@camstack/server 1.2.134 → 1.2.136

package/dist/api/trpc/trpc.context.js

@@ -93,10 +93,11 @@ function extractTokenFromRequest(req) {
  * its REST auth chain).
  *
  * Returns `null` for: missing token, malformed JWT, unknown scoped
- * token. Caller (protectedProcedure) decides the failure response
- * (typically UNAUTHORIZED).
+ * token, and a JWT that is not an ACCESS CREDENTIAL (see the classifier
+ * branch below). Caller (protectedProcedure) decides the failure
+ * response (typically UNAUTHORIZED).
  */
-async function resolveUser(token, authService, addonRegistry, shareTokens = null) {
+async function resolveUser(token, authService, addonRegistry, shareTokens = null, logger = null) {
     if (!token)
         return null;
     // Share-token path (`csv_*`): resolve through the ShareTokenService.
@@ -174,14 +175,42 @@ async function resolveUser(token, authService, addonRegistry, shareTokens = null
         if (typeof payload.isAdmin !== 'boolean') {
             return null;
         }
+        // What the token IS decides both WHETHER it authenticates at all and
+        // WHERE its scopes come from.
+        const principal = (0, types_1.classifyBearerPrincipal)(payload);
+        // ── The allowlist ────────────────────────────────────────────────
+        // Every token this hub mints verifies under the same `auth.jwtSecret`, so
+        // `verifyToken` succeeding means "we minted this", never "this is an API
+        // credential" (D103). Exactly two kinds are credentials here:
+        //
+        //   • `session` — no `kind` claim: `auth.login`'s JWT, the SSO-minted
+        //     session from `/api/auth/sso/finish`, a `type: 'service'` agent
+        //     token, a `type: 'api_key'` token.
+        //   • `integration` — `provider: 'oauth-access'`: the account-link
+        //     credential a component (Home Assistant) calls `/trpc` with.
+        //
+        // Everything else is minted for ONE hand-off step and is refused: an
+        // `oauth-code` is single-use, lives 60s and travels in a browser redirect
+        // URL (history, referrers, proxy logs); an `oauth-refresh` belongs to
+        // `POST /oauth/token`; an `oidc`/`magic-link` bridge belongs to
+        // `?bridge=` on `/api/auth/sso/finish`; a `totp-challenge` is login leg 1.
+        // `/addon/:addonId/*` has refused these since D103 — this closes the same
+        // hole on the other surface.
+        //
+        // The TOTP login is unaffected BY CONSTRUCTION: `loginVerifyTotp` takes
+        // the challenge as procedure INPUT on a public rate-limited procedure, and
+        // neither the SDK (`login()` calls `setToken` only when
+        // `!requiresSecondFactor`) nor the admin UI ever puts it in a header.
+        if (principal.kind === 'not-a-credential') {
+            logger?.warn('trpc: refused a bearer that is not an API credential', {
+                meta: { reason: principal.reason, userId: payload.userId ?? payload.keyId ?? 'unknown' },
+            });
+            return null;
+        }
         // What the token says it IS. An `oauth-access` token is an account link,
         // and until this was carried onto the principal a refusal of one was
         // indistinguishable in the logs from a refusal of a browser session.
         const credential = (0, trpc_error_principal_js_1.readCredentialIdentity)(payload);
-        // What the token IS decides WHERE its scopes come from. A `session` JWT is
-        // governed by its user's record; anything else carries its own grant and
-        // must keep it — see the live-scope note on the spread below.
-        const principal = (0, types_1.classifyBearerPrincipal)(payload);
         return {
             id: payload.userId ?? payload.keyId ?? 'unknown',
             username: payload.username ?? 'unknown',
@@ -270,10 +299,10 @@ function createMeshTrpcContext() {
     return { user };
 }
 /** Context factory for HTTP tRPC requests (Fastify adapter). */
-async function createTrpcContext(req, authService, addonRegistry, shareTokens = null) {
+async function createTrpcContext(req, authService, addonRegistry, shareTokens = null, logger = null) {
     const token = extractTokenFromRequest(req);
     return {
-        user: await resolveUser(token, authService, addonRegistry, shareTokens),
+        user: await resolveUser(token, authService, addonRegistry, shareTokens, logger),
         req,
         deviceScopeLookup: makeDeviceScopeLookup(addonRegistry),
         deviceFleet: () => addonRegistry.getPersistedDeviceList(),
@@ -284,11 +313,11 @@ async function createTrpcContext(req, authService, addonRegistry, shareTokens =
  * Token is sent via tRPC connectionParams (a JSON message sent right after
  * the WS handshake), which is more reliable than query params through proxies.
  */
-async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens = null) {
+async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens = null, logger = null) {
     // 1. connectionParams.token (sent by BackendClient's createWSClient)
     const paramToken = opts.info.connectionParams?.['token'];
     const token = (typeof paramToken === 'string' ? paramToken : null) ?? extractTokenFromRequest(opts.req);
-    const user = await resolveUser(token, authService, addonRegistry, shareTokens);
+    const user = await resolveUser(token, authService, addonRegistry, shareTokens, logger);
     return {
         user,
         req: opts.req,

package/dist/core/addon/addon-registry.service.js

@@ -54,6 +54,7 @@ const prune_misplaced_addons_js_1 = require("./prune-misplaced-addons.js");
 const require_cache_js_1 = require("./require-cache.js");
 const runner_convergence_1 = require("./runner-convergence");
 const runner_spawn_fanout_js_1 = require("./runner-spawn-fanout.js");
+const single_flight_refresh_js_1 = require("./single-flight-refresh.js");
 /**
  * Decide whether an in-memory addon entry should be evicted because it is no
  * longer on disk (the uninstall path in `loadNewAddons`).
@@ -1153,11 +1154,18 @@ class AddonRegistryService {
         }
         return out;
     };
+    /** One full-fleet rebuild in flight, at most one queued behind it. Every
+     *  event below asks for the SAME total rebuild, so running it once per event
+     *  was ~1 000 rebuilds of a 974-row mirror on a boot — each one a 625 KB read
+     *  and parse on hub-main's event loop. No timer: the first event still
+     *  refreshes immediately, because this mirror backs scope enforcement.
+     *  See `single-flight-refresh.ts`. */
+    deviceMirrorGate = (0, single_flight_refresh_js_1.createSingleFlightRefresh)(() => this.refreshDeviceParentMirror());
     /** Subscribe the mirror to every device-meta lifecycle event, and warm it once
      *  the addon set (device-manager included) is up. */
     wireDeviceParentMirror() {
         const refresh = () => {
-            void this.refreshDeviceParentMirror();
+            void this.deviceMirrorGate.request();
         };
         for (const category of [
             types_1.EventCategory.DeviceMetaChanged,

package/dist/core/addon/single-flight-refresh.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSingleFlightRefresh = createSingleFlightRefresh;
+/**
+ * @param run the total rebuild. Called with no arguments, never concurrently
+ *   with itself.
+ */
+function createSingleFlightRefresh(run) {
+    let inFlight = null;
+    // Set while a run is active and another request arrived. One flag, not a
+    // counter: N requests during one run need exactly ONE follow-up between
+    // them, because the follow-up reads the world as it is when it starts.
+    let pending = false;
+    let pendingPromise = null;
+    let releasePending = () => { };
+    const start = () => {
+        const active = (async () => {
+            try {
+                await run();
+            }
+            finally {
+                inFlight = null;
+                if (pending) {
+                    pending = false;
+                    const release = releasePending;
+                    releasePending = () => { };
+                    pendingPromise = null;
+                    // Chain the follow-up, then settle everyone who waited for it.
+                    void start().finally(release);
+                }
+            }
+        })();
+        inFlight = active;
+        return active;
+    };
+    return {
+        request: async () => {
+            if (inFlight === null) {
+                await start();
+                return;
+            }
+            if (!pending) {
+                pending = true;
+                pendingPromise = new Promise((resolve) => {
+                    releasePending = resolve;
+                });
+            }
+            // `pendingPromise` is non-null whenever `pending` is set; the local
+            // binding keeps that visible to the type checker after the await.
+            const wait = pendingPromise;
+            if (wait !== null)
+                await wait;
+        },
+    };
+}

package/dist/main.js

@@ -504,7 +504,11 @@ async function bootstrap() {
             prefix: '/trpc',
             trpcOptions: {
                 router: appRouter,
-                createContext: ({ req }) => (0, trpc_context_1.createTrpcContext)(req, authService, addonRegistry, shareTokenService),
+                createContext: ({ req }) => (0, trpc_context_1.createTrpcContext)(req, authService, addonRegistry, shareTokenService, 
+                // A bearer refused for NOT being an API credential never reaches a
+                // procedure, so `onError` below never sees it — the refusal would
+                // be silent without this. Same reason `gateAddonJwt` logs (D103).
+                app.get(logging_service_1.LoggingService).createLogger('tRPC')),
                 onError: ({ path: trpcPath, error, ctx, }) => {
                     const trpcLogger = app.get(logging_service_1.LoggingService).createLogger('tRPC');
                     trpcLogger.warn('tRPC error', {
@@ -1065,7 +1069,7 @@ async function bootstrap() {
         (0, ws_1.applyWSSHandler)({
             wss,
             router: appRouter,
-            createContext: (opts) => (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, shareTokenService),
+            createContext: (opts) => (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, shareTokenService, app.get(logging_service_1.LoggingService).createLogger('tRPC:ws')),
             onError: ({ path: trpcPath, error, ctx, }) => {
                 const trpcLogger = app.get(logging_service_1.LoggingService).createLogger('tRPC:ws');
                 trpcLogger.warn('tRPC error', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.134",
+  "version": "1.2.136",
   "private": false,
   "files": [
     "dist",
@@ -38,12 +38,12 @@
     "@camstack/addon-auth": "1.2.26",
     "@camstack/addon-decoder-nodeav": "1.2.22",
     "@camstack/addon-notifiers": "1.2.27",
-    "@camstack/addon-pipeline": "1.2.98",
+    "@camstack/addon-pipeline": "1.2.99",
     "@camstack/addon-pipeline-orchestrator": "1.2.83",
-    "@camstack/addon-post-analysis": "1.2.98",
+    "@camstack/addon-post-analysis": "1.2.100",
     "@camstack/sdk": "1.2.25",
     "@camstack/shm-ring": "1.1.22",
-    "@camstack/system": "1.2.106",
+    "@camstack/system": "1.2.107",
     "@camstack/types": "1.2.90",
     "@camstack/ui-library": "1.2.62",
     "@fastify/compress": "^9.0.0",