@camstack/server 1.2.134 → 1.2.135

package/dist/api/trpc/trpc.context.js

@@ -93,10 +93,11 @@ function extractTokenFromRequest(req) {
  * its REST auth chain).
  *
  * Returns `null` for: missing token, malformed JWT, unknown scoped
- * token. Caller (protectedProcedure) decides the failure response
- * (typically UNAUTHORIZED).
+ * token, and a JWT that is not an ACCESS CREDENTIAL (see the classifier
+ * branch below). Caller (protectedProcedure) decides the failure
+ * response (typically UNAUTHORIZED).
  */
-async function resolveUser(token, authService, addonRegistry, shareTokens = null) {
+async function resolveUser(token, authService, addonRegistry, shareTokens = null, logger = null) {
     if (!token)
         return null;
     // Share-token path (`csv_*`): resolve through the ShareTokenService.
@@ -174,14 +175,42 @@ async function resolveUser(token, authService, addonRegistry, shareTokens = null
         if (typeof payload.isAdmin !== 'boolean') {
             return null;
         }
+        // What the token IS decides both WHETHER it authenticates at all and
+        // WHERE its scopes come from.
+        const principal = (0, types_1.classifyBearerPrincipal)(payload);
+        // ── The allowlist ────────────────────────────────────────────────
+        // Every token this hub mints verifies under the same `auth.jwtSecret`, so
+        // `verifyToken` succeeding means "we minted this", never "this is an API
+        // credential" (D103). Exactly two kinds are credentials here:
+        //
+        //   • `session` — no `kind` claim: `auth.login`'s JWT, the SSO-minted
+        //     session from `/api/auth/sso/finish`, a `type: 'service'` agent
+        //     token, a `type: 'api_key'` token.
+        //   • `integration` — `provider: 'oauth-access'`: the account-link
+        //     credential a component (Home Assistant) calls `/trpc` with.
+        //
+        // Everything else is minted for ONE hand-off step and is refused: an
+        // `oauth-code` is single-use, lives 60s and travels in a browser redirect
+        // URL (history, referrers, proxy logs); an `oauth-refresh` belongs to
+        // `POST /oauth/token`; an `oidc`/`magic-link` bridge belongs to
+        // `?bridge=` on `/api/auth/sso/finish`; a `totp-challenge` is login leg 1.
+        // `/addon/:addonId/*` has refused these since D103 — this closes the same
+        // hole on the other surface.
+        //
+        // The TOTP login is unaffected BY CONSTRUCTION: `loginVerifyTotp` takes
+        // the challenge as procedure INPUT on a public rate-limited procedure, and
+        // neither the SDK (`login()` calls `setToken` only when
+        // `!requiresSecondFactor`) nor the admin UI ever puts it in a header.
+        if (principal.kind === 'not-a-credential') {
+            logger?.warn('trpc: refused a bearer that is not an API credential', {
+                meta: { reason: principal.reason, userId: payload.userId ?? payload.keyId ?? 'unknown' },
+            });
+            return null;
+        }
         // What the token says it IS. An `oauth-access` token is an account link,
         // and until this was carried onto the principal a refusal of one was
         // indistinguishable in the logs from a refusal of a browser session.
         const credential = (0, trpc_error_principal_js_1.readCredentialIdentity)(payload);
-        // What the token IS decides WHERE its scopes come from. A `session` JWT is
-        // governed by its user's record; anything else carries its own grant and
-        // must keep it — see the live-scope note on the spread below.
-        const principal = (0, types_1.classifyBearerPrincipal)(payload);
         return {
             id: payload.userId ?? payload.keyId ?? 'unknown',
             username: payload.username ?? 'unknown',
@@ -270,10 +299,10 @@ function createMeshTrpcContext() {
     return { user };
 }
 /** Context factory for HTTP tRPC requests (Fastify adapter). */
-async function createTrpcContext(req, authService, addonRegistry, shareTokens = null) {
+async function createTrpcContext(req, authService, addonRegistry, shareTokens = null, logger = null) {
     const token = extractTokenFromRequest(req);
     return {
-        user: await resolveUser(token, authService, addonRegistry, shareTokens),
+        user: await resolveUser(token, authService, addonRegistry, shareTokens, logger),
         req,
         deviceScopeLookup: makeDeviceScopeLookup(addonRegistry),
         deviceFleet: () => addonRegistry.getPersistedDeviceList(),
@@ -284,11 +313,11 @@ async function createTrpcContext(req, authService, addonRegistry, shareTokens =
  * Token is sent via tRPC connectionParams (a JSON message sent right after
  * the WS handshake), which is more reliable than query params through proxies.
  */
-async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens = null) {
+async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens = null, logger = null) {
     // 1. connectionParams.token (sent by BackendClient's createWSClient)
     const paramToken = opts.info.connectionParams?.['token'];
     const token = (typeof paramToken === 'string' ? paramToken : null) ?? extractTokenFromRequest(opts.req);
-    const user = await resolveUser(token, authService, addonRegistry, shareTokens);
+    const user = await resolveUser(token, authService, addonRegistry, shareTokens, logger);
     return {
         user,
         req: opts.req,

package/dist/main.js

@@ -504,7 +504,11 @@ async function bootstrap() {
             prefix: '/trpc',
             trpcOptions: {
                 router: appRouter,
-                createContext: ({ req }) => (0, trpc_context_1.createTrpcContext)(req, authService, addonRegistry, shareTokenService),
+                createContext: ({ req }) => (0, trpc_context_1.createTrpcContext)(req, authService, addonRegistry, shareTokenService, 
+                // A bearer refused for NOT being an API credential never reaches a
+                // procedure, so `onError` below never sees it — the refusal would
+                // be silent without this. Same reason `gateAddonJwt` logs (D103).
+                app.get(logging_service_1.LoggingService).createLogger('tRPC')),
                 onError: ({ path: trpcPath, error, ctx, }) => {
                     const trpcLogger = app.get(logging_service_1.LoggingService).createLogger('tRPC');
                     trpcLogger.warn('tRPC error', {
@@ -1065,7 +1069,7 @@ async function bootstrap() {
         (0, ws_1.applyWSSHandler)({
             wss,
             router: appRouter,
-            createContext: (opts) => (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, shareTokenService),
+            createContext: (opts) => (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, shareTokenService, app.get(logging_service_1.LoggingService).createLogger('tRPC:ws')),
             onError: ({ path: trpcPath, error, ctx, }) => {
                 const trpcLogger = app.get(logging_service_1.LoggingService).createLogger('tRPC:ws');
                 trpcLogger.warn('tRPC error', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.134",
+  "version": "1.2.135",
   "private": false,
   "files": [
     "dist",
@@ -40,7 +40,7 @@
     "@camstack/addon-notifiers": "1.2.27",
     "@camstack/addon-pipeline": "1.2.98",
     "@camstack/addon-pipeline-orchestrator": "1.2.83",
-    "@camstack/addon-post-analysis": "1.2.98",
+    "@camstack/addon-post-analysis": "1.2.99",
     "@camstack/sdk": "1.2.25",
     "@camstack/shm-ring": "1.1.22",
     "@camstack/system": "1.2.106",