@camstack/server 1.2.478 → 1.2.480

package/dist/api/trpc/trpc.router.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.enrichInputWithUserAgent = enrichInputWithUserAgent;
 exports.enrichInputWithRelayClass = enrichInputWithRelayClass;
+exports.stripTalkbackFromRequest = stripTalkbackFromRequest;
 exports.enrichHintsWithClientClass = enrichHintsWithClientClass;
 exports.wrapWebrtcSessionProviderWithRelay = wrapWebrtcSessionProviderWithRelay;
 exports.buildAppRouter = buildAppRouter;
@@ -95,6 +96,25 @@ function enrichInputWithRelayClass(input, clientClass) {
     const relayOnly = FORCE_RELAY_REMOTE ? (0, client_ip_js_1.deriveRelayOnly)(clientClass) : false;
     return { ...input, relayOnly };
 }
+/**
+ * Strip `talkback` from a REQUEST-bound `handleOffer` (D771).
+ *
+ * Talk-back sends the peer's microphone to the camera's speaker. Only a
+ * trusted, mesh-originated caller may ask for it — today the Alexa export,
+ * which has already checked the linked user may control the camera. A
+ * browser's talk permission lives on the intercom cap's own surface (share
+ * tokens gate it there); letting a request-bound `handleOffer` set this flag
+ * would be a second door to the speaker. Same rule as `relayOnly`: a
+ * mesh-originated call (`clientClass === null`) passes through unchanged.
+ *
+ * Immutable — builds a NEW input object, never mutates the caller's.
+ */
+function stripTalkbackFromRequest(input, clientClass) {
+    if (clientClass === null || input.talkback === undefined)
+        return input;
+    const { talkback: _dropped, ...rest } = input;
+    return rest;
+}
 /**
  * Bias used to live here (`prefersTier: 'low'` for `remote`). That pinned
  * every phone-sized session — including LAN IPv6 GUA misclassified as remote
@@ -145,7 +165,7 @@ function wrapWebrtcSessionProviderWithRelay(provider, ctx) {
     return {
         ...provider,
         createSession: (input) => provider.createSession(enrichHintsWithClientClass(enrichInputWithRelayClass(enrichInputWithUserAgent(input, userAgent), clientClass), clientClass)),
-        handleOffer: (input) => provider.handleOffer(enrichHintsWithClientClass(enrichInputWithRelayClass(enrichInputWithUserAgent(input, userAgent), clientClass), clientClass)),
+        handleOffer: (input) => provider.handleOffer(enrichHintsWithClientClass(enrichInputWithRelayClass(enrichInputWithUserAgent(stripTalkbackFromRequest(input, clientClass), userAgent), clientClass), clientClass)),
     };
 }
 /**

package/dist/core/addon/addon-registry.service.js

@@ -48,16 +48,17 @@ const types_1 = require("@camstack/types");
 const client_1 = require("@trpc/client");
 const addon_call_gateway_js_1 = require("./addon-call-gateway.js");
 const addon_row_manifest_1 = require("./addon-row-manifest");
-const settings_door_wiring_js_1 = require("./settings-door-wiring.js");
 const addon_settings_provider_js_1 = require("./addon-settings-provider.js");
 const device_meta_mirror_js_1 = require("./device-meta-mirror.js");
+const forked_custom_actions_js_1 = require("./forked-custom-actions.js");
 const integration_visibility_js_1 = require("./integration-visibility.js");
+const materialize_route_path_js_1 = require("./materialize-route-path.js");
 const package_dir_utils_1 = require("./package-dir-utils");
-const forked_custom_actions_js_1 = require("./forked-custom-actions.js");
 const prune_misplaced_addons_js_1 = require("./prune-misplaced-addons.js");
 const runner_convergence_1 = require("./runner-convergence");
 const runner_serialization_1 = require("./runner-serialization");
 const runner_spawn_fanout_js_1 = require("./runner-spawn-fanout.js");
+const settings_door_wiring_js_1 = require("./settings-door-wiring.js");
 /**
  * Decide whether an in-memory addon entry should be evicted because it is no
  * longer on disk (the uninstall path in `loadNewAddons`).
@@ -2672,7 +2673,9 @@ class AddonRegistryService {
             handler: async (req, reply) => {
                 const envelope = await invoker.invoke({
                     method: route.method,
-                    path: route.path,
+                    // The CONCRETE path, not the pattern: the child re-matches it and
+                    // would otherwise bind every param to its own `:placeholder`.
+                    path: (0, materialize_route_path_js_1.materializeRoutePath)(route.path, req.params),
                     params: req.params,
                     query: req.query,
                     body: req.body,

package/dist/core/addon/materialize-route-path.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.materializeRoutePath = materializeRoutePath;
+/**
+ * Rebuild the concrete request path from a route pattern and the params the
+ * hub already matched (`/:providerId/start` + `{providerId:'authentik'}` →
+ * `/authentik/start`).
+ *
+ * The forked-addon bridge forwards a request to the child's
+ * `buildAddonRouteProvider().invoke`, which matches the path again to pick the
+ * route and extract params. Sending it the PATTERN made that second match bind
+ * every param to its own placeholder (`providerId = ':providerId'`), which
+ * overwrote the real value — every parameterized route of a forked addon saw
+ * literal `:name` params.
+ */
+function materializeRoutePath(pattern, params) {
+    return pattern
+        .split('/')
+        .map((part) => {
+        if (!part.startsWith(':'))
+            return part;
+        const value = params[part.slice(1)];
+        return value === undefined ? part : encodeURIComponent(value);
+    })
+        .join('/');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.478",
+  "version": "1.2.480",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,17 +37,17 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.351",
+    "@camstack/addon-admin-ui": "1.2.353",
     "@camstack/addon-agent-ui": "1.2.190",
     "@camstack/addon-auth": "1.2.130",
     "@camstack/addon-decoder-nodeav": "1.2.121",
     "@camstack/addon-notifiers": "1.2.128",
-    "@camstack/addon-pipeline": "1.2.344",
+    "@camstack/addon-pipeline": "1.2.345",
     "@camstack/addon-pipeline-orchestrator": "1.2.297",
     "@camstack/addon-post-analysis": "1.2.342",
     "@camstack/sdk": "1.2.126",
-    "@camstack/system": "1.2.373",
-    "@camstack/types": "1.2.324",
+    "@camstack/system": "1.2.375",
+    "@camstack/types": "1.2.326",
     "@camstack/ui-library": "1.2.248",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",