@camstack/server 1.2.492 → 1.2.493

package/dist/agent/agent-http-auth.js

@@ -9,16 +9,20 @@
  *   - loopback callers (the Electron renderer, in-container probes) are
  *     always allowed — the desktop app keeps working with zero changes,
  *   - remote callers must present `Authorization: Bearer <cluster secret>`
- *     — the secret is the agent↔hub trust anchor and the only credential
- *     an agent can verify without a user database,
+ *     OR a short-lived unlock session token minted after a hub admin
+ *     unlock ticket (D821) — the cluster secret stays a mesh / pairing
+ *     credential, not a daily paste into the browser,
  *   - an UNPAIRED agent (no secret configured yet) can be set up remotely
  *     through the pairing surface only; everything else stays denied.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isLoopbackAddress = isLoopbackAddress;
 exports.bearerMatchesSecret = bearerMatchesSecret;
+exports.readBearerToken = readBearerToken;
 exports.isAuthorizedAgentRequest = isAuthorizedAgentRequest;
 exports.isPairingRequest = isPairingRequest;
+exports.isUnlockSessionRequest = isUnlockSessionRequest;
+exports.isUnlockInfoRequest = isUnlockInfoRequest;
 const node_crypto_1 = require("node:crypto");
 /** IPv4/IPv6 loopback (incl. the IPv4-mapped IPv6 form Node reports). */
 function isLoopbackAddress(addr) {
@@ -43,18 +47,29 @@ function bearerMatchesSecret(authorization, secret) {
     const expected = Buffer.from(secret);
     return token.length === expected.length && (0, node_crypto_1.timingSafeEqual)(token, expected);
 }
+/** Extract the bearer token value, or `null`. */
+function readBearerToken(authorization) {
+    if (!authorization?.startsWith('Bearer '))
+        return null;
+    const token = authorization.slice('Bearer '.length);
+    return token.length > 0 ? token : null;
+}
 /**
  * True when the request may access the protected agent API. `clusterSecret`
  * is the CURRENTLY configured secret (`null`/empty = unpaired agent — no
  * remote credential can be verified, so remote access is denied except for
  * the pairing surface, which the route layer allows via {@link isPairingRequest}).
+ * `sessionTokenOk` admits a hub-minted unlock session (D821).
  */
-function isAuthorizedAgentRequest(input, clusterSecret) {
+function isAuthorizedAgentRequest(input, clusterSecret, sessionTokenOk = () => false) {
     if (isLoopbackAddress(input.remoteAddress))
         return true;
     if (clusterSecret === null || clusterSecret.length === 0)
         return false;
-    return bearerMatchesSecret(input.authorization, clusterSecret);
+    if (bearerMatchesSecret(input.authorization, clusterSecret))
+        return true;
+    const token = readBearerToken(input.authorization);
+    return token !== null && sessionTokenOk(token);
 }
 /**
  * The first-boot pairing surface: what a remote browser needs to configure
@@ -74,3 +89,19 @@ function isPairingRequest(method, urlPath) {
     }
     return false;
 }
+/**
+ * Redeem a hub unlock ticket for a session token — reachable remotely without
+ * a prior Bearer (the ticket IS the proof). Paired agents only.
+ */
+function isUnlockSessionRequest(method, urlPath) {
+    const pathOnly = urlPath.split('?')[0] ?? urlPath;
+    return method === 'POST' && pathOnly === '/api/agent/session';
+}
+/**
+ * Public unlock probe: `nodeId` + hub HTTPS origin for Continue-with-hub (D821).
+ * No secrets, no metrics — only what the locked unlock screen needs.
+ */
+function isUnlockInfoRequest(method, urlPath) {
+    const pathOnly = urlPath.split('?')[0] ?? urlPath;
+    return method === 'GET' && pathOnly === '/api/agent/unlock-info';
+}

package/dist/agent/agent-http.js

@@ -50,9 +50,11 @@ exports.resolveHubEndpoint = resolveHubEndpoint;
 exports.mapDiscoveredNodes = mapDiscoveredNodes;
 exports.createAgentHttpServer = createAgentHttpServer;
 exports.startAgentHttpServer = startAgentHttpServer;
+const node_crypto_1 = require("node:crypto");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const fastify_1 = __importDefault(require("fastify"));
+const system_1 = require("@camstack/system");
 const agent_http_auth_js_1 = require("./agent-http-auth.js");
 const agent_mesh_enroll_js_1 = require("./agent-mesh-enroll.js");
 const agent_update_routes_js_1 = require("./agent-update-routes.js");
@@ -227,27 +229,43 @@ async function createAgentHttpServer(getBroker, config) {
     await app.register(cors.default);
     // -- Auth gate (port-4444 hardening, mirrors the hub's /health work) --
     // Loopback (Electron renderer, in-container probes) always passes;
-    // remote callers need `Authorization: Bearer <cluster secret>`. While
-    // the agent is UNPAIRED (no secret configured) only the pairing surface
-    // is reachable remotely. Registered as an onRequest hook over the /api
-    // + /health/details prefixes so any FUTURE route is gated fail-closed.
+    // remote callers need Bearer cluster secret OR a hub unlock session
+    // (D821). While UNPAIRED only the pairing surface is reachable remotely.
+    // `POST /api/agent/session` redeems an unlock ticket without a prior Bearer.
     const currentSecret = () => {
         const raw = readConfigFile(config.configPath);
         return typeof raw.secret === 'string' && raw.secret.length > 0 ? raw.secret : null;
     };
+    /** Tab sessions from hub unlock tickets — token → expiry ms. */
+    const unlockSessions = new Map();
+    const unlockJtis = new system_1.UnlockTicketJtiStore();
+    const sessionOk = (token) => {
+        const exp = unlockSessions.get(token);
+        if (exp === undefined)
+            return false;
+        if (exp <= Date.now()) {
+            unlockSessions.delete(token);
+            return false;
+        }
+        return true;
+    };
     app.addHook('onRequest', async (req, reply) => {
         const pathOnly = req.url.split('?')[0] ?? req.url;
         const isProtected = pathOnly.startsWith('/api/') || pathOnly.startsWith('/health/');
         if (!isProtected)
             return;
         const secret = currentSecret();
+        if (secret !== null && (0, agent_http_auth_js_1.isUnlockSessionRequest)(req.method, pathOnly))
+            return;
+        if ((0, agent_http_auth_js_1.isUnlockInfoRequest)(req.method, pathOnly))
+            return;
         const authInput = {
             remoteAddress: req.socket.remoteAddress ?? undefined,
             ...(typeof req.headers.authorization === 'string'
                 ? { authorization: req.headers.authorization }
                 : {}),
         };
-        if ((0, agent_http_auth_js_1.isAuthorizedAgentRequest)(authInput, secret))
+        if ((0, agent_http_auth_js_1.isAuthorizedAgentRequest)(authInput, secret, sessionOk))
             return;
         if (secret === null && (0, agent_http_auth_js_1.isPairingRequest)(req.method, pathOnly))
             return;
@@ -302,6 +320,10 @@ async function createAgentHttpServer(getBroker, config) {
         // registry) — lets the UI show the real endpoint even under UDP discovery
         // where `eff.hubAddress` is null.
         const resolvedHubAddress = resolveHubEndpoint(nodes);
+        // HTTPS origin the agent UI uses for "Continue with hub" unlock (D821).
+        const hubHttpsOrigin = (eff.hubAddress !== null ? (0, derive_hub_url_js_1.deriveHubUrlFromHubAddress)(eff.hubAddress) : undefined) ??
+            (resolvedHubAddress !== null ? (0, derive_hub_url_js_1.deriveHubUrlFromHubAddress)(resolvedHubAddress) : undefined) ??
+            null;
         // Version of the Electron wrapper (injected by the desktop app); absent
         // when the agent runs headless / in Docker.
         const appVersion = process.env['CAMSTACK_AGENT_APP_VERSION'] ?? null;
@@ -313,6 +335,7 @@ async function createAgentHttpServer(getBroker, config) {
                 name: eff.name,
                 hubAddress: eff.hubAddress,
                 resolvedHubAddress,
+                hubHttpsOrigin,
                 appVersion,
                 hubConnected,
                 hubConnectionState,
@@ -328,6 +351,7 @@ async function createAgentHttpServer(getBroker, config) {
                 name: eff.name,
                 hubAddress: eff.hubAddress,
                 resolvedHubAddress,
+                hubHttpsOrigin,
                 appVersion,
                 hubConnected,
                 hubConnectionState,
@@ -340,6 +364,46 @@ async function createAgentHttpServer(getBroker, config) {
             };
         }
     });
+    // -- Unlock info (public; Continue-with-hub needs hub origin while locked) --
+    app.get('/api/agent/unlock-info', async () => {
+        const secret = currentSecret();
+        const eff = getEffectiveConfig(config.configPath, config.nodeId);
+        const nodes = getRegistryNodes(getBroker());
+        const resolvedHubAddress = resolveHubEndpoint(nodes);
+        const hubHttpsOrigin = (eff.hubAddress !== null ? (0, derive_hub_url_js_1.deriveHubUrlFromHubAddress)(eff.hubAddress) : undefined) ??
+            (resolvedHubAddress !== null ? (0, derive_hub_url_js_1.deriveHubUrlFromHubAddress)(resolvedHubAddress) : undefined) ??
+            null;
+        return {
+            paired: secret !== null,
+            nodeId: config.nodeId,
+            hubHttpsOrigin,
+        };
+    });
+    // -- Unlock session (hub admin ticket → tab Bearer; D821) -----------
+    app.post('/api/agent/session', async (req, reply) => {
+        const secret = currentSecret();
+        if (secret === null) {
+            return reply.status(400).send({ ok: false, error: 'agent is not paired' });
+        }
+        const ticket = typeof req.body?.ticket === 'string' ? req.body.ticket.trim() : '';
+        if (ticket.length === 0) {
+            return reply.status(400).send({ ok: false, error: 'ticket required' });
+        }
+        const payload = (0, system_1.verifyAgentUiUnlockTicket)((0, system_1.hashClusterSecret)(secret), ticket, {
+            expectedNodeId: config.nodeId,
+        });
+        if (payload === null) {
+            return reply.status(401).send({ ok: false, error: 'invalid or expired unlock ticket' });
+        }
+        if (!unlockJtis.consume(payload.jti, payload.exp)) {
+            return reply.status(401).send({ ok: false, error: 'unlock ticket already used' });
+        }
+        const token = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+        // Session outlives the ticket so the tab keeps working after redeem.
+        const sessionExp = Date.now() + 8 * 60 * 60_000;
+        unlockSessions.set(token, sessionExp);
+        return { ok: true, token, expiresAt: sessionExp };
+    });
     // -- Processes ------------------------------------------------------
     app.get('/api/agent/processes', async () => {
         try {
@@ -391,11 +455,22 @@ async function createAgentHttpServer(getBroker, config) {
         const clearMeshTls = body['clearMeshTls'] === true;
         const patch = Object.fromEntries(Object.entries(body).filter(([k]) => k !== 'joinToken' && k !== 'meshTls' && k !== 'clearMeshTls'));
         const existing = readConfigFile(config.configPath);
+        const alreadyPaired = typeof existing.secret === 'string' && existing.secret.length > 0;
+        const patchSecret = typeof patch['secret'] === 'string' && patch['secret'].trim().length > 0;
+        const hasJoinToken = typeof joinToken === 'string' && joinToken.trim().length > 0;
+        // First pairing (D803 / D821): hub always has a secret — require secret or
+        // join token. Later edits may omit secret to keep the stored value.
+        if (!alreadyPaired && !patchSecret && !hasJoinToken) {
+            return reply.status(400).send({
+                success: false,
+                error: 'Cluster secret is required — copy it from the hub System → Cluster page, or paste a join token',
+            });
+        }
         // Join-token enrollment (mesh mTLS Release A): the hub address comes from
         // the token and wins over a `hubAddress` posted in the same form. Nothing is
         // written unless the whole enrollment verified.
         let enrolled = null;
-        if (typeof joinToken === 'string' && joinToken.trim().length > 0) {
+        if (hasJoinToken) {
             try {
                 enrolled = await (config.redeemJoinToken ?? defaultRedeemJoinToken)(joinToken, config.nodeId);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.492",
+  "version": "1.2.493",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,8 +37,8 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.365",
-    "@camstack/addon-agent-ui": "1.2.199",
+    "@camstack/addon-admin-ui": "1.2.366",
+    "@camstack/addon-agent-ui": "1.2.200",
     "@camstack/addon-auth": "1.2.136",
     "@camstack/addon-decoder-nodeav": "1.2.122",
     "@camstack/addon-notifiers": "1.2.129",
@@ -46,7 +46,7 @@
     "@camstack/addon-pipeline-orchestrator": "1.2.302",
     "@camstack/addon-post-analysis": "1.2.350",
     "@camstack/sdk": "1.2.128",
-    "@camstack/system": "1.2.386",
+    "@camstack/system": "1.2.387",
     "@camstack/types": "1.2.336",
     "@camstack/ui-library": "1.2.257",
     "@fastify/compress": "^9.0.0",