@camstack/server 1.2.487 → 1.2.488

package/dist/agent/agent-mesh-join.js

@@ -3,12 +3,17 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createAgentMeshJoin = createAgentMeshJoin;
 /**
  * The agent's mesh join (D802): authenticate to the hub on every connection,
- * before anything else reaches it, and check that the hub is the hub.
+ * before anything else reaches it, and check that the hub is the hub — plus
+ * the agent's inbound mesh gate so only that proven hub (and this agent's own
+ * registered children) may call it.
  *
- * `MeshJoinClient` (in `@camstack/system`) holds the protocol and the call
- * gate; this file binds it to the agent's broker lifecycle:
- *  - the hub connects → a join runs;
- *  - the hub disconnects → back to `pending` (calls wait for the next join);
+ * `MeshJoinClient` (in `@camstack/system`) holds the outbound protocol and the
+ * call gate; `AgentMeshAuthenticator` + `createMeshAccessMiddleware` hold the
+ * inbound side. This file binds both to the agent's broker lifecycle:
+ *  - the hub connects → a join runs; a settled mutual proof stamps the hub;
+ *  - the hub disconnects → back to `pending` (calls wait for the next join)
+ *    and the hub is forgotten on the inbound gate;
+ *  - any other node disconnects → forgotten on the inbound gate;
  *  - the hub says "not authenticated" (it restarted and lost us) → join again;
  *  - the join settles `unavailable` (the hub cannot read its secret yet) →
  *    retried every {@link REJOIN_INTERVAL_MS} while connected.
@@ -33,6 +38,18 @@ function createAgentMeshJoin(opts) {
             clearTimeout(rejoinTimer);
         rejoinTimer = null;
     };
+    const authenticator = new system_1.AgentMeshAuthenticator({
+        ownNodeId: opts.nodeId,
+        hubNodeId: HUB_NODE_ID,
+        hasSecret: () => {
+            const s = opts.secret();
+            return s !== null && s.length > 0;
+        },
+        onTolerated: (nodeId, action) => {
+            opts.log?.(`mesh inbound: node "${nodeId}" is calling without having authenticated — ` +
+                `tolerated while this agent has no cluster secret (first call: ${action})`);
+        },
+    });
     const client = new system_1.MeshJoinClient({
         nodeId: opts.nodeId,
         secret: opts.secret,
@@ -40,6 +57,7 @@ function createAgentMeshJoin(opts) {
         hubNodeId: HUB_NODE_ID,
         ...(opts.log !== undefined ? { log: opts.log } : {}),
         onSettled: (state) => {
+            authenticator.noteHubJoinState(state);
             opts.onState?.(state);
             clearRejoin();
             if (state === 'unavailable' && connected) {
@@ -55,11 +73,29 @@ function createAgentMeshJoin(opts) {
     };
     const rejoin = () => {
         client.reset();
+        authenticator.noteHubJoinState('pending');
         void runJoin();
     };
+    const joinMiddleware = client.middleware(rejoin);
+    const inboundMiddleware = (0, system_1.createMeshAccessMiddleware)({
+        ownNodeId: opts.nodeId,
+        authenticator,
+        logger: {
+            warn: (message, meta) => {
+                const detail = meta === undefined
+                    ? ''
+                    : ` ${Object.entries(meta)
+                        .map(([k, v]) => `${k}=${String(v)}`)
+                        .join(' ')}`;
+                opts.log?.(`${message}${detail}`);
+            },
+        },
+    });
     return {
         client,
-        middleware: client.middleware(rejoin),
+        authenticator,
+        middleware: joinMiddleware,
+        middlewares: [inboundMiddleware, joinMiddleware],
         attach(broker) {
             broker.localBus.on('$node.connected', (data) => {
                 if (nodeIdOf(data) !== HUB_NODE_ID)
@@ -68,11 +104,16 @@ function createAgentMeshJoin(opts) {
                 rejoin();
             });
             broker.localBus.on('$node.disconnected', (data) => {
-                if (nodeIdOf(data) !== HUB_NODE_ID)
+                const id = nodeIdOf(data);
+                if (id === undefined)
+                    return;
+                authenticator.forget(id);
+                if (id !== HUB_NODE_ID)
                     return;
                 connected = false;
                 clearRejoin();
                 client.reset();
+                authenticator.noteHubJoinState('pending');
             });
         },
         stop: clearRejoin,

package/dist/agent/agent-service.js

@@ -546,6 +546,10 @@ function createAgentService(deps) {
                     if (!(0, system_1.clusterSecretMatches)(deps.expectedClusterSecretHash, params.clusterSecretHash)) {
                         throw new moleculer_1.Errors.MoleculerError(`cluster secret mismatch — node "${params.nodeId}" rejected`, 403, system_1.CLUSTER_SECRET_MISMATCH_TYPE);
                     }
+                    const sender = typeof ctx.nodeID === 'string' ? ctx.nodeID : '';
+                    if (sender.length > 0) {
+                        deps.meshAuth?.noteChildRegistered(sender, deps.expectedClusterSecretHash !== undefined ? 'authenticated' : 'legacy');
+                    }
                     deps.onChildRegistered?.(params);
                     return { ok: true };
                 },

package/dist/agent/main.js

@@ -182,7 +182,7 @@ async function startAgent(configPath) {
         mode: 'agent',
         hubAddress: config.hubAddress,
         logLevel: config.logLevel,
-        middlewares: [meshJoin.middleware],
+        middlewares: meshJoin.middlewares,
     });
     meshJoin.attach(broker);
     /**
@@ -219,7 +219,7 @@ async function startAgent(configPath) {
             mode: 'agent',
             hubAddress: fresh.hubAddress,
             logLevel: fresh.logLevel,
-            middlewares: [meshJoin.middleware],
+            middlewares: meshJoin.middlewares,
         });
         meshJoin.attach(broker);
         // The boot-time `$node.connected` listeners belong to the old broker: let
@@ -520,6 +520,7 @@ async function startAgent(configPath) {
             triggerUpwardRegistration();
         },
         expectedClusterSecretHash: config.secret ? (0, system_1.hashClusterSecret)(config.secret) : undefined,
+        meshAuth: meshJoin.authenticator,
         installFromNpm: async (pkg, version) => {
             await installer.install(pkg, version);
         },

package/dist/api/mesh/enroll.routes.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerMeshEnrollRoute = registerMeshEnrollRoute;
+const system_1 = require("@camstack/system");
+function registerMeshEnrollRoute(fastify) {
+    fastify.post('/api/mesh/enroll', async (request, reply) => {
+        const caState = (0, system_1.getProcessMeshCaState)();
+        if (caState.state !== 'ready') {
+            return reply.status(503).send({
+                ok: false,
+                error: `mesh CA unavailable: ${caState.reason}`,
+            });
+        }
+        const body = request.body ?? {};
+        const result = await (0, system_1.enrollMeshNode)({ token: body.token ?? '', csr: body.csr ?? '' }, { ca: caState.ca });
+        if (!result.ok) {
+            return reply.status(result.status).send({ ok: false, error: result.error });
+        }
+        return reply.send({
+            ok: true,
+            cert: result.cert,
+            caCert: result.caCert,
+            nodeId: result.nodeId,
+            notAfter: result.notAfter,
+            serialNumber: result.serialNumber,
+        });
+    });
+}

package/dist/api/trpc/core-cap-bridge.js

@@ -18,7 +18,10 @@
  * routes the call exactly like any addon-provided cap.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CORE_CAP_REMOTE_FORBIDDEN_TYPE = exports.REMOTE_DENIED_NAMESPACES = void 0;
+exports.REMOTE_PRIVILEGE_LOG_ONLY = exports.CORE_CAP_REMOTE_FORBIDDEN_TYPE = exports.REMOTE_DENIED_NAMESPACES = void 0;
+exports.setRemotePrivilegeLogSink = setRemotePrivilegeLogSink;
+exports.__resetRemotePrivilegeObservationForTests = __resetRemotePrivilegeObservationForTests;
+exports.observeRemotePrivilege = observeRemotePrivilege;
 exports.isCoreServiceCapName = isCoreServiceCapName;
 exports.describeMeshOrigin = describeMeshOrigin;
 exports.buildCoreCapService = buildCoreCapService;
@@ -72,6 +75,42 @@ exports.REMOTE_DENIED_NAMESPACES = new Set([
 ]);
 /** Moleculer error `type` of a bridged call another node may not make. */
 exports.CORE_CAP_REMOTE_FORBIDDEN_TYPE = 'CORE_CAP_REMOTE_FORBIDDEN';
+/**
+ * When true, a remote node's allowed bridged calls are logged once per
+ * `(nodeId, path)` per process — still admin, not refused. Granting least
+ * privilege waits on census; this is the log-only week before that.
+ */
+exports.REMOTE_PRIVILEGE_LOG_ONLY = true;
+let remotePrivilegeLogSink = null;
+/** Attach the warn sink used by {@link observeRemotePrivilege}. */
+function setRemotePrivilegeLogSink(sink) {
+    remotePrivilegeLogSink = sink;
+}
+const remotePrivilegeObserved = new Set();
+/** Clears dedupe state and the sink — tests only. */
+function __resetRemotePrivilegeObservationForTests() {
+    remotePrivilegeObserved.clear();
+    remotePrivilegeLogSink = null;
+}
+function remotePrivilegeKey(nodeId, path) {
+    return `${nodeId}\0${path}`;
+}
+/**
+ * One warn per `(nodeId, path)` while {@link REMOTE_PRIVILEGE_LOG_ONLY} is on.
+ * Call only after {@link REMOTE_DENIED_NAMESPACES} has passed.
+ */
+function observeRemotePrivilege(nodeId, path) {
+    if (!exports.REMOTE_PRIVILEGE_LOG_ONLY)
+        return;
+    const key = remotePrivilegeKey(nodeId, path);
+    if (remotePrivilegeObserved.has(key))
+        return;
+    remotePrivilegeObserved.add(key);
+    const message = `mesh privilege: node:${nodeId} called ${path} (log-only; still allowed)`;
+    remotePrivilegeLogSink?.warn(message, {
+        meta: { nodeId, path, principal: `node:${nodeId}` },
+    });
+}
 /**
  * camelCase → kebab-case. Mirrors `toKebab` in `trpc-links.ts` so the
  * action name matches what `brokerTransportLink` derives from `op.path`.
@@ -220,6 +259,8 @@ function buildCoreCapService(appRouter, census = (0, http_request_census_singlet
                 if (remoteNode !== null && exports.REMOTE_DENIED_NAMESPACES.has(namespace)) {
                     throw new moleculer_1.Errors.MoleculerClientError(`"${path}" is not callable from another node (caller "${remoteNode}")`, 403, exports.CORE_CAP_REMOTE_FORBIDDEN_TYPE);
                 }
+                if (remoteNode !== null)
+                    observeRemotePrivilege(remoteNode, path);
                 const invoke = resolveInvoker(callerFor(remoteNode === null ? 'mesh' : `node:${remoteNode}`), path);
                 if (invoke === null)
                     throw new Error(`$core-caps: "${path}" is not invocable`);

package/dist/core/agent/agent-registry.service.js

@@ -385,6 +385,19 @@ class AgentRegistryService {
             tags: { nodeId },
             meta: { historyOutcome, historyRemoved, registryRemoved, stillListed },
         });
+        // Topology is push-only (`cluster.topology-snapshot`). Without this event
+        // the Cluster page kept the forgotten row until the 30 s heartbeat — the
+        // operator had to refresh by hand. `TopologyEmitterService` listens for
+        // `AgentUnregistered` and re-emits immediately.
+        if (historyRemoved || registryRemoved) {
+            this.eventBus.emit({
+                id: (0, node_crypto_1.randomUUID)(),
+                timestamp: new Date(),
+                source: { type: 'core', id: 'agent-registry' },
+                category: types_1.EventCategory.AgentUnregistered,
+                data: { agentId: nodeId },
+            });
+        }
         return {
             forgotten: historyRemoved || registryRemoved,
             historyRemoved,

package/dist/core/moleculer/moleculer.service.js

@@ -690,6 +690,18 @@ class MoleculerService {
             probe: (url, options) => this.streamProbe.probe(url, options),
             probeField: (key, value) => this.streamProbe.probeField(key, value),
         }));
+        // Release A: when system-config's MeshCaKeeper becomes ready it offers
+        // hub leaf material here; the transporter starts TLS on :6443 alongside
+        // clear :6000 so enrolled agents can dual-dial without splitting the cluster.
+        (0, system_1.setProcessMeshTlsEnabler)(async (material) => {
+            const tx = (0, system_1.getBrokerTlsTransporter)(this.broker);
+            if (tx === null) {
+                logger.warn('Mesh TLS material ready but broker transporter is not TlsTcpTransporter');
+                return;
+            }
+            await tx.enableMeshTls(material);
+            logger.info('Mesh mTLS listener enabled (dual-port with clear TCP)');
+        });
         await this.brokerSafe.start();
         logger.info('Moleculer broker started (TCP transport)');
         this.meshGuard.start(() => this.listAvailableNodeIds());
@@ -1322,6 +1334,7 @@ class MoleculerService {
         }
     }
     async onModuleDestroy() {
+        (0, system_1.setProcessMeshTlsEnabler)(null);
         this.meshGuard.stop();
         if (this.agentReadinessPullTimer !== null) {
             clearInterval(this.agentReadinessPullTimer);

package/dist/main.js

@@ -59,6 +59,7 @@ const ws_1 = require("@trpc/server/adapters/ws");
 const ws_2 = require("ws");
 const addon_upload_1 = require("./api/addon-upload");
 const auth_whoami_1 = require("./api/auth-whoami");
+const enroll_routes_js_1 = require("./api/mesh/enroll.routes.js");
 const backup_download_js_1 = require("./api/backup-download.js");
 const cap_providers_1 = require("./api/core/cap-providers");
 const logging_settings_1 = require("./api/core/logging-settings");
@@ -457,6 +458,7 @@ async function bootstrap() {
         // Mirrors the addon-upload auth chain so the CLI can ping for
         // token-still-valid without consuming a real cap.
         await (0, auth_whoami_1.registerAuthWhoamiRoute)(fastify, uploadAuthService, uploadAddonRegistry);
+        (0, enroll_routes_js_1.registerMeshEnrollRoute)(fastify);
         console.log('[bootstrap] Auth whoami route registered at GET /api/auth/whoami');
     }
     catch (err) {
@@ -715,7 +717,9 @@ async function bootstrap() {
     // an operator armed earlier. The logger is attached now so a restored census
     // has somewhere to report before the first request arrives.
     const httpRequestCensus = (0, http_request_census_singleton_1.getHttpRequestCensus)();
-    httpRequestCensus.setLogger(loggingService.createLogger('tRPC'));
+    const trpcLogger = loggingService.createLogger('tRPC');
+    httpRequestCensus.setLogger(trpcLogger);
+    (0, core_cap_bridge_1.setRemotePrivilegeLogSink)(trpcLogger);
     try {
         const authService = app.get(auth_service_1.AuthService);
         // Normally already built and bridged onto the mesh in `beforeAddonBoot`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.487",
+  "version": "1.2.488",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,16 +37,16 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.360",
+    "@camstack/addon-admin-ui": "1.2.361",
     "@camstack/addon-agent-ui": "1.2.196",
     "@camstack/addon-auth": "1.2.135",
     "@camstack/addon-decoder-nodeav": "1.2.122",
     "@camstack/addon-notifiers": "1.2.129",
     "@camstack/addon-pipeline": "1.2.347",
-    "@camstack/addon-pipeline-orchestrator": "1.2.299",
+    "@camstack/addon-pipeline-orchestrator": "1.2.300",
     "@camstack/addon-post-analysis": "1.2.348",
     "@camstack/sdk": "1.2.128",
-    "@camstack/system": "1.2.382",
+    "@camstack/system": "1.2.383",
     "@camstack/types": "1.2.333",
     "@camstack/ui-library": "1.2.254",
     "@fastify/compress": "^9.0.0",