@camstack/server 1.2.480 → 1.2.482

package/dist/api/core/cap-providers.js

@@ -70,6 +70,7 @@ exports.buildNodesProvider = buildNodesProvider;
 exports.buildIntegrationsProvider = buildIntegrationsProvider;
 exports.dispatchCustomAction = dispatchCustomAction;
 exports.buildAddonsProvider = buildAddonsProvider;
+const integration_secrets_1 = require("./integration-secrets");
 const node_crypto_1 = require("node:crypto");
 const os = __importStar(require("node:os"));
 const system_1 = require("@camstack/system");
@@ -685,6 +686,14 @@ function buildNodesProvider(agentRegistry, moleculer, addonRegistry, getNodeRoot
         },
     };
 }
+/**
+ * The keychain handle a hub door uses for an integration's addon (D787), or
+ * `null` when this registry predates the keychain (a test double, an older
+ * kernel) — the door then stores the settings as it always did.
+ */
+function ownerSecrets(ar, owner) {
+    return typeof ar.secretsForOwner === 'function' ? ar.secretsForOwner(owner) : null;
+}
 function requireIntegrationRegistry(ar) {
     const reg = ar.getIntegrationRegistry();
     if (!reg)
@@ -845,7 +854,10 @@ function buildIntegrationsProvider(ar, eb, loggingService, capabilityRegistry) {
         },
         getByAddonId: async (input) => requireIntegrationRegistry(ar).getIntegrationByAddonId(input.addonId),
         create: async (input) => {
-            const { skipRestart, ...payload } = input;
+            const { skipRestart, secretKeys, settings, ...rest } = input;
+            // Settings are written AFTER the row exists: a secret's ref is scoped
+            // to the integration id (D787).
+            const payload = rest;
             const reg = requireIntegrationRegistry(ar);
             logger.info('request', {
                 tags: { addonId: input.addonId },
@@ -872,7 +884,7 @@ function buildIntegrationsProvider(ar, eb, loggingService, capabilityRegistry) {
             // those would make every integration lacking the hook uncreatable, and
             // would fail a good create on a flaky network. They pass, and they SAY SO
             // in the log: silence here would read as "validated".
-            const verdict = await runConnectionTest(ar, input.addonId, input.settings ?? {}, logger);
+            const verdict = await runConnectionTest(ar, input.addonId, settings ?? {}, logger);
             if (verdict.status === 'rejected') {
                 logger.warn('rejected — connection test refused the settings', {
                     tags: { addonId: input.addonId },
@@ -896,11 +908,25 @@ function buildIntegrationsProvider(ar, eb, loggingService, capabilityRegistry) {
                 });
             }
             const integration = await reg.createIntegration(payload);
+            if (settings !== undefined && Object.keys(settings).length > 0) {
+                await (0, integration_secrets_1.writeIntegrationSettings)({
+                    registry: reg,
+                    secrets: ownerSecrets(ar, integration.addonId),
+                    onOrphaned: (refs) => logger.warn('dropped keychain refs could not be deleted', {
+                        meta: { refs: [...refs] },
+                    }),
+                }, {
+                    integrationId: integration.id,
+                    settings,
+                    secretKeys: secretKeys ?? [],
+                    operatorWrite: true,
+                });
+            }
             logger.info('persisted', {
                 tags: { integrationId: integration.id, addonId: integration.addonId },
                 meta: { phase: 'create' },
             });
-            const hasSettings = input.settings != null && Object.keys(input.settings).length > 0;
+            const hasSettings = settings != null && Object.keys(settings).length > 0;
             if (!skipRestart && hasSettings) {
                 logger.info('settings present — restarting addon', {
                     tags: { addonId: input.addonId },
@@ -1086,7 +1112,13 @@ function buildIntegrationsProvider(ar, eb, loggingService, capabilityRegistry) {
             const integration = await reg.getIntegration(input.id);
             if (!integration)
                 throw new Error(`Integration "${input.id}" not found`);
-            return reg.getIntegrationSettings(input.id);
+            // The integration's own addon (the caller the transport stamped) reads
+            // its secrets resolved; anyone else — the admin form — reads "set"
+            // views, never a value (D787, D789).
+            const caller = Reflect.get(input, 'callerAddonId');
+            const forOwner = typeof caller === 'string' &&
+                (caller === integration.addonId || ar.runnerIdFor(integration.addonId) === caller);
+            return (0, integration_secrets_1.readIntegrationSettings)({ registry: reg, secrets: forOwner ? ownerSecrets(ar, integration.addonId) : null }, { integrationId: input.id, forOwner });
         },
         setSettings: async (input) => {
             const reg = requireIntegrationRegistry(ar);
@@ -1103,7 +1135,19 @@ function buildIntegrationsProvider(ar, eb, loggingService, capabilityRegistry) {
                 tags: { integrationId: input.id, addonId: integration.addonId },
                 meta: { phase: 'setSettings', keys: settingsKeys },
             });
-            await reg.setIntegrationSettings(input.id, input.settings);
+            await (0, integration_secrets_1.writeIntegrationSettings)({
+                registry: reg,
+                secrets: ownerSecrets(ar, integration.addonId),
+                onOrphaned: (refs) => logger.warn('dropped keychain refs could not be deleted', {
+                    meta: { refs: [...refs] },
+                }),
+            }, {
+                integrationId: input.id,
+                settings: input.settings,
+                secretKeys: input.secretKeys ?? [],
+                // The integration's own addon writing back is not the operator.
+                operatorWrite: typeof Reflect.get(input, 'callerAddonId') !== 'string',
+            });
             logger.info('persisted — restarting addon', {
                 tags: { addonId: integration.addonId },
                 meta: { phase: 'setSettings' },

package/dist/api/core/integration-secrets.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeIntegrationSettings = writeIntegrationSettings;
+exports.readIntegrationSettings = readIntegrationSettings;
+/**
+ * The integration-settings door of the keychain (D787). An integration's
+ * settings (a Wyze password, a PetKit account password) live in the
+ * `integration_settings` table, written by `integrations.create` /
+ * `setSettings` and read back by the integration's own addon through
+ * `integrations.getSettings` — and by the admin form through the same method.
+ *
+ * - WRITE: the keys the form's schema declares secret (`secretKeys`, by type)
+ *   and every key that already holds a marker go through the keychain save
+ *   path, OWNED by the integration's addon (`integration/<id>` scope). A value
+ *   equal to an inline pre-keychain one stays inline; `''` keeps.
+ * - READ, by the owning addon (the caller the transport stamped): markers
+ *   resolve to values. READ, by anyone else (the admin form): markers become
+ *   their "set" views — the value never leaves the hub.
+ */
+const types_1 = require("@camstack/types");
+async function writeIntegrationSettings(deps, input) {
+    if (deps.secrets === null) {
+        return deps.registry.setIntegrationSettings(input.integrationId, input.settings);
+    }
+    const stored = (await deps.registry.getIntegrationSettings(input.integrationId)) ?? {};
+    const markerKeys = Object.entries(stored)
+        .filter(([, v]) => (0, types_1.isSecretMarker)(v))
+        .map(([k]) => k);
+    const tree = (0, types_1.secretTreeFromPaths)([...new Set([...input.secretKeys, ...markerKeys])]);
+    if (tree.size === 0) {
+        return deps.registry.setIntegrationSettings(input.integrationId, input.settings);
+    }
+    const result = await (0, types_1.transformSecretWrite)({
+        tree,
+        secrets: deps.secrets,
+        patch: input.settings,
+        stored,
+        scope: { kind: 'integration', integrationId: input.integrationId },
+        operatorWrite: input.operatorWrite === true,
+    });
+    if (Object.keys(result.patch).length > 0) {
+        await deps.registry.setIntegrationSettings(input.integrationId, result.patch);
+    }
+    const { orphaned } = await result.afterWrite();
+    if (orphaned.length > 0)
+        deps.onOrphaned?.(orphaned);
+}
+async function readIntegrationSettings(deps, input) {
+    const stored = await deps.registry.getIntegrationSettings(input.integrationId);
+    if (input.forOwner) {
+        if (deps.secrets === null)
+            return stored;
+        return (await (0, types_1.resolveSecretMarkers)(stored, deps.secrets)).value;
+    }
+    const out = {};
+    for (const [key, value] of Object.entries(stored)) {
+        out[key] = (0, types_1.isSecretMarker)(value) ? (0, types_1.toSecretFieldView)(value) : value;
+    }
+    return out;
+}

package/dist/api/trpc/device-config-secret-redaction.js

@@ -53,6 +53,7 @@ exports.redactStatusAggregateSetup = redactStatusAggregateSetup;
 exports.redactStatusAggregateBatchSetup = redactStatusAggregateBatchSetup;
 exports.redactConfigEntries = redactConfigEntries;
 exports.redactStreamUrlSecrets = redactStreamUrlSecrets;
+exports.maskUrlCredentialsDeep = maskUrlCredentialsDeep;
 /** What a non-admin sees instead of the value. Matches the `***` convention
  *  `maskUrlCredentials` already uses for credentials in log output, so one
  *  redaction marker means one thing across the system. */
@@ -86,24 +87,88 @@ function isSecretConfigKey(key) {
 function isRecord(x) {
     return x !== null && typeof x === 'object' && !Array.isArray(x);
 }
+function parsePath(path) {
+    return path
+        .split('.')
+        .filter((part) => part.length > 0)
+        .map((part) => part.endsWith('[]') ? { key: part.slice(0, -2), each: true } : { key: part, each: false });
+}
+/** The declared secret paths a device row advertises, parsed. Absent ⇒ none. */
+function declaredPathsOf(row) {
+    const raw = row['secretConfigPaths'];
+    if (!Array.isArray(raw))
+        return [];
+    return raw.filter((p) => typeof p === 'string').map(parsePath);
+}
+/** Withhold every non-empty string at or below `value` (a declared secret node). */
+function withholdAll(value) {
+    if (typeof value === 'string')
+        return value.length > 0 ? exports.REDACTED_SECRET : value;
+    if (Array.isArray(value))
+        return value.map(withholdAll);
+    if (!isRecord(value))
+        return value;
+    const out = {};
+    for (const [key, child] of Object.entries(value))
+        out[key] = withholdAll(child);
+    return out;
+}
+/** Apply ONE declared path to `value`, returning a copy; a path that does not resolve is a no-op. */
+function withholdPath(value, segments) {
+    const [head, ...rest] = segments;
+    if (head === undefined)
+        return withholdAll(value);
+    if (!isRecord(value) || !(head.key in value))
+        return value;
+    const child = value[head.key];
+    const next = head.each
+        ? Array.isArray(child)
+            ? child.map((el) => withholdPath(el, rest))
+            : child
+        : withholdPath(child, rest);
+    return { ...value, [head.key]: next };
+}
 /**
- * Replace the value of every credential-named key with {@link REDACTED_SECRET}.
+ * The keyword BACKSTOP (D634), now at any depth: a credential-NAMED key's
+ * string value is withheld, and a non-secret string that is a URL loses its
+ * userinfo / credential params. Only strings are touched — a numeric
+ * `maxTokens` or an array called `eventTypeTokens` is not a credential.
  *
- * An EMPTY value stays empty: "not configured" and "configured, withheld" are
- * different facts, and flattening them would make a broken camera look set up.
- * A non-string value is left alone — a numeric `maxTokens` is not a secret, and
- * the only credentials this repo persists are strings.
+ * This is no longer the declaration (D783): it catches what a driver has not
+ * yet declared, and `scripts/check-secret-fields-declared.ts` is what keeps
+ * that set from growing.
  */
-function redactRecord(config) {
+function backstop(value) {
+    if (typeof value === 'string') {
+        return value.includes('://') ? (0, types_1.maskUrlCredentials)(value) : value;
+    }
+    if (Array.isArray(value))
+        return value.map(backstop);
+    if (!isRecord(value))
+        return value;
     const out = {};
-    for (const [key, value] of Object.entries(config)) {
+    for (const [key, child] of Object.entries(value)) {
         out[key] =
-            isSecretConfigKey(key) && typeof value === 'string' && value.length > 0
+            isSecretConfigKey(key) && typeof child === 'string' && child.length > 0
                 ? exports.REDACTED_SECRET
-                : value;
+                : backstop(child);
     }
     return out;
 }
+/**
+ * Withhold a device `config` blob's secrets: first every DECLARED path
+ * (`secretConfigPaths`, at any depth), then the keyword backstop over what is
+ * left.
+ *
+ * An EMPTY value stays empty: "not configured" and "configured, withheld" are
+ * different facts, and flattening them would make a broken camera look set up.
+ */
+function redactConfigBlob(config, declared) {
+    let out = config;
+    for (const segments of declared)
+        out = withholdPath(out, segments);
+    return backstop(out);
+}
 /**
  * Project a `DeviceInfo` (or an array of them) with its `config` redacted.
  * Anything that is not a device row passes through untouched — a route that
@@ -117,7 +182,7 @@ function redactDeviceInfoSecrets(data) {
     const config = data['config'];
     if (!isRecord(config))
         return data;
-    return { ...data, config: redactRecord(config) };
+    return { ...data, config: redactConfigBlob(config, declaredPathsOf(data)) };
 }
 /**
  * Project a `Record<parentId, DeviceInfo[]>` — the shape `getChildrenBatch`
@@ -349,7 +414,7 @@ function redactConfigEntries(data) {
  * `streamBroker.getRtspEntry`, `deviceOps.getStreamSources`, …) hand a
  * non-admin caller `rtsp://admin:hunter2@192.168.10.139/…` verbatim: a
  * read-only token can open every camera by copy-pasting the string. These
- * are NOT config blobs, so {@link redactRecord} never sees them — the leak
+ * are NOT config blobs, so {@link redactDeviceInfoSecrets} never sees them — the leak
  * lives in a plain `url` / `mutedUrl` string field.
  */
 const URL_FIELD_KEYS = ['url', 'mutedUrl'];
@@ -377,6 +442,27 @@ function redactStreamUrlSecrets(data) {
     }
     return out;
 }
+/**
+ * Mask URL credentials in EVERY string of an arbitrary payload — the runtime
+ * state reads (`deviceState.getSnapshot` / `getCapSlice` / `getAllSnapshots`),
+ * the status aggregates and `streamCatalog.getCatalog`. Reolink persists its
+ * stream catalog (`rtsp://user:pass@…`, FLV `…&password=…`) in the
+ * `stream-catalog` slice, so a view-level read handed the camera password to
+ * any non-admin (D783). Only strings holding `://` are touched; no key is
+ * judged by its name here, so `eventTypeTokens` & co. keep their values.
+ */
+function maskUrlCredentialsDeep(data) {
+    if (typeof data === 'string')
+        return data.includes('://') ? (0, types_1.maskUrlCredentials)(data) : data;
+    if (Array.isArray(data))
+        return data.map(maskUrlCredentialsDeep);
+    if (!isRecord(data))
+        return data;
+    const out = {};
+    for (const [key, value] of Object.entries(data))
+        out[key] = maskUrlCredentialsDeep(value);
+    return out;
+}
 /**
  * Every device-manager read whose response carries a device `config` blob, and
  * the projection that cuts it.
@@ -408,8 +494,14 @@ exports.NON_ADMIN_CONFIG_REDACTED_METHODS = new Map([
     ['integrations.list', redactDeepSecrets],
     ['integrations.get', redactDeepSecrets],
     ['integrations.getByAddonId', redactDeepSecrets],
-    ['deviceManager.getDeviceStatusAggregate', redactStatusAggregateSetup],
-    ['deviceManager.getDeviceStatusAggregateBatch', redactStatusAggregateBatchSetup],
+    [
+        'deviceManager.getDeviceStatusAggregate',
+        (d) => maskUrlCredentialsDeep(redactStatusAggregateSetup(d)),
+    ],
+    [
+        'deviceManager.getDeviceStatusAggregateBatch',
+        (d) => maskUrlCredentialsDeep(redactStatusAggregateBatchSetup(d)),
+    ],
     ['deviceManager.getDevice', redactDeviceInfoSecrets],
     ['deviceManager.listAll', redactDeviceInfoSecrets],
     ['deviceManager.getChildren', redactDeviceInfoSecrets],
@@ -428,4 +520,10 @@ exports.NON_ADMIN_CONFIG_REDACTED_METHODS = new Map([
     ['deviceManager.getStreamSources', redactStreamUrlSecrets],
     ['streamBroker.getRtspEntry', redactStreamUrlSecrets],
     ['streamBroker.getAllRtspEntries', redactStreamUrlSecrets],
+    // ── Stream catalog + runtime state (D783) — Reolink persists its catalog,
+    // credentials inline, in the `stream-catalog` slice. Every URL is masked.
+    ['streamCatalog.getCatalog', maskUrlCredentialsDeep],
+    ['deviceState.getSnapshot', maskUrlCredentialsDeep],
+    ['deviceState.getCapSlice', maskUrlCredentialsDeep],
+    ['deviceState.getAllSnapshots', maskUrlCredentialsDeep],
 ]);

package/dist/api/trpc/generated-cap-mounts.js

@@ -2,7 +2,7 @@
 // AUTO-GENERATED by scripts/generate-cap-mounts.ts — DO NOT EDIT
 // Re-run: npx tsx scripts/generate-cap-mounts.ts
 //
-// Mounted: 162    Skipped (legacy): 3
+// Mounted: 164    Skipped (legacy): 3
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LEGACY_SHAPE_SKIP = void 0;
 exports.mountAllCaps = mountAllCaps;
@@ -269,6 +269,8 @@ function mountAllCaps(services) {
         imageSettings: (0, generated_cap_routers_js_1.createCapRouter_imageSettings)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'image-settings'), remoteCapProxy),
         integrations: (0, generated_cap_routers_js_1.createCapRouter_integrations)((_ctx) => reg?.getSingleton('integrations') ?? null, remoteCapProxy),
         intercom: (0, generated_cap_routers_js_1.createCapRouter_intercom)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'intercom'), remoteCapProxy),
+        keychain: (0, generated_cap_routers_js_1.createCapRouter_keychain)((_ctx) => reg?.getSingleton('keychain') ?? null, remoteCapProxy),
+        keychainAdmin: (0, generated_cap_routers_js_1.createCapRouter_keychainAdmin)((_ctx) => reg?.getSingleton('keychain-admin') ?? null, remoteCapProxy),
         lawnMowerControl: (0, generated_cap_routers_js_1.createCapRouter_lawnMowerControl)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'lawn-mower-control'), remoteCapProxy),
         llm: (0, generated_cap_routers_js_1.createCapRouter_llm)((_ctx, addonId) => {
             if (!reg)