@camstack/server 1.2.481 → 1.2.482

package/dist/auth/sso-finish.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OIDC_IDENTITY_PREFIX = exports.OIDC_BRIDGE_PROVIDER_PREFIX = exports.MAGIC_LINK_BRIDGE_PROVIDER = void 0;
+exports.SSO_POPUP_COMPLETE_PATH = exports.SSO_LOGIN_PATH = exports.SSO_PROFILE_PATH = exports.OIDC_IDENTITY_PREFIX = exports.OIDC_BRIDGE_PROVIDER_PREFIX = exports.MAGIC_LINK_BRIDGE_PROVIDER = void 0;
+exports.popupCompletionLocation = popupCompletionLocation;
 exports.isLoginBridge = isLoginBridge;
 exports.finishSsoLogin = finishSsoLogin;
 const auth_provider_gate_js_1 = require("./auth-provider-gate.js");
@@ -22,9 +23,41 @@ exports.MAGIC_LINK_BRIDGE_PROVIDER = 'auth-magic-link';
 exports.OIDC_BRIDGE_PROVIDER_PREFIX = 'auth-oidc/';
 /** `auth-oidc` names an identity `oidc:<instance>:<sub>`. */
 exports.OIDC_IDENTITY_PREFIX = 'oidc:';
-/** Where a completed (or refused) link lands — the signed-in user's profile. */
-const PROFILE_PATH = '/admin/system/my-access';
-const LOGIN_PATH = '/admin/login';
+/**
+ * Where a completed (or refused) link lands — the signed-in user's profile —
+ * and where a login returns. Admin-ui routes, relative to its mount: the
+ * route in `main.ts` prepends the hub's mount prefix. (These read `/admin/…`
+ * once, a path admin-ui has no route for, so both returns drew a blank page.)
+ */
+exports.SSO_PROFILE_PATH = '/system/my-access';
+exports.SSO_LOGIN_PATH = '/login';
+const PROFILE_PATH = exports.SSO_PROFILE_PATH;
+const LOGIN_PATH = exports.SSO_LOGIN_PATH;
+/**
+ * The admin-ui page a POPUP sign-in lands on (D791): it hands the outcome to
+ * the window that opened it and closes, or — opener gone — continues to the
+ * page the outcome names, like a full-page return.
+ */
+exports.SSO_POPUP_COMPLETE_PATH = '/sso-complete';
+/**
+ * The popup form of a return `location`: the completion page, with what the
+ * page return carried — the login FRAGMENT (session / challenge / error) or
+ * the profile QUERY (link outcome) — moved into the completion page's
+ * fragment, after `return=login|profile`. Fragment only: a session still
+ * never reaches a server log, and the completion page never posts it to
+ * another origin.
+ */
+function popupCompletionLocation(location) {
+    const hashAt = location.indexOf('#');
+    const pathAndQuery = hashAt === -1 ? location : location.slice(0, hashAt);
+    const fragment = hashAt === -1 ? '' : location.slice(hashAt + 1);
+    const queryAt = pathAndQuery.indexOf('?');
+    const path = queryAt === -1 ? pathAndQuery : pathAndQuery.slice(0, queryAt);
+    const query = queryAt === -1 ? '' : pathAndQuery.slice(queryAt + 1);
+    const target = path === exports.SSO_PROFILE_PATH ? 'profile' : 'login';
+    const carried = [query, fragment].filter((part) => part.length > 0).join('&');
+    return `${exports.SSO_POPUP_COMPLETE_PATH}#return=${target}${carried.length > 0 ? `&${carried}` : ''}`;
+}
 /**
  * `(provider, subject, issuer)` of an OIDC bridge, or `null` when it is not a
  * well-formed one. A subject is unique only per issuer, so a bridge without
@@ -130,7 +163,13 @@ async function completeLogin(claims, deps) {
     }
     return signIn(await deps.minter.findUser(link.userId), claims.provider, deps);
 }
-async function finishSsoLogin(bridge, deps) {
+async function finishSsoLogin(bridge, deps, options = {}) {
+    const outcome = await finishSsoReturn(bridge, deps);
+    if (options.popup !== true || outcome.kind !== 'redirect')
+        return outcome;
+    return redirect(popupCompletionLocation(outcome.location));
+}
+async function finishSsoReturn(bridge, deps) {
     if (!bridge)
         return { kind: 'error', status: 400, body: { error: 'Missing bridge token' } };
     const claims = deps.verifyBridge(bridge);

package/dist/boot/platform-keychain-key.js

@@ -0,0 +1,94 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.keychainKeyFdFromArgv = keychainKeyFdFromArgv;
+exports.loadPlatformKeychainKey = loadPlatformKeychainKey;
+/**
+ * Read the keychain master key a DESKTOP app handed this hub over an inherited
+ * pipe (D788): `--keychain-key-fd=<n>` names the descriptor, the parent wrote
+ * the key (base64) and closed it. Read once, at boot, before anything else
+ * can — then the descriptor is closed and the key lives only in memory, in
+ * the platform-key slot the keychain builtin reads.
+ *
+ * An env var was rejected: a child's environment is readable by every process
+ * of the same user and is inherited by every addon runner the hub forks.
+ */
+const fs = __importStar(require("node:fs"));
+const system_1 = require("@camstack/system");
+const FD_ARG = '--keychain-key-fd=';
+const KEY_BYTES = 32;
+/** The OS keychain's name, for the Secrets page. */
+function platformLabel(platform) {
+    switch (platform) {
+        case 'darwin':
+            return 'macOS Keychain';
+        case 'win32':
+            return 'Windows DPAPI';
+        default:
+            return 'OS secret service';
+    }
+}
+/** Parse the descriptor number out of argv; `null` when not passed. */
+function keychainKeyFdFromArgv(argv) {
+    const arg = argv.find((a) => a.startsWith(FD_ARG));
+    if (arg === undefined)
+        return null;
+    const n = Number(arg.slice(FD_ARG.length));
+    return Number.isInteger(n) && n > 2 ? n : null;
+}
+function loadPlatformKeychainKey(argv = process.argv, readFd = (fd) => fs.readFileSync(fd, 'utf8'), closeFd = (fd) => fs.closeSync(fd)) {
+    const fd = keychainKeyFdFromArgv(argv);
+    if (fd === null)
+        return { kind: 'none' };
+    try {
+        const key = Buffer.from(readFd(fd).trim(), 'base64');
+        if (key.length !== KEY_BYTES)
+            return { kind: 'failed', error: 'not 32 bytes of key material' };
+        const label = platformLabel(process.platform);
+        (0, system_1.setPlatformKeychainKey)({ label, key });
+        return { kind: 'loaded', label };
+    }
+    catch (err) {
+        return { kind: 'failed', error: err instanceof Error ? err.message : String(err) };
+    }
+    finally {
+        try {
+            closeFd(fd);
+        }
+        catch {
+            /* already closed */
+        }
+    }
+}

package/dist/core/addon/addon-registry.service.js

@@ -1151,6 +1151,22 @@ class AddonRegistryService {
      * addon (`execution.group`) is never misclassified as `in-process`.
      * Falls back to the addon id when the declaration is not yet known.
      */
+    /** The runner id hosting an addon — its `execution.group`, or itself. */
+    runnerIdFor(addonId) {
+        return this.childIdForAddon(addonId);
+    }
+    /**
+     * A hub in-process keychain handle acting for `owner` — the door hub-main
+     * code (the integration settings provider) uses to keep another addon's
+     * values (D787). Never handed to an addon.
+     */
+    secretsForOwner(owner) {
+        return (0, types_1.createSecretsAccess)({
+            owner,
+            transport: this.inProcessKeychainTransport(owner),
+            eventBus: this.eventBusService,
+        });
+    }
     childIdForAddon(addonId) {
         const decl = this.addonEntries.get(addonId)?.declaration;
         return decl ? (0, types_1.resolveRunnerId)(decl, addonId) : addonId;
@@ -2934,6 +2950,9 @@ class AddonRegistryService {
             deps: new system_1.AddonDepsManager(dataDir, logger),
             kernel: {
                 localNodeId: this.broker.nodeID,
+                // The keychain accepts a grouped runner's stamp (its group id) for the
+                // refs of the addons that runner hosts.
+                runnerIdForAddon: (id) => this.childIdForAddon(id),
                 storage: storageProvider ?? undefined,
                 deviceRegistry: this.deviceRegistry ?? undefined,
                 devices: deviceManagerApi,
@@ -2978,6 +2997,16 @@ class AddonRegistryService {
                 return (0, types_1.createDeviceProxy)(api, binding);
             },
             settings: settingsView,
+            // This builtin's keychain values (D787). In-process, so the caller is
+            // STATED (no wire, no stamp) — the one place the keychain trusts a
+            // claim. `forOwner` is the door a system builtin (device-manager,
+            // storage-orchestrator) uses to keep another addon's values.
+            secrets: (0, types_1.createSecretsAccess)({
+                owner: addonId,
+                transport: this.inProcessKeychainTransport(addonId),
+                transportForOwner: (owner) => this.inProcessKeychainTransport(owner),
+                eventBus: this.eventBusService,
+            }),
             useCapability(capName, scope = { type: 'global' }) {
                 return getOrCreateHandle(capName, scope, 15_000);
             },
@@ -2997,6 +3026,36 @@ class AddonRegistryService {
         };
         return ctx;
     }
+    /**
+     * The keychain transport of a hub in-process caller: the provider lives in
+     * this process, so the call goes straight to it with the caller STATED.
+     * Built per call so a keychain registered after this context still answers;
+     * a missing provider throws, which `ctx.secrets` reads as `unavailable`.
+     */
+    inProcessKeychainTransport(owner) {
+        const provider = () => {
+            const p = this.capabilityRegistry.getSingleton('keychain');
+            if (p === null || p === undefined)
+                throw new Error('keychain provider is not registered');
+            return p;
+        };
+        const callerAddonId = owner;
+        return {
+            put: (input) => {
+                const stated = { ref: input.ref, value: input.value, callerAddonId };
+                return provider().put(stated);
+            },
+            resolve: (input) => {
+                const stated = { refs: [...input.refs], callerAddonId };
+                return provider().resolve(stated);
+            },
+            delete: (input) => {
+                const stated = { refs: [...input.refs], callerAddonId };
+                return provider().delete(stated);
+            },
+            getState: () => provider().getState({}),
+        };
+    }
     /**
      * Per-addon disposer chain. Created lazily the first time an addon
      * calls `ctx.addDisposer(...)`. Drained by `restartAddon()` /

package/dist/core/addon/addon-settings-provider.js

@@ -76,7 +76,13 @@ function createAddonSettingsProvider(deps) {
                 if (!addon || typeof addon.updateGlobalSettings !== 'function') {
                     throw new Error(`Addon "${input.addonId}" does not implement updateGlobalSettings`);
                 }
-                await addon.updateGlobalSettings(input.patch, input.nodeId);
+                // The admin API's write is the OPERATOR's (D787).
+                if (typeof addon.updateGlobalSettingsAsOperator === 'function') {
+                    await addon.updateGlobalSettingsAsOperator(input.patch, input.nodeId);
+                }
+                else {
+                    await addon.updateGlobalSettings(input.patch, input.nodeId);
+                }
                 return { success: true };
             }
             return forkedUpdate(input.addonId, 'updateGlobalSettings', { patch: input.patch, ...(input.nodeId ? { nodeId: input.nodeId } : {}) }, input.nodeId);

package/dist/core/moleculer/moleculer.service.js

@@ -132,6 +132,27 @@ class MoleculerService {
     setRunnerIdResolver(resolver) {
         this.runnerIdResolver = resolver;
     }
+    /**
+     * Does `nodeId` (an agent) host the runner `runnerId`? Read from what the
+     * node itself registered: its manifest names the addons it runs, and an
+     * addon's runner is its `execution.group` or itself. A node that never
+     * registered hosts nothing.
+     */
+    isRunnerOnNode(nodeId, runnerId) {
+        const nodes = this.nodeRegistry
+            .listNodeIds()
+            .filter((id) => id === nodeId || id.startsWith(`${nodeId}/`));
+        if (nodes.includes(`${nodeId}/${runnerId}`))
+            return true;
+        for (const id of nodes) {
+            for (const entry of this.nodeRegistry.getNodeManifest(id) ?? []) {
+                const runner = this.runnerIdResolver?.(entry.addonId) ?? entry.addonId;
+                if (entry.addonId === runnerId || runner === runnerId)
+                    return true;
+            }
+        }
+        return false;
+    }
     get childRegistry() {
         return this.localChildRegistry;
     }
@@ -400,7 +421,16 @@ class MoleculerService {
             // `broker.call('$hub-cap-fwd.forward', …)` discovers it here. Without it a
             // remote agent's raw `${cap}.*` discovery 30s-deadlines (hub-local addon
             // runners expose no Moleculer service). See hub-cap-forward.ts.
-            this.brokerSafe.createService((0, system_1.createHubCapForwardService)(onUnownedCall));
+            this.brokerSafe.createService((0, system_1.createHubCapForwardService)(onUnownedCall, {
+                // The agent stamps WHO is calling (its child's runner id) into the
+                // envelope (D787). Believe it only when that runner is on the agent
+                // the request came from — a node's registered manifest lists the
+                // addons it hosts, and a grouped runner answers to its group id.
+                isCallerOnNode: (senderNodeId, callerRunnerId) => this.isRunnerOnNode(senderNodeId, callerRunnerId),
+                onRejectedCaller: (senderNodeId, callerRunnerId) => logger.warn('dropped an agent caller stamp the sender does not host', {
+                    meta: { senderNodeId, callerRunnerId },
+                }),
+            }));
             const registry = new system_1.LocalChildRegistry({
                 server: (0, system_1.createLocalTransport)().createServer(nodeId),
                 // This node's own id — lets the cap-call-out router serve a pin-to-self

package/dist/main.js

@@ -87,12 +87,13 @@ const ws_slow_consumer_guard_js_1 = require("./api/trpc/ws-slow-consumer-guard.j
 const addon_route_jwt_gate_js_1 = require("./auth/addon-route-jwt-gate.js");
 const addon_route_share_gate_js_1 = require("./auth/addon-route-share-gate.js");
 const auth_rate_limit_1 = require("./auth/auth-rate-limit");
+const external_link_intents_js_1 = require("./auth/external-link-intents.js");
 const session_cookie_js_1 = require("./auth/session-cookie.js");
 const session_mint_js_1 = require("./auth/session-mint.js");
-const external_link_intents_js_1 = require("./auth/external-link-intents.js");
 const sso_finish_js_1 = require("./auth/sso-finish.js");
 const sso_finish_deps_js_1 = require("./auth/sso-finish-deps.js");
 const boot_config_1 = require("./boot/boot-config");
+const platform_keychain_key_1 = require("./boot/platform-keychain-key");
 const integration_id_backfill_1 = require("./boot/integration-id-backfill");
 const post_boot_service_1 = require("./boot/post-boot.service");
 const retired_public_url_env_1 = require("./boot/retired-public-url-env");
@@ -250,6 +251,15 @@ async function bootstrap() {
     // forked, so no child can read it — and warned about once a logger exists
     // (below). See `boot/retired-public-url-env.ts`.
     const publicUrlWarning = (0, retired_public_url_env_1.dropRetiredHubAddressEnv)(process.env);
+    // A desktop hub's keychain master key arrives on an inherited pipe (D788).
+    // Read and closed before anything is forked, so no runner inherits it.
+    const platformKey = (0, platform_keychain_key_1.loadPlatformKeychainKey)();
+    if (platformKey.kind === 'loaded') {
+        console.log(`[keychain] master key provided by the ${platformKey.label}`);
+    }
+    else if (platformKey.kind === 'failed') {
+        console.warn(`[keychain] the desktop app's key pipe could not be read: ${platformKey.error}`);
+    }
     // hub-main's own memory, on the record. Deliberately started HERE and not in
     // the starter: the starter runs from the image's /opt closure, which only
     // changes with a new image, while this entry is what `applyServerUpdate`
@@ -831,11 +841,15 @@ async function bootstrap() {
                 logFailure: (error) => ssoLogger.error('SSO finish failed', {
                     meta: { error: error instanceof Error ? error.message : String(error) },
                 }),
-            }, request.headers.cookie));
+            }, request.headers.cookie), 
+            // A popup sign-in (D791) returns through the admin-ui completion page.
+            { popup: request.query.popup === '1' });
             if (outcome.kind === 'error')
                 return reply.status(outcome.status).send(outcome.body);
             reply.code(302);
-            reply.header('Location', outcome.location);
+            // Admin-ui paths are relative to the hub's mount (HA ingress etc.).
+            const ssoMount = (0, spa_mount_1.parseForwardedPrefix)(request.headers['x-forwarded-prefix']) ?? '';
+            reply.header('Location', `${ssoMount}${outcome.location}`);
             return reply.send('');
         });
         // ── Backup archive download ─────────────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.481",
+  "version": "1.2.482",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,18 +37,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.354",
-    "@camstack/addon-agent-ui": "1.2.191",
-    "@camstack/addon-auth": "1.2.131",
+    "@camstack/addon-admin-ui": "1.2.355",
+    "@camstack/addon-agent-ui": "1.2.192",
+    "@camstack/addon-auth": "1.2.132",
     "@camstack/addon-decoder-nodeav": "1.2.121",
     "@camstack/addon-notifiers": "1.2.128",
-    "@camstack/addon-pipeline": "1.2.345",
-    "@camstack/addon-pipeline-orchestrator": "1.2.297",
-    "@camstack/addon-post-analysis": "1.2.343",
+    "@camstack/addon-pipeline": "1.2.346",
+    "@camstack/addon-pipeline-orchestrator": "1.2.298",
+    "@camstack/addon-post-analysis": "1.2.344",
     "@camstack/sdk": "1.2.126",
-    "@camstack/system": "1.2.376",
-    "@camstack/types": "1.2.327",
-    "@camstack/ui-library": "1.2.249",
+    "@camstack/system": "1.2.377",
+    "@camstack/types": "1.2.328",
+    "@camstack/ui-library": "1.2.250",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",