@camstack/server 1.2.603 → 1.2.605

package/dist/api/core/auth.router.js

@@ -37,6 +37,7 @@ const principal_visibility_js_1 = require("../trpc/principal-visibility.js");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
 const auth_limits_js_1 = require("./auth-limits.js");
 const auth_admin_tokens_procedures_js_1 = require("./auth-admin-tokens.procedures.js");
+const auth_tokens_procedures_js_1 = require("./auth-tokens.procedures.js");
 const auth_revoke_credentials_procedures_js_1 = require("./auth-revoke-credentials.procedures.js");
 const auth_reauth_procedures_js_1 = require("./auth-reauth.procedures.js");
 const auth_device_cert_procedures_js_1 = require("./auth-device-cert.procedures.js");
@@ -199,6 +200,8 @@ const ShareTokenSummarySchema = zod_1.z.object({
     /** Derived convenience flag so listings surface infinite tokens clearly. */
     neverExpires: zod_1.z.boolean(),
     lastUsedAt: zod_1.z.number().optional(),
+    /** A pre-D892 `csv_` link: valid until it expires, never minted again. */
+    legacy: zod_1.z.boolean().optional(),
 });
 function toShareTokenSummary(record) {
     return {
@@ -219,9 +222,10 @@ function toShareTokenSummary(record) {
  * a leaked restricted token would otherwise widen its own reach.
  */
 function assertRealUserSession(user, what = 'Share-token management') {
-    // An admin token is a script's credential, never a person's session: it
-    // must not turn itself into a session (handoff codes) or mint links.
-    if (user.isScoped || user.shareView || user.adminTokenId !== undefined) {
+    // A minted token (admin, scoped, share — legacy or unified) is a script's
+    // credential, never a person's: it must not turn itself into a session
+    // (handoff codes) or mint links. Provenance, not permission (D892).
+    if (user.userDelegated !== true) {
         throw new server_1.TRPCError({
             code: 'FORBIDDEN',
             message: `${what} requires a real user session`,
@@ -304,6 +308,15 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
     const credentialProcedure = makeRateLimitedProcedure(limiters.credential, network);
     /** Challenge-minting begin-legs — looser, they verify nothing. */
     const ceremonyProcedure = makeRateLimitedProcedure(limiters.ceremony, network);
+    const credentialTokens = options.credentialTokens ?? null;
+    const tokenDeps = { auth, registry, network, credentialTokens, shareTokens };
+    /** The unified share link behind `id`, or `null` (a legacy `csv_`, or none). */
+    const unifiedShare = async (id) => {
+        if (credentialTokens === null)
+            return null;
+        const record = await credentialTokens.get(id);
+        return record !== null && (0, types_2.shareViewGrantOf)(record.scopes) !== null ? record : null;
+    };
     const requireShareTokens = () => {
         if (!shareTokens) {
             throw new Error('Share tokens unavailable — service not wired on this node');
@@ -957,7 +970,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             // hide surfaces from a single probe (F1 #5). Admins summarise to
             // "everything"; a scoped principal's selectors expand to counts.
             const fleet = ctx.deviceFleet?.() ?? [];
-            const scope = (0, types_1.summarizeEffectiveScope)(ctx.user.scopes ?? [], fleet, ctx.user.isAdmin);
+            const scope = (0, types_1.summarizeEffectiveScope)((0, types_2.capabilityScopesOf)(ctx.user.scopes ?? []), fleet, ctx.user.isAdmin);
             return { ...ctx.user, scope };
         }),
         /**
@@ -1188,7 +1201,6 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             .output(zod_1.z.object({ id: zod_1.z.string(), token: zod_1.z.string(), expiresAt: zod_1.z.number().nullable() }))
             .mutation(async ({ input, ctx }) => {
             assertRealUserSession(ctx.user);
-            const service = requireShareTokens();
             // SECURITY (F0.4): a share token is a PRIVILEGE HANDOFF — it authorises
             // whoever holds the link to view its devices with no further auth. A
             // scoped (non-admin) minter must therefore not be able to mint for a
@@ -1202,7 +1214,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 ? input.scope
                 : {
                     ...input.scope,
-                    deviceIds: (0, principal_visibility_js_1.filterViewableDeviceIds)(ctx.user.scopes ?? [], input.scope.deviceIds, ctx.deviceScopeLookup),
+                    deviceIds: (0, principal_visibility_js_1.filterViewableDeviceIds)((0, types_2.capabilityScopesOf)(ctx.user.scopes ?? []), input.scope.deviceIds, ctx.deviceScopeLookup),
                 };
             if (scope.deviceIds.length === 0) {
                 throw new server_1.TRPCError({
@@ -1210,7 +1222,20 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                     message: 'None of the requested devices are within your scope — you cannot mint a share token for devices you cannot see',
                 });
             }
-            const { token, record } = await service.create({
+            // A thin wrapper for one release (D892): the link is a unified token
+            // whose only scope is the share-view grant. Without the store (a
+            // node that cannot mint) it is still a legacy `csv_`.
+            if (credentialTokens !== null) {
+                const ttl = input.ttlSec ?? share_token_service_js_1.SHARE_TOKEN_TTL_DEFAULT_SEC;
+                const minted = await (0, auth_tokens_procedures_js_1.mintFor)(tokenDeps, ctx, {
+                    scopes: [{ type: 'share-view', grant: scope }],
+                    expiresIn: ttl,
+                    label: `share ${scope.kind}`,
+                    allowAccountLink: true,
+                });
+                return { id: minted.record.id, token: minted.token, expiresAt: minted.record.expiresAt };
+            }
+            const { token, record } = await requireShareTokens().create({
                 userId: ctx.user.id,
                 scope,
                 ...(input.ttlSec !== undefined ? { ttlSec: input.ttlSec } : {}),
@@ -1230,6 +1255,23 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             .output(zod_1.z.object({ id: zod_1.z.string(), expiresAt: zod_1.z.number() }))
             .mutation(async ({ input, ctx }) => {
             assertRealUserSession(ctx.user);
+            const unified = await unifiedShare(input.id);
+            if (unified !== null && credentialTokens !== null) {
+                if (!ctx.user.isAdmin && unified.subjectId !== ctx.user.id) {
+                    throw new server_1.TRPCError({
+                        code: 'FORBIDDEN',
+                        message: 'Only the token owner or an admin can extend a share token',
+                    });
+                }
+                if (unified.expiresAt === null) {
+                    throw (0, user_error_js_1.trpcUserError)('BAD_REQUEST', 'auth.share-never-expiring-extend', undefined, 'A never-expiring share token cannot be extended');
+                }
+                const moved = await credentialTokens.setExpiry(input.id, Date.now() + input.ttlSec * 1000);
+                if (moved === null || moved.expiresAt === null) {
+                    throw new server_1.TRPCError({ code: 'NOT_FOUND', message: `Share token expired: ${input.id}` });
+                }
+                return { id: moved.id, expiresAt: moved.expiresAt };
+            }
             const service = requireShareTokens();
             try {
                 const record = await service.extend({
@@ -1259,6 +1301,16 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             .output(zod_1.z.object({ success: zod_1.z.boolean() }))
             .mutation(async ({ input, ctx }) => {
             assertRealUserSession(ctx.user);
+            const unified = await unifiedShare(input.id);
+            if (unified !== null && credentialTokens !== null) {
+                if (!ctx.user.isAdmin && unified.subjectId !== ctx.user.id) {
+                    throw new server_1.TRPCError({
+                        code: 'FORBIDDEN',
+                        message: 'Only the token owner or an admin can revoke a share token',
+                    });
+                }
+                return { success: await credentialTokens.revoke(input.id) };
+            }
             const service = requireShareTokens();
             try {
                 const removed = await service.revoke({
@@ -1303,7 +1355,9 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             .output(zod_1.z.array(ShareTokenSummarySchema))
             .query(async ({ ctx, input }) => {
             assertRealUserSession(ctx.user);
-            const service = requireShareTokens();
+            // The legacy `csv_` store, or — on a node with only the unified store —
+            // none; with neither, the clear refusal below.
+            const service = credentialTokens === null ? requireShareTokens() : shareTokens;
             const owner = input?.owner ?? (ctx.user.isAdmin ? 'all' : 'self');
             if (owner === 'all' && !ctx.user.isAdmin) {
                 throw new server_1.TRPCError({
@@ -1311,8 +1365,36 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                     message: "Listing every user's share links requires an admin",
                 });
             }
-            const records = owner === 'all' ? await service.listAll() : await service.listForUser(ctx.user.id);
-            return records.map(toShareTokenSummary);
+            const records = service === null
+                ? []
+                : owner === 'all'
+                    ? await service.listAll()
+                    : await service.listForUser(ctx.user.id);
+            const unified = credentialTokens === null
+                ? []
+                : await credentialTokens.list(owner === 'all' ? undefined : ctx.user.id);
+            const unifiedRows = unified.flatMap((record) => {
+                const grant = (0, types_2.shareViewGrantOf)(record.scopes);
+                if (grant === null || record.revokedAt !== null)
+                    return [];
+                return [
+                    {
+                        id: record.id,
+                        userId: record.subjectId,
+                        tokenPrefix: `token:${record.id.slice(0, 8)}`,
+                        scope: grant,
+                        createdAt: record.createdAt,
+                        expiresAt: record.expiresAt,
+                        neverExpires: record.expiresAt === null,
+                        ...(record.lastUsedAt !== null ? { lastUsedAt: record.lastUsedAt } : {}),
+                        legacy: false,
+                    },
+                ];
+            });
+            return [
+                ...unifiedRows,
+                ...records.map((record) => ({ ...toShareTokenSummary(record), legacy: true })),
+            ];
         }),
         ...(0, auth_sessions_procedures_js_1.createSessionProcedures)({ registry, minter, credentialProcedure }),
         ...(0, auth_device_cert_procedures_js_1.createDeviceCertProcedures)({
@@ -1331,8 +1413,9 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             issueFor,
         }),
         ...(0, auth_reauth_procedures_js_1.createReauthProcedures)({ auth, registry, moleculer, limiters }),
-        ...(0, auth_admin_tokens_procedures_js_1.createAdminTokenProcedures)({ auth, registry, network }),
-        ...(0, auth_revoke_credentials_procedures_js_1.createRevokeCredentialsProcedures)({ registry, shareTokens, network }),
+        ...(0, auth_admin_tokens_procedures_js_1.createAdminTokenProcedures)({ auth, registry, network, credentialTokens, shareTokens }),
+        ...(0, auth_tokens_procedures_js_1.createTokenProcedures)({ auth, registry, network, credentialTokens, shareTokens }),
+        ...(0, auth_revoke_credentials_procedures_js_1.createRevokeCredentialsProcedures)({ registry, shareTokens, network, credentialTokens }),
         // ── External sign-in identities (D782) ────────────────────────
         //
         // A signed-in user links an OIDC identity to THEIR OWN account. The

package/dist/api/core/live-events.router.js

@@ -45,7 +45,7 @@ function createLiveEventsRouter(eb, ar) {
             // Share-view principals get a device-filtered stream: only events
             // attributable to an in-scope device are pushed (fail closed —
             // unattributable events are dropped).
-            const shareScope = ctx.user.shareView?.scope ?? null;
+            const shareScope = (0, types_1.shareViewGrantOf)(ctx.user.scopes ?? []);
             // Non-share scoped tokens get the SAME projection keyed to what they may
             // view (F0.5); admins and broad category-view operators are unfiltered.
             const scopedKeep = shareScope

package/dist/api/trpc/principal-authorization.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authorizeProcedure = authorizeProcedure;
+exports.authorizeAddonRoute = authorizeAddonRoute;
+/**
+ * The ONE scope matcher (D892): every authorization decision about a verified
+ * principal is a function of `principal.scopes`, here. It answers for a tRPC
+ * procedure and for an addon's own HTTP surface (routes and data planes);
+ * neither asks what kind of credential the principal came from.
+ *
+ * Order, the same on both surfaces:
+ *   1. a `share-view` grant RESTRICTS the principal to its fail-closed
+ *      perimeter — nothing else it holds is honoured;
+ *   2. `'*'` passes;
+ *   3. the capability / addon grants decide.
+ */
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
+const addon_route_share_gate_js_1 = require("../../auth/addon-route-share-gate.js");
+const scope_access_js_1 = require("./scope-access.js");
+const share_view_access_js_1 = require("./share-view-access.js");
+/**
+ * May a principal holding `scopes` call the tRPC procedure at `path`?
+ *
+ * A hand-written core route (`auth.me`, `system.info`) has no cap entry: the
+ * authentication already passed, and an explicit `adminProcedure` on top of it
+ * gates what is destructive. A share-view principal never reaches that
+ * pass-through — its allowlist is enumerated.
+ */
+function authorizeProcedure(scopes, path, rawInput, lookup) {
+    const grant = (0, types_1.shareViewGrantOf)(scopes);
+    if (grant !== null) {
+        const result = (0, share_view_access_js_1.checkShareViewAccess)(grant, path, rawInput);
+        return result.ok ? { ok: true, mode: 'share', grant } : { ok: false, reason: result.reason };
+    }
+    if ((0, types_1.scopesGrantAdmin)(scopes))
+        return { ok: true, mode: 'all' };
+    const capability = (0, types_1.capabilityScopesOf)(scopes);
+    if (path in system_1.METHOD_ACCESS_MAP) {
+        const result = (0, scope_access_js_1.checkScopeAccess)(capability, path, rawInput, lookup);
+        if (!result.ok)
+            return { ok: false, reason: result.reason };
+    }
+    return { ok: true, mode: 'scoped', scopes: capability };
+}
+/** May a principal holding `scopes` reach `/addon/<addonId>/…` with this verb? */
+function authorizeAddonRoute(scopes, target) {
+    const grant = (0, types_1.shareViewGrantOf)(scopes);
+    if (grant !== null) {
+        if (!(target.share ?? []).includes(grant.kind)) {
+            return {
+                ok: false,
+                status: 403,
+                error: 'Share token not accepted here',
+                reason: `share-view ${grant.kind} not accepted by ${target.addonId}`,
+            };
+        }
+        return {
+            ok: true,
+            shareHeaders: {
+                [addon_route_share_gate_js_1.SHARE_KIND_HEADER]: grant.kind,
+                [addon_route_share_gate_js_1.SHARE_DEVICES_HEADER]: grant.deviceIds.join(','),
+            },
+        };
+    }
+    if ((0, types_1.scopesGrantAdmin)(scopes))
+        return { ok: true, shareHeaders: null };
+    if (target.access === 'admin') {
+        return { ok: false, status: 403, error: 'Admin required', reason: 'admin route' };
+    }
+    const access = (0, types_1.methodAccessForHttpMethod)(target.method);
+    if ((0, types_1.scopesAllowAddonRoutes)(scopes, access) ||
+        (0, types_1.scopesAllowAddon)((0, types_1.capabilityScopesOf)(scopes), target.addonId, access)) {
+        return { ok: true, shareHeaders: null };
+    }
+    return {
+        ok: false,
+        status: 403,
+        error: 'Token scope mismatch',
+        reason: `holds no addon:${target.addonId}[${access}] grant`,
+    };
+}

package/dist/api/trpc/principal-visibility.js

@@ -147,7 +147,7 @@ function projectListAllForPrincipal(data, isAdmin, scopes, fleet) {
 function scopedEventVisibility(user, lookup) {
     if (user.isAdmin)
         return null;
-    const scopes = user.scopes ?? [];
+    const scopes = (0, types_1.capabilityScopesOf)(user.scopes ?? []);
     if (isBroadEventViewer(scopes))
         return null;
     return (evt) => {

package/dist/api/trpc/trpc-error-principal.js

@@ -29,12 +29,14 @@ function readCredentialIdentity(claims) {
 /**
  * Render a principal for one log line.
  *
- * Shapes, in the order they are distinguished:
+ * Shapes, in the order they are distinguished (the label comes from the
+ * principal's audit tag — attribution only, D892):
  *
  *   anonymous
  *   apocaliss92 (admin)
- *   share:ab12cd34 (share-view)
- *   scoped:1a2b3c4d (scoped-token)
+ *   share:ab12cd34 (legacy-share-token)
+ *   scoped:1a2b3c4d (legacy-scoped-token)
+ *   token:ci (token)
  *   apocaliss92 (oauth-access session=910a6179-…)
  *   apocaliss92 (session)
  */
@@ -44,15 +46,14 @@ function describeTrpcPrincipal(user) {
     if (!user)
         return 'anonymous';
     const name = user.username || user.id || 'unknown';
-    if (user.shareView)
-        return `${name} (share-view)`;
-    if (user.isAdmin)
+    if (user.auditTag === 'session' && user.isAdmin)
         return `${name} (admin)`;
     if (user.credential) {
         const session = user.oauthSessionId ? ` session=${user.oauthSessionId}` : '';
         return `${name} (${user.credential}${session})`;
     }
-    if (user.isScoped)
-        return `${name} (scoped-token)`;
-    return `${name} (session)`;
+    if (user.auditTag !== undefined) {
+        return `${name} (${user.auditTag}${user.isAdmin && user.auditTag !== 'session' ? ' admin' : ''})`;
+    }
+    return user.isAdmin ? `${name} (admin)` : `${name} (session)`;
 }