@camstack/server 1.2.480 → 1.2.482

package/dist/core/addon/addon-registry.service.js

@@ -1151,6 +1151,22 @@ class AddonRegistryService {
      * addon (`execution.group`) is never misclassified as `in-process`.
      * Falls back to the addon id when the declaration is not yet known.
      */
+    /** The runner id hosting an addon — its `execution.group`, or itself. */
+    runnerIdFor(addonId) {
+        return this.childIdForAddon(addonId);
+    }
+    /**
+     * A hub in-process keychain handle acting for `owner` — the door hub-main
+     * code (the integration settings provider) uses to keep another addon's
+     * values (D787). Never handed to an addon.
+     */
+    secretsForOwner(owner) {
+        return (0, types_1.createSecretsAccess)({
+            owner,
+            transport: this.inProcessKeychainTransport(owner),
+            eventBus: this.eventBusService,
+        });
+    }
     childIdForAddon(addonId) {
         const decl = this.addonEntries.get(addonId)?.declaration;
         return decl ? (0, types_1.resolveRunnerId)(decl, addonId) : addonId;
@@ -2934,6 +2950,9 @@ class AddonRegistryService {
             deps: new system_1.AddonDepsManager(dataDir, logger),
             kernel: {
                 localNodeId: this.broker.nodeID,
+                // The keychain accepts a grouped runner's stamp (its group id) for the
+                // refs of the addons that runner hosts.
+                runnerIdForAddon: (id) => this.childIdForAddon(id),
                 storage: storageProvider ?? undefined,
                 deviceRegistry: this.deviceRegistry ?? undefined,
                 devices: deviceManagerApi,
@@ -2978,6 +2997,16 @@ class AddonRegistryService {
                 return (0, types_1.createDeviceProxy)(api, binding);
             },
             settings: settingsView,
+            // This builtin's keychain values (D787). In-process, so the caller is
+            // STATED (no wire, no stamp) — the one place the keychain trusts a
+            // claim. `forOwner` is the door a system builtin (device-manager,
+            // storage-orchestrator) uses to keep another addon's values.
+            secrets: (0, types_1.createSecretsAccess)({
+                owner: addonId,
+                transport: this.inProcessKeychainTransport(addonId),
+                transportForOwner: (owner) => this.inProcessKeychainTransport(owner),
+                eventBus: this.eventBusService,
+            }),
             useCapability(capName, scope = { type: 'global' }) {
                 return getOrCreateHandle(capName, scope, 15_000);
             },
@@ -2997,6 +3026,36 @@ class AddonRegistryService {
         };
         return ctx;
     }
+    /**
+     * The keychain transport of a hub in-process caller: the provider lives in
+     * this process, so the call goes straight to it with the caller STATED.
+     * Built per call so a keychain registered after this context still answers;
+     * a missing provider throws, which `ctx.secrets` reads as `unavailable`.
+     */
+    inProcessKeychainTransport(owner) {
+        const provider = () => {
+            const p = this.capabilityRegistry.getSingleton('keychain');
+            if (p === null || p === undefined)
+                throw new Error('keychain provider is not registered');
+            return p;
+        };
+        const callerAddonId = owner;
+        return {
+            put: (input) => {
+                const stated = { ref: input.ref, value: input.value, callerAddonId };
+                return provider().put(stated);
+            },
+            resolve: (input) => {
+                const stated = { refs: [...input.refs], callerAddonId };
+                return provider().resolve(stated);
+            },
+            delete: (input) => {
+                const stated = { refs: [...input.refs], callerAddonId };
+                return provider().delete(stated);
+            },
+            getState: () => provider().getState({}),
+        };
+    }
     /**
      * Per-addon disposer chain. Created lazily the first time an addon
      * calls `ctx.addDisposer(...)`. Drained by `restartAddon()` /

package/dist/core/addon/addon-settings-provider.js

@@ -76,7 +76,13 @@ function createAddonSettingsProvider(deps) {
                 if (!addon || typeof addon.updateGlobalSettings !== 'function') {
                     throw new Error(`Addon "${input.addonId}" does not implement updateGlobalSettings`);
                 }
-                await addon.updateGlobalSettings(input.patch, input.nodeId);
+                // The admin API's write is the OPERATOR's (D787).
+                if (typeof addon.updateGlobalSettingsAsOperator === 'function') {
+                    await addon.updateGlobalSettingsAsOperator(input.patch, input.nodeId);
+                }
+                else {
+                    await addon.updateGlobalSettings(input.patch, input.nodeId);
+                }
                 return { success: true };
             }
             return forkedUpdate(input.addonId, 'updateGlobalSettings', { patch: input.patch, ...(input.nodeId ? { nodeId: input.nodeId } : {}) }, input.nodeId);

package/dist/core/moleculer/moleculer.service.js

@@ -132,6 +132,27 @@ class MoleculerService {
     setRunnerIdResolver(resolver) {
         this.runnerIdResolver = resolver;
     }
+    /**
+     * Does `nodeId` (an agent) host the runner `runnerId`? Read from what the
+     * node itself registered: its manifest names the addons it runs, and an
+     * addon's runner is its `execution.group` or itself. A node that never
+     * registered hosts nothing.
+     */
+    isRunnerOnNode(nodeId, runnerId) {
+        const nodes = this.nodeRegistry
+            .listNodeIds()
+            .filter((id) => id === nodeId || id.startsWith(`${nodeId}/`));
+        if (nodes.includes(`${nodeId}/${runnerId}`))
+            return true;
+        for (const id of nodes) {
+            for (const entry of this.nodeRegistry.getNodeManifest(id) ?? []) {
+                const runner = this.runnerIdResolver?.(entry.addonId) ?? entry.addonId;
+                if (entry.addonId === runnerId || runner === runnerId)
+                    return true;
+            }
+        }
+        return false;
+    }
     get childRegistry() {
         return this.localChildRegistry;
     }
@@ -400,7 +421,16 @@ class MoleculerService {
             // `broker.call('$hub-cap-fwd.forward', …)` discovers it here. Without it a
             // remote agent's raw `${cap}.*` discovery 30s-deadlines (hub-local addon
             // runners expose no Moleculer service). See hub-cap-forward.ts.
-            this.brokerSafe.createService((0, system_1.createHubCapForwardService)(onUnownedCall));
+            this.brokerSafe.createService((0, system_1.createHubCapForwardService)(onUnownedCall, {
+                // The agent stamps WHO is calling (its child's runner id) into the
+                // envelope (D787). Believe it only when that runner is on the agent
+                // the request came from — a node's registered manifest lists the
+                // addons it hosts, and a grouped runner answers to its group id.
+                isCallerOnNode: (senderNodeId, callerRunnerId) => this.isRunnerOnNode(senderNodeId, callerRunnerId),
+                onRejectedCaller: (senderNodeId, callerRunnerId) => logger.warn('dropped an agent caller stamp the sender does not host', {
+                    meta: { senderNodeId, callerRunnerId },
+                }),
+            }));
             const registry = new system_1.LocalChildRegistry({
                 server: (0, system_1.createLocalTransport)().createServer(nodeId),
                 // This node's own id — lets the cap-call-out router serve a pin-to-self

package/dist/main.js

@@ -87,10 +87,13 @@ const ws_slow_consumer_guard_js_1 = require("./api/trpc/ws-slow-consumer-guard.j
 const addon_route_jwt_gate_js_1 = require("./auth/addon-route-jwt-gate.js");
 const addon_route_share_gate_js_1 = require("./auth/addon-route-share-gate.js");
 const auth_rate_limit_1 = require("./auth/auth-rate-limit");
+const external_link_intents_js_1 = require("./auth/external-link-intents.js");
 const session_cookie_js_1 = require("./auth/session-cookie.js");
 const session_mint_js_1 = require("./auth/session-mint.js");
 const sso_finish_js_1 = require("./auth/sso-finish.js");
+const sso_finish_deps_js_1 = require("./auth/sso-finish-deps.js");
 const boot_config_1 = require("./boot/boot-config");
+const platform_keychain_key_1 = require("./boot/platform-keychain-key");
 const integration_id_backfill_1 = require("./boot/integration-id-backfill");
 const post_boot_service_1 = require("./boot/post-boot.service");
 const retired_public_url_env_1 = require("./boot/retired-public-url-env");
@@ -248,6 +251,15 @@ async function bootstrap() {
     // forked, so no child can read it — and warned about once a logger exists
     // (below). See `boot/retired-public-url-env.ts`.
     const publicUrlWarning = (0, retired_public_url_env_1.dropRetiredHubAddressEnv)(process.env);
+    // A desktop hub's keychain master key arrives on an inherited pipe (D788).
+    // Read and closed before anything is forked, so no runner inherits it.
+    const platformKey = (0, platform_keychain_key_1.loadPlatformKeychainKey)();
+    if (platformKey.kind === 'loaded') {
+        console.log(`[keychain] master key provided by the ${platformKey.label}`);
+    }
+    else if (platformKey.kind === 'failed') {
+        console.warn(`[keychain] the desktop app's key pipe could not be read: ${platformKey.error}`);
+    }
     // hub-main's own memory, on the record. Deliberately started HERE and not in
     // the starter: the starter runs from the image's /opt closure, which only
     // changes with a new image, while this entry is what `applyServerUpdate`
@@ -523,10 +535,14 @@ async function bootstrap() {
     // minted by `auth.createHandoffCode`, redeemed by the viewer app via the
     // public `auth.redeemHandoffCode`.
     const handoffCodeService = new handoff_code_service_1.HandoffCodeService();
+    // Pending "link this sign-in account" intents (D782) — minted by
+    // `auth.beginExternalLink`, consumed once by `/api/auth/sso/finish`.
+    const externalLinkIntents = new external_link_intents_js_1.ExternalLinkIntents();
     const buildRouter = () => (0, trpc_router_1.buildAppRouter)({
         authService: app.get(auth_service_1.AuthService),
         shareTokenService,
         handoffCodeService,
+        externalLinkIntents,
         configService: config,
         featureService: app.get(feature_service_1.FeatureService),
         loggingService,
@@ -810,19 +826,30 @@ async function bootstrap() {
         // minted by THE session mint from the user record as it is now (D712) —
         // `auth/sso-finish.ts` holds the rules, this route only maps the reply.
         const ssoAuth = app.get(auth_service_1.AuthService);
+        const ssoLogger = app.get(logging_service_1.LoggingService).createLogger('sso-finish');
         const ssoMinter = (0, session_mint_js_1.createSessionMinter)({
             signer: ssoAuth,
             directory: () => capabilityRegistry.getSingleton('user-management'),
         });
         fastify.get('/api/auth/sso/finish', async (request, reply) => {
-            const outcome = await (0, sso_finish_js_1.finishSsoLogin)(request.query.bridge, {
-                verifyBridge: (token) => ssoAuth.verifySsoBridgeToken(token),
+            const outcome = await (0, sso_finish_js_1.finishSsoLogin)(request.query.bridge, (0, sso_finish_deps_js_1.createSsoFinishDeps)({
+                auth: ssoAuth,
+                registry: capabilityRegistry,
+                moleculer: app.get(moleculer_service_1.MoleculerService),
                 minter: ssoMinter,
-            });
+                linkIntents: externalLinkIntents,
+                logFailure: (error) => ssoLogger.error('SSO finish failed', {
+                    meta: { error: error instanceof Error ? error.message : String(error) },
+                }),
+            }, request.headers.cookie), 
+            // A popup sign-in (D791) returns through the admin-ui completion page.
+            { popup: request.query.popup === '1' });
             if (outcome.kind === 'error')
                 return reply.status(outcome.status).send(outcome.body);
             reply.code(302);
-            reply.header('Location', outcome.location);
+            // Admin-ui paths are relative to the hub's mount (HA ingress etc.).
+            const ssoMount = (0, spa_mount_1.parseForwardedPrefix)(request.headers['x-forwarded-prefix']) ?? '';
+            reply.header('Location', `${ssoMount}${outcome.location}`);
             return reply.send('');
         });
         // ── Backup archive download ─────────────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.480",
+  "version": "1.2.482",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,18 +37,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.353",
-    "@camstack/addon-agent-ui": "1.2.190",
-    "@camstack/addon-auth": "1.2.130",
+    "@camstack/addon-admin-ui": "1.2.355",
+    "@camstack/addon-agent-ui": "1.2.192",
+    "@camstack/addon-auth": "1.2.132",
     "@camstack/addon-decoder-nodeav": "1.2.121",
     "@camstack/addon-notifiers": "1.2.128",
-    "@camstack/addon-pipeline": "1.2.345",
-    "@camstack/addon-pipeline-orchestrator": "1.2.297",
-    "@camstack/addon-post-analysis": "1.2.342",
+    "@camstack/addon-pipeline": "1.2.346",
+    "@camstack/addon-pipeline-orchestrator": "1.2.298",
+    "@camstack/addon-post-analysis": "1.2.344",
     "@camstack/sdk": "1.2.126",
-    "@camstack/system": "1.2.375",
-    "@camstack/types": "1.2.326",
-    "@camstack/ui-library": "1.2.248",
+    "@camstack/system": "1.2.377",
+    "@camstack/types": "1.2.328",
+    "@camstack/ui-library": "1.2.250",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",