@camstack/server 1.2.579 → 1.2.580

package/dist/api/core/auth.router.js

@@ -41,6 +41,7 @@ const auth_revoke_credentials_procedures_js_1 = require("./auth-revoke-credentia
 const auth_reauth_procedures_js_1 = require("./auth-reauth.procedures.js");
 const auth_device_cert_procedures_js_1 = require("./auth-device-cert.procedures.js");
 const auth_sessions_procedures_js_1 = require("./auth-sessions.procedures.js");
+const server_name_js_1 = require("./server-name.js");
 /**
  * A public procedure limited per (procedure, REAL client address) — see
  * `auth-limits.ts` for the tiers and why the address is the forwarded client.
@@ -459,6 +460,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             return refuse('this sign-in already started a step-up');
         }
     };
+    const serverNameReader = (0, server_name_js_1.serverNameReaderFor)(registry);
     const aggregateLoginMethods = async () => {
         if (!registry)
             return [];
@@ -1504,5 +1506,14 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             .input(zod_1.z.void())
             .output(zod_1.z.array(PublicLoginMethodSchema).readonly())
             .query(async () => aggregateLoginMethods()),
+        /**
+         * The hub's human name (D861), public like `listLoginMethods` and exposing
+         * nothing else. A separate method on purpose: `listLoginMethods` stays the bare
+         * array every installed viewer already parses.
+         */
+        getServerName: trpc_middleware_js_1.publicProcedure
+            .input(zod_1.z.void())
+            .output(types_1.ServerNameInfoSchema)
+            .query(async () => serverNameReader.read()),
     });
 }

package/dist/api/core/cap-providers.js

@@ -87,6 +87,7 @@ const failure_contributions_js_1 = require("./failure-contributions.js");
 const load_contributions_js_1 = require("./load-contributions.js");
 const logging_settings_js_1 = require("./logging-settings.js");
 const request_census_settings_js_1 = require("./request-census-settings.js");
+const server_name_js_1 = require("./server-name.js");
 const site_location_js_1 = require("./site-location.js");
 // ── system ──────────────────────────────────────────────────────────
 function getRetention(registry) {
@@ -95,6 +96,7 @@ function getRetention(registry) {
 function buildSystemProvider(feature, registry, logger, census = (0, http_request_census_singleton_js_1.getHttpRequestCensus)()) {
     const siteLocation = buildSiteLocationService(registry, logger);
     const store = buildSettingsStoreGateway(registry);
+    const serverName = new server_name_js_1.ServerNameReader({ store, ...(logger !== undefined ? { logger } : {}) });
     const requestCensus = new request_census_settings_js_1.RequestCensusService({
         census,
         store,
@@ -130,7 +132,7 @@ function buildSystemProvider(feature, registry, logger, census = (0, http_reques
         ...(logger !== undefined ? { logger } : {}),
     });
     return {
-        info: async () => feature.getManifest(),
+        info: async () => ({ ...feature.getManifest(), serverName: await serverName.read() }),
         health: async () => ({ status: 'ok', uptime: process.uptime() }),
         featureFlags: async () => feature.getManifest(),
         networkAddresses: async () => {

package/dist/api/core/server-name.js

@@ -0,0 +1,64 @@
+"use strict";
+/**
+ * Reads the hub's human name (D861) from the one row that holds it,
+ * `system-settings` / `server.name`, and falls back to the machine hostname.
+ *
+ * Read-only on purpose: the only writer is the `system-config` addon's form
+ * (System -> Settings), which validates with the same `ServerNameSchema`. Nothing
+ * here writes a default, at boot or on a read.
+ *
+ * A read that FAILS is not an unset name: it answers the hostname default for
+ * display (a title is never worth a failed page) but says so in the log, so a
+ * hub that looks unnamed because its store is down is not mistaken for one that
+ * was never named.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServerNameReader = void 0;
+exports.serverNameReaderFor = serverNameReaderFor;
+const node_os_1 = __importDefault(require("node:os"));
+const types_1 = require("@camstack/types");
+const SYSTEM_SETTINGS_COLLECTION = 'system-settings';
+class ServerNameReader {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    async read() {
+        const hostname = (this.deps.hostname ?? node_os_1.default.hostname)();
+        try {
+            const stored = await this.deps.store.get({
+                collection: SYSTEM_SETTINGS_COLLECTION,
+                key: types_1.SERVER_NAME_SETTING_KEY,
+            });
+            return (0, types_1.resolveServerName)(stored, hostname);
+        }
+        catch (err) {
+            this.deps.logger?.warn('server name read failed - answering the hostname default', {
+                meta: { error: (0, types_1.errMsg)(err) },
+            });
+            return (0, types_1.resolveServerName)(undefined, hostname);
+        }
+    }
+}
+exports.ServerNameReader = ServerNameReader;
+/**
+ * A reader that resolves the `settings-store` cap lazily from the registry (it
+ * boots after the routers are built). Without a registry, or before the cap is
+ * up, the read throws and {@link ServerNameReader} answers the hostname default.
+ */
+function serverNameReaderFor(registry, logger) {
+    return new ServerNameReader({
+        store: {
+            get: async (input) => {
+                const provider = registry?.getSingleton('settings-store') ?? null;
+                if (provider === null)
+                    throw new Error('settings-store unavailable: cap not registered yet');
+                return provider.get(input);
+            },
+        },
+        ...(logger !== undefined ? { logger } : {}),
+    });
+}

package/dist/api/oauth2/consent-page.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderConsentPage = renderConsentPage;
 const app_page_shell_js_1 = require("../../auth/app-page-shell.js");
+const app_page_strings_js_1 = require("../../auth/app-page-strings.js");
 /** Allow/Deny consent screen on the hub's shared page shell (the look of the
  *  app sign-in pages). Submitting POSTs to the same path with the hidden query
  *  fields + `consent=allow|deny`. */
@@ -9,17 +10,19 @@ function renderConsentPage(input) {
     const hidden = Object.entries(input.hidden)
         .map(([name, value]) => (0, app_page_shell_js_1.appHiddenField)(name, value))
         .join('');
+    const t = (0, app_page_strings_js_1.appStrings)(input.lang).consent;
     const destination = input.redirectUri
-        ? `<p class="hint">Sending the authorization to <code>${(0, app_page_shell_js_1.escapeHtml)(input.redirectUri)}</code></p>`
+        ? `<p class="hint">${(0, app_page_shell_js_1.escapeHtml)(t.sendingTo)}<code>${(0, app_page_shell_js_1.escapeHtml)(input.redirectUri)}</code></p>`
         : '';
     return (0, app_page_shell_js_1.renderAppPage)({
-        title: `CamStack · Authorize ${input.displayName}`,
-        heading: `Authorize ${input.displayName}`,
+        lang: input.lang,
+        title: `${t.titlePrefix}${input.displayName}`,
+        heading: `${t.headingPrefix}${input.displayName}`,
         body: [
-            `<p>Signed in as <strong>${(0, app_page_shell_js_1.escapeHtml)(input.username)}</strong></p>`,
-            (0, app_page_shell_js_1.appHint)(`This will grant: ${input.scopeSummary}`),
+            `<p>${(0, app_page_shell_js_1.escapeHtml)(t.signedInAs)}<strong>${(0, app_page_shell_js_1.escapeHtml)(input.username)}</strong></p>`,
+            (0, app_page_shell_js_1.appHint)(`${t.grantPrefix}${input.scopeSummary}`),
             destination,
-            `<form method="POST">${hidden}<div class="actions">${(0, app_page_shell_js_1.appSubmitButton)('Allow', 'consent', 'allow')}${(0, app_page_shell_js_1.appSubmitButton)('Deny', 'consent', 'deny', true)}</div></form>`,
+            `<form method="POST">${hidden}<div class="actions">${(0, app_page_shell_js_1.appSubmitButton)(t.allow, 'consent', 'allow')}${(0, app_page_shell_js_1.appSubmitButton)(t.deny, 'consent', 'deny', true)}</div></form>`,
         ].join(''),
     });
 }

package/dist/api/oauth2/oauth2-routes.js

@@ -7,6 +7,7 @@ exports.isRedirectUriAllowed = isRedirectUriAllowed;
 exports.summariseScopes = summariseScopes;
 exports.registerOauth2Routes = registerOauth2Routes;
 const session_cookie_js_1 = require("../../auth/session-cookie.js");
+const app_page_strings_js_1 = require("../../auth/app-page-strings.js");
 const consent_page_js_1 = require("./consent-page.js");
 const private_host_js_1 = require("./private-host.js");
 /**
@@ -341,6 +342,10 @@ function registerOauth2Routes(fastify, deps) {
                 .send({ error: 'invalid_request — redirect_uri not allowed for this integration' });
         }
         const html = (0, consent_page_js_1.renderConsentPage)({
+            lang: (0, app_page_strings_js_1.resolveAppPageLang)({
+                lang: request.query['lang'],
+                acceptLanguage: request.headers['accept-language'],
+            }),
             displayName: descriptor.displayName,
             username: tokenInfo.username ?? '',
             scopeSummary: summariseScopes(descriptor.requestedScopes),

package/dist/api/trpc/trpc.context.js

@@ -364,6 +364,7 @@ async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens
     return {
         user,
         req: opts.req,
+        ...(user === null && token !== null && token !== '' ? { credentialRejected: true } : {}),
         ...(user !== null && sessionId !== undefined
             ? {
                 sessionLive: () => authService.checkSession({

package/dist/api/trpc/trpc.router.js

@@ -41,6 +41,7 @@ exports.wrapWebrtcSessionProviderWithRelay = wrapWebrtcSessionProviderWithRelay;
 exports.buildAppRouter = buildAppRouter;
 const path = __importStar(require("node:path"));
 const addon_settings_router_js_1 = require("../core/addon-settings.router.js");
+const session_connections_js_1 = require("../../auth/session-connections.js");
 const agent_pairing_router_js_1 = require("../core/agent-pairing.router.js");
 const certificates_router_js_1 = require("../core/certificates.router.js");
 const node_certificates_client_js_1 = require("../../core/agent/node-certificates-client.js");
@@ -199,10 +200,36 @@ function enrichHintsWithClientClass(input, _clientClass) {
 function wrapWebrtcSessionProviderWithRelay(provider, ctx) {
     const userAgent = (0, client_ip_js_1.extractUserAgent)(ctx.req);
     const clientClass = (0, client_ip_js_1.classifyClientRequest)(ctx.req);
+    // The login session this request runs under: media opened here dies with it
+    // (`session-connections.ts`). A principal with no `sid` has nothing to tie to.
+    const authSessionId = ctx.user?.sessionId;
+    const hold = (deviceId, mediaSessionId) => {
+        if (authSessionId === undefined)
+            return;
+        (0, session_connections_js_1.getSessionConnections)().trackMedia(authSessionId, {
+            deviceId,
+            mediaSessionId,
+            close: () => provider.closeSession({ deviceId, sessionId: mediaSessionId }),
+        });
+    };
     return {
         ...provider,
-        createSession: (input) => provider.createSession(enrichHintsWithClientClass(enrichInputWithRelayClass(enrichInputWithUserAgent(input, userAgent), clientClass), clientClass)),
-        handleOffer: (input) => provider.handleOffer(enrichHintsWithClientClass(enrichInputWithRelayClass(enrichInputWithUserAgent(stripTalkbackFromRequest(input, clientClass), userAgent), clientClass), clientClass)),
+        createSession: async (input) => {
+            const created = await provider.createSession(enrichHintsWithClientClass(enrichInputWithRelayClass(enrichInputWithUserAgent(input, userAgent), clientClass), clientClass));
+            hold(input.deviceId, created.sessionId);
+            return created;
+        },
+        handleOffer: async (input) => {
+            const answered = await provider.handleOffer(enrichHintsWithClientClass(enrichInputWithRelayClass(enrichInputWithUserAgent(stripTalkbackFromRequest(input, clientClass), userAgent), clientClass), clientClass));
+            hold(input.deviceId, answered.sessionId);
+            return answered;
+        },
+        closeSession: (input) => {
+            if (authSessionId !== undefined) {
+                (0, session_connections_js_1.getSessionConnections)().forgetMedia(authSessionId, input.sessionId);
+            }
+            return provider.closeSession(input);
+        },
     };
 }
 /**

package/dist/auth/app-confirm-page.js

@@ -17,9 +17,11 @@ exports.appConfirmRefusalPage = appConfirmRefusalPage;
  * `error=cancelled`.
  */
 const app_page_shell_js_1 = require("./app-page-shell.js");
+const app_page_strings_js_1 = require("./app-page-strings.js");
 const PAGE_SCRIPT = `(function () {
   var btn = document.getElementById('go');
   var msg = document.getElementById('msg');
+  var S = function (k) { return document.body.getAttribute('data-s-' + k) || ''; };
   var APP_CALLBACK = /^camstack(\\.dev)?:\\/\\/auth-callback(\\?|$)/;
   btn.addEventListener('click', function () {
     btn.disabled = true;
@@ -32,11 +34,11 @@ const PAGE_SCRIPT = `(function () {
       cache: 'no-store'
     }).then(function (r) { return r.json(); }).then(function (body) {
       if (typeof body.location !== 'string' || !APP_CALLBACK.test(body.location)) {
-        throw new Error(body.error || 'Sign-in failed.');
+        throw new Error('bad-location');
       }
       location.assign(body.location);
     }).catch(function () {
-      msg.textContent = 'This confirmation expired. Start the sign-in again from the app.';
+      msg.textContent = S('confirm-expired');
     });
   });
 })();`;
@@ -46,27 +48,31 @@ exports.APP_CONFIRM_CSP = (0, app_page_shell_js_1.appPageCsp)({ script: PAGE_SCR
 exports.APP_CONFIRM_REFUSAL_CSP = (0, app_page_shell_js_1.appPageCsp)();
 /** The confirmation page for `username`; `cancelHref` is the app callback carrying `error=cancelled`. */
 function appConfirmPage(input) {
+    const t = (0, app_page_strings_js_1.appStrings)(input.lang);
     return (0, app_page_shell_js_1.renderAppPage)({
-        title: 'Sign in the CamStack app',
-        heading: 'Sign in the CamStack app?',
+        lang: input.lang,
+        title: t.confirm.title,
+        heading: t.confirm.heading,
         noReferrer: true,
         script: PAGE_SCRIPT,
+        scriptStrings: { 'confirm-expired': t.script.confirmExpired },
         body: [
-            `<p>The CamStack app on this device will be signed in as <strong>${(0, app_page_shell_js_1.escapeHtml)(input.username)}</strong>.</p>`,
-            (0, app_page_shell_js_1.appHint)('Continue only if you just started this from the CamStack app.'),
-            (0, app_page_shell_js_1.appButton)('Continue', `id="go" data-confirm="${(0, app_page_shell_js_1.escapeHtml)(input.token)}"`),
+            `<p>${(0, app_page_shell_js_1.escapeHtml)(t.confirm.signedInAsBefore)}<strong>${(0, app_page_shell_js_1.escapeHtml)(input.username)}</strong>${(0, app_page_shell_js_1.escapeHtml)(t.confirm.signedInAsAfter)}</p>`,
+            (0, app_page_shell_js_1.appHint)(t.confirm.hint),
+            (0, app_page_shell_js_1.appButton)(t.confirm.continueLabel, `id="go" data-confirm="${(0, app_page_shell_js_1.escapeHtml)(input.token)}"`),
             (0, app_page_shell_js_1.appErrorLine)('msg'),
-            (0, app_page_shell_js_1.appCancelLink)(input.cancelHref, 'Cancel'),
-            '<noscript><p class="error">JavaScript is required to continue.</p></noscript>',
+            (0, app_page_shell_js_1.appCancelLink)(input.cancelHref, t.confirm.cancel),
+            `<noscript><p class="error">${(0, app_page_shell_js_1.escapeHtml)(t.confirm.noscript)}</p></noscript>`,
         ].join(''),
     });
 }
 /** A confirmation that is gone (expired, used, or opened in another browser): a sentence, nothing runs. */
-function appConfirmRefusalPage() {
+function appConfirmRefusalPage(lang) {
+    const t = (0, app_page_strings_js_1.appStrings)(lang).confirmExpired;
     return (0, app_page_shell_js_1.renderAppPage)({
-        title: 'Confirmation expired',
-        heading: 'Confirmation expired',
-        body: (0, app_page_shell_js_1.appParagraph)('This sign-in confirmation is no longer valid.') +
-            (0, app_page_shell_js_1.appHint)('Close this window and start the sign-in again from the app.'),
+        lang,
+        title: t.title,
+        heading: t.title,
+        body: (0, app_page_shell_js_1.appParagraph)(t.body) + (0, app_page_shell_js_1.appHint)(t.hint),
     });
 }

package/dist/auth/app-confirm-routes.js

@@ -17,6 +17,7 @@ const types_1 = require("@camstack/types");
 const zod_1 = require("zod");
 const app_confirmations_js_1 = require("./app-confirmations.js");
 const app_confirm_page_js_1 = require("./app-confirm-page.js");
+const app_page_strings_js_1 = require("./app-page-strings.js");
 const auth_rate_limit_js_1 = require("./auth-rate-limit.js");
 const sso_finish_deps_js_1 = require("./sso-finish-deps.js");
 exports.APP_CONFIRM_PATH = '/auth/app/confirm';
@@ -75,10 +76,16 @@ function registerAppConfirmRoutes(fastify, deps) {
                 meta: { reason: 'unknown-expired-or-other-browser' },
             });
             reply.header('Content-Security-Policy', app_confirm_page_js_1.APP_CONFIRM_REFUSAL_CSP);
-            return reply.status(400).send((0, app_confirm_page_js_1.appConfirmRefusalPage)());
+            return reply
+                .status(400)
+                .send((0, app_confirm_page_js_1.appConfirmRefusalPage)((0, app_page_strings_js_1.resolveAppPageLang)({ acceptLanguage: request.headers['accept-language'] })));
         }
         reply.header('Content-Security-Policy', app_confirm_page_js_1.APP_CONFIRM_CSP);
         return reply.send((0, app_confirm_page_js_1.appConfirmPage)({
+            lang: (0, app_page_strings_js_1.resolveAppPageLang)({
+                lang: confirmation.app.lang,
+                acceptLanguage: request.headers['accept-language'],
+            }),
             username: confirmation.username,
             token,
             cancelHref: (0, types_1.appFlowLocation)(confirmation.app.redirect, { error: 'cancelled' }, confirmation.app.state),

package/dist/auth/app-page-shell.js

@@ -95,7 +95,10 @@ function escapeHtml(text) {
 function renderAppPage(input) {
     const referrer = input.noReferrer === true ? '<meta name="referrer" content="no-referrer">' : '';
     const script = input.script === undefined ? '' : `<script>${input.script}</script>`;
-    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover"><meta name="color-scheme" content="light dark">${referrer}<title>${escapeHtml(input.title)}</title><style>${exports.APP_PAGE_STYLE}</style></head><body><main><div class="brand">${LOGO_DARK}${LOGO_LIGHT}</div><div class="card"><h1>${escapeHtml(input.heading)}</h1>${input.body}</div></main>${script}</body></html>`;
+    const strings = Object.entries(input.scriptStrings ?? {})
+        .map(([key, value]) => ` data-s-${key}="${escapeHtml(value)}"`)
+        .join('');
+    return `<!doctype html><html lang="${input.lang}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover"><meta name="color-scheme" content="light dark">${referrer}<title>${escapeHtml(input.title)}</title><style>${exports.APP_PAGE_STYLE}</style></head><body${strings}><main><div class="brand">${LOGO_DARK}${LOGO_LIGHT}</div><div class="card"><h1>${escapeHtml(input.heading)}</h1>${input.body}</div></main>${script}</body></html>`;
 }
 /** A paragraph of the card (`text` is escaped). */
 const appParagraph = (text) => `<p>${escapeHtml(text)}</p>`;

package/dist/auth/app-page-strings.js

@@ -0,0 +1,157 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APP_PAGE_STRINGS = exports.APP_PAGE_DEFAULT_LANG = void 0;
+exports.appStrings = appStrings;
+exports.langFromAcceptLanguage = langFromAcceptLanguage;
+exports.resolveAppPageLang = resolveAppPageLang;
+/**
+ * Every word the hub's app landing pages show (D858), in both languages, and
+ * the one rule that picks the language.
+ *
+ * The pages (`app-confirm-page.ts`, `app-passkey-page.ts`, `app-refused-route.ts`,
+ * the OAuth2 consent page) hold NO prose of their own: they ask {@link appStrings}.
+ * A key present in one locale and not the other is a compile error AND a spec
+ * failure; a page that renders an English literal is a spec failure
+ * (`app-page-strings.spec.ts`).
+ *
+ * Language choice ({@link resolveAppPageLang}): the `lang` the app sent
+ * (allow-listed) wins; else the first supported tag of `Accept-Language`
+ * (`it*` -> `it`); else English. Neither input is ever reflected into a page.
+ */
+const types_1 = require("@camstack/types");
+exports.APP_PAGE_DEFAULT_LANG = 'en';
+const EN = {
+    confirm: {
+        title: 'Sign in the CamStack app',
+        heading: 'Sign in the CamStack app?',
+        signedInAsBefore: 'The CamStack app on this device will be signed in as ',
+        signedInAsAfter: '.',
+        hint: 'Continue only if you just started this from the CamStack app.',
+        continueLabel: 'Continue',
+        cancel: 'Cancel',
+        noscript: 'JavaScript is required to continue.',
+    },
+    confirmExpired: {
+        title: 'Confirmation expired',
+        body: 'This sign-in confirmation is no longer valid.',
+        hint: 'Close this window and start the sign-in again from the app.',
+    },
+    passkey: {
+        title: 'Sign in with a passkey',
+        heading: 'Sign in to CamStack',
+        body: 'Use a passkey saved on this device to sign in to the CamStack app.',
+        button: 'Sign in with a passkey',
+        cancel: 'Cancel',
+        noscript: 'JavaScript is required to use a passkey.',
+    },
+    refused: {
+        title: 'Sign-in request refused',
+        hint: 'Close this window and try again from the app.',
+        generic: 'The sign-in request was refused.',
+        reasons: types_1.APP_START_REFUSAL_MESSAGES,
+    },
+    consent: {
+        titlePrefix: 'CamStack · Authorize ',
+        headingPrefix: 'Authorize ',
+        signedInAs: 'Signed in as ',
+        grantPrefix: 'This will grant: ',
+        sendingTo: 'Sending the authorization to ',
+        allow: 'Allow',
+        deny: 'Deny',
+    },
+    script: {
+        confirmExpired: 'This confirmation expired. Start the sign-in again from the app.',
+        passkeyUnsupported: 'This browser cannot use passkeys.',
+        passkeyUnavailable: 'Passkeys are not available.',
+        passkeyCancelled: 'The passkey request was cancelled.',
+        signInFailed: 'Sign-in failed. Try again.',
+    },
+};
+const IT = {
+    confirm: {
+        title: "Accedi all'app CamStack",
+        heading: "Accedere all'app CamStack?",
+        signedInAsBefore: "L'app CamStack su questo dispositivo accederà come ",
+        signedInAsAfter: '.',
+        hint: "Continua solo se hai appena avviato l'operazione dall'app CamStack.",
+        continueLabel: 'Continua',
+        cancel: 'Annulla',
+        noscript: 'Per continuare serve JavaScript.',
+    },
+    confirmExpired: {
+        title: 'Conferma scaduta',
+        body: 'Questa conferma di accesso non è più valida.',
+        hint: "Chiudi questa finestra e riavvia l'accesso dall'app.",
+    },
+    passkey: {
+        title: 'Accedi con una passkey',
+        heading: 'Accedi a CamStack',
+        body: "Usa una passkey salvata su questo dispositivo per accedere all'app CamStack.",
+        button: 'Accedi con una passkey',
+        cancel: 'Annulla',
+        noscript: 'Per usare una passkey serve JavaScript.',
+    },
+    refused: {
+        title: 'Richiesta di accesso rifiutata',
+        hint: "Chiudi questa finestra e riprova dall'app.",
+        generic: 'La richiesta di accesso è stata rifiutata.',
+        reasons: {
+            'bad-challenge': 'La richiesta di accesso non ha una sfida PKCE valida (S256).',
+            'bad-challenge-method': 'È supportato solo il metodo PKCE S256.',
+            'bad-state': 'La richiesta di accesso non ha uno state valido.',
+            'bad-purpose': 'La richiesta di accesso indica uno scopo sconosciuto.',
+            'bad-redirect': 'La richiesta di accesso indica un indirizzo di ritorno che questo hub non accetta.',
+            'combined-flow': "L'accesso dell'app non può essere combinato con il collegamento o con un popup.",
+        },
+    },
+    consent: {
+        titlePrefix: 'CamStack · Autorizza ',
+        headingPrefix: 'Autorizza ',
+        signedInAs: 'Accesso eseguito come ',
+        grantPrefix: 'Concederà: ',
+        sendingTo: "Invio dell'autorizzazione a ",
+        allow: 'Consenti',
+        deny: 'Nega',
+    },
+    script: {
+        confirmExpired: "Questa conferma è scaduta. Riavvia l'accesso dall'app.",
+        passkeyUnsupported: 'Questo browser non supporta le passkey.',
+        passkeyUnavailable: 'Le passkey non sono disponibili.',
+        passkeyCancelled: 'La richiesta della passkey è stata annullata.',
+        signInFailed: 'Accesso non riuscito. Riprova.',
+    },
+};
+exports.APP_PAGE_STRINGS = { en: EN, it: IT };
+function appStrings(lang) {
+    return exports.APP_PAGE_STRINGS[lang];
+}
+/** The first supported language of an `Accept-Language` value (by q, then order), or `undefined`. */
+function langFromAcceptLanguage(header) {
+    const value = typeof header === 'string' ? header : header?.join(',');
+    if (value === undefined || value.length > 512)
+        return undefined;
+    const ranked = value
+        .split(',')
+        .map((part, index) => {
+        const [tag = '', ...params] = part.trim().split(';');
+        const q = params
+            .map((p) => /^\s*q\s*=\s*([0-9.]+)\s*$/i.exec(p)?.[1])
+            .find((m) => m !== undefined);
+        const weight = q === undefined ? 1 : Number.parseFloat(q);
+        return { primary: tag.trim().toLowerCase().split('-')[0] ?? '', weight, index };
+    })
+        .filter((t) => Number.isFinite(t.weight) && t.weight > 0)
+        .sort((a, b) => b.weight - a.weight || a.index - b.index);
+    for (const { primary } of ranked) {
+        const lang = (0, types_1.parseAppPageLang)(primary);
+        if (lang !== undefined)
+            return lang;
+    }
+    return undefined;
+}
+/** The page language: the app's `lang` (allow-listed), else `Accept-Language`, else English. */
+function resolveAppPageLang(input) {
+    return ((0, types_1.parseAppPageLang)(input.lang) ??
+        langFromAcceptLanguage(input.acceptLanguage) ??
+        exports.APP_PAGE_DEFAULT_LANG);
+}

package/dist/auth/app-passkey-page.js

@@ -20,12 +20,14 @@ exports.appPasskeyRefusalPage = appPasskeyRefusalPage;
  * (allow-listed, HTML-escaped) cancel link.
  */
 const app_page_shell_js_1 = require("./app-page-shell.js");
+const app_page_strings_js_1 = require("./app-page-strings.js");
 const PAGE_SCRIPT = `(function () {
   var q = new URLSearchParams(location.search);
   var base = location.pathname.replace(/\\/+$/, '');
   var btn = document.getElementById('go');
   var msg = document.getElementById('msg');
-  var KEYS = ['code_challenge', 'code_challenge_method', 'state', 'purpose', 'redirect'];
+  var S = function (k) { return document.body.getAttribute('data-s-' + k) || ''; };
+  var KEYS = ['code_challenge', 'code_challenge_method', 'state', 'purpose', 'redirect', 'lang'];
   var APP_CALLBACK = /^camstack(\\.dev)?:\\/\\/auth-callback(\\?|$)/;
   function fromB64u(s) {
     s = s.replace(/-/g, '+').replace(/_/g, '/');
@@ -58,10 +60,10 @@ const PAGE_SCRIPT = `(function () {
     btn.disabled = true;
     msg.textContent = '';
     if (!window.PublicKeyCredential || !navigator.credentials) {
-      return fail('This browser cannot use passkeys.');
+      return fail(S('passkey-unsupported'));
     }
     post('/begin', flow()).then(function (begin) {
-      if (!begin.ok) throw new Error(begin.body.error || 'Passkeys are not available.');
+      if (!begin.ok) throw new Error('unavailable');
       var opts = begin.body.optionsJSON;
       var pk = {
         challenge: fromB64u(opts.challenge),
@@ -98,11 +100,15 @@ const PAGE_SCRIPT = `(function () {
       }
       var target = done.body && done.body.location;
       if (typeof target !== 'string' || !APP_CALLBACK.test(target)) {
-        throw new Error((done.body && done.body.error) || 'Sign-in failed.');
+        throw new Error('failed');
       }
       location.assign(target);
     }).catch(function (e) {
-      fail(e && e.name === 'NotAllowedError' ? 'The passkey request was cancelled.' : 'Sign-in failed. Try again.');
+      fail(
+        e && e.name === 'NotAllowedError' ? S('passkey-cancelled')
+          : e && e.message === 'unavailable' ? S('passkey-unavailable')
+          : S('sign-in-failed')
+      );
     });
   }
   btn.addEventListener('click', go);
@@ -113,27 +119,37 @@ const PAGE_SCRIPT = `(function () {
  */
 exports.APP_PASSKEY_CSP = (0, app_page_shell_js_1.appPageCsp)({ script: PAGE_SCRIPT });
 /** The page; `cancelHref` is the app callback carrying `error=cancelled`. */
-function appPasskeyPage(cancelHref) {
+function appPasskeyPage(cancelHref, lang) {
+    const t = (0, app_page_strings_js_1.appStrings)(lang);
     return (0, app_page_shell_js_1.renderAppPage)({
-        title: 'Sign in with a passkey',
-        heading: 'Sign in to CamStack',
+        lang,
+        title: t.passkey.title,
+        heading: t.passkey.heading,
         noReferrer: true,
         script: PAGE_SCRIPT,
+        scriptStrings: {
+            'passkey-unsupported': t.script.passkeyUnsupported,
+            'passkey-unavailable': t.script.passkeyUnavailable,
+            'passkey-cancelled': t.script.passkeyCancelled,
+            'sign-in-failed': t.script.signInFailed,
+        },
         body: [
-            (0, app_page_shell_js_1.appParagraph)('Use a passkey saved on this device to sign in to the CamStack app.'),
-            (0, app_page_shell_js_1.appButton)('Sign in with a passkey', 'id="go"'),
+            (0, app_page_shell_js_1.appParagraph)(t.passkey.body),
+            (0, app_page_shell_js_1.appButton)(t.passkey.button, 'id="go"'),
             (0, app_page_shell_js_1.appErrorLine)('msg'),
-            (0, app_page_shell_js_1.appCancelLink)(cancelHref, 'Cancel'),
-            '<noscript><p class="error">JavaScript is required to use a passkey.</p></noscript>',
+            (0, app_page_shell_js_1.appCancelLink)(cancelHref, t.passkey.cancel),
+            `<noscript><p class="error">${(0, app_page_shell_js_1.escapeHtml)(t.passkey.noscript)}</p></noscript>`,
         ].join(''),
     });
 }
 /** The page for a request the hub refuses to serve: a sentence, no script, no assets. */
-function appPasskeyRefusalPage(message) {
+function appPasskeyRefusalPage(message, lang) {
+    const t = (0, app_page_strings_js_1.appStrings)(lang).refused;
     return (0, app_page_shell_js_1.renderAppPage)({
-        title: 'Sign-in request refused',
-        heading: 'Sign-in request refused',
-        body: (0, app_page_shell_js_1.appParagraph)(message) + (0, app_page_shell_js_1.appHint)('Close this window and try again from the app.'),
+        lang,
+        title: t.title,
+        heading: t.title,
+        body: (0, app_page_shell_js_1.appParagraph)(message) + (0, app_page_shell_js_1.appHint)(t.hint),
     });
 }
 /** CSP of the refusal page: the shell's style only, nothing runs. */

package/dist/auth/app-passkey-routes.js

@@ -22,6 +22,7 @@ const types_1 = require("@camstack/types");
 const zod_1 = require("zod");
 const app_confirm_routes_js_1 = require("./app-confirm-routes.js");
 const app_passkey_page_js_1 = require("./app-passkey-page.js");
+const app_page_strings_js_1 = require("./app-page-strings.js");
 const auth_rate_limit_js_1 = require("./auth-rate-limit.js");
 const session_mint_js_1 = require("./session-mint.js");
 exports.APP_PASSKEY_PATH = '/auth/app/passkey';
@@ -32,6 +33,7 @@ const FinishBodySchema = zod_1.z.object({
     state: zod_1.z.string().optional(),
     purpose: zod_1.z.string().optional(),
     redirect: zod_1.z.string().optional(),
+    lang: zod_1.z.string().optional(),
 });
 function noStore(reply) {
     reply.header('Cache-Control', 'no-store');
@@ -53,6 +55,10 @@ function registerAppPasskeyRoutes(fastify, deps) {
         noStore(reply);
         reply.type('text/html; charset=utf-8');
         const parsed = (0, types_1.parseAppFlowRequest)(request.query);
+        const lang = (0, app_page_strings_js_1.resolveAppPageLang)({
+            lang: parsed.ok ? parsed.request.lang : request.query['lang'],
+            acceptLanguage: request.headers['accept-language'],
+        });
         if (!parsed.ok) {
             deps.logger.warn('Passkey app sign-in refused at the page', {
                 meta: { reason: parsed.reason },
@@ -60,11 +66,11 @@ function registerAppPasskeyRoutes(fastify, deps) {
             reply.header('Content-Security-Policy', app_passkey_page_js_1.APP_PASSKEY_REFUSAL_CSP);
             return reply
                 .status(400)
-                .send((0, app_passkey_page_js_1.appPasskeyRefusalPage)(types_1.APP_FLOW_REFUSAL_MESSAGES[parsed.reason]));
+                .send((0, app_passkey_page_js_1.appPasskeyRefusalPage)((0, app_page_strings_js_1.appStrings)(lang).refused.reasons[parsed.reason], lang));
         }
         reply.header('Content-Security-Policy', app_passkey_page_js_1.APP_PASSKEY_CSP);
         const cancel = (0, types_1.appFlowLocation)(parsed.request.redirect, { error: 'cancelled' }, parsed.request.state);
-        return reply.send((0, app_passkey_page_js_1.appPasskeyPage)(cancel));
+        return reply.send((0, app_passkey_page_js_1.appPasskeyPage)(cancel, lang));
     });
     fastify.post(`${exports.APP_PASSKEY_PATH}/begin`, async (request, reply) => {
         noStore(reply);
@@ -103,6 +109,7 @@ function registerAppPasskeyRoutes(fastify, deps) {
             state: body.data.state,
             purpose: body.data.purpose,
             redirect: body.data.redirect,
+            lang: body.data.lang,
         });
         if (!parsed.ok)
             return reply.status(400).send({ error: types_1.APP_FLOW_REFUSAL_MESSAGES[parsed.reason] });

package/dist/auth/app-refused-route.js

@@ -8,20 +8,22 @@ exports.registerAppRefusedRoute = registerAppRefusedRoute;
  * sign-in could not start (D858).
  *
  * The OIDC start lives in an addon, which cannot reach the hub's theme; it
- * redirects here with a reason CODE and the hub renders the sentence in the
- * same shell as every other app page. The query is never echoed: an unknown or
+ * redirects here with a reason CODE (and the app's optional `lang`) and the hub renders the
+ * sentence, in the language of `lang`/`Accept-Language`, in the same shell as every other app page. The query is never echoed: an unknown or
  * absent code gets a generic sentence, a known one its fixed words.
  */
 const types_1 = require("@camstack/types");
 const app_page_shell_js_1 = require("./app-page-shell.js");
-const GENERIC_REFUSAL = 'The sign-in request was refused.';
+const app_page_strings_js_1 = require("./app-page-strings.js");
 /** The refusal page for `reason` (a known code, or anything: unknown renders the generic sentence). */
-function appRefusedPage(reason) {
-    const message = (0, types_1.isAppStartRefusal)(reason) ? types_1.APP_START_REFUSAL_MESSAGES[reason] : GENERIC_REFUSAL;
+function appRefusedPage(reason, lang) {
+    const t = (0, app_page_strings_js_1.appStrings)(lang).refused;
+    const message = (0, types_1.isAppStartRefusal)(reason) ? t.reasons[reason] : t.generic;
     return (0, app_page_shell_js_1.renderAppPage)({
-        title: 'Sign-in request refused',
-        heading: 'Sign-in request refused',
-        body: (0, app_page_shell_js_1.appParagraph)(message) + (0, app_page_shell_js_1.appHint)('Close this window and try again from the app.'),
+        lang,
+        title: t.title,
+        heading: t.title,
+        body: (0, app_page_shell_js_1.appParagraph)(message) + (0, app_page_shell_js_1.appHint)(t.hint),
     });
 }
 /** CSP of the refusal page: the shell's style only, nothing runs. */
@@ -32,6 +34,10 @@ function registerAppRefusedRoute(fastify) {
         reply.header('Referrer-Policy', 'no-referrer');
         reply.header('Content-Security-Policy', exports.APP_REFUSED_CSP);
         reply.type('text/html; charset=utf-8');
-        return reply.status(400).send(appRefusedPage(request.query['reason']));
+        const lang = (0, app_page_strings_js_1.resolveAppPageLang)({
+            lang: request.query['lang'],
+            acceptLanguage: request.headers['accept-language'],
+        });
+        return reply.status(400).send(appRefusedPage(request.query['reason'], lang));
     });
 }

package/dist/auth/session-connections.js

@@ -0,0 +1,136 @@
+"use strict";
+/**
+ * What a login session still HOLDS on the hub — its open WebSockets and its
+ * live media sessions — so that revoking the session ends them.
+ *
+ * A revoked `sid` is refused on the NEXT call (`ctx.sessionLive`), which is not
+ * the same as ending anything: the socket stayed open, the client kept polling
+ * as an anonymous principal and its stream kept playing until the app was
+ * killed (2026-10-16, "Sign out all my sessions"). The login-session table
+ * announces every revocation (`onSessionsRevoked`); this registry turns that
+ * into closed sockets and closed media, touching ONLY the sessions named.
+ *
+ * - A socket closes with {@link SESSION_ENDED_CLOSE_CODE} / {@link SESSION_ENDED_CLOSE_REASON}
+ *   so the client can tell "your session ended" from a network drop.
+ * - A media hold is whatever the creating call registered as its way to end
+ *   the session (the WebRTC `closeSession`); recorded playback rides the same
+ *   cap, so the same hold covers it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionConnections = exports.SESSION_ENDED_CLOSE_REASON = exports.SESSION_ENDED_CLOSE_CODE = void 0;
+exports.getSessionConnections = getSessionConnections;
+exports.__resetSessionConnectionsForTests = __resetSessionConnectionsForTests;
+/** WebSocket close code a client recognises as "the hub ended this session". */
+exports.SESSION_ENDED_CLOSE_CODE = 4401;
+exports.SESSION_ENDED_CLOSE_REASON = 'session-ended';
+/** Bound on live media holds kept per login session (oldest dropped past it). */
+const MAX_MEDIA_HOLDS_PER_SESSION = 256;
+class SessionConnections {
+    sockets = new Set();
+    media = new Map();
+    logger = null;
+    setLogger(logger) {
+        this.logger = logger;
+    }
+    /** Track an authenticated socket; returns the untrack (call on socket close). */
+    trackSocket(socket, identity) {
+        const tracked = { socket, identity };
+        this.sockets.add(tracked);
+        return () => {
+            this.sockets.delete(tracked);
+        };
+    }
+    /** Track a live media session opened under `sessionId`; returns the untrack. */
+    trackMedia(sessionId, hold) {
+        const holds = this.media.get(sessionId) ?? new Map();
+        holds.set(hold.mediaSessionId, hold);
+        if (holds.size > MAX_MEDIA_HOLDS_PER_SESSION) {
+            const oldest = holds.keys().next();
+            if (!oldest.done)
+                holds.delete(oldest.value);
+        }
+        this.media.set(sessionId, holds);
+        return () => {
+            const current = this.media.get(sessionId);
+            current?.delete(hold.mediaSessionId);
+            if (current?.size === 0)
+                this.media.delete(sessionId);
+        };
+    }
+    /** A media session the client closed itself: nothing left to end. */
+    forgetMedia(sessionId, mediaSessionId) {
+        const current = this.media.get(sessionId);
+        current?.delete(mediaSessionId);
+        if (current?.size === 0)
+            this.media.delete(sessionId);
+    }
+    /** End what the revoked sessions hold. Sessions not named are never touched. */
+    endSessions(input) {
+        const named = new Set(input.sessionIds);
+        let sockets = 0;
+        for (const tracked of [...this.sockets]) {
+            const { sessionId, userId } = tracked.identity;
+            const hit = sessionId !== undefined
+                ? named.has(sessionId)
+                : input.allOfUser && input.userId !== null && userId === input.userId;
+            if (!hit)
+                continue;
+            this.sockets.delete(tracked);
+            try {
+                tracked.socket.close(exports.SESSION_ENDED_CLOSE_CODE, exports.SESSION_ENDED_CLOSE_REASON);
+                sockets += 1;
+            }
+            catch (error) {
+                this.logger?.warn('Closing a socket of an ended session failed', {
+                    meta: { error: error instanceof Error ? error.message : String(error) },
+                });
+            }
+        }
+        let mediaSessions = 0;
+        for (const sessionId of named) {
+            const holds = this.media.get(sessionId);
+            if (holds === undefined)
+                continue;
+            this.media.delete(sessionId);
+            for (const hold of holds.values()) {
+                mediaSessions += 1;
+                void this.closeMedia(hold, input.reason);
+            }
+        }
+        if (sockets > 0 || mediaSessions > 0) {
+            this.logger?.info('Revoked sessions ended their connections', {
+                meta: { reason: input.reason, sessions: input.sessionIds.length, sockets, mediaSessions },
+            });
+        }
+        return { sockets, mediaSessions };
+    }
+    async closeMedia(hold, reason) {
+        try {
+            await hold.close();
+            this.logger?.info('Media session closed by session revocation', {
+                tags: { deviceId: hold.deviceId },
+                meta: { mediaSessionId: hold.mediaSessionId, reason },
+            });
+        }
+        catch (error) {
+            this.logger?.warn('Closing a media session of an ended session failed', {
+                tags: { deviceId: hold.deviceId },
+                meta: {
+                    mediaSessionId: hold.mediaSessionId,
+                    error: error instanceof Error ? error.message : String(error),
+                },
+            });
+        }
+    }
+}
+exports.SessionConnections = SessionConnections;
+let instance = null;
+/** The process-wide registry (the WS factory, the WebRTC wrapper and the revoke listener share it). */
+function getSessionConnections() {
+    instance ??= new SessionConnections();
+    return instance;
+}
+/** Test-only. */
+function __resetSessionConnectionsForTests() {
+    instance = null;
+}

package/dist/auth/sso-finish-app.js

@@ -82,7 +82,13 @@ async function finishSsoApp(bridge, deps) {
         const parked = deps.confirmations.create({
             userId: record.id,
             username: record.username,
-            app: { codeChallenge: app.codeChallenge, state: app.state, purpose: app.purpose, redirect },
+            app: {
+                codeChallenge: app.codeChallenge,
+                state: app.state,
+                purpose: app.purpose,
+                redirect,
+                ...(app.lang !== undefined ? { lang: app.lang } : {}),
+            },
             authMethod: 'sso',
         });
         return { kind: 'confirm', ...parked };

package/dist/main.js

@@ -80,6 +80,7 @@ const core_cap_bridge_1 = require("./api/trpc/core-cap-bridge");
 const http_request_census_singleton_1 = require("./api/trpc/http-request-census.singleton");
 const http_request_census_hook_1 = require("./api/trpc/http-request-census-hook");
 const trpc_context_1 = require("./api/trpc/trpc.context");
+const session_connections_js_1 = require("./auth/session-connections.js");
 const trpc_router_1 = require("./api/trpc/trpc.router");
 const trpc_error_device_tags_1 = require("./api/trpc/trpc-error-device-tags");
 const trpc_error_principal_1 = require("./api/trpc/trpc-error-principal");
@@ -1356,6 +1357,19 @@ async function bootstrap() {
             (0, ws_request_census_1.attachWsCensusSession)(httpRequestCensus, client, req, app.get(logging_service_1.LoggingService).createLogger('tRPC:ws'));
             wsSlowConsumerGuard.attach(client, (0, ws_slow_consumer_guard_js_1.wsConnectionFacts)(req));
         });
+        // Revoking a login session ends what it holds: its sockets (close 4401
+        // `session-ended`) and its live media. See `auth/session-connections.ts`.
+        const sessionConnections = (0, session_connections_js_1.getSessionConnections)();
+        sessionConnections.setLogger(app.get(logging_service_1.LoggingService).createLogger('session-revocation'));
+        (0, system_1.onSessionsRevoked)((event) => {
+            sessionConnections.endSessions({
+                sessionIds: event.sessionIds,
+                userId: event.userId,
+                allOfUser: event.allOfUser,
+                exceptSessionId: event.exceptSessionId,
+                reason: event.reason,
+            });
+        });
         (0, ws_1.applyWSSHandler)({
             wss,
             router: appRouter,
@@ -1376,6 +1390,23 @@ async function bootstrap() {
                 const principal = (0, trpc_error_principal_1.describeTrpcPrincipal)(wsCtx.user);
                 (0, ws_request_census_1.identifyWsCensusSession)(opts.res, principal);
                 wsSlowConsumerGuard.identify(opts.res, principal);
+                const connectionLogger = app.get(logging_service_1.LoggingService).createLogger('tRPC:ws');
+                if (wsCtx.credentialRejected === true) {
+                    // A bearer that resolves to nobody (revoked, expired): say so with
+                    // the close code the client recognises, instead of leaving an
+                    // anonymous socket open for the client to poll.
+                    connectionLogger.info('Closing a socket whose credential was refused', {
+                        meta: { principal, code: session_connections_js_1.SESSION_ENDED_CLOSE_CODE },
+                    });
+                    opts.res.close(session_connections_js_1.SESSION_ENDED_CLOSE_CODE, session_connections_js_1.SESSION_ENDED_CLOSE_REASON);
+                }
+                else if (wsCtx.user !== null) {
+                    const untrack = sessionConnections.trackSocket(opts.res, {
+                        userId: wsCtx.user.id,
+                        sessionId: wsCtx.user.sessionId,
+                    });
+                    opts.res.once('close', untrack);
+                }
                 return wsCtx;
             },
             onError: ({ path: trpcPath, error, ctx, input, }) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.579",
+  "version": "1.2.580",
   "license": "MIT",
   "private": false,
   "files": [
@@ -38,19 +38,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.427",
-    "@camstack/addon-agent-ui": "1.2.234",
-    "@camstack/addon-auth": "1.2.146",
+    "@camstack/addon-admin-ui": "1.2.428",
+    "@camstack/addon-agent-ui": "1.2.235",
+    "@camstack/addon-auth": "1.2.147",
     "@camstack/addon-decoder-nodeav": "1.2.123",
     "@camstack/addon-notifiers": "1.2.134",
-    "@camstack/addon-pipeline": "1.2.369",
+    "@camstack/addon-pipeline": "1.2.370",
     "@camstack/addon-pipeline-orchestrator": "1.2.323",
     "@camstack/addon-post-analysis": "1.2.369",
     "@camstack/develop": "0.1.11",
     "@camstack/sdk": "1.2.131",
-    "@camstack/system": "1.2.436",
-    "@camstack/types": "1.2.372",
-    "@camstack/ui-library": "1.2.290",
+    "@camstack/system": "1.2.437",
+    "@camstack/types": "1.2.373",
+    "@camstack/ui-library": "1.2.291",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",