@camstack/server 1.2.486 → 1.2.487

package/dist/auth/used-bridge-ids.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UsedBridgeIds = void 0;
+/**
+ * The `jti`s of login bridges already swapped for a session or a link.
+ *
+ * A bridge lives 5 minutes; until it expires a second presentation is refused.
+ * Entries are kept for {@link RETENTION_MS} (longer than any bridge), and the
+ * set is bounded — only a bridge that verified AND matched its browser's
+ * state cookie is ever recorded, so filling it needs that many real sign-ins.
+ *
+ * In memory: a hub restart within a bridge's 5 minutes forgets it, and the
+ * browser binding (the bridge is useless without the state cookie of the
+ * browser that started the sign-in) is what still stands then.
+ */
+const RETENTION_MS = 10 * 60_000;
+const DEFAULT_MAX_ENTRIES = 10_000;
+class UsedBridgeIds {
+    used = new Map();
+    now;
+    maxEntries;
+    constructor(opts = {}) {
+        this.now = opts.now ?? Date.now;
+        this.maxEntries = opts.maxEntries ?? DEFAULT_MAX_ENTRIES;
+    }
+    /** Record `jti`; `true` the first time, `false` for every replay. */
+    consume(jti) {
+        const at = this.now();
+        this.prune(at);
+        if (this.used.has(jti))
+            return false;
+        while (this.used.size >= this.maxEntries) {
+            const oldest = this.used.keys().next();
+            if (oldest.done)
+                break;
+            this.used.delete(oldest.value);
+        }
+        this.used.set(jti, at + RETENTION_MS);
+        return true;
+    }
+    size() {
+        return this.used.size;
+    }
+    prune(at) {
+        for (const [jti, until] of this.used) {
+            if (until > at)
+                break; // insertion order = expiry order
+            this.used.delete(jti);
+        }
+    }
+}
+exports.UsedBridgeIds = UsedBridgeIds;

package/dist/core/addon/addon-registry.service.js

@@ -180,11 +180,15 @@ function parseSerializableRouteDescriptors(raw) {
             throw new Error('addon-routes: route descriptor missing method/path');
         }
         const description = Reflect.get(entry, 'description');
+        // An unknown limit name is dropped, never widened into "no limit" silently
+        // by a typo on the hub side: only names the hub implements are kept.
+        const rateLimit = Reflect.get(entry, 'rateLimit') === 'auth' ? 'auth' : undefined;
         return {
             method: asRouteMethod(method),
             path: routePath,
             access: asRouteAccess(Reflect.get(entry, 'access')),
             ...(typeof description === 'string' ? { description } : {}),
+            ...(rateLimit !== undefined ? { rateLimit } : {}),
         };
     });
 }
@@ -2686,6 +2690,7 @@ class AddonRegistryService {
             path: route.path,
             access: route.access,
             ...(route.description !== undefined ? { description: route.description } : {}),
+            ...(route.rateLimit !== undefined ? { rateLimit: route.rateLimit } : {}),
             handler: async (req, reply) => {
                 const envelope = await invoker.invoke({
                     method: route.method,

package/dist/core/agent/agent-registry.service.js

@@ -448,6 +448,16 @@ class AgentRegistryService {
         this.moleculer.setOnAgentRegistered((agentId) => {
             void this.reconcileAgentAddons(agentId, 'node-registration');
         });
+        // D802: the mesh `transition` ends only once every agent this hub has
+        // EVER seen has authenticated — offline ones included. `null` (store not
+        // wired or not answering) never counts as "no agents".
+        this.moleculer.setKnownAgentsProvider(async () => {
+            const store = this.historyStore;
+            if (!store)
+                return null;
+            const rows = await store.tryGetAll();
+            return rows === null ? null : rows.filter((r) => !r.isHub).map((r) => r.id);
+        });
         this.broker.localBus.on('$node.connected', ({ node }) => {
             const kind = classifyNode(node.id);
             if (!kind)

package/dist/core/auth/auth.service.js

@@ -1,7 +1,56 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthService = void 0;
+exports.AuthService = exports.SessionRevokedError = void 0;
 const system_1 = require("@camstack/system");
+/**
+ * A session-grade token whose server-side session is gone (logged out,
+ * revoked, expired) or cannot be checked right now. Every caller of
+ * `verifyToken` already treats a throw as "not authenticated".
+ */
+class SessionRevokedError extends Error {
+    reason;
+    constructor(reason) {
+        super(`Session is no longer valid (${reason})`);
+        this.reason = reason;
+        this.name = 'SessionRevokedError';
+    }
+}
+exports.SessionRevokedError = SessionRevokedError;
+/** A v2 session token: string `userId`, boolean `isAdmin`, no `kind` (not a bridge/challenge). */
+function isSessionGrade(payload) {
+    return (Reflect.get(payload, 'kind') === undefined &&
+        typeof payload.userId === 'string' &&
+        typeof payload.isAdmin === 'boolean');
+}
 class AuthService extends system_1.AuthManager {
+    sessionCheck = null;
+    /**
+     * Wire the login-session check (`hub-sessions.ts`). From then on EVERY
+     * `verifyToken` of a session-grade token — the tRPC boundary, addon routes,
+     * the session cookie, the OAuth authorize page, health, uploads — also
+     * requires its session to be live, so a revocation applies everywhere at
+     * once and no surface can forget to ask.
+     */
+    setSessionCheck(check) {
+        this.sessionCheck = check;
+    }
+    /**
+     * Why the session behind `payload` is no longer valid, or `null` when it is
+     * (or when no check is wired). For a principal resolved earlier — a
+     * WebSocket re-checks its session on every call without re-verifying an
+     * access token that may have expired since connect.
+     */
+    checkSession(payload) {
+        return this.sessionCheck === null ? null : this.sessionCheck(payload);
+    }
+    verifyToken(token) {
+        const payload = super.verifyToken(token);
+        if (this.sessionCheck !== null && isSessionGrade(payload)) {
+            const refusal = this.sessionCheck(payload);
+            if (refusal !== null)
+                throw new SessionRevokedError(refusal);
+        }
+        return payload;
+    }
 }
 exports.AuthService = AuthService;

package/dist/core/auth/handoff-code.service.js

@@ -79,14 +79,19 @@ class HandoffCodeService {
     /** Mint a single-use code bound to `userId`. Throws when the pending
      *  store is full even after pruning expired entries (fail fast — a
      *  legitimate flow never has anywhere near this many in flight). */
-    create(userId) {
+    create(userId, options = {}) {
         this.prune();
         if (this.pending.size >= exports.HANDOFF_CODE_MAX_PENDING) {
             throw new Error('Too many pending handoff codes — try again shortly');
         }
         const code = `${exports.HANDOFF_CODE_PREFIX}${crypto.randomBytes(32).toString('hex')}`;
         const expiresAt = this.now() + this.ttlMs;
-        this.pending.set(hashCode(code), { userId, expiresAt });
+        this.pending.set(hashCode(code), {
+            userId,
+            ...(options.sessionId !== undefined ? { sessionId: options.sessionId } : {}),
+            purpose: options.purpose ?? 'renew',
+            expiresAt,
+        });
         return { code, expiresAt };
     }
     /** Redeem a raw code. Consumes the entry on the FIRST attempt no
@@ -99,7 +104,8 @@ class HandoffCodeService {
         this.pending.delete(hashCode(code));
         if (this.now() > entry.expiresAt)
             return null;
-        return { userId: entry.userId };
+        const { expiresAt: _expiresAt, ...grant } = entry;
+        return grant;
     }
     /** Number of not-yet-redeemed (possibly expired) codes. Test/diag aid. */
     get pendingCount() {

package/dist/core/moleculer/hub-mesh-guard.js

@@ -0,0 +1,132 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HubMeshGuard = void 0;
+/**
+ * The hub's mesh guard (D802) — one object owning everything that decides
+ * whether another node may talk to the hub:
+ *
+ *  - the {@link MeshAuthenticator} (who proved what, on which connection);
+ *  - the broker middleware built on it (installed at broker construction);
+ *  - the System → Cluster status slot;
+ *  - the automatic end of `transition` ({@link decideMeshAutoEnforce}), checked
+ *    after every successful join and once a minute.
+ *
+ * Kept out of `moleculer.service.ts` so that file only wires it.
+ */
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
+/** How often `transition` is re-checked when nothing joins. */
+const AUTO_ENFORCE_INTERVAL_MS = 60_000;
+class HubMeshGuard {
+    ownNodeId;
+    logger;
+    authenticator;
+    startedAt = Date.now();
+    knownAgents = null;
+    listConnected = () => [];
+    timer = null;
+    evaluating = false;
+    lastWaitingFor = '';
+    constructor(ownNodeId, logger) {
+        this.ownNodeId = ownNodeId;
+        this.logger = logger;
+        this.authenticator = new system_1.MeshAuthenticator({
+            ownNodeId,
+            gate: system_1.getProcessClusterSecretGate,
+            mode: system_1.getProcessMeshAuthMode,
+            onAuthenticated: (nodeId) => {
+                this.logger.info('node authenticated to the mesh (challenge–response)', {
+                    meta: { nodeId },
+                });
+                void this.evaluateAutoEnforce();
+            },
+            onTolerated: (nodeId, action) => {
+                this.logger.warn('node is calling the hub WITHOUT having authenticated — tolerated while System → ' +
+                    'Cluster is in Transition. Enter the cluster secret in this agent.', { meta: { nodeId, firstCall: action } });
+            },
+        });
+        (0, system_1.setProcessMeshAuthStatusSource)(() => this.authenticator.snapshot());
+    }
+    /** The middleware the hub broker must be constructed with. */
+    middleware() {
+        return (0, system_1.createMeshAccessMiddleware)({
+            ownNodeId: this.ownNodeId,
+            authenticator: this.authenticator,
+            logger: {
+                warn: (message, meta) => this.logger.warn(message, meta ? { meta } : undefined),
+            },
+        });
+    }
+    /** Start the periodic auto-enforce check; `listConnected` reads the live node list. */
+    start(listConnected) {
+        this.listConnected = listConnected;
+        if (this.timer !== null)
+            return;
+        this.timer = setInterval(() => void this.evaluateAutoEnforce(), AUTO_ENFORCE_INTERVAL_MS);
+        this.timer.unref?.();
+    }
+    /** Wired by `AgentRegistryService`, which owns the cluster-node history. */
+    setKnownAgentsProvider(provider) {
+        this.knownAgents = provider;
+    }
+    /** A node's connection dropped. */
+    forget(nodeId) {
+        this.authenticator.forget(nodeId);
+    }
+    stop() {
+        if (this.timer !== null)
+            clearInterval(this.timer);
+        this.timer = null;
+        (0, system_1.setProcessMeshAuthStatusSource)(null);
+    }
+    /** Public for the spec; the timer and every join call it. */
+    async evaluateAutoEnforce() {
+        if (this.evaluating || (0, system_1.getProcessMeshAuthMode)() !== 'transition')
+            return;
+        this.evaluating = true;
+        try {
+            let knownAgents = null;
+            if (this.knownAgents !== null) {
+                try {
+                    knownAgents = await this.knownAgents();
+                }
+                catch {
+                    knownAgents = null;
+                }
+            }
+            const decision = (0, system_1.decideMeshAutoEnforce)({
+                mode: (0, system_1.getProcessMeshAuthMode)(),
+                gate: (0, system_1.getProcessClusterSecretGate)().kind,
+                uptimeMs: Date.now() - this.startedAt,
+                knownAgents,
+                connected: this.listConnected(),
+                toleratedEver: this.authenticator.everToleratedNodeIds(),
+                authenticatedEver: this.authenticator.everAuthenticatedNodeIds(),
+                ownNodeId: this.ownNodeId,
+            });
+            if (!decision.enforce) {
+                const waiting = decision.waitingFor.join(',');
+                if (waiting.length > 0 && waiting !== this.lastWaitingFor) {
+                    this.logger.info('mesh transition: still waiting for agents to authenticate', {
+                        meta: { waitingFor: decision.waitingFor },
+                    });
+                }
+                this.lastWaitingFor = waiting;
+                return;
+            }
+            const done = await (0, system_1.requestProcessMeshEnforcement)(decision.reason);
+            if (done) {
+                this.logger.info('mesh authentication switched to ENFORCED', {
+                    meta: { reason: decision.reason },
+                });
+            }
+        }
+        catch (err) {
+            this.logger.warn('mesh auto-enforce check failed', { meta: { error: (0, types_1.errMsg)(err) } });
+        }
+        finally {
+            this.evaluating = false;
+        }
+    }
+}
+exports.HubMeshGuard = HubMeshGuard;

package/dist/core/moleculer/moleculer.service.js

@@ -9,6 +9,7 @@ const types_1 = require("@camstack/types");
 const cap_router_runtime_js_1 = require("../../api/trpc/cap-router-runtime.js");
 const core_cap_bridge_js_1 = require("../../api/trpc/core-cap-bridge.js");
 const agent_readiness_pull_js_1 = require("./agent-readiness-pull.js");
+const hub_mesh_guard_js_1 = require("./hub-mesh-guard.js");
 const cap_call_fn_js_1 = require("./cap-call-fn.js");
 const cap_route_authority_js_1 = require("./cap-route-authority.js");
 class MoleculerService {
@@ -23,6 +24,12 @@ class MoleculerService {
         return this.broker;
     }
     logger;
+    /**
+     * D802 — who may talk to the hub over the mesh: the challenge–response join,
+     * the broker middleware that refuses / tolerates unauthenticated nodes and
+     * strips forged identities, and the automatic end of `transition`.
+     */
+    meshGuard;
     /**
      * D3 authority: union of every node's manifest delivered via
      * `$hub.registerNode`. Populated by `onRegisterNode` in `hubDeps`.
@@ -190,9 +197,12 @@ class MoleculerService {
         // can answer, and the Moleculer namespace was never authentication (TCP
         // ignores it; UDP discovery broadcasts it in clear). The secret gates
         // `$hub.registerNode`, read from the keychain at call time.
+        this.meshGuard = new hub_mesh_guard_js_1.HubMeshGuard('hub', this.logging.createLogger('mesh-auth'));
         const broker = (0, system_1.createBroker)({
             nodeID: 'hub',
             mode: 'hub',
+            // D802: every action and event another node sends passes the mesh gate.
+            middlewares: [this.meshGuard.middleware()],
             logLevel: this.config.get('moleculer.logLevel') ?? 'warn',
             ...(tcpPort && !Number.isNaN(tcpPort) ? { tcpPort } : {}),
             ...(udpPort && !Number.isNaN(udpPort) ? { udpPort } : {}),
@@ -217,6 +227,23 @@ class MoleculerService {
     setOnAgentRegistered(cb) {
         this.onAgentRegisteredCb = cb;
     }
+    /**
+     * D802: the cluster-node history, for the automatic end of the mesh
+     * `transition` — wired by `AgentRegistryService`, which owns the history.
+     */
+    setKnownAgentsProvider(provider) {
+        this.meshGuard.setKnownAgentsProvider(provider);
+    }
+    /** Every node Moleculer currently lists as available (this hub included). */
+    listAvailableNodeIds() {
+        const registry = this.broker.registry;
+        try {
+            return (registry?.getNodeList?.({ onlyAvailable: true }) ?? []).map((n) => n.id);
+        }
+        catch {
+            return [];
+        }
+    }
     async onModuleInit() {
         const logger = this.logging.createLogger('moleculer');
         const hubDeps = {
@@ -270,6 +297,8 @@ class MoleculerService {
             },
             // System → Cluster, from the keychain (D797): off / on / unknown.
             clusterSecretGate: system_1.getProcessClusterSecretGate,
+            // D802: challenge–response join + who may register.
+            meshAuth: this.meshGuard.authenticator,
         };
         const hubService = (0, system_1.createHubService)(hubDeps);
         this.brokerSafe.createService(hubService);
@@ -613,6 +642,8 @@ class MoleculerService {
             // the incarnation) and this call is refused if the id has been reclaimed;
             // remote nodes register no owner at all, so they clean up as before.
             this.removeNodeFromRegistry(node.id);
+            // D802: a node authenticates again on its next connection.
+            this.meshGuard.forget(node.id);
         });
         // D8 reverse-leg snapshot-reconcile: on every agent (re)connect, pull
         // the agent's own readiness snapshot (`$agent-readiness.getSnapshot`)
@@ -661,6 +692,7 @@ class MoleculerService {
         }));
         await this.brokerSafe.start();
         logger.info('Moleculer broker started (TCP transport)');
+        this.meshGuard.start(() => this.listAvailableNodeIds());
         // Construct the CapRouteResolver now that both the broker and
         // localChildRegistry are ready. The resolver reads live registry state
         // via closure accessors on every call (not a frozen snapshot), so new
@@ -1290,6 +1322,7 @@ class MoleculerService {
         }
     }
     async onModuleDestroy() {
+        this.meshGuard.stop();
         if (this.agentReadinessPullTimer !== null) {
             clearInterval(this.agentReadinessPullTimer);
             this.agentReadinessPullTimer = null;

package/dist/main.js

@@ -86,12 +86,17 @@ const ws_request_census_1 = require("./api/trpc/ws-request-census");
 const ws_slow_consumer_guard_js_1 = require("./api/trpc/ws-slow-consumer-guard.js");
 const addon_route_jwt_gate_js_1 = require("./auth/addon-route-jwt-gate.js");
 const addon_route_share_gate_js_1 = require("./auth/addon-route-share-gate.js");
+const auth_network_policy_js_1 = require("./auth/auth-network-policy.js");
+const hub_sessions_js_1 = require("./auth/hub-sessions.js");
+const session_lifetimes_js_1 = require("./auth/session-lifetimes.js");
 const auth_rate_limit_1 = require("./auth/auth-rate-limit");
 const external_link_intents_js_1 = require("./auth/external-link-intents.js");
 const session_cookie_js_1 = require("./auth/session-cookie.js");
 const session_mint_js_1 = require("./auth/session-mint.js");
-const sso_finish_js_1 = require("./auth/sso-finish.js");
 const sso_finish_deps_js_1 = require("./auth/sso-finish-deps.js");
+const sso_routes_js_1 = require("./auth/sso-routes.js");
+const used_bridge_ids_js_1 = require("./auth/used-bridge-ids.js");
+const native_link_completions_js_1 = require("./auth/native-link-completions.js");
 const boot_config_1 = require("./boot/boot-config");
 const platform_keychain_key_1 = require("./boot/platform-keychain-key");
 const integration_id_backfill_1 = require("./boot/integration-id-backfill");
@@ -410,6 +415,16 @@ async function bootstrap() {
     storageService.setLocationManager(infra.locationManager);
     // ConfigService — SettingsStore is wired later by the settings-store capability consumer
     const config = app.get(config_service_1.ConfigService);
+    // The real client address behind a trusted proxy, and the opt-in trusted
+    // networks — read from settings per request (auth-network-policy.ts).
+    const authNetwork = (0, auth_network_policy_js_1.createAuthNetworkPolicy)((key) => config.get(key));
+    // Public addon routes that declare `rateLimit: 'auth'` (an IdP start /
+    // callback) and the SSO finish: 30 per minute per real client address.
+    const authRouteLimiter = (0, auth_rate_limit_1.createRateLimiter)({ windowMs: 60_000, max: 30 });
+    // Login sessions (local-auth's table, reached through its hub-internal
+    // surface): every session token minted from here on carries a `sid`, and
+    // every verify of one asks whether that session is still live.
+    const sessionLifetimes = () => (0, session_lifetimes_js_1.readSessionLifetimes)((key) => config.get(key));
     // Register addon upload route (multipart — must be registered before tRPC).
     // We pass AddonRegistryService so the handler can resolve the
     // `user-management` cap singleton at request time (the only working
@@ -498,6 +513,11 @@ async function bootstrap() {
     addonRegistry.setDataPlaneRegistry(dataPlaneRegistry);
     // ── Configure the CapabilityRegistry (created in AddonRegistryService constructor) ──
     const capabilityRegistry = addonRegistry.getCapabilityRegistry();
+    const sessionBacking = (0, hub_sessions_js_1.sessionBackingFrom)(capabilityRegistry, sessionLifetimes);
+    // From here on every verify of a session-grade token — tRPC, addon routes,
+    // the session cookie, OAuth authorize, uploads, health — requires its
+    // session to be live (`hub-sessions.ts`).
+    app.get(auth_service_1.AuthService).setSessionCheck((0, hub_sessions_js_1.createSessionTokenCheck)(capabilityRegistry));
     // Declare every shipped capability BEFORE app.init() so addon
     // registerProvider() calls (in-process or via the Moleculer bridge
     // from forked workers / agents) find their definition during
@@ -507,7 +527,7 @@ async function bootstrap() {
         capabilityRegistry.declareCapability(capDef);
     }
     // Hub-internal `sso-bridge` provider — gives auth-provider addons
-    // (OIDC, SAML, magic-link, …) a typed gateway to mint an HMAC-signed
+    // (OIDC, SAML, …) a typed gateway to mint an HMAC-signed
     // bridge token before redirecting to `/api/auth/sso/finish`. Without
     // this, the finish endpoint would have to trust unsigned query params
     // (anyone could craft `?isAdmin=1`). Backed by AuthService.
@@ -538,12 +558,41 @@ async function bootstrap() {
     // Pending "link this sign-in account" intents (D782) — minted by
     // `auth.beginExternalLink`, consumed once by `/api/auth/sso/finish`.
     const externalLinkIntents = new external_link_intents_js_1.ExternalLinkIntents();
+    // Native-app links parked for the app to claim, and one-time codes that
+    // open the account page signed in, in a browser (D801).
+    const nativeLinkCompletions = new native_link_completions_js_1.NativeLinkCompletions();
+    // `jti`s of login bridges already finished — a bridge is single-use.
+    const usedBridgeIds = new used_bridge_ids_js_1.UsedBridgeIds();
+    const browserHandoffCodes = new handoff_code_service_1.HandoffCodeService();
+    const nativeLinkMinter = (0, session_mint_js_1.createSessionMinter)({
+        signer: app.get(auth_service_1.AuthService),
+        directory: () => capabilityRegistry.getSingleton('user-management'),
+        sessions: sessionBacking,
+    });
+    const nativeLinkWiring = () => ({
+        auth: app.get(auth_service_1.AuthService),
+        registry: capabilityRegistry,
+        moleculer: app.get(moleculer_service_1.MoleculerService),
+        minter: nativeLinkMinter,
+        linkIntents: externalLinkIntents,
+        nativeLinks: nativeLinkCompletions,
+        usedBridgeIds,
+    });
     const buildRouter = () => (0, trpc_router_1.buildAppRouter)({
         authService: app.get(auth_service_1.AuthService),
         shareTokenService,
         handoffCodeService,
         externalLinkIntents,
+        nativeLink: {
+            completions: nativeLinkCompletions,
+            browserHandoffs: browserHandoffCodes,
+            // The SSO finish's own link step — the same conflict rule, the same
+            // store — run for the app's claim instead of the browser's return.
+            link: (input) => (0, sso_finish_deps_js_1.createSsoFinishDeps)(nativeLinkWiring(), undefined).identities.link(input),
+        },
         configService: config,
+        authNetworkPolicy: authNetwork,
+        sessionBacking,
         featureService: app.get(feature_service_1.FeatureService),
         loggingService,
         eventBus: app.get(event_bus_service_1.EventBusService),
@@ -582,7 +631,11 @@ async function bootstrap() {
         beforeAddonBoot: () => {
             try {
                 appRouter = buildRouter();
-                app.get(moleculer_service_1.MoleculerService).registerCoreCapService((0, core_cap_bridge_1.buildCoreCapService)(appRouter));
+                {
+                    const meshBroker = app.get(moleculer_service_1.MoleculerService);
+                    // D802: another node's call runs as `node:<id>`, never the hub's own principal.
+                    meshBroker.registerCoreCapService((0, core_cap_bridge_1.buildCoreCapService)(appRouter, undefined, { ownNodeId: meshBroker.nodeId }));
+                }
                 console.log('[bootstrap] core-cap mesh bridge registered ($core-caps) — before addon boot');
             }
             catch (err) {
@@ -629,6 +682,7 @@ async function bootstrap() {
         (0, adaptive_probe_routes_1.registerAdaptiveProbeRoute)(fastify, {
             verifyToken: (token) => app.get(auth_service_1.AuthService).verifyToken(token),
             limiter: (0, auth_rate_limit_1.createRateLimiter)({ windowMs: 60_000, max: adaptive_probe_routes_1.ADAPTIVE_PROBE_PER_IP_PER_MINUTE }),
+            network: authNetwork,
         });
     }
     catch (err) {
@@ -670,7 +724,11 @@ async function bootstrap() {
         if (appRouter === null) {
             appRouter = buildRouter();
             try {
-                app.get(moleculer_service_1.MoleculerService).registerCoreCapService((0, core_cap_bridge_1.buildCoreCapService)(appRouter));
+                {
+                    const meshBroker = app.get(moleculer_service_1.MoleculerService);
+                    // D802: another node's call runs as `node:<id>`, never the hub's own principal.
+                    meshBroker.registerCoreCapService((0, core_cap_bridge_1.buildCoreCapService)(appRouter, undefined, { ownNodeId: meshBroker.nodeId }));
+                }
                 console.log('[bootstrap] core-cap mesh bridge registered ($core-caps) — late fallback');
             }
             catch (err) {
@@ -820,37 +878,31 @@ async function bootstrap() {
             reply.header('cache-control', 'public, max-age=86400');
             return reply.send(fs.readFileSync(filePath));
         });
-        // ── SSO finish endpoint ─────────────────────────────────────────
-        // OIDC / magic-link redirect here with an HMAC-signed LOGIN bridge
-        // (`sso-bridge` cap). The bridge says who signed in; the session is
-        // minted by THE session mint from the user record as it is now (D712) —
-        // `auth/sso-finish.ts` holds the rules, this route only maps the reply.
-        const ssoAuth = app.get(auth_service_1.AuthService);
-        const ssoLogger = app.get(logging_service_1.LoggingService).createLogger('sso-finish');
+        // ── SSO finish + browser handoff ────────────────────────────────
+        // OIDC redirects to the finish with an HMAC-signed, single-use LOGIN
+        // bridge bound to the browser that started it; the session is minted by
+        // THE session mint from the user record as it is now (D712). Rules in
+        // `auth/sso-finish.ts`, routes in `auth/sso-routes.ts`.
         const ssoMinter = (0, session_mint_js_1.createSessionMinter)({
-            signer: ssoAuth,
+            signer: app.get(auth_service_1.AuthService),
             directory: () => capabilityRegistry.getSingleton('user-management'),
+            sessions: sessionBacking,
         });
-        fastify.get('/api/auth/sso/finish', async (request, reply) => {
-            const outcome = await (0, sso_finish_js_1.finishSsoLogin)(request.query.bridge, (0, sso_finish_deps_js_1.createSsoFinishDeps)({
-                auth: ssoAuth,
+        (0, sso_routes_js_1.registerSsoRoutes)(fastify, {
+            wiring: {
+                auth: app.get(auth_service_1.AuthService),
                 registry: capabilityRegistry,
                 moleculer: app.get(moleculer_service_1.MoleculerService),
                 minter: ssoMinter,
                 linkIntents: externalLinkIntents,
-                logFailure: (error) => ssoLogger.error('SSO finish failed', {
-                    meta: { error: error instanceof Error ? error.message : String(error) },
-                }),
-            }, request.headers.cookie), 
-            // A popup sign-in (D791) returns through the admin-ui completion page.
-            { popup: request.query.popup === '1' });
-            if (outcome.kind === 'error')
-                return reply.status(outcome.status).send(outcome.body);
-            reply.code(302);
-            // Admin-ui paths are relative to the hub's mount (HA ingress etc.).
-            const ssoMount = (0, spa_mount_1.parseForwardedPrefix)(request.headers['x-forwarded-prefix']) ?? '';
-            reply.header('Location', `${ssoMount}${outcome.location}`);
-            return reply.send('');
+                nativeLinks: nativeLinkCompletions,
+                usedBridgeIds,
+            },
+            network: authNetwork,
+            limiter: authRouteLimiter,
+            browserHandoffCodes,
+            minter: ssoMinter,
+            logger: app.get(logging_service_1.LoggingService).createLogger('sso-finish'),
         });
         // ── Backup archive download ─────────────────────────────────────
         // Streams an archive through the storage cap's chunked-download
@@ -1052,6 +1104,18 @@ async function bootstrap() {
                 }
                 return reply.status(404).send({ error: 'Not found' });
             }
+            // A route that asked for it (an IdP start / callback) is limited per
+            // REAL client address before its handler runs.
+            if (match.route.rateLimit === 'auth') {
+                const routeClient = (0, auth_rate_limit_1.clientKeyFromRequest)(request, authNetwork);
+                if (routeClient !== null) {
+                    const verdict = authRouteLimiter.check(`route:${addonId}:${routeClient}`);
+                    if (!verdict.allowed) {
+                        reply.header('retry-after', String(verdict.retryAfterSeconds));
+                        return reply.status(429).send({ error: 'Too many attempts' });
+                    }
+                }
+            }
             // Auth check based on route.access
             if (match.route.access !== 'public') {
                 const authHeader = request.headers.authorization;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.486",
+  "version": "1.2.487",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,18 +37,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.359",
-    "@camstack/addon-agent-ui": "1.2.195",
-    "@camstack/addon-auth": "1.2.134",
-    "@camstack/addon-decoder-nodeav": "1.2.121",
-    "@camstack/addon-notifiers": "1.2.128",
-    "@camstack/addon-pipeline": "1.2.346",
-    "@camstack/addon-pipeline-orchestrator": "1.2.298",
-    "@camstack/addon-post-analysis": "1.2.347",
-    "@camstack/sdk": "1.2.127",
-    "@camstack/system": "1.2.381",
-    "@camstack/types": "1.2.332",
-    "@camstack/ui-library": "1.2.253",
+    "@camstack/addon-admin-ui": "1.2.360",
+    "@camstack/addon-agent-ui": "1.2.196",
+    "@camstack/addon-auth": "1.2.135",
+    "@camstack/addon-decoder-nodeav": "1.2.122",
+    "@camstack/addon-notifiers": "1.2.129",
+    "@camstack/addon-pipeline": "1.2.347",
+    "@camstack/addon-pipeline-orchestrator": "1.2.299",
+    "@camstack/addon-post-analysis": "1.2.348",
+    "@camstack/sdk": "1.2.128",
+    "@camstack/system": "1.2.382",
+    "@camstack/types": "1.2.333",
+    "@camstack/ui-library": "1.2.254",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",