@camstack/server 1.2.455 → 1.2.456

package/THIRD_PARTY_MODELS.md

@@ -30,9 +30,9 @@ under [Non-commercial models](#non-commercial-models).
 
 ## Required attributions
 
-- © Ultralytics, AGPL-3.0. Corresponding source: the upstream Ultralytics checkpoint and scripts/build-camstack-models.py in https://github.com/camstack/server. https://github.com/ultralytics/ultralytics
+- © Ultralytics, AGPL-3.0. Corresponding source: the upstream Ultralytics checkpoint and build-camstack-models.py (with convert_lib.py) published at https://huggingface.co/camstack/camstack-models/tree/main/source. https://github.com/ultralytics/ultralytics
 - Coral Edge TPU models and AIY Vision Birds V1 © Google LLC, Apache-2.0. https://github.com/google-coral/test_data
-- © Ultralytics, AGPL-3.0 (Ultralytics YOLOv9 weights). YOLOv9 architecture: Chien-Yao Wang, I-Hau Yeh, Hong-Yuan Mark Liao, GPL-3.0 (https://github.com/WongKinYiu/yolov9). Corresponding source: the upstream Ultralytics checkpoint and scripts/build-camstack-models.py in https://github.com/camstack/server. https://github.com/ultralytics/ultralytics
+- © Ultralytics, AGPL-3.0 (Ultralytics YOLOv9 weights). YOLOv9 architecture: Chien-Yao Wang, I-Hau Yeh, Hong-Yuan Mark Liao, GPL-3.0 (https://github.com/WongKinYiu/yolov9). Corresponding source: the upstream Ultralytics checkpoint and build-camstack-models.py (with convert_lib.py) published at https://huggingface.co/camstack/camstack-models/tree/main/source. https://github.com/ultralytics/ultralytics
 - RF-DETR © Roboflow, Apache-2.0. https://github.com/roboflow/rf-detr
 - YuNet weights Copyright (c) 2020 Shiqi Yu, MIT. Training code: ShiqiYu/libfacedetection.train, BSD-3-Clause. https://github.com/opencv/opencv_zoo/tree/main/models/face_detection_yunet
 - AuraFace v1 by fal.ai, Apache-2.0. https://huggingface.co/fal/AuraFace-v1
@@ -45,11 +45,10 @@ under [Non-commercial models](#non-commercial-models).
 - YAMNet © Google LLC, Apache-2.0. AudioSet ontology and labels © Google LLC, CC BY 4.0. https://github.com/tensorflow/models/tree/master/research/audioset/yamnet
 - Qwen models © Alibaba Cloud, Apache-2.0. https://huggingface.co/Qwen · https://huggingface.co/unsloth · https://huggingface.co/unsloth/Qwen3.6-35B-A3B-GGUF
 - Built with Llama. Llama 3.2 is licensed under the Llama 3.2 Community License, Copyright © Meta Platforms, Inc. All Rights Reserved. https://huggingface.co/bartowski/Llama-3.2-3B-Instruct-GGUF
-- Scrypted YOLOv9 ReLU detectors, Koushik Dutta (scrypted/plugin-models, repository tagged MIT); trained with the YOLOv9 code of Chien-Yao Wang, I-Hau Yeh, Hong-Yuan Mark Liao, GPL-3.0 (https://github.com/WongKinYiu/yolov9). https://huggingface.co/scrypted/plugin-models
 
 Training data under attribution terms:
 
-- **COCO 2017** (training data of `yolo26n` and 51 more): annotations CC-BY-4.0; images under their Flickr owners' terms. https://cocodataset.org/#termsofuse
+- **COCO 2017** (training data of `yolo26n` and 50 more): annotations CC-BY-4.0; images under their Flickr owners' terms. https://cocodataset.org/#termsofuse
 - **WIDER FACE** (training data of `yunet-2023mar`): research-oriented terms; images CC BY-NC-ND. http://shuoyang1213.me/WIDERFACE/
 - **Open Images V7** (training data of `animal-classifier`): annotations CC-BY-4.0 (Google LLC); images listed as CC-BY-2.0, no warranty. https://storage.googleapis.com/openimages/web/factsfigures_v7.html
 - **DrBimmer/vehicle-classification** (training data of `vehicle-type-v1`): CC-BY-NC-4.0 — treated as binding the trained weights (conservative reading). https://huggingface.co/datasets/DrBimmer/vehicle-classification
@@ -65,27 +64,29 @@ Training data under attribution terms:
 
 The folders `objectDetection/yolo26`, `objectDetection/yolov9`, `plateDetection/yolov8-plate` and `segmentation/yolo26-seg` of the model mirror hold Ultralytics weights,
 modified by CamStack and distributed under AGPL-3.0. Their Corresponding Source
-is the public CamStack source repository, **https://github.com/camstack/server**
-(MIT), together with the upstream checkpoints it starts from:
+is published in the mirror itself, in its **`source/`** folder,
+**https://huggingface.co/camstack/camstack-models/tree/main/source**, together
+with the upstream checkpoints it starts from:
 
 1. **The upstream checkpoints**, published by Ultralytics at
    https://github.com/ultralytics/assets/releases: `yolo26{n,s,m,l,x}.pt`,
    `yolov9{t,s,m,c}.pt`, `yolo26{n,s,m}-seg.pt`.
-2. **The export scripts** in https://github.com/camstack/server:
-   `scripts/build-camstack-models.py` (ONNX with a dynamic batch axis, CoreML
-   FP16, OpenVINO IR, OpenVINO NNCF INT8) and `scripts/export-models.py`. The
-   build instructions (Python environment, invocation, calibration images for
-   INT8) are in each script's header.
-3. **The software** that downloads and runs these weights, CamStack itself, is
-   the same repository.
+2. **The export scripts** in `source/`: `build-camstack-models.py` (ONNX
+   with a dynamic batch axis, CoreML FP16, OpenVINO IR, OpenVINO NNCF INT8),
+   `convert_lib.py` (the ONNX to OpenVINO / INT8 / CoreML converter it imports,
+   the same one CamStack's Model Studio runs), `requirements.txt` and
+   `export-models.py`. The build instructions (Python environment,
+   invocation, calibration images for INT8) are in `source/README.md` and in
+   each script's header. These scripts are CamStack's own code and are offered
+   under the MIT licence; the weights they produce keep their upstream licence.
 
-What the repository does **not** cover yet:
+What the published scripts do **not** cover yet:
 
 - **Some hosted sizes and input resolutions.** The export scripts do not list
   every variant in the mirror (for example the `-320`/`-256` YOLO26 exports,
   `yolov9m`/`yolov9c`, and the `yolo26*-seg` models). Each one is the same
-  Ultralytics `export()` with a different model id or `imgsz`, but no script in
-  the repository reproduces it as-is.
+  Ultralytics `export()` with a different model id or `imgsz`, but no
+  published script reproduces it as-is.
 - **`yolov8n-plate` has no training checkpoint.** It is a third-party model
   (trained 2023-12-05 according to its own metadata, origin not identified).
   The ONNX file is the only form CamStack has.
@@ -205,16 +206,13 @@ entry kept resolvable for a saved selection but no longer offered.
 | `llm-qwen3-vl-8b-instruct-q4` | [Qwen3-VL (GGUF by unsloth)](https://huggingface.co/unsloth) | — / Apache-2.0 (`Apache-2.0.txt`) | — | Q4_K_M GGUF quantisation by unsloth (not re-hosted by CamStack) | https://huggingface.co/unsloth/Qwen3-VL-8B-Instruct-GGUF |
 | `llm-qwen3.6-35b-a3b-ud-q4` | [Qwen3.6-35B-A3B (GGUF by unsloth)](https://huggingface.co/unsloth/Qwen3.6-35B-A3B-GGUF) | — / Apache-2.0 (`Apache-2.0.txt`) | — | UD-Q4_K_M GGUF quantisation by unsloth (not re-hosted by CamStack) | https://huggingface.co/unsloth/Qwen3.6-35B-A3B-GGUF |
 
-### Model Studio catalogs (object detection, imported on request)
-
-| Catalog ids | Upstream | Code / weights | Training data | CamStack changes | Downloaded from |
-| --- | --- | --- | --- | --- | --- |
-| `scrypted-yolov9t-relu-320`, `scrypted-yolov9t-relu_test-320`, `scrypted-yolov9s-relu-320`, `scrypted-yolov9s-relu_test-320`, `scrypted-yolov9m-relu-320`, `scrypted-yolov9m-relu_test-320`, `scrypted-yolov9c-relu-320`, `scrypted-yolov9c-relu_test-320`, `scrypted-yolov9t-relu-int8-320`, `scrypted-yolov9t-relu_test-int8-320`, `scrypted-yolov9s-relu-int8-320`, `scrypted-yolov9s-relu_test-int8-320`, `scrypted-yolov9m-relu-int8-320`, `scrypted-yolov9m-relu_test-int8-320`, `scrypted-yolov9c-relu-int8-320`, `scrypted-yolov9c-relu_test-int8-320` | [Scrypted plugin-models (repository tagged MIT, no per-model terms)](https://huggingface.co/scrypted/plugin-models) | GPL-3.0 (`GPL-3.0.txt`) / **Unknown** | not stated by Scrypted: UNKNOWN | none: downloaded as published, at a pinned revision | https://huggingface.co/scrypted/plugin-models |
-| `frigate-mobiledet-edgetpu` | [Google Coral test_data](https://github.com/google-coral/test_data) | Apache-2.0 / Apache-2.0 (`Apache-2.0.txt`) | COCO 2017: annotations CC-BY-4.0; images under their Flickr owners' terms | none | https://github.com/google-coral/test_data |
-
 ### Your own models
 
-The Scrypted and Frigate catalogs that Model Studio offers are listed above. A
-model you upload or convert yourself, or pull from your own Frigate+ account,
-keeps whatever licence its author published. CamStack does not change it and
-does not record it.
+Model Studio can import third-party models (for example community
+object-detection catalogs) on request. They are downloaded from their
+publishers, are not hosted or redistributed by CamStack, and keep their
+publishers' licences; Model Studio shows the licence where the source declares
+one. A model you upload or convert
+yourself, or pull from your own Frigate+ account, likewise keeps whatever
+licence its author published. CamStack does not change it and does not record
+it.

package/dist/api/cors/cors-policy.js

@@ -0,0 +1,193 @@
+"use strict";
+/**
+ * cors-policy — which browser origins may READ this hub's responses (D707).
+ *
+ * The viewer PWA is hosted at {@link VIEWER_PWA_ORIGIN} and talks to each
+ * operator's own hub straight from the browser — no proxy, no cloud. Before
+ * D707 the hub answered every request with `Access-Control-Allow-Origin: *`,
+ * which let ANY web page a user visited read any hub response its script could
+ * reach (an unauthenticated probe of a LAN hub, for one). The policy is now an
+ * allowlist:
+ *
+ *  - the hub's OWN origin — the `Origin` whose host is the request's `Host`
+ *    (or `X-Forwarded-Host`, which a relay such as the Home Assistant panel
+ *    proxy sets to ITS origin). Same-origin calls never needed CORS; this
+ *    entry exists for the WebSocket check, where a browser always sends
+ *    `Origin` and the native clients send their target's;
+ *  - {@link VIEWER_PWA_ORIGIN}, the hosted viewer;
+ *  - {@link OPAQUE_ORIGIN} (`null`): the native app's OTA-bundled embed is a
+ *    `file://` page inside a WKWebView, whose origin is opaque. Removing it
+ *    breaks live view on iOS;
+ *  - `CAMSTACK_PUBLIC_ORIGIN`, when set, and the operator's extras
+ *    (`server.corsOrigins` in config.yaml / `CAMSTACK_CORS_ORIGINS`).
+ *
+ * The answer to an allowed origin REFLECTS it exactly — never `*` — and never
+ * carries `Access-Control-Allow-Credentials`. The cross-origin viewer
+ * authenticates with a bearer token in `Authorization` (or tRPC
+ * `connectionParams` on the socket), which needs no credentials mode; the
+ * httpOnly session cookie therefore never rides a cross-origin request, so the
+ * cookie-gated surfaces (`auth.exchangeSession`, `/api/embed-auth`, the
+ * admin-ui) stay same-origin by construction.
+ *
+ * Pure: no Fastify, no I/O — `register-cors-policy.ts` is the glue.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CORS_PREFLIGHT_MAX_AGE_SEC = exports.CORS_EXPOSED_HEADERS = exports.CORS_ALLOWED_HEADERS = exports.CORS_ALLOWED_METHODS = exports.OPAQUE_ORIGIN = exports.VIEWER_PWA_ORIGIN = void 0;
+exports.normalizeOrigin = normalizeOrigin;
+exports.parseConfiguredOrigins = parseConfiguredOrigins;
+exports.builtInOrigins = builtInOrigins;
+exports.judgeCorsOrigin = judgeCorsOrigin;
+exports.corsResponseHeaders = corsResponseHeaders;
+exports.appendVary = appendVary;
+/** The hosted viewer PWA (operator decision 2026-10-06). */
+exports.VIEWER_PWA_ORIGIN = 'https://camstack.zentik.app';
+/**
+ * The serialisation of an opaque origin. The native app's OTA embed
+ * (`assets/embed/camstack-embed.html`, loaded from `file://`) sends it.
+ */
+exports.OPAQUE_ORIGIN = 'null';
+/** Every method a hub route answers. */
+exports.CORS_ALLOWED_METHODS = 'GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS';
+/**
+ * Request headers a cross-origin caller may send. `authorization` is the
+ * whole point; `range` is recorded-media seeking; the `trpc-*` / `x-trpc-*`
+ * names are what `@trpc/client` links may add. NOT `x-camstack-exchange`:
+ * the cookie→bearer exchange is a same-origin mechanism and a cross-origin
+ * page has no business asking for it.
+ */
+exports.CORS_ALLOWED_HEADERS = 'authorization, content-type, range, if-range, if-none-match, cache-control, trpc-accept, x-trpc-source, x-trpc-batch-mode';
+/**
+ * Response headers a cross-origin script may read. The byte-range trio is
+ * recorded playback (a seek reads `content-range`); `content-disposition` is
+ * export downloads; `retry-after` is the rate limiter; the `x-camstack-*`
+ * trio is the clip-still contract (a 204 that says WHY there is no image).
+ */
+exports.CORS_EXPOSED_HEADERS = 'content-range, accept-ranges, content-length, content-disposition, etag, retry-after, x-camstack-reason, x-camstack-reason-code, x-camstack-disposition';
+/** Preflight cache. Chromium caps at 7200 s; Firefox honours up to 86400. */
+exports.CORS_PREFLIGHT_MAX_AGE_SEC = 7200;
+/**
+ * The canonical serialisation of an origin (`scheme://host[:port]`, lower
+ * case, default port dropped), or `null` when `raw` is not an http(s) origin.
+ * `null` (the opaque origin) is accepted verbatim.
+ */
+function normalizeOrigin(raw) {
+    const trimmed = raw.trim();
+    if (trimmed === exports.OPAQUE_ORIGIN)
+        return exports.OPAQUE_ORIGIN;
+    let url;
+    try {
+        url = new URL(trimmed);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== 'https:' && url.protocol !== 'http:')
+        return null;
+    // An origin has no path, query, fragment or credentials. Accept a bare
+    // trailing slash (a common paste), refuse anything that names more.
+    if (url.username !== '' || url.password !== '')
+        return null;
+    if ((url.pathname !== '/' && url.pathname !== '') || url.search !== '' || url.hash !== '') {
+        return null;
+    }
+    return url.origin;
+}
+/** Read the configured value (array from YAML, already split from env). */
+function parseConfiguredOrigins(value) {
+    if (!Array.isArray(value))
+        return { origins: [], rejected: [] };
+    const origins = [];
+    const rejected = [];
+    for (const entry of value) {
+        if (typeof entry !== 'string') {
+            rejected.push(String(entry));
+            continue;
+        }
+        const normalized = normalizeOrigin(entry);
+        if (normalized === null)
+            rejected.push(entry);
+        else
+            origins.push(normalized);
+    }
+    return { origins, rejected };
+}
+/** The built-in entries plus the optional public origin. */
+function builtInOrigins(publicOrigin) {
+    const entries = [exports.VIEWER_PWA_ORIGIN, exports.OPAQUE_ORIGIN];
+    const pub = publicOrigin !== undefined ? normalizeOrigin(publicOrigin) : null;
+    if (pub !== null && pub !== exports.OPAQUE_ORIGIN)
+        entries.push(pub);
+    return entries;
+}
+/** The first value of a possibly comma-joined forwarding header, lower case. */
+function firstHost(value) {
+    if (value === undefined)
+        return null;
+    const first = value.split(',')[0]?.trim().toLowerCase() ?? '';
+    return first.length > 0 ? first : null;
+}
+/** `host[:port]` of an http(s) origin, or null. */
+function hostOfOrigin(origin) {
+    if (origin === exports.OPAQUE_ORIGIN)
+        return null;
+    try {
+        return new URL(origin).host.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Judge one request's `Origin`. `listed` is the full allowlist (built-ins and
+ * the operator's extras), already normalised.
+ */
+function judgeCorsOrigin(facts, listed) {
+    const raw = facts.origin;
+    if (raw === undefined || raw.length === 0)
+        return { kind: 'no-origin' };
+    const normalized = normalizeOrigin(raw);
+    if (normalized === null)
+        return { kind: 'denied', origin: raw };
+    if (listed.has(normalized))
+        return { kind: 'allowed', origin: raw, reason: 'listed' };
+    const originHost = hostOfOrigin(normalized);
+    if (originHost !== null) {
+        const ownHosts = [firstHost(facts.host), firstHost(facts.forwardedHost)];
+        if (ownHosts.includes(originHost))
+            return { kind: 'allowed', origin: raw, reason: 'own-host' };
+    }
+    return { kind: 'denied', origin: raw };
+}
+/**
+ * The headers an ALLOWED origin gets. `preflight` adds the method/header
+ * grants and the cache lifetime. The origin is the exact one the browser
+ * sent — reflecting it is what lets the browser hand the response to the
+ * page, and `Vary: Origin` (set by the glue on every response) keeps a cache
+ * from serving one origin's answer to another.
+ */
+function corsResponseHeaders(origin, preflight) {
+    const base = {
+        'access-control-allow-origin': origin,
+        'access-control-expose-headers': exports.CORS_EXPOSED_HEADERS,
+    };
+    if (preflight === null)
+        return base;
+    return {
+        ...base,
+        'access-control-allow-methods': exports.CORS_ALLOWED_METHODS,
+        'access-control-allow-headers': exports.CORS_ALLOWED_HEADERS,
+        'access-control-max-age': String(exports.CORS_PREFLIGHT_MAX_AGE_SEC),
+        // A public origin (the PWA) calling a LAN hub is a "private network"
+        // request to Chromium; its preflight must be answered explicitly.
+        ...(preflight.requestPrivateNetwork ? { 'access-control-allow-private-network': 'true' } : {}),
+    };
+}
+/** Append `token` to a `Vary` value unless it is already there. */
+function appendVary(existing, token) {
+    if (existing === undefined || existing.trim().length === 0)
+        return token;
+    const parts = existing.split(',').map((p) => p.trim().toLowerCase());
+    if (parts.includes('*') || parts.includes(token.toLowerCase()))
+        return existing;
+    return `${existing}, ${token}`;
+}

package/dist/api/cors/register-cors-policy.js

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCorsPolicy = createCorsPolicy;
+exports.registerCorsPolicy = registerCorsPolicy;
+exports.refuseForeignWsUpgrade = refuseForeignWsUpgrade;
+const cors_policy_js_1 = require("./cors-policy.js");
+/** Distinct refused origins remembered for log de-duplication. */
+const MAX_LOGGED_DENIALS = 256;
+function headerValue(value) {
+    if (Array.isArray(value))
+        return value[0];
+    return value;
+}
+function varyText(value) {
+    if (typeof value === 'string')
+        return value;
+    if (Array.isArray(value))
+        return value.filter((v) => typeof v === 'string').join(', ');
+    return undefined;
+}
+function createCorsPolicy(deps) {
+    const builtIns = (0, cors_policy_js_1.builtInOrigins)(deps.publicOrigin);
+    let lastConfigured = Symbol('unset');
+    let listed = new Set(builtIns);
+    const loggedDenials = new Set();
+    const currentList = () => {
+        const configured = deps.configuredOrigins();
+        if (configured === lastConfigured)
+            return listed;
+        lastConfigured = configured;
+        const parsed = (0, cors_policy_js_1.parseConfiguredOrigins)(configured);
+        if (parsed.rejected.length > 0) {
+            deps.logger.warn('cors: ignored configured origins that are not http(s) origins', {
+                meta: { rejected: parsed.rejected, setting: 'server.corsOrigins' },
+            });
+        }
+        listed = new Set([...builtIns, ...parsed.origins]);
+        return listed;
+    };
+    return {
+        judge(headers) {
+            const verdict = (0, cors_policy_js_1.judgeCorsOrigin)({
+                origin: headerValue(headers.origin),
+                host: headerValue(headers.host),
+                forwardedHost: headerValue(headers['x-forwarded-host']),
+            }, currentList());
+            if (verdict.kind === 'denied' && !loggedDenials.has(verdict.origin)) {
+                if (loggedDenials.size < MAX_LOGGED_DENIALS)
+                    loggedDenials.add(verdict.origin);
+                deps.logger.warn('cors: refused a cross-origin caller not on the allowlist', {
+                    meta: {
+                        origin: verdict.origin,
+                        host: headerValue(headers.host) ?? null,
+                        hint: 'add it to server.corsOrigins (config.yaml) or CAMSTACK_CORS_ORIGINS',
+                    },
+                });
+            }
+            return verdict;
+        },
+    };
+}
+/**
+ * Install the policy on the hub's Fastify instance. Every `OPTIONS` is
+ * answered here with 204 (as before D707) — with grants only for an allowed
+ * origin, so a refused preflight fails in the browser.
+ */
+function registerCorsPolicy(fastify, policy) {
+    fastify.addHook('onRequest', async (request, reply) => {
+        // The answer depends on Origin for every route, so every response says so
+        // — a cached same-origin answer must never be replayed to another origin.
+        const vary = (0, cors_policy_js_1.appendVary)(varyText(reply.getHeader('vary')), 'Origin');
+        reply.header('vary', vary);
+        reply.raw.setHeader('vary', vary);
+        const verdict = policy.judge(request.headers);
+        const isPreflight = request.method === 'OPTIONS' && request.headers['access-control-request-method'] !== undefined;
+        if (verdict.kind === 'allowed') {
+            const headers = (0, cors_policy_js_1.corsResponseHeaders)(verdict.origin, isPreflight
+                ? {
+                    requestPrivateNetwork: headerValue(request.headers['access-control-request-private-network']) === 'true',
+                }
+                : null);
+            for (const [name, value] of Object.entries(headers)) {
+                reply.header(name, value);
+                // Hijacked replies (the data-plane proxy) skip Fastify's header
+                // write; Node merges these into their `writeHead`.
+                reply.raw.setHeader(name, value);
+            }
+        }
+        if (request.method === 'OPTIONS') {
+            return reply.code(204).send();
+        }
+        return undefined;
+    });
+}
+/**
+ * Refuse a WebSocket upgrade whose `Origin` is not on the allowlist. Returns
+ * `true` when it refused (the socket is answered 403 and destroyed); the
+ * caller must then do nothing else with it. A request with no `Origin` (a
+ * Node client, an agent) passes — Origin is the browser's signal, and auth is
+ * the bearer in `connectionParams` either way.
+ */
+function refuseForeignWsUpgrade(policy, headers, socket) {
+    const verdict = policy.judge(headers);
+    if (verdict.kind !== 'denied')
+        return false;
+    socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');
+    socket.destroy();
+    return true;
+}

package/dist/api/oauth2/private-host.js

@@ -4,7 +4,7 @@
  *
  * Used by `/api/oauth2/authorize` to admit a `redirect_uri` whose host the hub
  * cannot know in advance — a self-hosted Home Assistant at
- * `http://192.168.x.x:8123/auth/external/callback`. Pairing "private host" with
+ * `http://192.168.10.40:8123/auth/external/callback`. Pairing "private host" with
  * "exact path" is what keeps that from being a wildcard prefix: a public host
  * never satisfies it, so the worst an attacker can aim a code at is a machine
  * they already need LAN presence to read.

package/dist/api/trpc/client-ip.js

@@ -101,7 +101,7 @@ function extractUserAgent(req) {
     return null;
 }
 /**
- * Strip an IPv4-mapped IPv6 prefix (`::ffff:192.168.x.x` → `192.168.x.x`)
+ * Strip an IPv4-mapped IPv6 prefix (`::ffff:192.168.10.5` → `192.168.10.5`)
  * and any zone id (`fe80::1%en0` → `fe80::1`) so the range checks below
  * see a clean address.
  */
@@ -216,13 +216,13 @@ function isPrivateIpv4(ip) {
     if (a === undefined || b === undefined)
         return false;
     if (a === 10)
-        return true; // 10.x.x.x/8
+        return true; // 10.0.0.0/8
     if (a === 127)
         return true; // 127.0.0.0/8 loopback
     if (a === 172 && b >= 16 && b <= 31)
         return true; // 172.16.0.0/12
     if (a === 192 && b === 168)
-        return true; // 192.168.x.x/16
+        return true; // 192.168.0.0/16
     if (a === 169 && b === 254)
         return true; // 169.254.0.0/16 link-local
     return false;

package/dist/api/trpc/device-config-secret-redaction.js

@@ -347,7 +347,7 @@ function redactConfigEntries(data) {
  *
  * The stream surfaces (`cameraStreams.getRtspEntries`,
  * `streamBroker.getRtspEntry`, `deviceOps.getStreamSources`, …) hand a
- * non-admin caller `rtsp://admin:hunter2@192.168.x.x/…` verbatim: a
+ * non-admin caller `rtsp://admin:hunter2@192.168.10.139/…` verbatim: a
  * read-only token can open every camera by copy-pasting the string. These
  * are NOT config blobs, so {@link redactRecord} never sees them — the leak
  * lives in a plain `url` / `mutedUrl` string field.

package/dist/main.js

@@ -70,6 +70,7 @@ const precompressed_asset_js_1 = require("./api/static/precompressed-asset.js");
 const spa_static_1 = require("./api/static/spa-static");
 const spa_mount_1 = require("./api/static/spa-mount");
 const frame_policy_1 = require("./api/static/frame-policy");
+const register_cors_policy_1 = require("./api/cors/register-cors-policy");
 const cap_providers_1 = require("./api/core/cap-providers");
 const logging_settings_1 = require("./api/core/logging-settings");
 const request_census_settings_1 = require("./api/core/request-census-settings");
@@ -347,8 +348,18 @@ async function bootstrap() {
     const fastifyOpts = tlsOptions ? { https: tlsOptions } : {};
     const app = await (0, manual_boot_1.bootManual)({ infra, fastifyOpts });
     app.enableShutdownHooks();
-    app.enableCors();
     const fastify = app.getHttpAdapter().getInstance();
+    // Which browser origins may read hub responses, and open the /trpc socket
+    // (D707): the hub's own, the hosted viewer PWA, the native embed's opaque
+    // `null`, and the operator's `server.corsOrigins`. First hook on the
+    // instance so every route — and every OPTIONS — is judged.
+    const corsConfig = app.get(config_service_1.ConfigService);
+    const corsPolicy = (0, register_cors_policy_1.createCorsPolicy)({
+        configuredOrigins: () => corsConfig.get('server.corsOrigins'),
+        publicOrigin: process.env.CAMSTACK_PUBLIC_ORIGIN,
+        logger: app.get(logging_service_1.LoggingService).createLogger('cors'),
+    });
+    (0, register_cors_policy_1.registerCorsPolicy)(fastify, corsPolicy);
     await fastify.register(cookie_1.default);
     // Every HTML document the hub serves may be framed by its own origin only
     // (D425). Stamped here, on the one instance, so no shell-send site added
@@ -1239,6 +1250,9 @@ async function bootstrap() {
         httpServer.on('upgrade', (request, socket, head) => {
             const pathname = (request.url ?? '').split('?')[0];
             if (pathname === '/trpc') {
+                // CORS does not cover a WebSocket: refuse a foreign page here (D707).
+                if ((0, register_cors_policy_1.refuseForeignWsUpgrade)(corsPolicy, request.headers, socket))
+                    return;
                 wss.handleUpgrade(request, socket, head, (ws) => {
                     wss.emit('connection', ws, request);
                 });

package/dist/manual-boot.js

@@ -394,16 +394,6 @@ async function bootManual(opts) {
         getHttpAdapter() {
             return { getInstance: () => fastify };
         },
-        enableCors() {
-            fastify.addHook('onRequest', async (request, reply) => {
-                reply.header('access-control-allow-origin', '*');
-                reply.header('access-control-allow-methods', 'GET,POST,PUT,DELETE,OPTIONS,PATCH');
-                reply.header('access-control-allow-headers', 'content-type,authorization');
-                if (request.method === 'OPTIONS') {
-                    reply.status(204).send();
-                }
-            });
-        },
         enableShutdownHooks() {
             if (shutdownHooksRegistered)
                 return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.455",
+  "version": "1.2.456",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,18 +37,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.329",
-    "@camstack/addon-agent-ui": "1.2.173",
+    "@camstack/addon-admin-ui": "1.2.330",
+    "@camstack/addon-agent-ui": "1.2.174",
     "@camstack/addon-auth": "1.2.126",
     "@camstack/addon-decoder-nodeav": "1.2.119",
-    "@camstack/addon-notifiers": "1.2.127",
-    "@camstack/addon-pipeline": "1.2.326",
-    "@camstack/addon-pipeline-orchestrator": "1.2.280",
-    "@camstack/addon-post-analysis": "1.2.332",
-    "@camstack/sdk": "1.2.120",
-    "@camstack/system": "1.2.353",
-    "@camstack/types": "1.2.304",
-    "@camstack/ui-library": "1.2.231",
+    "@camstack/addon-notifiers": "1.2.128",
+    "@camstack/addon-pipeline": "1.2.327",
+    "@camstack/addon-pipeline-orchestrator": "1.2.281",
+    "@camstack/addon-post-analysis": "1.2.333",
+    "@camstack/sdk": "1.2.121",
+    "@camstack/system": "1.2.354",
+    "@camstack/types": "1.2.305",
+    "@camstack/ui-library": "1.2.232",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",