@camstack/server 1.2.603 → 1.2.605

package/dist/api/trpc/trpc.context.js

@@ -1,56 +1,64 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.agentFromPrincipal = agentFromPrincipal;
+exports.bindHubCredentialStores = bindHubCredentialStores;
+exports.hubCredentialVerifier = hubCredentialVerifier;
+exports.requestFacts = requestFacts;
 exports.createMeshTrpcContext = createMeshTrpcContext;
 exports.createTrpcContext = createTrpcContext;
 exports.createWsTrpcContext = createWsTrpcContext;
 const system_1 = require("@camstack/system");
-const types_1 = require("@camstack/types");
 const auth_network_policy_js_1 = require("../../auth/auth-network-policy.js");
-const share_token_service_js_1 = require("../../core/auth/share-token.service.js");
+const credential_verifier_js_1 = require("../../auth/credential-verifier.js");
 const request_lang_js_1 = require("../../i18n/request-lang.js");
-const trpc_error_principal_js_1 = require("./trpc-error-principal.js");
+/** The tRPC principal a verified credential becomes. */
+function agentFromPrincipal(principal) {
+    return {
+        id: principal.subjectId,
+        username: principal.username,
+        isAdmin: principal.isAdmin,
+        permissions: { isAdmin: principal.isAdmin, allowedProviders: '*', allowedDevices: {} },
+        isApiKey: !principal.interactive,
+        scopes: principal.scopes,
+        credentialId: principal.credentialId,
+        auditTag: principal.auditTag,
+        interactive: principal.interactive,
+        userDelegated: principal.userDelegated,
+        legacy: principal.legacy,
+        ...(principal.sessionId !== undefined ? { sessionId: principal.sessionId } : {}),
+        ...(principal.oauthSessionId !== undefined ? { oauthSessionId: principal.oauthSessionId } : {}),
+        ...(principal.credential !== undefined ? { credential: principal.credential } : {}),
+    };
+}
 /**
- * Live-scope refresh memo (see the JWT branch of `resolveUser`).
- *
- * The JWT embeds scopes at login, so an admin's scope edit used to reach a
- * live session only at the next login — a user granted cameras while logged
- * in saw NONE until they signed out and back in (2026-08-15, user report).
- * The store is therefore re-read per user, but memoized: a scope change
- * propagates within {@link SCOPE_REFRESH_TTL_MS} and a busy session costs at
- * most one store read per TTL window, not one per request.
+ * The live-scope memo of non-admin sessions, shared by every verifier this
+ * process builds (a request builds one; the memo must outlive it).
  */
-const SCOPE_REFRESH_TTL_MS = 30_000;
-const SCOPE_REFRESH_MISS_TTL_MS = 5_000;
-const liveScopeMemo = new Map();
-async function refreshScopesFromStore(userId, addonRegistry) {
-    const cached = liveScopeMemo.get(userId);
-    const now = Date.now();
-    if (cached &&
-        now - cached.at < (cached.scopes === null ? SCOPE_REFRESH_MISS_TTL_MS : SCOPE_REFRESH_TTL_MS)) {
-        return cached.scopes;
-    }
-    let scopes = null;
-    try {
-        const userMgmt = addonRegistry.getCapabilityRegistry().getSingleton('user-management');
-        const fresh = typeof userMgmt?.listUsers === 'function'
-            ? (await userMgmt.listUsers()).find((u) => u.id === userId)
-            : null;
-        if (fresh)
-            scopes = (0, types_1.normalizeTokenScopes)(fresh.scopes ?? []);
-    }
-    catch {
-        scopes = null;
-    }
-    liveScopeMemo.set(userId, { at: now, scopes });
-    // Bound the map: sessions come and go, entries are tiny, and a missed
-    // sweep would grow it by one row per distinct user per TTL window.
-    if (liveScopeMemo.size > 512) {
-        for (const [key, entry] of liveScopeMemo) {
-            if (now - entry.at > SCOPE_REFRESH_TTL_MS * 4)
-                liveScopeMemo.delete(key);
-        }
-    }
-    return scopes;
+const hubScopeMemo = new Map();
+const hubStores = { shareTokens: null, tokenRows: null };
+function bindHubCredentialStores(stores) {
+    if (stores.shareTokens !== undefined)
+        hubStores.shareTokens = stores.shareTokens;
+    if (stores.tokenRows !== undefined)
+        hubStores.tokenRows = stores.tokenRows;
+}
+/**
+ * The hub's verifier over its own stores — the same one for tRPC and the
+ * addon routes. Documented type boundary: the registry hands the
+ * `user-management` provider back untyped; the two methods the adapters read
+ * (`validateScopedToken`, `listUsers`) are asserted here.
+ */
+function hubCredentialVerifier(deps) {
+    const provider = () => deps.addonRegistry.getCapabilityRegistry().getSingleton('user-management');
+    return (0, credential_verifier_js_1.createCredentialVerifier)({
+        verifyJwt: (token) => deps.authService.verifyToken(token),
+        users: () => provider() ?? null,
+        internal: () => (0, system_1.getUserManagementInternal)(provider()),
+        shareTokens: () => deps.shareTokens ?? hubStores.shareTokens,
+        tokenRows: () => deps.tokenRows ?? hubStores.tokenRows,
+        logger: deps.logger ?? null,
+        scopeMemo: hubScopeMemo,
+    });
 }
 /** Read `req.query` if present (Fastify-only) without losing type safety. */
 function readQuery(req) {
@@ -62,7 +70,7 @@ function readQuery(req) {
     return { ...q };
 }
 /**
- * Extract a JWT token from an HTTP request.
+ * Extract a bearer from an HTTP request.
  * Priority: Authorization header → Fastify req.query → URL query string
  */
 function extractTokenFromRequest(req) {
@@ -89,6 +97,7 @@ function extractTokenFromRequest(req) {
     }
     return null;
 }
+/** What the audit of an admin-capable token's use records about the request. */
 function requestFacts(req) {
     if (req === undefined)
         return {};
@@ -97,203 +106,9 @@ function requestFacts(req) {
     const path = typeof url === 'string' ? url.split('?')[0] : undefined;
     return { ...(path !== undefined ? { path } : {}), ...(ip !== null ? { ip } : {}) };
 }
-/**
- * An admin token (`csa_`): an ADMIN principal, attributed to the admin who
- * created it, every use audited. Validation (owner still exists and is still
- * an admin, not revoked, not expired) is local-auth's (`AdminTokenManager`).
- */
-async function resolveAdminToken(token, addonRegistry, facts) {
-    const internal = (0, system_1.getUserManagementInternal)(addonRegistry.getCapabilityRegistry().getSingleton('user-management'));
-    if (internal === null)
-        return null;
-    const record = await internal.adminTokens.validate(token).catch(() => null);
-    if (record === null)
-        return null;
-    void internal.audit.record({
-        action: 'admin-token-used',
-        userId: record.createdBy,
-        ...(facts.ip !== undefined ? { ip: facts.ip } : {}),
-        detail: {
-            tokenId: record.id,
-            name: record.name,
-            prefix: record.tokenPrefix,
-            ...(facts.path !== undefined ? { path: facts.path } : {}),
-        },
-    });
-    return {
-        id: record.createdBy,
-        username: `admin-token:${record.name}`,
-        isAdmin: true,
-        permissions: { isAdmin: true, allowedProviders: '*', allowedDevices: {} },
-        isApiKey: true,
-        credential: 'admin-token',
-        adminTokenId: record.id,
-    };
-}
-async function resolveUser(token, authService, addonRegistry, shareTokens = null, logger = null, facts = {}) {
-    if (!token)
-        return null;
-    if (token.startsWith(system_1.ADMIN_TOKEN_PREFIX))
-        return resolveAdminToken(token, addonRegistry, facts);
-    // Share-token path (`csv_*`): resolve through the ShareTokenService.
-    // The synthetic principal is maximally restricted — non-admin, no
-    // scopes; the `shareView` grant routes it into the fail-closed
-    // allowlist in `protectedProcedure` instead of the scope matcher.
-    if (token.startsWith(share_token_service_js_1.SHARE_TOKEN_PREFIX)) {
-        if (!shareTokens)
-            return null;
-        try {
-            const record = await shareTokens.validate(token);
-            if (!record)
-                return null;
-            return {
-                id: record.userId,
-                // Display label — `share:<prefix>` keeps audit logs readable
-                // without exposing the token hash.
-                username: `share:${record.tokenPrefix}`,
-                isAdmin: false,
-                permissions: {
-                    isAdmin: false,
-                    allowedProviders: '*',
-                    allowedDevices: {},
-                },
-                isApiKey: true,
-                shareView: { tokenId: record.id, scope: record.scope },
-            };
-        }
-        catch {
-            return null;
-        }
-    }
-    // Scoped-token path: hit the user-management cap. Synthetic user
-    // with `isAdmin: false` so admin-gated procedures bounce while
-    // protectedProcedure can still gate by scope match.
-    if (token.startsWith('cst_')) {
-        try {
-            const userMgmt = addonRegistry.getCapabilityRegistry().getSingleton('user-management');
-            if (!userMgmt)
-                return null;
-            const record = await userMgmt.validateScopedToken({ token });
-            if (!record)
-                return null;
-            return {
-                id: record.userId,
-                // Display label — `scoped:<prefix>` makes audit logs read
-                // naturally without exposing the token hash.
-                username: `scoped:${record.tokenPrefix}`,
-                isAdmin: false,
-                permissions: {
-                    isAdmin: false,
-                    allowedProviders: '*',
-                    allowedDevices: {},
-                },
-                isApiKey: true,
-                isScoped: true,
-                // Migrate any v2 `device:targets` grant to a v3 selector at the
-                // boundary so the enforcement matcher only ever sees v3.
-                scopes: (0, types_1.normalizeTokenScopes)(record.scopes),
-            };
-        }
-        catch {
-            return null;
-        }
-    }
-    // JWT path.
-    try {
-        const payload = authService.verifyToken(token);
-        // Reject pre-v2 JWTs at the boundary. Tokens issued before the
-        // role → isAdmin migration don't carry the `isAdmin` field, so
-        // letting them through would degrade silently into "non-admin
-        // with no scopes" → locked out of every cap. Returning null forces
-        // the client to land on 401 → re-login, where it picks up a fresh
-        // v2 token. No back-compat shim — the role enum is gone.
-        if (typeof payload.isAdmin !== 'boolean') {
-            return null;
-        }
-        // What the token IS decides both WHETHER it authenticates at all and
-        // WHERE its scopes come from.
-        const principal = (0, types_1.classifyBearerPrincipal)(payload);
-        // ── The allowlist ────────────────────────────────────────────────
-        // Every token this hub mints verifies under the same `auth.jwtSecret`, so
-        // `verifyToken` succeeding means "we minted this", never "this is an API
-        // credential" (D103). Exactly two kinds are credentials here:
-        //
-        //   • `session` — no `kind` claim: `auth.login`'s JWT and the SSO-minted
-        //     session from `/api/auth/sso/finish`.
-        //   • `integration` — `provider: 'oauth-access'`: the account-link
-        //     credential a component (Home Assistant) calls `/trpc` with.
-        //
-        // Everything else is minted for ONE hand-off step and is refused: an
-        // `oauth-code` is single-use, lives 60s and travels in a browser redirect
-        // URL (history, referrers, proxy logs); an `oauth-refresh` belongs to
-        // `POST /oauth/token`; an `oidc` login bridge belongs to
-        // `?bridge=` on `/api/auth/sso/finish`; a `totp-challenge` is login leg 1.
-        // `/addon/:addonId/*` has refused these since D103 — this closes the same
-        // hole on the other surface.
-        //
-        // The TOTP login is unaffected BY CONSTRUCTION: `loginVerifyTotp` takes
-        // the challenge as procedure INPUT on a public rate-limited procedure, and
-        // neither the SDK (`login()` calls `setToken` only when
-        // `!requiresSecondFactor`) nor the admin UI ever puts it in a header.
-        if (principal.kind === 'not-a-credential') {
-            logger?.warn('trpc: refused a bearer that is not an API credential', {
-                meta: { reason: principal.reason, userId: payload.userId ?? 'unknown' },
-            });
-            return null;
-        }
-        // What the token says it IS. An `oauth-access` token is an account link,
-        // and until this was carried onto the principal a refusal of one was
-        // indistinguishable in the logs from a refusal of a browser session.
-        const credential = (0, trpc_error_principal_js_1.readCredentialIdentity)(payload);
-        return {
-            id: payload.userId ?? 'unknown',
-            username: payload.username ?? 'unknown',
-            isAdmin: payload.isAdmin,
-            permissions: {
-                isAdmin: payload.isAdmin,
-                allowedProviders: payload.allowedProviders,
-                allowedDevices: payload.allowedDevices,
-            },
-            isApiKey: false,
-            ...(principal.kind === 'session' && typeof payload.sid === 'string'
-                ? { sessionId: payload.sid }
-                : {}),
-            // Scopes are baked into the JWT at login; the middleware uses
-            // them to gate every call until the user re-logs. Normalised at the
-            // boundary — a v2 `device:targets` JWT (issued before the v3 model)
-            // migrates to a selector here, so a pre-v3 token keeps working.
-            //
-            // …but a login-time snapshot is exactly the bug: an admin editing a
-            // user's scopes expects the change to APPLY, and the live session
-            // kept gating on the old set until re-login (2026-08-15: a user
-            // granted the whole fleet kept seeing zero cameras). For non-admin
-            // SESSION principals the store's current scopes win when readable
-            // (memoized — see above); the JWT's copy is the fallback when the
-            // user-management cap is unreachable, so a store hiccup never
-            // locks anybody out mid-request.
-            //
-            // `session` ONLY, and that word is the whole fix. An ACCOUNT-LINK token
-            // is governed by the grant the operator consented to, not by the linking
-            // user's record: it always carries `isAdmin: false` (`oauth-grants.ts`
-            // → `baseClaims`) and its owner is normally an admin, whose record is
-            // deliberately unscoped — so the refresh replaced a six-scope Home
-            // Assistant grant with `[]` and the hub refused the component's first
-            // call with `Have: (none)` (2026-08-19). The user store knows nothing
-            // about a link and must not get a vote on one.
-            ...(payload.scopes !== undefined ? { scopes: (0, types_1.normalizeTokenScopes)(payload.scopes) } : {}),
-            ...(!payload.isAdmin && principal.kind === 'session'
-                ? await (async () => {
-                    const fresh = await refreshScopesFromStore(payload.userId ?? 'unknown', addonRegistry);
-                    return fresh !== null ? { scopes: fresh } : {};
-                })()
-                : {}),
-            ...(credential.credential !== undefined ? { credential: credential.credential } : {}),
-            ...(credential.sessionId !== undefined ? { oauthSessionId: credential.sessionId } : {}),
-        };
-    }
-    catch {
-        return null;
-    }
+async function resolveUser(token, verifier, facts) {
+    const principal = await verifier.verify(token, facts);
+    return principal === null ? null : agentFromPrincipal(principal);
 }
 /**
  * Build the parent-chain walker for the scope-access matcher. Returns every
@@ -304,8 +119,7 @@ async function resolveUser(token, authService, addonRegistry, shareTokens = null
  * the device-manager's PERSISTED parentage (F0.6). It MUST NOT walk the hub
  * `DeviceRegistry` directly: that registry only holds hub-local devices, so it
  * is empty for every forked provider and the inheritance this function exists to
- * provide silently did nothing (0/6 providers inherited). The mirror is warmed
- * off the event path and read synchronously here.
+ * provide silently did nothing (0/6 providers inherited).
  */
 function makeDeviceScopeLookup(addonRegistry) {
     return {
@@ -321,15 +135,12 @@ function makeDeviceScopeLookup(addonRegistry) {
  * `principal` names WHO is calling (D802): `mesh` for the hub's own runners
  * (they reach the bridge over UDS, inside the hub's trust boundary), and
  * `node:<nodeId>` for another node — whose id the hub's mesh gate has bound
- * to its CERTIFICATE before the call got here (`createMeshAccessMiddleware`:
- * the TLS handshake chained to the mesh CA, the leaf CN is that id, D857).
+ * to its CERTIFICATE before the call got here (D857).
  *
- * Both principals are still admins: that keeps every `adminProcedure` an
- * agent's addons call working. What is NOT reachable from another node is
- * decided by the bridge itself (`REMOTE_DENIED_NAMESPACES`), and `repl` is not
- * bridged at all. Narrowing the remote principal to a per-method grant is the
- * next step once the mesh census has measured what each node calls (D802).
- * There is no HTTP request behind the call.
+ * Both principals hold `'*'`: that keeps every `adminProcedure` an agent's
+ * addons call working. What is NOT reachable from another node is decided by
+ * the bridge itself (`REMOTE_DENIED_NAMESPACES`), and `repl` is not bridged at
+ * all. There is no HTTP request behind the call.
  */
 function createMeshTrpcContext(principal = 'mesh') {
     const user = {
@@ -338,14 +149,22 @@ function createMeshTrpcContext(principal = 'mesh') {
         isAdmin: true,
         permissions: { isAdmin: true, allowedProviders: '*', allowedDevices: {} },
         isApiKey: true,
+        scopes: ['*'],
+        credentialId: principal,
     };
     return { user };
 }
 /** Context factory for HTTP tRPC requests (Fastify adapter). */
-async function createTrpcContext(req, authService, addonRegistry, shareTokens = null, logger = null) {
-    const token = extractTokenFromRequest(req);
+async function createTrpcContext(req, authService, addonRegistry, shareTokens = null, logger = null, tokenRows = null) {
+    const verifier = hubCredentialVerifier({
+        authService,
+        addonRegistry,
+        shareTokens,
+        tokenRows,
+        logger,
+    });
     return {
-        user: await resolveUser(token, authService, addonRegistry, shareTokens, logger, requestFacts(req)),
+        user: await resolveUser(extractTokenFromRequest(req), verifier, requestFacts(req)),
         req,
         lang: (0, request_lang_js_1.resolveRequestLang)((0, request_lang_js_1.requestLangInputFrom)(req.headers, readQuery(req))),
         deviceScopeLookup: makeDeviceScopeLookup(addonRegistry),
@@ -357,11 +176,18 @@ async function createTrpcContext(req, authService, addonRegistry, shareTokens =
  * Token is sent via tRPC connectionParams (a JSON message sent right after
  * the WS handshake), which is more reliable than query params through proxies.
  */
-async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens = null, logger = null) {
+async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens = null, logger = null, tokenRows = null) {
     // 1. connectionParams.token (sent by BackendClient's createWSClient)
     const paramToken = opts.info.connectionParams?.['token'];
     const token = (typeof paramToken === 'string' ? paramToken : null) ?? extractTokenFromRequest(opts.req);
-    const user = await resolveUser(token, authService, addonRegistry, shareTokens, logger, requestFacts(opts.req));
+    const verifier = hubCredentialVerifier({
+        authService,
+        addonRegistry,
+        shareTokens,
+        tokenRows,
+        logger,
+    });
+    const user = await resolveUser(token, verifier, requestFacts(opts.req));
     const sessionId = user?.sessionId;
     return {
         user,

package/dist/api/trpc/trpc.middleware.js

@@ -14,6 +14,7 @@ const cap_route_error_formatter_js_1 = require("./cap-route-error-formatter.js")
 const device_config_secret_redaction_js_1 = require("./device-config-secret-redaction.js");
 const principal_visibility_js_1 = require("./principal-visibility.js");
 const localized_schema_paths_js_1 = require("./localized-schema-paths.js");
+const principal_authorization_js_1 = require("./principal-authorization.js");
 const scope_access_js_1 = require("./scope-access.js");
 const share_view_access_js_1 = require("./share-view-access.js");
 const user_error_js_1 = require("./user-error.js");
@@ -91,24 +92,20 @@ exports.publicProcedure = t.procedure;
  */
 exports.createCallerFactory = t.createCallerFactory;
 /**
- * Caps-only authenticated procedure (v2).
+ * The authenticated procedure (D892).
  *
- *   - `isAdmin: true` → pass-through. Admin's `scopes` field is ignored.
- *   - `isAdmin: false` → `METHOD_ACCESS_MAP[path]` lookup + scope match.
- *     The caller's scope set must grant the required (capName, access)
- *     pair via one of the three forms (`category`/`capability`/`addon`).
+ * The principal's `scopes` decide, through ONE matcher
+ * (`authorizeProcedure`, `principal-authorization.ts`):
  *
- * Hand-written core routers (`auth.*`, `system.info`, etc.) are not
- * codegen'd from cap definitions and therefore not in
- * `METHOD_ACCESS_MAP`. Those routes carry their own gating via
- * `adminProcedure` when destructive; the bare `protectedProcedure`
- * authentication check is the only gate. The middleware skips the
- * scope-check for unknown paths so the SDK boot probe (`auth.me`) and
- * `system.info` reach non-admin / scoped-token callers — without
- * pulling every core route into the codegen map.
+ *   - a `share-view` grant restricts it to the fail-closed embed allowlist
+ *     (`share-view-access.ts`) — enumerated methods, in-scope devices only —
+ *     and its answers are projected to that perimeter;
+ *   - `'*'` passes;
+ *   - otherwise a cap route (`METHOD_ACCESS_MAP`) is scope-matched, and a
+ *     hand-written core route (`auth.*`, `system.info` …) needs authentication
+ *     only — `adminProcedure` on top gates what is destructive.
  *
- * Single source of authority for caps: `isAdmin`. The legacy role enum
- * collapsed onto this boolean in v2.
+ * What kind of credential the principal came from is never read here.
  */
 exports.protectedProcedure = localized.use(async ({ ctx, next, path, getRawInput }) => {
     if (!ctx.user) {
@@ -120,93 +117,55 @@ exports.protectedProcedure = localized.use(async ({ ctx, next, path, getRawInput
     if (ctx.sessionLive !== undefined && !ctx.sessionLive()) {
         throw (0, user_error_js_1.trpcUserError)('UNAUTHORIZED', 'auth.session-ended', undefined, 'Session ended — sign in again');
     }
-    // Share-view principals (`csv_*` tokens) NEVER reach the admin bypass,
-    // the hand-written-route pass-through, or the scope matcher below —
-    // they are gated exclusively by the fail-closed embed-surface allowlist
-    // (`share-view-access.ts`): enumerated methods only, in-scope devices only.
-    if (ctx.user.shareView) {
-        const rawInput = await getRawInput();
-        const result = (0, share_view_access_js_1.checkShareViewAccess)(ctx.user.shareView.scope, path, rawInput);
-        if (!result.ok) {
-            throw new server_1.TRPCError({ code: 'FORBIDDEN', message: result.reason });
-        }
-        // `deviceManager.listAll` is allowlisted for the embed's tile names,
-        // but its raw rows describe EVERY device (config incl. credentials).
-        // Project the output down to the in-scope whitelisted rows.
+    const user = ctx.user;
+    const verdict = (0, principal_authorization_js_1.authorizeProcedure)(user.scopes ?? [], path, await getRawInput(), ctx.deviceScopeLookup);
+    if (!verdict.ok) {
+        throw new server_1.TRPCError({ code: 'FORBIDDEN', message: verdict.reason });
+    }
+    // Spread+reassign of `user` narrows downstream ctx from `User | null` to
+    // `User` so `adminProcedure` can read fields without re-checking.
+    if (verdict.mode === 'all') {
+        return next({ ctx: { ...ctx, user } });
+    }
+    if (verdict.mode === 'share') {
+        const grant = verdict.grant;
+        // `deviceManager.listAll` is allowlisted for the embed's tile names, but
+        // its raw rows describe EVERY device (config incl. credentials): project
+        // it down to the in-scope whitelisted rows. The events surface answers
+        // with ROWS carrying a `deviceId`, and two of its methods can reach
+        // devices outside the scope — this is where that answer is cut.
         if (path === 'deviceManager.listAll') {
-            const out = await next({ ctx: { ...ctx, user: ctx.user } });
-            if (out.ok) {
-                return { ...out, data: (0, share_view_access_js_1.projectListAllForShareScope)(out.data, ctx.user.shareView.scope) };
-            }
-            return out;
+            const out = await next({ ctx: { ...ctx, user } });
+            return out.ok ? { ...out, data: (0, share_view_access_js_1.projectListAllForShareScope)(out.data, grant) } : out;
         }
-        // The events surface answers with ROWS carrying a `deviceId`, and two of
-        // its three methods can legitimately reach devices outside the scope: a
-        // partially in-scope `listRecentTracks`, and a `searchObjectEvents` with
-        // no `deviceId` at all (which means EVERY camera). The enumeration lets
-        // those calls through — this is where the answer is cut. Without it the
-        // allowlist would be a doorman who checks the ticket and then hands over
-        // the whole building.
         if (share_view_access_js_1.SHARE_SCOPE_PROJECTED_METHODS.has(path)) {
-            const out = await next({ ctx: { ...ctx, user: ctx.user } });
-            if (out.ok) {
-                return { ...out, data: (0, share_view_access_js_1.projectShareScopeRows)(out.data, ctx.user.shareView.scope) };
-            }
-            return out;
-        }
-        return next({ ctx: { ...ctx, user: ctx.user } });
-    }
-    // Spread+reassign of `user` narrows downstream ctx from `User | null`
-    // to `User` so `adminProcedure` can read fields
-    // without re-checking.
-    if (ctx.user.isAdmin) {
-        return next({ ctx: { ...ctx, user: ctx.user } });
-    }
-    // Everything below this line is a NON-ADMIN principal.
-    //
-    // A hand-written core route has no cap entry. Authentication has
-    // already passed; defer further gating to any explicit
-    // `adminProcedure` chained on top of this one. A cap route is
-    // scope-matched first.
-    if (path in system_1.METHOD_ACCESS_MAP) {
-        // Device-scope caps may be gated by a `device:N` scope. Resolve the
-        // raw input once so the matcher can read `input.deviceId` without
-        // re-doing the Zod parse (tRPC caches the parsed input downstream).
-        // The `getDeviceAncestors` hook lets the matcher walk parent → child
-        // accessory inheritance (grant on Reolink also covers its siren / PIR).
-        const rawInput = await getRawInput();
-        const result = (0, scope_access_js_1.checkScopeAccess)(ctx.user.scopes ?? [], path, rawInput, ctx.deviceScopeLookup);
-        if (!result.ok) {
-            throw new server_1.TRPCError({ code: 'FORBIDDEN', message: result.reason });
+            const out = await next({ ctx: { ...ctx, user } });
+            return out.ok ? { ...out, data: (0, share_view_access_js_1.projectShareScopeRows)(out.data, grant) } : out;
         }
+        return next({ ctx: { ...ctx, user } });
     }
     // A non-admin who is allowed to READ a device is not thereby allowed to
     // read the credential that opens it. `deviceManager.getDevice` &co. are
     // `auth: 'protected'`, so a read-only `category:system` grant reaches
-    // them — and the raw row carries `config.password` in plaintext for
-    // every camera in the deployment. The value is withheld HERE, at the
-    // transport boundary, so in-process callers (`ctx.api`, the pipeline
-    // orchestrator, the drivers that must actually connect) are unaffected.
+    // them — and the raw row carries `config.password` in plaintext. The value
+    // is withheld HERE, at the transport boundary, so in-process callers
+    // (`ctx.api`, the drivers that must actually connect) are unaffected.
     const redactConfigSecrets = device_config_secret_redaction_js_1.NON_ADMIN_CONFIG_REDACTED_METHODS.get(path);
-    const out = await next({ ctx: { ...ctx, user: ctx.user } });
+    const out = await next({ ctx: { ...ctx, user } });
     if (!out.ok)
         return out;
     // A device-scoped principal ENUMERATES only its own devices (F1 #4). The
     // matcher lets a `device`-selector grant reach `deviceManager.listAll`
-    // precisely because the answer is cut here; without this the grant would
-    // hand back the whole fleet — names, locations, online state.
+    // precisely because the answer is cut here.
     if (scope_access_js_1.DEVICE_ENUMERATION_METHODS.has(path)) {
-        const projected = (0, principal_visibility_js_1.projectListAllForPrincipal)(out.data, ctx.user.isAdmin, ctx.user.scopes ?? [], ctx.deviceFleet?.() ?? []);
+        const projected = (0, principal_visibility_js_1.projectListAllForPrincipal)(out.data, false, verdict.scopes, ctx.deviceFleet?.() ?? []);
         return {
             ...out,
             data: redactConfigSecrets ? redactConfigSecrets(projected) : projected,
         };
     }
-    // Batch device methods (`deviceIds[]` / `targets[].deviceId` inputs — the
-    // snapshot overview/links and the merged events feed) need no response
-    // projection: the matcher already required EVERY device the request names
-    // to be covered (see `referencedDeviceIds`), so the answer can only
-    // contain rows the caller is entitled to.
+    // Batch device methods need no response projection: the matcher already
+    // required EVERY device the request names to be covered.
     if (redactConfigSecrets) {
         return { ...out, data: redactConfigSecrets(out.data) };
     }

package/dist/api/trpc/trpc.router.js

@@ -362,6 +362,7 @@ function buildCapabilityRouters(services) {
                 ? { network: services.authNetworkPolicy }
                 : {}),
             ...(services.sessionBacking !== undefined ? { sessions: services.sessionBacking } : {}),
+            credentialTokens: services.credentialTokenService ?? null,
             logger: services.loggingService.createLogger('auth'),
         }),
         // NOT MOUNTED — `mount: { kind: 'skip' }` legacy provider shapes