@camstack/server 1.2.602 → 1.2.603

package/dist/api/oauth2/oauth2-routes.js

@@ -6,6 +6,7 @@ exports.validateAuthorizeQuery = validateAuthorizeQuery;
 exports.isRedirectUriAllowed = isRedirectUriAllowed;
 exports.summariseScopes = summariseScopes;
 exports.registerOauth2Routes = registerOauth2Routes;
+const types_1 = require("@camstack/types");
 const session_cookie_js_1 = require("../../auth/session-cookie.js");
 const app_page_strings_js_1 = require("../../auth/app-page-strings.js");
 const consent_page_js_1 = require("./consent-page.js");
@@ -232,7 +233,7 @@ function summariseScopes(scopes) {
  * weakened. The RESPONSE carries only the caller's own echoed input; it tells
  * a client nothing about what else this hub has installed.
  */
-function refuseAuthorize(reply, logger, method, call, refusal) {
+function refuseAuthorize(request, reply, logger, method, call, refusal) {
     logger.warn(`oauth2 authorize refused: ${refusal.error}`, {
         meta: {
             method,
@@ -245,7 +246,28 @@ function refuseAuthorize(reply, logger, method, call, refusal) {
     if (refusal.retryAfterSec !== undefined) {
         void reply.header('Retry-After', String(refusal.retryAfterSec));
     }
-    return reply.status(refusal.status).send({ error: refusal.error, ...refusal.detail });
+    return answerRefusal(request, reply, refusal.status, { error: refusal.error, ...refusal.detail }, refusal.status === 503 ? 'unavailable' : 'invalid_request', typeof refusal.detail?.received === 'string' ? refusal.detail.received : undefined);
+}
+/**
+ * Answer a refused authorize. A BROWSER (it asked for HTML: a person who
+ * followed a link) is sent to the CamStack completion page with a reason CODE
+ * — a bare JSON body is a dead end for them. A machine caller keeps the status
+ * and JSON it always got. Relative: the browser is already on the hub's origin,
+ * and nothing the request carried (the redirect target, the state, any code)
+ * goes into the URL.
+ */
+function answerRefusal(request, reply, status, body, reason, integration) {
+    const accept = request.headers.accept;
+    if (typeof accept === 'string' && accept.includes('text/html')) {
+        return reply.redirect((0, types_1.oauthLandingUrl)(null, {
+            status: 'error',
+            reason,
+            ...(integration !== undefined && /^[A-Za-z0-9._-]{1,64}$/.test(integration)
+                ? { integration }
+                : {}),
+        }));
+    }
+    return reply.status(status).send(body);
 }
 /**
  * An authorize call turned away for want of a usable session.
@@ -317,13 +339,13 @@ function registerOauth2Routes(fastify, deps) {
         }
         const registry = deps.getRegistry();
         if (!registry) {
-            return reply.status(503).send({ error: 'service_unavailable' });
+            return answerRefusal(request, reply, 503, { error: 'service_unavailable' }, 'unavailable');
         }
         const { descriptors, pendingAddons } = await readIntegrationRegistry(registry);
         const query = request.query;
         const v = validateAuthorizeQuery(query, descriptors, pendingAddons);
         if (!v.ok) {
-            return refuseAuthorize(reply, deps.logger, 'GET', call, v);
+            return refuseAuthorize(request, reply, deps.logger, 'GET', call, v);
         }
         const descriptor = descriptors.get(v.integration);
         if (!isRedirectUriAllowed(v.redirectUri, descriptor.allowedRedirectPrefixes, descriptor.allowedPrivateHostPaths ?? [])) {
@@ -337,9 +359,7 @@ function registerOauth2Routes(fastify, deps) {
                     allowedPrivateHostPaths: descriptor.allowedPrivateHostPaths ?? [],
                 },
             });
-            return reply
-                .status(400)
-                .send({ error: 'invalid_request — redirect_uri not allowed for this integration' });
+            return answerRefusal(request, reply, 400, { error: 'invalid_request — redirect_uri not allowed for this integration' }, 'invalid_request', v.integration);
         }
         const html = (0, consent_page_js_1.renderConsentPage)({
             lang: (0, app_page_strings_js_1.resolveAppPageLang)({
@@ -417,7 +437,7 @@ function registerOauth2Routes(fastify, deps) {
         }
         const registry = deps.getRegistry();
         if (!registry) {
-            return reply.status(503).send({ error: 'service_unavailable' });
+            return answerRefusal(request, reply, 503, { error: 'service_unavailable' }, 'unavailable');
         }
         const { descriptors, pendingAddons } = await readIntegrationRegistry(registry);
         const body = request.body;
@@ -433,7 +453,7 @@ function registerOauth2Routes(fastify, deps) {
         // and every one of them is attacker-editable.
         const v = validateAuthorizeQuery(formQuery, descriptors, pendingAddons);
         if (!v.ok) {
-            return refuseAuthorize(reply, deps.logger, 'POST', call, v);
+            return refuseAuthorize(request, reply, deps.logger, 'POST', call, v);
         }
         const descriptor = descriptors.get(v.integration);
         if (!isRedirectUriAllowed(v.redirectUri, descriptor.allowedRedirectPrefixes, descriptor.allowedPrivateHostPaths ?? [])) {
@@ -447,9 +467,7 @@ function registerOauth2Routes(fastify, deps) {
                     allowedPrivateHostPaths: descriptor.allowedPrivateHostPaths ?? [],
                 },
             });
-            return reply
-                .status(400)
-                .send({ error: 'invalid_request — redirect_uri not allowed for this integration' });
+            return answerRefusal(request, reply, 400, { error: 'invalid_request — redirect_uri not allowed for this integration' }, 'invalid_request', v.integration);
         }
         if (body.consent !== 'allow') {
             return reply.redirect(`${v.redirectUri}?error=access_denied&state=${encodeURIComponent(v.state)}`);

package/dist/api/trpc/generated-cap-routers.js

@@ -4269,6 +4269,15 @@ function createCapRouter_dishwasher(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.pause(methodInput);
         }),
+        resume: trpc_middleware_js_1.protectedProcedure
+            .input(types_56.dishwasherCapability.methods.resume.input.loose())
+            .output(types_56.dishwasherCapability.methods.resume.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('dishwasher', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.resume(methodInput);
+        }),
         stop: trpc_middleware_js_1.protectedProcedure
             .input(types_56.dishwasherCapability.methods.stop.input.loose())
             .output(types_56.dishwasherCapability.methods.stop.output)
@@ -4359,6 +4368,15 @@ function createCapRouter_dishwasher(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.setOption(methodInput);
         }),
+        getOptions: trpc_middleware_js_1.protectedProcedure
+            .input(types_56.dishwasherCapability.methods.getOptions.input.loose())
+            .output(types_56.dishwasherCapability.methods.getOptions.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('dishwasher', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.getOptions(methodInput);
+        }),
     });
 }
 function createCapRouter_doorbell(getProvider, createRemoteProxy) {
@@ -11128,6 +11146,15 @@ function createCapRouter_storageMigration(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.movers(methodInput);
         }),
+        moverClearance: trpc_middleware_js_1.adminProcedure
+            .input(types_127.storageMigrationCapability.methods.moverClearance.input.loose())
+            .output(types_127.storageMigrationCapability.methods.moverClearance.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('storage-migration', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.moverClearance(methodInput);
+        }),
         residue: trpc_middleware_js_1.adminProcedure
             .input(types_127.storageMigrationCapability.methods.residue.input.loose())
             .output(types_127.storageMigrationCapability.methods.residue.output)

package/dist/auth/alexa-lambda-page-style.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.alexaLambdaPageStyleSource = alexaLambdaPageStyleSource;
+/**
+ * The source text of the skill Lambda's `page-style.js`: the hub's standalone
+ * page stylesheet plus the brand mark, as constants. Kept here, beside
+ * `app-page-shell.ts`, so there is ONE place the look lives and a spec holds the
+ * Lambda's copy to it (`scripts/gen-alexa-lambda-page-style.ts` writes it).
+ */
+const app_page_shell_js_1 = require("./app-page-shell.js");
+function alexaLambdaPageStyleSource() {
+    return `// biome-ignore-all format: generated file
+// biome-ignore-all lint: generated file
+/**
+ * GENERATED by scripts/gen-alexa-lambda-page-style.ts from the hub's page shell
+ * (server/backend/src/auth/app-page-shell.ts). Do not edit: change the shell and
+ * regenerate. The Lambda ships plain files, so the stylesheet travels as a constant.
+ */
+'use strict'
+
+const STYLE = ${JSON.stringify(app_page_shell_js_1.APP_PAGE_STYLE)}
+const LOGO_DARK = ${JSON.stringify(app_page_shell_js_1.APP_PAGE_LOGOS.dark)}
+const LOGO_LIGHT = ${JSON.stringify(app_page_shell_js_1.APP_PAGE_LOGOS.light)}
+
+module.exports = { STYLE, LOGO_DARK, LOGO_LIGHT }
+`;
+}

package/dist/auth/app-page-shell.js

@@ -64,6 +64,10 @@ const COMPONENT_CSS = [
     `.error:empty{display:none}`,
     `.btn:focus-visible,.link:focus-visible{outline:2px solid var(--color-primary);outline-offset:2px}`,
     `code{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:12px;overflow-wrap:anywhere}`,
+    `.field{display:flex;flex-direction:column;gap:var(--spacing-md)}`,
+    `.field label{font-size:12px;line-height:16px;font-weight:500;color:var(--color-foreground-muted)}`,
+    `input[type=url],input[type=text]{width:100%;min-height:44px;padding:10px 12px;border:1px solid var(--color-border);border-radius:var(--radius-lg);background:var(--color-background);color:var(--color-foreground);font:inherit}`,
+    `input[type=url]:focus-visible,input[type=text]:focus-visible{outline:2px solid var(--color-primary);outline-offset:2px}`,
     `form{display:contents}`,
     `.actions{display:flex;flex-direction:column;gap:var(--spacing-md)}`,
 ].join('');

package/dist/manual-boot.js

@@ -267,7 +267,7 @@ async function bootManual(opts) {
                 throw new Error('the process service did not answer');
             return rows;
         },
-        // The verdict reaches the alert centre (one alert + the direct critical push).
+        // The verdict reaches the alert centre (one critical alert).
         onResult: (check) => {
             eventBusService.emit({
                 id: (0, node_crypto_1.randomUUID)(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.602",
+  "version": "1.2.603",
   "license": "MIT",
   "private": false,
   "files": [
@@ -38,19 +38,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.439",
-    "@camstack/addon-agent-ui": "1.2.245",
-    "@camstack/addon-auth": "1.2.150",
-    "@camstack/addon-decoder-nodeav": "1.2.124",
-    "@camstack/addon-notifiers": "1.2.602",
-    "@camstack/addon-pipeline": "1.2.602",
-    "@camstack/addon-pipeline-orchestrator": "1.2.603",
-    "@camstack/addon-post-analysis": "1.2.607",
-    "@camstack/develop": "0.1.14",
-    "@camstack/sdk": "1.2.134",
-    "@camstack/system": "1.2.453",
-    "@camstack/types": "1.2.384",
-    "@camstack/ui-library": "1.2.301",
+    "@camstack/addon-admin-ui": "1.2.440",
+    "@camstack/addon-agent-ui": "1.2.246",
+    "@camstack/addon-auth": "1.2.151",
+    "@camstack/addon-decoder-nodeav": "1.2.125",
+    "@camstack/addon-notifiers": "1.2.603",
+    "@camstack/addon-pipeline": "1.2.603",
+    "@camstack/addon-pipeline-orchestrator": "1.2.604",
+    "@camstack/addon-post-analysis": "1.2.608",
+    "@camstack/develop": "0.1.15",
+    "@camstack/sdk": "1.2.135",
+    "@camstack/system": "1.2.454",
+    "@camstack/types": "1.2.385",
+    "@camstack/ui-library": "1.2.302",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",