: false` (`oauth-grants.ts`
+            // → `baseClaims`) and its owner is normally an admin, whose record is
+            // deliberately unscoped — so the refresh replaced a six-scope Home
+            // Assistant grant with `[]` and the hub refused the component's first
+            // call with `Have: (none)` (2026-08-19). The user store knows nothing
+            // about a link and must not get a vote on one.
             ...(payload.scopes !== undefined ? { scopes: (0, types_1.normalizeTokenScopes)(payload.scopes) } : {}),
-            ...(!payload.isAdmin
+            ...(!payload.isAdmin && principal.kind === 'session'
                 ? await (async () => {
                     const fresh = await refreshScopesFromStore(payload.userId ?? payload.keyId ?? 'unknown', addonRegistry);
                     return fresh !== null ? { scopes: fresh } : {};
@@ -257,10 +299,10 @@ function createMeshTrpcContext() {
     return { user };
 }
 /** Context factory for HTTP tRPC requests (Fastify adapter). */
-async function createTrpcContext(req, authService, addonRegistry, shareTokens = null) {
+async function createTrpcContext(req, authService, addonRegistry, shareTokens = null, logger = null) {
     const token = extractTokenFromRequest(req);
     return {
-        user: await resolveUser(token, authService, addonRegistry, shareTokens),
+        user: await resolveUser(token, authService, addonRegistry, shareTokens, logger),
         req,
         deviceScopeLookup: makeDeviceScopeLookup(addonRegistry),
         deviceFleet: () => addonRegistry.getPersistedDeviceList(),
@@ -271,11 +313,11 @@ async function createTrpcContext(req, authService, addonRegistry, shareTokens =
  * Token is sent via tRPC connectionParams (a JSON message sent right after
  * the WS handshake), which is more reliable than query params through proxies.
  */
-async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens = null) {
+async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens = null, logger = null) {
     // 1. connectionParams.token (sent by BackendClient's createWSClient)
     const paramToken = opts.info.connectionParams?.['token'];
     const token = (typeof paramToken === 'string' ? paramToken : null) ?? extractTokenFromRequest(opts.req);
-    const user = await resolveUser(token, authService, addonRegistry, shareTokens);
+    const user = await resolveUser(token, authService, addonRegistry, shareTokens, logger);
     return {
         user,
         req: opts.req,

package/dist/main.js

@@ -504,7 +504,11 @@ async function bootstrap() {
             prefix: '/trpc',
             trpcOptions: {
                 router: appRouter,
-                createContext: ({ req }) => (0, trpc_context_1.createTrpcContext)(req, authService, addonRegistry, shareTokenService),
+                createContext: ({ req }) => (0, trpc_context_1.createTrpcContext)(req, authService, addonRegistry, shareTokenService, 
+                // A bearer refused for NOT being an API credential never reaches a
+                // procedure, so `onError` below never sees it — the refusal would
+                // be silent without this. Same reason `gateAddonJwt` logs (D103).
+                app.get(logging_service_1.LoggingService).createLogger('tRPC')),
                 onError: ({ path: trpcPath, error, ctx, }) => {
                     const trpcLogger = app.get(logging_service_1.LoggingService).createLogger('tRPC');
                     trpcLogger.warn('tRPC error', {
@@ -1065,7 +1069,7 @@ async function bootstrap() {
         (0, ws_1.applyWSSHandler)({
             wss,
             router: appRouter,
-            createContext: (opts) => (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, shareTokenService),
+            createContext: (opts) => (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, shareTokenService, app.get(logging_service_1.LoggingService).createLogger('tRPC:ws')),
             onError: ({ path: trpcPath, error, ctx, }) => {
                 const trpcLogger = app.get(logging_service_1.LoggingService).createLogger('tRPC:ws');
                 trpcLogger.warn('tRPC error', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.133",
+  "version": "1.2.135",
   "private": false,
   "files": [
     "dist",
@@ -33,19 +33,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.81",
-    "@camstack/addon-agent-ui": "1.2.23",
-    "@camstack/addon-auth": "1.2.25",
+    "@camstack/addon-admin-ui": "1.2.83",
+    "@camstack/addon-agent-ui": "1.2.24",
+    "@camstack/addon-auth": "1.2.26",
     "@camstack/addon-decoder-nodeav": "1.2.22",
     "@camstack/addon-notifiers": "1.2.27",
-    "@camstack/addon-pipeline": "1.2.97",
-    "@camstack/addon-pipeline-orchestrator": "1.2.81",
-    "@camstack/addon-post-analysis": "1.2.96",
+    "@camstack/addon-pipeline": "1.2.98",
+    "@camstack/addon-pipeline-orchestrator": "1.2.83",
+    "@camstack/addon-post-analysis": "1.2.99",
     "@camstack/sdk": "1.2.25",
     "@camstack/shm-ring": "1.1.22",
     "@camstack/system": "1.2.106",
-    "@camstack/types": "1.2.89",
-    "@camstack/ui-library": "1.2.61",
+    "@camstack/types": "1.2.90",
+    "@camstack/ui-library": "1.2.62",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",