@camstack/server 1.2.486 → 1.2.488

package/dist/main.js

@@ -59,6 +59,7 @@ const ws_1 = require("@trpc/server/adapters/ws");
 const ws_2 = require("ws");
 const addon_upload_1 = require("./api/addon-upload");
 const auth_whoami_1 = require("./api/auth-whoami");
+const enroll_routes_js_1 = require("./api/mesh/enroll.routes.js");
 const backup_download_js_1 = require("./api/backup-download.js");
 const cap_providers_1 = require("./api/core/cap-providers");
 const logging_settings_1 = require("./api/core/logging-settings");
@@ -86,12 +87,17 @@ const ws_request_census_1 = require("./api/trpc/ws-request-census");
 const ws_slow_consumer_guard_js_1 = require("./api/trpc/ws-slow-consumer-guard.js");
 const addon_route_jwt_gate_js_1 = require("./auth/addon-route-jwt-gate.js");
 const addon_route_share_gate_js_1 = require("./auth/addon-route-share-gate.js");
+const auth_network_policy_js_1 = require("./auth/auth-network-policy.js");
+const hub_sessions_js_1 = require("./auth/hub-sessions.js");
+const session_lifetimes_js_1 = require("./auth/session-lifetimes.js");
 const auth_rate_limit_1 = require("./auth/auth-rate-limit");
 const external_link_intents_js_1 = require("./auth/external-link-intents.js");
 const session_cookie_js_1 = require("./auth/session-cookie.js");
 const session_mint_js_1 = require("./auth/session-mint.js");
-const sso_finish_js_1 = require("./auth/sso-finish.js");
 const sso_finish_deps_js_1 = require("./auth/sso-finish-deps.js");
+const sso_routes_js_1 = require("./auth/sso-routes.js");
+const used_bridge_ids_js_1 = require("./auth/used-bridge-ids.js");
+const native_link_completions_js_1 = require("./auth/native-link-completions.js");
 const boot_config_1 = require("./boot/boot-config");
 const platform_keychain_key_1 = require("./boot/platform-keychain-key");
 const integration_id_backfill_1 = require("./boot/integration-id-backfill");
@@ -410,6 +416,16 @@ async function bootstrap() {
     storageService.setLocationManager(infra.locationManager);
     // ConfigService — SettingsStore is wired later by the settings-store capability consumer
     const config = app.get(config_service_1.ConfigService);
+    // The real client address behind a trusted proxy, and the opt-in trusted
+    // networks — read from settings per request (auth-network-policy.ts).
+    const authNetwork = (0, auth_network_policy_js_1.createAuthNetworkPolicy)((key) => config.get(key));
+    // Public addon routes that declare `rateLimit: 'auth'` (an IdP start /
+    // callback) and the SSO finish: 30 per minute per real client address.
+    const authRouteLimiter = (0, auth_rate_limit_1.createRateLimiter)({ windowMs: 60_000, max: 30 });
+    // Login sessions (local-auth's table, reached through its hub-internal
+    // surface): every session token minted from here on carries a `sid`, and
+    // every verify of one asks whether that session is still live.
+    const sessionLifetimes = () => (0, session_lifetimes_js_1.readSessionLifetimes)((key) => config.get(key));
     // Register addon upload route (multipart — must be registered before tRPC).
     // We pass AddonRegistryService so the handler can resolve the
     // `user-management` cap singleton at request time (the only working
@@ -442,6 +458,7 @@ async function bootstrap() {
         // Mirrors the addon-upload auth chain so the CLI can ping for
         // token-still-valid without consuming a real cap.
         await (0, auth_whoami_1.registerAuthWhoamiRoute)(fastify, uploadAuthService, uploadAddonRegistry);
+        (0, enroll_routes_js_1.registerMeshEnrollRoute)(fastify);
         console.log('[bootstrap] Auth whoami route registered at GET /api/auth/whoami');
     }
     catch (err) {
@@ -498,6 +515,11 @@ async function bootstrap() {
     addonRegistry.setDataPlaneRegistry(dataPlaneRegistry);
     // ── Configure the CapabilityRegistry (created in AddonRegistryService constructor) ──
     const capabilityRegistry = addonRegistry.getCapabilityRegistry();
+    const sessionBacking = (0, hub_sessions_js_1.sessionBackingFrom)(capabilityRegistry, sessionLifetimes);
+    // From here on every verify of a session-grade token — tRPC, addon routes,
+    // the session cookie, OAuth authorize, uploads, health — requires its
+    // session to be live (`hub-sessions.ts`).
+    app.get(auth_service_1.AuthService).setSessionCheck((0, hub_sessions_js_1.createSessionTokenCheck)(capabilityRegistry));
     // Declare every shipped capability BEFORE app.init() so addon
     // registerProvider() calls (in-process or via the Moleculer bridge
     // from forked workers / agents) find their definition during
@@ -507,7 +529,7 @@ async function bootstrap() {
         capabilityRegistry.declareCapability(capDef);
     }
     // Hub-internal `sso-bridge` provider — gives auth-provider addons
-    // (OIDC, SAML, magic-link, …) a typed gateway to mint an HMAC-signed
+    // (OIDC, SAML, …) a typed gateway to mint an HMAC-signed
     // bridge token before redirecting to `/api/auth/sso/finish`. Without
     // this, the finish endpoint would have to trust unsigned query params
     // (anyone could craft `?isAdmin=1`). Backed by AuthService.
@@ -538,12 +560,41 @@ async function bootstrap() {
     // Pending "link this sign-in account" intents (D782) — minted by
     // `auth.beginExternalLink`, consumed once by `/api/auth/sso/finish`.
     const externalLinkIntents = new external_link_intents_js_1.ExternalLinkIntents();
+    // Native-app links parked for the app to claim, and one-time codes that
+    // open the account page signed in, in a browser (D801).
+    const nativeLinkCompletions = new native_link_completions_js_1.NativeLinkCompletions();
+    // `jti`s of login bridges already finished — a bridge is single-use.
+    const usedBridgeIds = new used_bridge_ids_js_1.UsedBridgeIds();
+    const browserHandoffCodes = new handoff_code_service_1.HandoffCodeService();
+    const nativeLinkMinter = (0, session_mint_js_1.createSessionMinter)({
+        signer: app.get(auth_service_1.AuthService),
+        directory: () => capabilityRegistry.getSingleton('user-management'),
+        sessions: sessionBacking,
+    });
+    const nativeLinkWiring = () => ({
+        auth: app.get(auth_service_1.AuthService),
+        registry: capabilityRegistry,
+        moleculer: app.get(moleculer_service_1.MoleculerService),
+        minter: nativeLinkMinter,
+        linkIntents: externalLinkIntents,
+        nativeLinks: nativeLinkCompletions,
+        usedBridgeIds,
+    });
     const buildRouter = () => (0, trpc_router_1.buildAppRouter)({
         authService: app.get(auth_service_1.AuthService),
         shareTokenService,
         handoffCodeService,
         externalLinkIntents,
+        nativeLink: {
+            completions: nativeLinkCompletions,
+            browserHandoffs: browserHandoffCodes,
+            // The SSO finish's own link step — the same conflict rule, the same
+            // store — run for the app's claim instead of the browser's return.
+            link: (input) => (0, sso_finish_deps_js_1.createSsoFinishDeps)(nativeLinkWiring(), undefined).identities.link(input),
+        },
         configService: config,
+        authNetworkPolicy: authNetwork,
+        sessionBacking,
         featureService: app.get(feature_service_1.FeatureService),
         loggingService,
         eventBus: app.get(event_bus_service_1.EventBusService),
@@ -582,7 +633,11 @@ async function bootstrap() {
         beforeAddonBoot: () => {
             try {
                 appRouter = buildRouter();
-                app.get(moleculer_service_1.MoleculerService).registerCoreCapService((0, core_cap_bridge_1.buildCoreCapService)(appRouter));
+                {
+                    const meshBroker = app.get(moleculer_service_1.MoleculerService);
+                    // D802: another node's call runs as `node:<id>`, never the hub's own principal.
+                    meshBroker.registerCoreCapService((0, core_cap_bridge_1.buildCoreCapService)(appRouter, undefined, { ownNodeId: meshBroker.nodeId }));
+                }
                 console.log('[bootstrap] core-cap mesh bridge registered ($core-caps) — before addon boot');
             }
             catch (err) {
@@ -629,6 +684,7 @@ async function bootstrap() {
         (0, adaptive_probe_routes_1.registerAdaptiveProbeRoute)(fastify, {
             verifyToken: (token) => app.get(auth_service_1.AuthService).verifyToken(token),
             limiter: (0, auth_rate_limit_1.createRateLimiter)({ windowMs: 60_000, max: adaptive_probe_routes_1.ADAPTIVE_PROBE_PER_IP_PER_MINUTE }),
+            network: authNetwork,
         });
     }
     catch (err) {
@@ -661,7 +717,9 @@ async function bootstrap() {
     // an operator armed earlier. The logger is attached now so a restored census
     // has somewhere to report before the first request arrives.
     const httpRequestCensus = (0, http_request_census_singleton_1.getHttpRequestCensus)();
-    httpRequestCensus.setLogger(loggingService.createLogger('tRPC'));
+    const trpcLogger = loggingService.createLogger('tRPC');
+    httpRequestCensus.setLogger(trpcLogger);
+    (0, core_cap_bridge_1.setRemotePrivilegeLogSink)(trpcLogger);
     try {
         const authService = app.get(auth_service_1.AuthService);
         // Normally already built and bridged onto the mesh in `beforeAddonBoot`
@@ -670,7 +728,11 @@ async function bootstrap() {
         if (appRouter === null) {
             appRouter = buildRouter();
             try {
-                app.get(moleculer_service_1.MoleculerService).registerCoreCapService((0, core_cap_bridge_1.buildCoreCapService)(appRouter));
+                {
+                    const meshBroker = app.get(moleculer_service_1.MoleculerService);
+                    // D802: another node's call runs as `node:<id>`, never the hub's own principal.
+                    meshBroker.registerCoreCapService((0, core_cap_bridge_1.buildCoreCapService)(appRouter, undefined, { ownNodeId: meshBroker.nodeId }));
+                }
                 console.log('[bootstrap] core-cap mesh bridge registered ($core-caps) — late fallback');
             }
             catch (err) {
@@ -820,37 +882,31 @@ async function bootstrap() {
             reply.header('cache-control', 'public, max-age=86400');
             return reply.send(fs.readFileSync(filePath));
         });
-        // ── SSO finish endpoint ─────────────────────────────────────────
-        // OIDC / magic-link redirect here with an HMAC-signed LOGIN bridge
-        // (`sso-bridge` cap). The bridge says who signed in; the session is
-        // minted by THE session mint from the user record as it is now (D712) —
-        // `auth/sso-finish.ts` holds the rules, this route only maps the reply.
-        const ssoAuth = app.get(auth_service_1.AuthService);
-        const ssoLogger = app.get(logging_service_1.LoggingService).createLogger('sso-finish');
+        // ── SSO finish + browser handoff ────────────────────────────────
+        // OIDC redirects to the finish with an HMAC-signed, single-use LOGIN
+        // bridge bound to the browser that started it; the session is minted by
+        // THE session mint from the user record as it is now (D712). Rules in
+        // `auth/sso-finish.ts`, routes in `auth/sso-routes.ts`.
         const ssoMinter = (0, session_mint_js_1.createSessionMinter)({
-            signer: ssoAuth,
+            signer: app.get(auth_service_1.AuthService),
             directory: () => capabilityRegistry.getSingleton('user-management'),
+            sessions: sessionBacking,
         });
-        fastify.get('/api/auth/sso/finish', async (request, reply) => {
-            const outcome = await (0, sso_finish_js_1.finishSsoLogin)(request.query.bridge, (0, sso_finish_deps_js_1.createSsoFinishDeps)({
-                auth: ssoAuth,
+        (0, sso_routes_js_1.registerSsoRoutes)(fastify, {
+            wiring: {
+                auth: app.get(auth_service_1.AuthService),
                 registry: capabilityRegistry,
                 moleculer: app.get(moleculer_service_1.MoleculerService),
                 minter: ssoMinter,
                 linkIntents: externalLinkIntents,
-                logFailure: (error) => ssoLogger.error('SSO finish failed', {
-                    meta: { error: error instanceof Error ? error.message : String(error) },
-                }),
-            }, request.headers.cookie), 
-            // A popup sign-in (D791) returns through the admin-ui completion page.
-            { popup: request.query.popup === '1' });
-            if (outcome.kind === 'error')
-                return reply.status(outcome.status).send(outcome.body);
-            reply.code(302);
-            // Admin-ui paths are relative to the hub's mount (HA ingress etc.).
-            const ssoMount = (0, spa_mount_1.parseForwardedPrefix)(request.headers['x-forwarded-prefix']) ?? '';
-            reply.header('Location', `${ssoMount}${outcome.location}`);
-            return reply.send('');
+                nativeLinks: nativeLinkCompletions,
+                usedBridgeIds,
+            },
+            network: authNetwork,
+            limiter: authRouteLimiter,
+            browserHandoffCodes,
+            minter: ssoMinter,
+            logger: app.get(logging_service_1.LoggingService).createLogger('sso-finish'),
         });
         // ── Backup archive download ─────────────────────────────────────
         // Streams an archive through the storage cap's chunked-download
@@ -1052,6 +1108,18 @@ async function bootstrap() {
                 }
                 return reply.status(404).send({ error: 'Not found' });
             }
+            // A route that asked for it (an IdP start / callback) is limited per
+            // REAL client address before its handler runs.
+            if (match.route.rateLimit === 'auth') {
+                const routeClient = (0, auth_rate_limit_1.clientKeyFromRequest)(request, authNetwork);
+                if (routeClient !== null) {
+                    const verdict = authRouteLimiter.check(`route:${addonId}:${routeClient}`);
+                    if (!verdict.allowed) {
+                        reply.header('retry-after', String(verdict.retryAfterSeconds));
+                        return reply.status(429).send({ error: 'Too many attempts' });
+                    }
+                }
+            }
             // Auth check based on route.access
             if (match.route.access !== 'public') {
                 const authHeader = request.headers.authorization;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.486",
+  "version": "1.2.488",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,18 +37,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.359",
-    "@camstack/addon-agent-ui": "1.2.195",
-    "@camstack/addon-auth": "1.2.134",
-    "@camstack/addon-decoder-nodeav": "1.2.121",
-    "@camstack/addon-notifiers": "1.2.128",
-    "@camstack/addon-pipeline": "1.2.346",
-    "@camstack/addon-pipeline-orchestrator": "1.2.298",
-    "@camstack/addon-post-analysis": "1.2.347",
-    "@camstack/sdk": "1.2.127",
-    "@camstack/system": "1.2.381",
-    "@camstack/types": "1.2.332",
-    "@camstack/ui-library": "1.2.253",
+    "@camstack/addon-admin-ui": "1.2.361",
+    "@camstack/addon-agent-ui": "1.2.196",
+    "@camstack/addon-auth": "1.2.135",
+    "@camstack/addon-decoder-nodeav": "1.2.122",
+    "@camstack/addon-notifiers": "1.2.129",
+    "@camstack/addon-pipeline": "1.2.347",
+    "@camstack/addon-pipeline-orchestrator": "1.2.300",
+    "@camstack/addon-post-analysis": "1.2.348",
+    "@camstack/sdk": "1.2.128",
+    "@camstack/system": "1.2.383",
+    "@camstack/types": "1.2.333",
+    "@camstack/ui-library": "1.2.254",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",