@camstack/server 1.2.480 → 1.2.481

package/dist/api/trpc/device-config-secret-redaction.js

@@ -53,6 +53,7 @@ exports.redactStatusAggregateSetup = redactStatusAggregateSetup;
 exports.redactStatusAggregateBatchSetup = redactStatusAggregateBatchSetup;
 exports.redactConfigEntries = redactConfigEntries;
 exports.redactStreamUrlSecrets = redactStreamUrlSecrets;
+exports.maskUrlCredentialsDeep = maskUrlCredentialsDeep;
 /** What a non-admin sees instead of the value. Matches the `***` convention
  *  `maskUrlCredentials` already uses for credentials in log output, so one
  *  redaction marker means one thing across the system. */
@@ -86,24 +87,88 @@ function isSecretConfigKey(key) {
 function isRecord(x) {
     return x !== null && typeof x === 'object' && !Array.isArray(x);
 }
+function parsePath(path) {
+    return path
+        .split('.')
+        .filter((part) => part.length > 0)
+        .map((part) => part.endsWith('[]') ? { key: part.slice(0, -2), each: true } : { key: part, each: false });
+}
+/** The declared secret paths a device row advertises, parsed. Absent ⇒ none. */
+function declaredPathsOf(row) {
+    const raw = row['secretConfigPaths'];
+    if (!Array.isArray(raw))
+        return [];
+    return raw.filter((p) => typeof p === 'string').map(parsePath);
+}
+/** Withhold every non-empty string at or below `value` (a declared secret node). */
+function withholdAll(value) {
+    if (typeof value === 'string')
+        return value.length > 0 ? exports.REDACTED_SECRET : value;
+    if (Array.isArray(value))
+        return value.map(withholdAll);
+    if (!isRecord(value))
+        return value;
+    const out = {};
+    for (const [key, child] of Object.entries(value))
+        out[key] = withholdAll(child);
+    return out;
+}
+/** Apply ONE declared path to `value`, returning a copy; a path that does not resolve is a no-op. */
+function withholdPath(value, segments) {
+    const [head, ...rest] = segments;
+    if (head === undefined)
+        return withholdAll(value);
+    if (!isRecord(value) || !(head.key in value))
+        return value;
+    const child = value[head.key];
+    const next = head.each
+        ? Array.isArray(child)
+            ? child.map((el) => withholdPath(el, rest))
+            : child
+        : withholdPath(child, rest);
+    return { ...value, [head.key]: next };
+}
 /**
- * Replace the value of every credential-named key with {@link REDACTED_SECRET}.
+ * The keyword BACKSTOP (D634), now at any depth: a credential-NAMED key's
+ * string value is withheld, and a non-secret string that is a URL loses its
+ * userinfo / credential params. Only strings are touched — a numeric
+ * `maxTokens` or an array called `eventTypeTokens` is not a credential.
  *
- * An EMPTY value stays empty: "not configured" and "configured, withheld" are
- * different facts, and flattening them would make a broken camera look set up.
- * A non-string value is left alone — a numeric `maxTokens` is not a secret, and
- * the only credentials this repo persists are strings.
+ * This is no longer the declaration (D783): it catches what a driver has not
+ * yet declared, and `scripts/check-secret-fields-declared.ts` is what keeps
+ * that set from growing.
  */
-function redactRecord(config) {
+function backstop(value) {
+    if (typeof value === 'string') {
+        return value.includes('://') ? (0, types_1.maskUrlCredentials)(value) : value;
+    }
+    if (Array.isArray(value))
+        return value.map(backstop);
+    if (!isRecord(value))
+        return value;
     const out = {};
-    for (const [key, value] of Object.entries(config)) {
+    for (const [key, child] of Object.entries(value)) {
         out[key] =
-            isSecretConfigKey(key) && typeof value === 'string' && value.length > 0
+            isSecretConfigKey(key) && typeof child === 'string' && child.length > 0
                 ? exports.REDACTED_SECRET
-                : value;
+                : backstop(child);
     }
     return out;
 }
+/**
+ * Withhold a device `config` blob's secrets: first every DECLARED path
+ * (`secretConfigPaths`, at any depth), then the keyword backstop over what is
+ * left.
+ *
+ * An EMPTY value stays empty: "not configured" and "configured, withheld" are
+ * different facts, and flattening them would make a broken camera look set up.
+ */
+function redactConfigBlob(config, declared) {
+    let out = config;
+    for (const segments of declared)
+        out = withholdPath(out, segments);
+    return backstop(out);
+}
 /**
  * Project a `DeviceInfo` (or an array of them) with its `config` redacted.
  * Anything that is not a device row passes through untouched — a route that
@@ -117,7 +182,7 @@ function redactDeviceInfoSecrets(data) {
     const config = data['config'];
     if (!isRecord(config))
         return data;
-    return { ...data, config: redactRecord(config) };
+    return { ...data, config: redactConfigBlob(config, declaredPathsOf(data)) };
 }
 /**
  * Project a `Record<parentId, DeviceInfo[]>` — the shape `getChildrenBatch`
@@ -349,7 +414,7 @@ function redactConfigEntries(data) {
  * `streamBroker.getRtspEntry`, `deviceOps.getStreamSources`, …) hand a
  * non-admin caller `rtsp://admin:hunter2@192.168.10.139/…` verbatim: a
  * read-only token can open every camera by copy-pasting the string. These
- * are NOT config blobs, so {@link redactRecord} never sees them — the leak
+ * are NOT config blobs, so {@link redactDeviceInfoSecrets} never sees them — the leak
  * lives in a plain `url` / `mutedUrl` string field.
  */
 const URL_FIELD_KEYS = ['url', 'mutedUrl'];
@@ -377,6 +442,27 @@ function redactStreamUrlSecrets(data) {
     }
     return out;
 }
+/**
+ * Mask URL credentials in EVERY string of an arbitrary payload — the runtime
+ * state reads (`deviceState.getSnapshot` / `getCapSlice` / `getAllSnapshots`),
+ * the status aggregates and `streamCatalog.getCatalog`. Reolink persists its
+ * stream catalog (`rtsp://user:pass@…`, FLV `…&password=…`) in the
+ * `stream-catalog` slice, so a view-level read handed the camera password to
+ * any non-admin (D783). Only strings holding `://` are touched; no key is
+ * judged by its name here, so `eventTypeTokens` & co. keep their values.
+ */
+function maskUrlCredentialsDeep(data) {
+    if (typeof data === 'string')
+        return data.includes('://') ? (0, types_1.maskUrlCredentials)(data) : data;
+    if (Array.isArray(data))
+        return data.map(maskUrlCredentialsDeep);
+    if (!isRecord(data))
+        return data;
+    const out = {};
+    for (const [key, value] of Object.entries(data))
+        out[key] = maskUrlCredentialsDeep(value);
+    return out;
+}
 /**
  * Every device-manager read whose response carries a device `config` blob, and
  * the projection that cuts it.
@@ -408,8 +494,14 @@ exports.NON_ADMIN_CONFIG_REDACTED_METHODS = new Map([
     ['integrations.list', redactDeepSecrets],
     ['integrations.get', redactDeepSecrets],
     ['integrations.getByAddonId', redactDeepSecrets],
-    ['deviceManager.getDeviceStatusAggregate', redactStatusAggregateSetup],
-    ['deviceManager.getDeviceStatusAggregateBatch', redactStatusAggregateBatchSetup],
+    [
+        'deviceManager.getDeviceStatusAggregate',
+        (d) => maskUrlCredentialsDeep(redactStatusAggregateSetup(d)),
+    ],
+    [
+        'deviceManager.getDeviceStatusAggregateBatch',
+        (d) => maskUrlCredentialsDeep(redactStatusAggregateBatchSetup(d)),
+    ],
     ['deviceManager.getDevice', redactDeviceInfoSecrets],
     ['deviceManager.listAll', redactDeviceInfoSecrets],
     ['deviceManager.getChildren', redactDeviceInfoSecrets],
@@ -428,4 +520,10 @@ exports.NON_ADMIN_CONFIG_REDACTED_METHODS = new Map([
     ['deviceManager.getStreamSources', redactStreamUrlSecrets],
     ['streamBroker.getRtspEntry', redactStreamUrlSecrets],
     ['streamBroker.getAllRtspEntries', redactStreamUrlSecrets],
+    // ── Stream catalog + runtime state (D783) — Reolink persists its catalog,
+    // credentials inline, in the `stream-catalog` slice. Every URL is masked.
+    ['streamCatalog.getCatalog', maskUrlCredentialsDeep],
+    ['deviceState.getSnapshot', maskUrlCredentialsDeep],
+    ['deviceState.getCapSlice', maskUrlCredentialsDeep],
+    ['deviceState.getAllSnapshots', maskUrlCredentialsDeep],
 ]);

package/dist/api/trpc/generated-cap-routers.js

@@ -7079,6 +7079,24 @@ function createCapRouter_pipelineAnalytics(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.getRetrainExportUrl(methodInput);
         }),
+        setRetrainFrameComplete: trpc_middleware_js_1.adminProcedure
+            .input(types_92.pipelineAnalyticsCapability.methods.setRetrainFrameComplete.input.loose())
+            .output(types_92.pipelineAnalyticsCapability.methods.setRetrainFrameComplete.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('pipeline-analytics', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.setRetrainFrameComplete(methodInput);
+        }),
+        writeRetrainArchive: trpc_middleware_js_1.adminProcedure
+            .input(types_92.pipelineAnalyticsCapability.methods.writeRetrainArchive.input.loose())
+            .output(types_92.pipelineAnalyticsCapability.methods.writeRetrainArchive.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('pipeline-analytics', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.writeRetrainArchive(methodInput);
+        }),
         getEventMedia: trpc_middleware_js_1.protectedProcedure
             .input(types_92.pipelineAnalyticsCapability.methods.getEventMedia.input.loose())
             .output(types_92.pipelineAnalyticsCapability.methods.getEventMedia.output)
@@ -10851,6 +10869,42 @@ function createCapRouter_userManagement(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.oauthVerifyAccessToken(methodInput);
         }),
+        listExternalIdentities: trpc_middleware_js_1.adminProcedure
+            .input(types_128.userManagementCapability.methods.listExternalIdentities.input.loose())
+            .output(types_128.userManagementCapability.methods.listExternalIdentities.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('user-management', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.listExternalIdentities(methodInput);
+        }),
+        findUserByExternalIdentity: trpc_middleware_js_1.adminProcedure
+            .input(types_128.userManagementCapability.methods.findUserByExternalIdentity.input.loose())
+            .output(types_128.userManagementCapability.methods.findUserByExternalIdentity.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('user-management', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.findUserByExternalIdentity(methodInput);
+        }),
+        linkExternalIdentity: trpc_middleware_js_1.adminProcedure
+            .input(types_128.userManagementCapability.methods.linkExternalIdentity.input.loose())
+            .output(types_128.userManagementCapability.methods.linkExternalIdentity.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('user-management', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.linkExternalIdentity(methodInput);
+        }),
+        unlinkExternalIdentity: trpc_middleware_js_1.adminProcedure
+            .input(types_128.userManagementCapability.methods.unlinkExternalIdentity.input.loose())
+            .output(types_128.userManagementCapability.methods.unlinkExternalIdentity.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('user-management', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.unlinkExternalIdentity(methodInput);
+        }),
         listOauthSessions: trpc_middleware_js_1.adminProcedure
             .input(zod_1.z.object({ nodeId: zod_1.z.string().optional() }).optional())
             .output(types_128.userManagementCapability.methods.listOauthSessions.output)

package/dist/api/trpc/trpc.router.js

@@ -269,7 +269,7 @@ function buildCapabilityRouters(services) {
         // clusterNodes — fixed core API. Write-side purge for the durable
         // offline-node history (Track A "Forget node"); read side is push-only.
         clusterNodes: (0, cluster_nodes_router_js_1.createClusterNodesRouter)(services.agentRegistry),
-        auth: (0, auth_router_js_1.createAuthRouter)(services.authService, services.capabilityRegistry, services.moleculer, services.shareTokenService, services.handoffCodeService),
+        auth: (0, auth_router_js_1.createAuthRouter)(services.authService, services.capabilityRegistry, services.moleculer, services.shareTokenService, services.handoffCodeService, services.externalLinkIntents),
         // NOT MOUNTED — `mount: { kind: 'skip' }` legacy provider shapes
         // (positional args / sync returns) that don't match the codegen
         // routers' {input}-object + Promise<T> contract. The runtime builder

package/dist/auth/auth-provider-gate.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_GOVERNING_CAPS = void 0;
+exports.isAuthAddonDisabled = isAuthAddonDisabled;
+exports.bridgeProviderAddonId = bridgeProviderAddonId;
+/** Capabilities whose per-provider toggle is an auth addon's enable. */
+exports.AUTH_GOVERNING_CAPS = ['auth-provider', 'user-passkeys'];
+/** Whether the operator disabled `addonId` on Identity → Authentication. */
+function isAuthAddonDisabled(registry, addonId) {
+    return exports.AUTH_GOVERNING_CAPS.some((cap) => registry.isProviderDisabled(cap, addonId));
+}
+/**
+ * The addon behind an SSO bridge's `provider` claim: `auth-oidc/<instance>`
+ * is signed by `auth-oidc`, anything else names its addon directly.
+ */
+function bridgeProviderAddonId(provider) {
+    const slash = provider.indexOf('/');
+    return slash === -1 ? provider : provider.slice(0, slash);
+}

package/dist/auth/external-link-intents.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExternalLinkIntents = void 0;
+/**
+ * Pending "link this sign-in account" requests (D782).
+ *
+ * A signed-in user presses "Link Authentik": `auth.beginExternalLink` mints
+ * an intent for THAT session's user and returns the provider's start URL with
+ * the intent's opaque handle as `?link=`. The handle rides the IdP round trip
+ * (the OIDC addon keeps it in its server-side pending state, keyed by the
+ * OAuth `state`) and comes back inside the signed bridge. The SSO finish
+ * resolves it here — once — to the user it was minted for. The user id never
+ * travels through the browser.
+ *
+ * Hub-local and in memory on purpose: an intent lives minutes, and a hub
+ * restart mid-link costs the user one more click.
+ */
+const node_crypto_1 = require("node:crypto");
+/** Long enough for an IdP login with a password manager; short enough to be useless later. */
+const DEFAULT_TTL_MS = 10 * 60_000;
+/** Bounded: a session minting intents in a loop cannot grow this without limit. */
+const DEFAULT_MAX_ENTRIES = 1_000;
+class ExternalLinkIntents {
+    intents = new Map();
+    now;
+    ttlMs;
+    maxEntries;
+    constructor(opts = {}) {
+        this.now = opts.now ?? Date.now;
+        this.ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
+        this.maxEntries = opts.maxEntries ?? DEFAULT_MAX_ENTRIES;
+    }
+    create(userId, provider) {
+        this.prune();
+        while (this.intents.size >= this.maxEntries) {
+            const oldest = this.intents.keys().next();
+            if (oldest.done)
+                break;
+            this.intents.delete(oldest.value);
+        }
+        const handle = `li_${(0, node_crypto_1.randomBytes)(24).toString('base64url')}`;
+        this.intents.set(handle, { userId, provider, expiresAt: this.now() + this.ttlMs });
+        return handle;
+    }
+    /** The intent behind `handle`, removing it — or `null` (unknown, used, expired). */
+    consume(handle) {
+        const stored = this.intents.get(handle);
+        if (stored === undefined)
+            return null;
+        this.intents.delete(handle);
+        if (stored.expiresAt < this.now())
+            return null;
+        return { userId: stored.userId, provider: stored.provider };
+    }
+    prune() {
+        const now = this.now();
+        for (const [handle, intent] of this.intents) {
+            if (intent.expiresAt < now)
+                this.intents.delete(handle);
+        }
+    }
+}
+exports.ExternalLinkIntents = ExternalLinkIntents;

package/dist/auth/passkey-provider.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SetSecondFactorPreferenceSchema = exports.SecondFactorPreferenceSchema = exports.RemovePasskeySchema = exports.FinishDiscoverableAuthenticationSchema = exports.FinishAuthenticationSchema = exports.FinishRegistrationSchema = exports.OptionsJsonSchema = void 0;
+exports.resolvePasskeyProvider = resolvePasskeyProvider;
+exports.userHasPasskey = userHasPasskey;
+exports.passkeySecondFactorOptedIn = passkeySecondFactorOptedIn;
+const types_1 = require("@camstack/types");
+const zod_1 = require("zod");
+// ── Passkey (user-passkeys cap) resolution ───────────────────────────
+//
+// Cap-agnostic: the passkey provider is resolved through the
+// `user-passkeys` CAPABILITY, never by addon id. Any addon registering
+// the cap works. Resolution mirrors `hwaccel.router`:
+//   1. hub-in-process collection provider (a future hub-resident impl),
+//   2. else the hub-local forked child over UDS via the Moleculer cap
+//      proxy (`createCapabilityProxy(cap, 'hub')`) — the same routing the
+//      generated cap routers use.
+// The proxy is loosely typed (`Record<method, (params)=>Promise<unknown>>`);
+// its outputs are narrowed through the cap's own Zod schemas rather than
+// cast to the provider type (repo rule: no `as` on cross-boundary values).
+exports.OptionsJsonSchema = zod_1.z.object({ optionsJSON: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) });
+exports.FinishRegistrationSchema = zod_1.z.object({
+    success: zod_1.z.literal(true),
+    credentialId: zod_1.z.string(),
+});
+exports.FinishAuthenticationSchema = zod_1.z.object({ verified: zod_1.z.boolean() });
+exports.FinishDiscoverableAuthenticationSchema = zod_1.z.object({
+    verified: zod_1.z.boolean(),
+    userId: zod_1.z.string().nullable(),
+});
+exports.RemovePasskeySchema = zod_1.z.object({ success: zod_1.z.literal(true) });
+exports.SecondFactorPreferenceSchema = zod_1.z.object({ enabled: zod_1.z.boolean() });
+exports.SetSecondFactorPreferenceSchema = zod_1.z.object({ success: zod_1.z.literal(true) });
+function proxyPasskeyProvider(proxy) {
+    const call = async (method, params) => {
+        const fn = proxy[method];
+        if (typeof fn !== 'function')
+            throw new Error(`user-passkeys proxy missing method '${method}'`);
+        return fn(params);
+    };
+    return {
+        beginRegistration: async (input) => exports.OptionsJsonSchema.parse(await call('beginRegistration', input)),
+        finishRegistration: async (input) => exports.FinishRegistrationSchema.parse(await call('finishRegistration', input)),
+        beginAuthentication: async (input) => exports.OptionsJsonSchema.parse(await call('beginAuthentication', input)),
+        finishAuthentication: async (input) => exports.FinishAuthenticationSchema.parse(await call('finishAuthentication', input)),
+        beginDiscoverableAuthentication: async (input) => exports.OptionsJsonSchema.parse(await call('beginDiscoverableAuthentication', input)),
+        finishDiscoverableAuthentication: async (input) => exports.FinishDiscoverableAuthenticationSchema.parse(await call('finishDiscoverableAuthentication', input)),
+        listPasskeys: async (input) => zod_1.z.array(types_1.PasskeySummarySchema).parse(await call('listPasskeys', input)),
+        removePasskey: async (input) => exports.RemovePasskeySchema.parse(await call('removePasskey', input)),
+        getSecondFactorPreference: async (input) => exports.SecondFactorPreferenceSchema.parse(await call('getSecondFactorPreference', input)),
+        setSecondFactorPreference: async (input) => exports.SetSecondFactorPreferenceSchema.parse(await call('setSecondFactorPreference', input)),
+    };
+}
+function resolvePasskeyProvider(registry, moleculer) {
+    const local = registry?.getCollection('user-passkeys')?.[0] ?? null;
+    if (local)
+        return local;
+    const proxy = moleculer?.createCapabilityProxy('user-passkeys', 'hub') ?? null;
+    return proxy ? proxyPasskeyProvider(proxy) : null;
+}
+/**
+ * Whether the user has at least one enrolled passkey. Never throws — a
+ * missing provider or a transport hiccup degrades to `false` so the
+ * login flow is never blocked by passkey introspection.
+ */
+async function userHasPasskey(userId, provider) {
+    if (!provider)
+        return false;
+    try {
+        const list = await provider.listPasskeys({ userId });
+        return list.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether the user OPTED IN to their passkey doubling as a mandatory
+ * second factor after a password login. Enrolling a passkey alone only
+ * enables passkey-FIRST sign-in — this flag (default OFF, stored by the
+ * `user-passkeys` provider) is what re-arms the 2FA gate. Never throws:
+ * a missing provider, a provider predating the method, or a transport
+ * hiccup all read as `false` so the preference lookup can never lock a
+ * user out of the password flow.
+ */
+async function passkeySecondFactorOptedIn(userId, provider) {
+    if (!provider || typeof provider.getSecondFactorPreference !== 'function')
+        return false;
+    try {
+        const pref = await provider.getSecondFactorPreference({ userId });
+        return pref.enabled;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/auth/second-factors.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecondFactorSchema = void 0;
+exports.collectSecondFactors = collectSecondFactors;
+const zod_1 = require("zod");
+const passkey_provider_js_1 = require("./passkey-provider.js");
+exports.SecondFactorSchema = zod_1.z.enum(['totp', 'passkey']);
+async function collectSecondFactors(deps, userId, primary) {
+    const totpStatus = deps.getTotpStatus ? await deps.getTotpStatus({ userId }) : { enabled: false };
+    const factors = [];
+    if (totpStatus.enabled)
+        factors.push('totp');
+    if (primary !== 'passkey') {
+        const provider = deps.passkeyProvider();
+        const enrolled = await (0, passkey_provider_js_1.userHasPasskey)(userId, provider);
+        if (enrolled && (await (0, passkey_provider_js_1.passkeySecondFactorOptedIn)(userId, provider))) {
+            factors.push('passkey');
+        }
+    }
+    return factors;
+}

package/dist/auth/session-mint.js

@@ -52,13 +52,5 @@ function createSessionMinter(deps) {
         findUserOrNull,
         mintForRecord,
         mintForUserId: async (userId) => mintForRecord(await findUser(userId)),
-        mintForFederatedIdentity: (identity) => mintForRecord({
-            id: identity.userId,
-            username: identity.username,
-            isAdmin: identity.isAdmin,
-            allowedProviders: '*',
-            allowedDevices: {},
-            scopes: [],
-        }),
     };
 }

package/dist/auth/sso-finish-deps.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sessionUserIdFromCookie = sessionUserIdFromCookie;
+exports.createSsoFinishDeps = createSsoFinishDeps;
+const auth_provider_gate_js_1 = require("./auth-provider-gate.js");
+const passkey_provider_js_1 = require("./passkey-provider.js");
+const second_factors_js_1 = require("./second-factors.js");
+const session_cookie_js_1 = require("./session-cookie.js");
+/**
+ * The user a REAL session cookie names, or `null`. Same rule as
+ * `auth.exchangeSession`: a bridge or challenge token verifies under the same
+ * secret but carries a `kind`, and a session always has a boolean `isAdmin`
+ * and a string `userId`.
+ */
+function sessionUserIdFromCookie(auth, cookieHeader) {
+    const token = (0, session_cookie_js_1.readSessionCookieFromHeader)(cookieHeader);
+    if (token === null)
+        return null;
+    try {
+        const payload = auth.verifyToken(token);
+        if (Reflect.get(payload, 'kind') !== undefined)
+            return null;
+        if (typeof payload.isAdmin !== 'boolean' || typeof payload.userId !== 'string')
+            return null;
+        return payload.userId;
+    }
+    catch {
+        return null;
+    }
+}
+function createSsoFinishDeps(wiring, cookieHeader) {
+    const { auth, registry, moleculer } = wiring;
+    const userManagement = () => {
+        const um = registry.getSingleton('user-management');
+        if (!um)
+            throw new Error('Login unavailable — `user-management` capability not registered');
+        return um;
+    };
+    return {
+        verifyBridge: (token) => auth.verifySsoBridgeToken(token),
+        minter: wiring.minter,
+        isProviderDisabled: (addonId) => (0, auth_provider_gate_js_1.isAuthAddonDisabled)(registry, addonId),
+        identities: {
+            findUser: async (provider, subject) => userManagement().findUserByExternalIdentity({ provider, subject }),
+            link: async (input) => {
+                const um = userManagement();
+                const holder = await um.findUserByExternalIdentity({
+                    provider: input.provider,
+                    subject: input.subject,
+                });
+                if (holder !== null && holder.userId !== input.userId)
+                    return 'conflict';
+                await um.linkExternalIdentity(input);
+                return 'linked';
+            },
+        },
+        consumeLinkIntent: (handle) => wiring.linkIntents.consume(handle),
+        sessionUserId: () => sessionUserIdFromCookie(auth, cookieHeader),
+        secondFactors: (userId) => {
+            const um = registry.getSingleton('user-management');
+            return (0, second_factors_js_1.collectSecondFactors)({
+                ...(um && typeof um.getTotpStatus === 'function'
+                    ? { getTotpStatus: (input) => um.getTotpStatus(input) }
+                    : {}),
+                passkeyProvider: () => (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer),
+            }, userId, 'sso');
+        },
+        signChallenge: (user) => auth.signTotpChallengeToken(user),
+        ...(wiring.logFailure !== undefined ? { logFailure: wiring.logFailure } : {}),
+    };
+}