@camstack/server 1.2.486 → 1.2.488

package/dist/auth/used-bridge-ids.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UsedBridgeIds = void 0;
+/**
+ * The `jti`s of login bridges already swapped for a session or a link.
+ *
+ * A bridge lives 5 minutes; until it expires a second presentation is refused.
+ * Entries are kept for {@link RETENTION_MS} (longer than any bridge), and the
+ * set is bounded — only a bridge that verified AND matched its browser's
+ * state cookie is ever recorded, so filling it needs that many real sign-ins.
+ *
+ * In memory: a hub restart within a bridge's 5 minutes forgets it, and the
+ * browser binding (the bridge is useless without the state cookie of the
+ * browser that started the sign-in) is what still stands then.
+ */
+const RETENTION_MS = 10 * 60_000;
+const DEFAULT_MAX_ENTRIES = 10_000;
+class UsedBridgeIds {
+    used = new Map();
+    now;
+    maxEntries;
+    constructor(opts = {}) {
+        this.now = opts.now ?? Date.now;
+        this.maxEntries = opts.maxEntries ?? DEFAULT_MAX_ENTRIES;
+    }
+    /** Record `jti`; `true` the first time, `false` for every replay. */
+    consume(jti) {
+        const at = this.now();
+        this.prune(at);
+        if (this.used.has(jti))
+            return false;
+        while (this.used.size >= this.maxEntries) {
+            const oldest = this.used.keys().next();
+            if (oldest.done)
+                break;
+            this.used.delete(oldest.value);
+        }
+        this.used.set(jti, at + RETENTION_MS);
+        return true;
+    }
+    size() {
+        return this.used.size;
+    }
+    prune(at) {
+        for (const [jti, until] of this.used) {
+            if (until > at)
+                break; // insertion order = expiry order
+            this.used.delete(jti);
+        }
+    }
+}
+exports.UsedBridgeIds = UsedBridgeIds;

package/dist/core/addon/addon-registry.service.js

@@ -180,11 +180,15 @@ function parseSerializableRouteDescriptors(raw) {
             throw new Error('addon-routes: route descriptor missing method/path');
         }
         const description = Reflect.get(entry, 'description');
+        // An unknown limit name is dropped, never widened into "no limit" silently
+        // by a typo on the hub side: only names the hub implements are kept.
+        const rateLimit = Reflect.get(entry, 'rateLimit') === 'auth' ? 'auth' : undefined;
         return {
             method: asRouteMethod(method),
             path: routePath,
             access: asRouteAccess(Reflect.get(entry, 'access')),
             ...(typeof description === 'string' ? { description } : {}),
+            ...(rateLimit !== undefined ? { rateLimit } : {}),
         };
     });
 }
@@ -2686,6 +2690,7 @@ class AddonRegistryService {
             path: route.path,
             access: route.access,
             ...(route.description !== undefined ? { description: route.description } : {}),
+            ...(route.rateLimit !== undefined ? { rateLimit: route.rateLimit } : {}),
             handler: async (req, reply) => {
                 const envelope = await invoker.invoke({
                     method: route.method,

package/dist/core/agent/agent-registry.service.js

@@ -385,6 +385,19 @@ class AgentRegistryService {
             tags: { nodeId },
             meta: { historyOutcome, historyRemoved, registryRemoved, stillListed },
         });
+        // Topology is push-only (`cluster.topology-snapshot`). Without this event
+        // the Cluster page kept the forgotten row until the 30 s heartbeat — the
+        // operator had to refresh by hand. `TopologyEmitterService` listens for
+        // `AgentUnregistered` and re-emits immediately.
+        if (historyRemoved || registryRemoved) {
+            this.eventBus.emit({
+                id: (0, node_crypto_1.randomUUID)(),
+                timestamp: new Date(),
+                source: { type: 'core', id: 'agent-registry' },
+                category: types_1.EventCategory.AgentUnregistered,
+                data: { agentId: nodeId },
+            });
+        }
         return {
             forgotten: historyRemoved || registryRemoved,
             historyRemoved,
@@ -448,6 +461,16 @@ class AgentRegistryService {
         this.moleculer.setOnAgentRegistered((agentId) => {
             void this.reconcileAgentAddons(agentId, 'node-registration');
         });
+        // D802: the mesh `transition` ends only once every agent this hub has
+        // EVER seen has authenticated — offline ones included. `null` (store not
+        // wired or not answering) never counts as "no agents".
+        this.moleculer.setKnownAgentsProvider(async () => {
+            const store = this.historyStore;
+            if (!store)
+                return null;
+            const rows = await store.tryGetAll();
+            return rows === null ? null : rows.filter((r) => !r.isHub).map((r) => r.id);
+        });
         this.broker.localBus.on('$node.connected', ({ node }) => {
             const kind = classifyNode(node.id);
             if (!kind)

package/dist/core/auth/auth.service.js

@@ -1,7 +1,56 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthService = void 0;
+exports.AuthService = exports.SessionRevokedError = void 0;
 const system_1 = require("@camstack/system");
+/**
+ * A session-grade token whose server-side session is gone (logged out,
+ * revoked, expired) or cannot be checked right now. Every caller of
+ * `verifyToken` already treats a throw as "not authenticated".
+ */
+class SessionRevokedError extends Error {
+    reason;
+    constructor(reason) {
+        super(`Session is no longer valid (${reason})`);
+        this.reason = reason;
+        this.name = 'SessionRevokedError';
+    }
+}
+exports.SessionRevokedError = SessionRevokedError;
+/** A v2 session token: string `userId`, boolean `isAdmin`, no `kind` (not a bridge/challenge). */
+function isSessionGrade(payload) {
+    return (Reflect.get(payload, 'kind') === undefined &&
+        typeof payload.userId === 'string' &&
+        typeof payload.isAdmin === 'boolean');
+}
 class AuthService extends system_1.AuthManager {
+    sessionCheck = null;
+    /**
+     * Wire the login-session check (`hub-sessions.ts`). From then on EVERY
+     * `verifyToken` of a session-grade token — the tRPC boundary, addon routes,
+     * the session cookie, the OAuth authorize page, health, uploads — also
+     * requires its session to be live, so a revocation applies everywhere at
+     * once and no surface can forget to ask.
+     */
+    setSessionCheck(check) {
+        this.sessionCheck = check;
+    }
+    /**
+     * Why the session behind `payload` is no longer valid, or `null` when it is
+     * (or when no check is wired). For a principal resolved earlier — a
+     * WebSocket re-checks its session on every call without re-verifying an
+     * access token that may have expired since connect.
+     */
+    checkSession(payload) {
+        return this.sessionCheck === null ? null : this.sessionCheck(payload);
+    }
+    verifyToken(token) {
+        const payload = super.verifyToken(token);
+        if (this.sessionCheck !== null && isSessionGrade(payload)) {
+            const refusal = this.sessionCheck(payload);
+            if (refusal !== null)
+                throw new SessionRevokedError(refusal);
+        }
+        return payload;
+    }
 }
 exports.AuthService = AuthService;

package/dist/core/auth/handoff-code.service.js

@@ -79,14 +79,19 @@ class HandoffCodeService {
     /** Mint a single-use code bound to `userId`. Throws when the pending
      *  store is full even after pruning expired entries (fail fast — a
      *  legitimate flow never has anywhere near this many in flight). */
-    create(userId) {
+    create(userId, options = {}) {
         this.prune();
         if (this.pending.size >= exports.HANDOFF_CODE_MAX_PENDING) {
             throw new Error('Too many pending handoff codes — try again shortly');
         }
         const code = `${exports.HANDOFF_CODE_PREFIX}${crypto.randomBytes(32).toString('hex')}`;
         const expiresAt = this.now() + this.ttlMs;
-        this.pending.set(hashCode(code), { userId, expiresAt });
+        this.pending.set(hashCode(code), {
+            userId,
+            ...(options.sessionId !== undefined ? { sessionId: options.sessionId } : {}),
+            purpose: options.purpose ?? 'renew',
+            expiresAt,
+        });
         return { code, expiresAt };
     }
     /** Redeem a raw code. Consumes the entry on the FIRST attempt no
@@ -99,7 +104,8 @@ class HandoffCodeService {
         this.pending.delete(hashCode(code));
         if (this.now() > entry.expiresAt)
             return null;
-        return { userId: entry.userId };
+        const { expiresAt: _expiresAt, ...grant } = entry;
+        return grant;
     }
     /** Number of not-yet-redeemed (possibly expired) codes. Test/diag aid. */
     get pendingCount() {

package/dist/core/moleculer/hub-mesh-guard.js

@@ -0,0 +1,132 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HubMeshGuard = void 0;
+/**
+ * The hub's mesh guard (D802) — one object owning everything that decides
+ * whether another node may talk to the hub:
+ *
+ *  - the {@link MeshAuthenticator} (who proved what, on which connection);
+ *  - the broker middleware built on it (installed at broker construction);
+ *  - the System → Cluster status slot;
+ *  - the automatic end of `transition` ({@link decideMeshAutoEnforce}), checked
+ *    after every successful join and once a minute.
+ *
+ * Kept out of `moleculer.service.ts` so that file only wires it.
+ */
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
+/** How often `transition` is re-checked when nothing joins. */
+const AUTO_ENFORCE_INTERVAL_MS = 60_000;
+class HubMeshGuard {
+    ownNodeId;
+    logger;
+    authenticator;
+    startedAt = Date.now();
+    knownAgents = null;
+    listConnected = () => [];
+    timer = null;
+    evaluating = false;
+    lastWaitingFor = '';
+    constructor(ownNodeId, logger) {
+        this.ownNodeId = ownNodeId;
+        this.logger = logger;
+        this.authenticator = new system_1.MeshAuthenticator({
+            ownNodeId,
+            gate: system_1.getProcessClusterSecretGate,
+            mode: system_1.getProcessMeshAuthMode,
+            onAuthenticated: (nodeId) => {
+                this.logger.info('node authenticated to the mesh (challenge–response)', {
+                    meta: { nodeId },
+                });
+                void this.evaluateAutoEnforce();
+            },
+            onTolerated: (nodeId, action) => {
+                this.logger.warn('node is calling the hub WITHOUT having authenticated — tolerated while System → ' +
+                    'Cluster is in Transition. Enter the cluster secret in this agent.', { meta: { nodeId, firstCall: action } });
+            },
+        });
+        (0, system_1.setProcessMeshAuthStatusSource)(() => this.authenticator.snapshot());
+    }
+    /** The middleware the hub broker must be constructed with. */
+    middleware() {
+        return (0, system_1.createMeshAccessMiddleware)({
+            ownNodeId: this.ownNodeId,
+            authenticator: this.authenticator,
+            logger: {
+                warn: (message, meta) => this.logger.warn(message, meta ? { meta } : undefined),
+            },
+        });
+    }
+    /** Start the periodic auto-enforce check; `listConnected` reads the live node list. */
+    start(listConnected) {
+        this.listConnected = listConnected;
+        if (this.timer !== null)
+            return;
+        this.timer = setInterval(() => void this.evaluateAutoEnforce(), AUTO_ENFORCE_INTERVAL_MS);
+        this.timer.unref?.();
+    }
+    /** Wired by `AgentRegistryService`, which owns the cluster-node history. */
+    setKnownAgentsProvider(provider) {
+        this.knownAgents = provider;
+    }
+    /** A node's connection dropped. */
+    forget(nodeId) {
+        this.authenticator.forget(nodeId);
+    }
+    stop() {
+        if (this.timer !== null)
+            clearInterval(this.timer);
+        this.timer = null;
+        (0, system_1.setProcessMeshAuthStatusSource)(null);
+    }
+    /** Public for the spec; the timer and every join call it. */
+    async evaluateAutoEnforce() {
+        if (this.evaluating || (0, system_1.getProcessMeshAuthMode)() !== 'transition')
+            return;
+        this.evaluating = true;
+        try {
+            let knownAgents = null;
+            if (this.knownAgents !== null) {
+                try {
+                    knownAgents = await this.knownAgents();
+                }
+                catch {
+                    knownAgents = null;
+                }
+            }
+            const decision = (0, system_1.decideMeshAutoEnforce)({
+                mode: (0, system_1.getProcessMeshAuthMode)(),
+                gate: (0, system_1.getProcessClusterSecretGate)().kind,
+                uptimeMs: Date.now() - this.startedAt,
+                knownAgents,
+                connected: this.listConnected(),
+                toleratedEver: this.authenticator.everToleratedNodeIds(),
+                authenticatedEver: this.authenticator.everAuthenticatedNodeIds(),
+                ownNodeId: this.ownNodeId,
+            });
+            if (!decision.enforce) {
+                const waiting = decision.waitingFor.join(',');
+                if (waiting.length > 0 && waiting !== this.lastWaitingFor) {
+                    this.logger.info('mesh transition: still waiting for agents to authenticate', {
+                        meta: { waitingFor: decision.waitingFor },
+                    });
+                }
+                this.lastWaitingFor = waiting;
+                return;
+            }
+            const done = await (0, system_1.requestProcessMeshEnforcement)(decision.reason);
+            if (done) {
+                this.logger.info('mesh authentication switched to ENFORCED', {
+                    meta: { reason: decision.reason },
+                });
+            }
+        }
+        catch (err) {
+            this.logger.warn('mesh auto-enforce check failed', { meta: { error: (0, types_1.errMsg)(err) } });
+        }
+        finally {
+            this.evaluating = false;
+        }
+    }
+}
+exports.HubMeshGuard = HubMeshGuard;

package/dist/core/moleculer/moleculer.service.js

@@ -9,6 +9,7 @@ const types_1 = require("@camstack/types");
 const cap_router_runtime_js_1 = require("../../api/trpc/cap-router-runtime.js");
 const core_cap_bridge_js_1 = require("../../api/trpc/core-cap-bridge.js");
 const agent_readiness_pull_js_1 = require("./agent-readiness-pull.js");
+const hub_mesh_guard_js_1 = require("./hub-mesh-guard.js");
 const cap_call_fn_js_1 = require("./cap-call-fn.js");
 const cap_route_authority_js_1 = require("./cap-route-authority.js");
 class MoleculerService {
@@ -23,6 +24,12 @@ class MoleculerService {
         return this.broker;
     }
     logger;
+    /**
+     * D802 — who may talk to the hub over the mesh: the challenge–response join,
+     * the broker middleware that refuses / tolerates unauthenticated nodes and
+     * strips forged identities, and the automatic end of `transition`.
+     */
+    meshGuard;
     /**
      * D3 authority: union of every node's manifest delivered via
      * `$hub.registerNode`. Populated by `onRegisterNode` in `hubDeps`.
@@ -190,9 +197,12 @@ class MoleculerService {
         // can answer, and the Moleculer namespace was never authentication (TCP
         // ignores it; UDP discovery broadcasts it in clear). The secret gates
         // `$hub.registerNode`, read from the keychain at call time.
+        this.meshGuard = new hub_mesh_guard_js_1.HubMeshGuard('hub', this.logging.createLogger('mesh-auth'));
         const broker = (0, system_1.createBroker)({
             nodeID: 'hub',
             mode: 'hub',
+            // D802: every action and event another node sends passes the mesh gate.
+            middlewares: [this.meshGuard.middleware()],
             logLevel: this.config.get('moleculer.logLevel') ?? 'warn',
             ...(tcpPort && !Number.isNaN(tcpPort) ? { tcpPort } : {}),
             ...(udpPort && !Number.isNaN(udpPort) ? { udpPort } : {}),
@@ -217,6 +227,23 @@ class MoleculerService {
     setOnAgentRegistered(cb) {
         this.onAgentRegisteredCb = cb;
     }
+    /**
+     * D802: the cluster-node history, for the automatic end of the mesh
+     * `transition` — wired by `AgentRegistryService`, which owns the history.
+     */
+    setKnownAgentsProvider(provider) {
+        this.meshGuard.setKnownAgentsProvider(provider);
+    }
+    /** Every node Moleculer currently lists as available (this hub included). */
+    listAvailableNodeIds() {
+        const registry = this.broker.registry;
+        try {
+            return (registry?.getNodeList?.({ onlyAvailable: true }) ?? []).map((n) => n.id);
+        }
+        catch {
+            return [];
+        }
+    }
     async onModuleInit() {
         const logger = this.logging.createLogger('moleculer');
         const hubDeps = {
@@ -270,6 +297,8 @@ class MoleculerService {
             },
             // System → Cluster, from the keychain (D797): off / on / unknown.
             clusterSecretGate: system_1.getProcessClusterSecretGate,
+            // D802: challenge–response join + who may register.
+            meshAuth: this.meshGuard.authenticator,
         };
         const hubService = (0, system_1.createHubService)(hubDeps);
         this.brokerSafe.createService(hubService);
@@ -613,6 +642,8 @@ class MoleculerService {
             // the incarnation) and this call is refused if the id has been reclaimed;
             // remote nodes register no owner at all, so they clean up as before.
             this.removeNodeFromRegistry(node.id);
+            // D802: a node authenticates again on its next connection.
+            this.meshGuard.forget(node.id);
         });
         // D8 reverse-leg snapshot-reconcile: on every agent (re)connect, pull
         // the agent's own readiness snapshot (`$agent-readiness.getSnapshot`)
@@ -659,8 +690,21 @@ class MoleculerService {
             probe: (url, options) => this.streamProbe.probe(url, options),
             probeField: (key, value) => this.streamProbe.probeField(key, value),
         }));
+        // Release A: when system-config's MeshCaKeeper becomes ready it offers
+        // hub leaf material here; the transporter starts TLS on :6443 alongside
+        // clear :6000 so enrolled agents can dual-dial without splitting the cluster.
+        (0, system_1.setProcessMeshTlsEnabler)(async (material) => {
+            const tx = (0, system_1.getBrokerTlsTransporter)(this.broker);
+            if (tx === null) {
+                logger.warn('Mesh TLS material ready but broker transporter is not TlsTcpTransporter');
+                return;
+            }
+            await tx.enableMeshTls(material);
+            logger.info('Mesh mTLS listener enabled (dual-port with clear TCP)');
+        });
         await this.brokerSafe.start();
         logger.info('Moleculer broker started (TCP transport)');
+        this.meshGuard.start(() => this.listAvailableNodeIds());
         // Construct the CapRouteResolver now that both the broker and
         // localChildRegistry are ready. The resolver reads live registry state
         // via closure accessors on every call (not a frozen snapshot), so new
@@ -1290,6 +1334,8 @@ class MoleculerService {
         }
     }
     async onModuleDestroy() {
+        (0, system_1.setProcessMeshTlsEnabler)(null);
+        this.meshGuard.stop();
         if (this.agentReadinessPullTimer !== null) {
             clearInterval(this.agentReadinessPullTimer);
             this.agentReadinessPullTimer = null;