@camstack/server 1.2.237 → 1.2.238

package/dist/api/static/spa-mount.js

@@ -0,0 +1,123 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FORWARDED_PREFIX_HEADER = void 0;
+exports.parseForwardedPrefix = parseForwardedPrefix;
+exports.injectSpaMount = injectSpaMount;
+exports.sendSpaShell = sendSpaShell;
+/**
+ * spa-mount — serving the admin-UI shell under a reverse-proxy path prefix.
+ *
+ * The Home Assistant component frames the admin UI through a same-origin
+ * relay, `https://<ha>/api/camstack/p/<grant>/…` → `https://<hub>:4443/…`, so
+ * the browser never has to trust the hub's local certificate. The relay
+ * forwards the path WITHOUT the prefix (the hub sees `/`, `/settings`,
+ * `/assets/x.js`, `/trpc`) and says where it mounted us with
+ * `X-Forwarded-Prefix: /api/camstack/p/<grant>` on every request.
+ *
+ * The shell is the one response that has to differ: it tells the page where
+ * it lives, and every URL the page composes derives from that
+ * (`@camstack/ui-library` `lib/hub-mount.ts`). Assets are already relative
+ * (`vite base: './'`), so they need nothing from us.
+ *
+ * Without the header nothing changes — the shell is served exactly as before.
+ */
+const fs = __importStar(require("node:fs/promises"));
+const spa_static_1 = require("./spa-static");
+/** Node lower-cases incoming header names. */
+exports.FORWARDED_PREFIX_HEADER = 'x-forwarded-prefix';
+/** The canonical spelling, for `Vary`. */
+const FORWARDED_PREFIX_VARY = 'X-Forwarded-Prefix';
+const MOUNT_META_NAME = 'camstack-mount';
+/**
+ * A prefix is one or more clean path segments. No scheme, no `//`, no `..`,
+ * no query, no whitespace, no markup — it is going into an HTML attribute.
+ */
+const PREFIX_RE = /^\/[A-Za-z0-9_\-.]+(?:\/[A-Za-z0-9_\-.]+)*$/;
+const MAX_PREFIX_LENGTH = 512;
+/**
+ * The mount prefix the relay named, without a trailing slash, or `null` when
+ * the header is absent, names the root, or is anything we would not put in
+ * an attribute. Invalid is treated as absent — a relay that gets this wrong
+ * gets the root shell, never a 4xx and never a partial injection.
+ */
+function parseForwardedPrefix(value) {
+    if (typeof value !== 'string')
+        return null;
+    if (value.length === 0 || value.length > MAX_PREFIX_LENGTH)
+        return null;
+    const trimmed = value.endsWith('/') ? value.slice(0, -1) : value;
+    if (trimmed === '')
+        return null;
+    if (!PREFIX_RE.test(trimmed))
+        return null;
+    if (trimmed.split('/').some((segment) => segment === '..' || segment === '.'))
+        return null;
+    return trimmed;
+}
+/**
+ * The shell with `<base href>` and the mount meta as the FIRST children of
+ * `<head>` — `<base>` must precede every URL-bearing element to apply to it.
+ * A shell with no `<head>` is returned untouched: guessing where to put a
+ * `<base>` is worse than serving the root shell.
+ */
+function injectSpaMount(html, prefix) {
+    const match = /<head(?:\s[^>]*)?>/i.exec(html);
+    if (match === null)
+        return html;
+    const mount = `${prefix}/`;
+    const injected = `<base href="${mount}"><meta name="${MOUNT_META_NAME}" content="${mount}">`;
+    const at = match.index + match[0].length;
+    return `${html.slice(0, at)}${injected}${html.slice(at)}`;
+}
+/**
+ * Send the SPA shell for a page navigation. Always `no-store` and always
+ * `Vary: X-Forwarded-Prefix` — a cache that ignores `no-store` must still
+ * never hand a root shell to a relayed request or vice versa.
+ */
+async function sendSpaShell(reply, indexPath, headers) {
+    reply.header('cache-control', (0, spa_static_1.spaShellCacheControl)());
+    reply.header('vary', FORWARDED_PREFIX_VARY);
+    let html;
+    try {
+        html = await fs.readFile(indexPath, 'utf8');
+    }
+    catch {
+        // A redeploy replaced the dist under us; the next request finds the new one.
+        return reply.status(503).send({ error: 'Admin UI shell unavailable' });
+    }
+    const prefix = parseForwardedPrefix(headers[exports.FORWARDED_PREFIX_HEADER]);
+    return reply.type('text/html').send(prefix === null ? html : injectSpaMount(html, prefix));
+}

package/dist/auth/session-cookie.js

@@ -68,9 +68,17 @@ function readSessionCookieFromHeader(header) {
 function shouldRedirectToLogin(method, accept) {
     return method === 'GET' && typeof accept === 'string' && accept.includes('text/html');
 }
-/** Build the `/login?next=…` URL for an unauthenticated browser request. */
-function loginRedirectUrl(originalUrl) {
-    return `/login?next=${encodeURIComponent(originalUrl)}`;
+/**
+ * Build the `/login?next=…` URL for an unauthenticated browser request.
+ *
+ * `mountPrefix` is the path a reverse proxy mounted the admin UI under
+ * (`X-Forwarded-Prefix`, already validated — see `api/static/spa-mount.ts`):
+ * the login PAGE lives under it, while `next` stays hub-root-relative because
+ * the SPA re-mounts it itself (`hubPath`) — so one value serves both the
+ * relayed and the direct case.
+ */
+function loginRedirectUrl(originalUrl, mountPrefix = null) {
+    return `${mountPrefix ?? ''}/login?next=${encodeURIComponent(originalUrl)}`;
 }
 /** Allowed redirect target for `GET /api/embed-auth`: a same-origin RELATIVE
  *  path to a stream-broker embed page. Defeats open-redirects — the endpoint

package/dist/main.js

@@ -66,6 +66,7 @@ const server_upload_1 = require("./api/server-upload");
 const sse_no_compression_js_1 = require("./api/sse-no-compression.js");
 const precompressed_asset_js_1 = require("./api/static/precompressed-asset.js");
 const spa_static_1 = require("./api/static/spa-static");
+const spa_mount_1 = require("./api/static/spa-mount");
 const cap_providers_1 = require("./api/core/cap-providers");
 const logging_settings_1 = require("./api/core/logging-settings");
 const request_census_settings_1 = require("./api/core/request-census-settings");
@@ -1053,10 +1054,7 @@ async function bootstrap() {
                     // send used to carry no cache header at all, so browsers kept the
                     // index.html of a previous build (and its dead hashed asset names)
                     // across deploys until a force refresh.
-                    return reply
-                        .header('cache-control', (0, spa_static_1.spaShellCacheControl)())
-                        .type('text/html')
-                        .send(fs.createReadStream(spaIndexHtml));
+                    return (0, spa_mount_1.sendSpaShell)(reply, spaIndexHtml, request.headers);
                 }
                 return reply.status(404).send({ error: 'Not found' });
             }
@@ -1069,7 +1067,7 @@ async function bootstrap() {
                 if (!authHeader && !cookieToken) {
                     if ((0, session_cookie_js_1.shouldRedirectToLogin)(request.method, request.headers.accept)) {
                         const qs = request.url.includes('?') ? request.url.slice(request.url.indexOf('?')) : '';
-                        return reply.redirect((0, session_cookie_js_1.loginRedirectUrl)(fullPath + qs));
+                        return reply.redirect((0, session_cookie_js_1.loginRedirectUrl)(fullPath + qs, (0, spa_mount_1.parseForwardedPrefix)(request.headers['x-forwarded-prefix'])));
                     }
                     return reply.status(401).send({ error: 'Unauthorized' });
                 }
@@ -1336,7 +1334,9 @@ async function bootstrap() {
             return reply.status(503).send({ error: 'Admin UI is starting' });
         }
         const pathOnly = url.split('?')[0] ?? url;
-        if (/\.[a-zA-Z0-9]+$/.test(pathOnly)) {
+        // The shell asked for BY NAME is still the shell: it gets the mount
+        // injection and the no-store policy, never the asset branch.
+        if (pathOnly !== '/index.html' && /\.[a-zA-Z0-9]+$/.test(pathOnly)) {
             const rel = pathOnly.replace(/^\/+/, '');
             const abs = path.join(staticDir, rel);
             if ((abs === staticDir || abs.startsWith(staticDir + path.sep)) && fs.existsSync(abs)) {
@@ -1345,8 +1345,9 @@ async function bootstrap() {
             }
             return reply.callNotFound();
         }
-        reply.header('cache-control', (0, spa_static_1.spaShellCacheControl)());
-        return reply.type('text/html').send(fs.createReadStream(indexPath));
+        // A relayed navigation (`X-Forwarded-Prefix`) gets a shell that says where
+        // it is mounted; without the header the shell is served as before.
+        return (0, spa_mount_1.sendSpaShell)(reply, indexPath, request.headers);
     });
     const resolveAdminUi = async () => {
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.237",
+  "version": "1.2.238",
   "private": false,
   "files": [
     "dist",