@camstack/server 1.2.603 → 1.2.605

package/dist/core/auth/credential-token.service.js

@@ -0,0 +1,250 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialTokenService = void 0;
+/**
+ * The unified token store (D892).
+ *
+ * A token is a signed JWT `{ kind: 'credential', sub, jti, scopes }` and one
+ * row here: the SHA-256 of its `jti`, its label, its scopes, its ONE expiry,
+ * when it was last used and whether it was revoked. The verifier reads the
+ * row by `jti` on every request — that is what makes revocation immediate and
+ * the expiry slidable (a share link's `extend`). The raw token leaves this
+ * service exactly once, in `mint`'s answer; neither it nor the `jti` is ever
+ * stored or logged.
+ *
+ * Rows live in the `core-auth` records (`credential-tokens`), declared by the
+ * hub beside the share links. Until that binding happens the store refuses to
+ * mint and authenticates nothing — it never falls back to another table.
+ */
+const crypto = __importStar(require("node:crypto"));
+const types_1 = require("@camstack/types");
+const record_kinds_js_1 = require("./record-kinds.js");
+const TOUCH_EVERY_MS = 60_000;
+const DEAD_RETENTION_MS = 30 * 86_400_000;
+const LABEL_MAX = 80;
+const PAGE = 1000;
+const MAX_PAGES = 100;
+function hashJti(jti) {
+    return crypto.createHash('sha256').update(jti).digest('hex');
+}
+/** Constant-time equality of two hex digests. */
+function sameDigest(a, b) {
+    const left = Buffer.from(a, 'hex');
+    const right = Buffer.from(b, 'hex');
+    return left.length === right.length && crypto.timingSafeEqual(left, right);
+}
+function toRecord(id, body) {
+    return {
+        id,
+        subjectId: body.subjectId,
+        createdBy: body.createdBy,
+        label: body.label,
+        scopes: body.scopes,
+        createdAt: body.createdAt,
+        expiresAt: body.expiresAt,
+        lastUsedAt: body.lastUsedAt ?? null,
+        revokedAt: body.revokedAt ?? null,
+    };
+}
+class CredentialTokenService {
+    signer;
+    logger;
+    now;
+    resolveKind = () => null;
+    constructor(signer, logger = null, now = Date.now) {
+        this.signer = signer;
+        this.logger = logger;
+        this.now = now;
+    }
+    /** Hub wiring after `records.forOwner('core-auth').declare(...)`. */
+    bindKind(resolver) {
+        this.resolveKind = resolver;
+    }
+    kind() {
+        const kind = this.resolveKind();
+        if (kind === null) {
+            throw (0, types_1.userError)('auth.tokens-unavailable', undefined, 'Tokens are not available yet');
+        }
+        return kind;
+    }
+    /** Issue a token. The raw token is in this answer only. */
+    async mint(input) {
+        const label = input.label.trim().slice(0, LABEL_MAX);
+        if (label.length === 0) {
+            throw (0, types_1.userError)('auth.token-label-required', undefined, 'A token needs a name');
+        }
+        const at = this.now();
+        if (input.expiresAt !== null && input.expiresAt <= at) {
+            throw (0, types_1.userError)('auth.token-expiry-past', undefined, 'A token must expire in the future');
+        }
+        const jti = crypto.randomBytes(32).toString('base64url');
+        const id = crypto.randomUUID();
+        const body = {
+            subjectId: input.subjectId,
+            createdBy: input.createdBy,
+            label,
+            jtiHash: hashJti(jti),
+            scopes: [...input.scopes],
+            createdAt: at,
+            expiresAt: input.expiresAt,
+            lastUsedAt: null,
+            revokedAt: null,
+        };
+        const parsed = record_kinds_js_1.coreAuthRecordKinds['credential-tokens'].schema.safeParse(body);
+        if (!parsed.success)
+            throw new Error(parsed.error.message);
+        const kind = this.kind();
+        const token = this.signer.signCredentialToken({
+            kind: types_1.CREDENTIAL_TOKEN_KIND,
+            sub: input.subjectId,
+            jti,
+            scopes: [...input.scopes],
+        });
+        await kind.put({
+            id,
+            ...(body.expiresAt !== null ? { expiresAt: body.expiresAt } : {}),
+            data: parsed.data,
+        });
+        this.logger?.info('Token minted', {
+            meta: { tokenId: id, subjectId: input.subjectId, label, expiresAt: input.expiresAt },
+        });
+        return { token, record: toRecord(id, parsed.data) };
+    }
+    /** The live row behind `jti`: unknown, revoked and expired answer `null`. */
+    async lookupLive(jti) {
+        const kind = this.resolveKind();
+        if (kind === null)
+            return null;
+        const digest = hashJti(jti);
+        const page = await kind.query({ where: { jtiHash: digest }, limit: 1 });
+        const row = page.records[0];
+        if (row === undefined || !sameDigest(row.data.jtiHash, digest))
+            return null;
+        const at = this.now();
+        if (row.data.revokedAt !== null && row.data.revokedAt !== undefined)
+            return null;
+        if (row.data.expiresAt !== null && row.data.expiresAt <= at)
+            return null;
+        const lastUsedAt = row.data.lastUsedAt ?? null;
+        if (lastUsedAt === null || at - lastUsedAt > TOUCH_EVERY_MS) {
+            void this.write(row.id, { ...row.data, lastUsedAt: at }).catch(() => { });
+        }
+        return {
+            id: row.id,
+            subjectId: row.data.subjectId,
+            label: row.data.label,
+            scopes: row.data.scopes,
+        };
+    }
+    async get(id) {
+        const row = await this.kind().get(id);
+        return row === null ? null : toRecord(row.id, row.data);
+    }
+    /** Every row not yet reaped, newest first; `subjectId` narrows to one user's. */
+    async list(subjectId) {
+        const kind = this.resolveKind();
+        if (kind === null)
+            return [];
+        const out = [];
+        let cursor;
+        for (let page = 0; page < MAX_PAGES; page += 1) {
+            const answer = await kind.query({
+                ...(subjectId === undefined ? {} : { where: { subjectId } }),
+                limit: PAGE,
+                ...(cursor === undefined ? {} : { cursor }),
+            });
+            out.push(...answer.records.map((row) => toRecord(row.id, row.data)));
+            if (answer.nextCursor === null)
+                return out.toSorted((a, b) => b.createdAt - a.createdAt);
+            cursor = answer.nextCursor;
+        }
+        throw new Error('credential-tokens: row count exceeds pagination bound');
+    }
+    /** Revoke one token now. `false` when unknown or already revoked. */
+    async revoke(id) {
+        const row = await this.kind().get(id);
+        if (row === null || (row.data.revokedAt !== null && row.data.revokedAt !== undefined)) {
+            return false;
+        }
+        await this.write(id, { ...row.data, revokedAt: this.now() });
+        this.logger?.info('Token revoked', { meta: { tokenId: id, subjectId: row.data.subjectId } });
+        return true;
+    }
+    /** Move a live token's expiry (a share link's slide). `null` when not live. */
+    async setExpiry(id, expiresAt) {
+        const row = await this.kind().get(id);
+        if (row === null)
+            return null;
+        const at = this.now();
+        const dead = (row.data.revokedAt !== null && row.data.revokedAt !== undefined) ||
+            (row.data.expiresAt !== null && row.data.expiresAt <= at);
+        if (dead || expiresAt <= at)
+            return null;
+        const next = { ...row.data, expiresAt };
+        await this.write(id, next);
+        return toRecord(id, next);
+    }
+    /** Revoke every live token of `subjectId` (the user was deleted). */
+    async revokeAllFor(subjectId) {
+        let revoked = 0;
+        for (const token of await this.list(subjectId)) {
+            if (token.revokedAt === null && (await this.revoke(token.id)))
+                revoked += 1;
+        }
+        return revoked;
+    }
+    /** Delete rows expired or revoked more than 30 days ago. */
+    async reap() {
+        const horizon = this.now() - DEAD_RETENTION_MS;
+        let deleted = 0;
+        for (const token of await this.list()) {
+            const deadAt = token.revokedAt ?? token.expiresAt;
+            if (deadAt !== null && deadAt < horizon) {
+                await this.kind().delete(token.id);
+                deleted += 1;
+            }
+        }
+        return deleted;
+    }
+    async write(id, body) {
+        await this.kind().put({
+            id,
+            ...(body.expiresAt !== null ? { expiresAt: body.expiresAt } : {}),
+            data: body,
+        });
+    }
+}
+exports.CredentialTokenService = CredentialTokenService;

package/dist/core/auth/record-kinds.js

@@ -21,6 +21,22 @@ const ShareViewTokenBodySchema = zod_1.z.object({
     expiresAt: zod_1.z.number().nullable(),
     lastUsedAt: zod_1.z.number().nullish(),
 });
+/**
+ * The unified token (D892): one row per token `auth.mintToken` issued — the
+ * hashed `jti` the verifier looks up for revocation, the label, the scopes,
+ * the ONE expiry (`null` only for a never-expiring share link), last use.
+ */
+const CredentialTokenBodySchema = zod_1.z.object({
+    subjectId: zod_1.z.string(),
+    createdBy: zod_1.z.string(),
+    label: zod_1.z.string(),
+    jtiHash: zod_1.z.string(),
+    scopes: zod_1.z.array(types_1.CredentialScopeSchema).min(1),
+    createdAt: zod_1.z.number(),
+    expiresAt: zod_1.z.number().nullable(),
+    lastUsedAt: zod_1.z.number().nullish(),
+    revokedAt: zod_1.z.number().nullish(),
+});
 exports.coreAuthRecordKinds = (0, types_1.defineRecordKinds)({
     'share-view-tokens': {
         schema: ShareViewTokenBodySchema,
@@ -35,4 +51,19 @@ exports.coreAuthRecordKinds = (0, types_1.defineRecordKinds)({
         retention: { none: 'revoke only; expiry enforced at validate' },
         adoptsFrom: exports.SHARE_VIEW_TOKENS_LEGACY,
     },
+    'credential-tokens': {
+        schema: CredentialTokenBodySchema,
+        class: 'config',
+        writeTrigger: 'a user mints a token (auth.mintToken or a wrapper); validate touches lastUsedAt at most once a minute; revoke stamps revokedAt',
+        device: 'none',
+        at: 'none',
+        indexes: [
+            { name: 'jti', fields: ['jtiHash'], unique: true },
+            { name: 'subject', fields: ['subjectId'] },
+        ],
+        retention: {
+            owner: 'core-auth',
+            reason: 'the daily reap deletes rows expired or revoked more than 30 days ago',
+        },
+    },
 });

package/dist/main.js

@@ -88,7 +88,7 @@ const trpc_error_device_tags_1 = require("./api/trpc/trpc-error-device-tags");
 const trpc_error_principal_1 = require("./api/trpc/trpc-error-principal");
 const ws_request_census_1 = require("./api/trpc/ws-request-census");
 const ws_slow_consumer_guard_js_1 = require("./api/trpc/ws-slow-consumer-guard.js");
-const addon_route_jwt_gate_js_1 = require("./auth/addon-route-jwt-gate.js");
+const addon_route_auth_js_1 = require("./auth/addon-route-auth.js");
 const addon_route_share_gate_js_1 = require("./auth/addon-route-share-gate.js");
 const auth_network_policy_js_1 = require("./auth/auth-network-policy.js");
 const hub_sessions_js_1 = require("./auth/hub-sessions.js");
@@ -121,6 +121,7 @@ const agent_registry_service_1 = require("./core/agent/agent-registry.service");
 const well_known_app_links_1 = require("./core/app-links/well-known-app-links");
 const auth_service_1 = require("./core/auth/auth.service");
 const handoff_code_service_1 = require("./core/auth/handoff-code.service");
+const credential_token_service_js_1 = require("./core/auth/credential-token.service.js");
 const share_token_service_1 = require("./core/auth/share-token.service");
 const config_service_1 = require("./core/config/config.service");
 const event_bus_service_1 = require("./core/events/event-bus.service");
@@ -600,6 +601,12 @@ async function bootstrap() {
     // builtin registers; the service resolves it per call).
     const shareTokenService = new share_token_service_1.ShareTokenService(() => addonRegistry.getSettingsBackend(), loggingService.createLogger('share-tokens'));
     addonRegistry.setShareTokenService(shareTokenService);
+    // The unified token store (D892): rows in the `core-auth` records, bound
+    // with the share links; the JWT is signed with the session signing key.
+    const credentialTokenService = new credential_token_service_js_1.CredentialTokenService(app.get(auth_service_1.AuthService), loggingService.createLogger('tokens'));
+    addonRegistry.setCredentialTokenService(credentialTokenService);
+    // Every surface that verifies a bearer reads the same stores (D892).
+    (0, trpc_context_1.bindHubCredentialStores)({ shareTokens: shareTokenService, tokenRows: credentialTokenService });
     // One-time native-app login handoff codes (in-memory, 60s TTL, single-use) —
     // minted by `auth.createHandoffCode`, redeemed by the viewer app via the
     // public `auth.redeemHandoffCode`.
@@ -632,6 +639,7 @@ async function bootstrap() {
     const buildRouter = () => (0, trpc_router_1.buildAppRouter)({
         authService: app.get(auth_service_1.AuthService),
         shareTokenService,
+        credentialTokenService,
         handoffCodeService,
         externalLinkIntents,
         nativeLink: {
@@ -803,7 +811,7 @@ async function bootstrap() {
                     const trpcCtx = await (0, trpc_context_1.createTrpcContext)(req, authService, addonRegistry, shareTokenService, 
                     // A bearer refused for NOT being an API credential never reaches a
                     // procedure, so `onError` below never sees it — the refusal would
-                    // be silent without this. Same reason `gateAddonJwt` logs (D103).
+                    // be silent without this. Same reason the addon gate logs (D103).
                     app.get(logging_service_1.LoggingService).createLogger('tRPC'));
                     // WHO called, counted here because this is the first point at which
                     // a principal exists AND the only one tRPC runs exactly once per
@@ -1075,6 +1083,12 @@ async function bootstrap() {
         // about ("why did Home Assistant stop actuating?"). Its own scope so the
         // reason is greppable rather than buried in the bootstrap logger.
         const addonGateLogger = app.get(logging_service_1.LoggingService).createLogger('addon-route-auth');
+        const addonVerifier = (0, trpc_context_1.hubCredentialVerifier)({
+            authService,
+            addonRegistry,
+            shareTokens: shareTokenService,
+            logger: addonGateLogger,
+        });
         // Addon HTTP API route catch-all: /addon/:addonId/*
         // Only handles non-GET or routes that actually exist in the addon route registry.
         // GET requests that don't match an addon route are SPA pages — handled by the /* fallback.
@@ -1113,40 +1127,20 @@ async function bootstrap() {
                         return reply.status(401).send({ error: 'Unauthorized' });
                     }
                     const token = authHeader ? authHeader.replace('Bearer ', '') : cookieToken;
-                    if (token.startsWith('csv_')) {
-                        // A share link (`csv_*`): admitted only by a plane that opted in
-                        // to its scope kind, and the scope's devices travel in headers the
-                        // HUB sets — whatever the client sent under those names is dropped
-                        // (see `addon-route-share-gate.ts`).
-                        const record = await shareTokenService.validate(token);
-                        const gate = (0, addon_route_share_gate_js_1.gateAddonShareToken)({ record, endpoint: dpMatch.endpoint });
-                        if (!gate.ok)
-                            return reply.status(gate.status).send({ error: gate.error });
-                        shareHeaders = gate.headers;
-                    }
-                    else if (token.startsWith('cst_')) {
-                        const userMgmt = capabilityRegistry?.getSingleton('user-management');
-                        if (!userMgmt)
-                            return reply.status(503).send({ error: 'User management not available' });
-                        const scopedToken = await userMgmt.validateScopedToken({ token });
-                        const scopeOk = scopedToken?.scopes.some((scope) => scope.type === 'addon' && scope.target === addonId);
-                        if (!scopedToken || !scopeOk) {
-                            return reply.status(403).send({ error: 'Token scope mismatch' });
-                        }
-                    }
-                    else {
-                        let payload;
-                        try {
-                            payload = authService.verifyToken(token);
-                        }
-                        catch {
-                            return reply.status(401).send({ error: 'Invalid token' });
-                        }
-                        const gate = (0, addon_route_jwt_gate_js_1.gateAddonJwt)({ payload, addonId, method, access }, addonGateLogger);
-                        if (!gate.ok) {
-                            return reply.status(gate.status).send({ error: gate.error });
-                        }
-                    }
+                    // The ONE verifier and the ONE scope matcher, as on tRPC (D892). A
+                    // share principal is admitted only by a plane that opted in to its
+                    // kind, and its devices travel in headers the HUB sets — whatever
+                    // the client sent under those names is dropped below.
+                    const auth = await (0, addon_route_auth_js_1.authorizeAddonBearer)({
+                        bearer: token,
+                        verifier: addonVerifier,
+                        target: { addonId, method, access, share: dpMatch.endpoint.share ?? [] },
+                        facts: (0, trpc_context_1.requestFacts)(request),
+                        logger: addonGateLogger,
+                    });
+                    if (!auth.ok)
+                        return reply.status(auth.status).send({ error: auth.error });
+                    shareHeaders = auth.shareHeaders;
                 }
                 const qIdx = request.url.indexOf('?');
                 const queryString = qIdx >= 0 ? request.url.slice(qIdx) : '';
@@ -1221,67 +1215,27 @@ async function bootstrap() {
                     return reply.status(401).send({ error: 'Unauthorized' });
                 }
                 const token = authHeader ? authHeader.replace('Bearer ', '') : cookieToken;
-                if (token.startsWith('cst_')) {
-                    const userMgmt = capabilityRegistry?.getSingleton('user-management');
-                    if (!userMgmt)
-                        return reply.status(503).send({ error: 'User management not available' });
-                    const scopedToken = await userMgmt.validateScopedToken({ token });
-                    if (!scopedToken) {
-                        return reply.status(401).send({ error: 'Invalid token' });
-                    }
-                    // v2 model: scoped tokens grant by cap-category/cap-name/addon.
-                    // For addon-route REST endpoints we match the `addon` scope
-                    // type only — generic route-prefix scopes were dropped with
-                    // the caps-only refactor.
-                    const scopeMatch = scopedToken.scopes.some((scope) => {
-                        return scope.type === 'addon' && scope.target === addonId;
-                    });
-                    if (!scopeMatch) {
-                        return reply.status(403).send({ error: 'Token scope mismatch' });
-                    }
-                    // Build addon request with scoped token context
-                    const addonRequest = {
-                        params: match.params,
-                        query,
-                        body: request.body,
-                        headers,
-                        scopedToken: {
-                            id: scopedToken.id,
-                            userId: scopedToken.userId,
-                            scopes: scopedToken.scopes,
-                        },
-                    };
-                    const addonReply = buildAddonReply(reply);
-                    return match.route.handler(addonRequest, addonReply);
-                }
-                else {
-                    let payload;
-                    try {
-                        payload = authService.verifyToken(token);
-                    }
-                    catch {
-                        return reply.status(401).send({ error: 'Invalid token' });
-                    }
-                    // NOTE: the handler call used to sit INSIDE this try, so a throw from
-                    // an addon's own route handler was reported as `401 Invalid token`.
-                    const gate = (0, addon_route_jwt_gate_js_1.gateAddonJwt)({ payload, addonId, method, access: match.route.access }, addonGateLogger);
-                    if (!gate.ok) {
-                        return reply.status(gate.status).send({ error: gate.error });
-                    }
-                    const addonRequest = {
-                        params: match.params,
-                        query,
-                        body: request.body,
-                        headers,
-                        user: {
-                            id: payload.userId ?? 'unknown',
-                            username: payload.username ?? 'unknown',
-                            isAdmin: payload.isAdmin,
-                        },
-                    };
-                    const addonReply = buildAddonReply(reply);
-                    return match.route.handler(addonRequest, addonReply);
-                }
+                // The ONE verifier and the ONE scope matcher, as on tRPC (D892).
+                const auth = await (0, addon_route_auth_js_1.authorizeAddonBearer)({
+                    bearer: token,
+                    verifier: addonVerifier,
+                    target: { addonId, method, access: match.route.access },
+                    facts: (0, trpc_context_1.requestFacts)(request),
+                    logger: addonGateLogger,
+                });
+                if (!auth.ok)
+                    return reply.status(auth.status).send({ error: auth.error });
+                // NOTE: the handler call used to sit INSIDE the JWT try, so a throw
+                // from an addon's own route handler was reported as `401 Invalid token`.
+                const addonRequest = {
+                    params: match.params,
+                    query,
+                    body: request.body,
+                    headers,
+                    ...(0, addon_route_auth_js_1.addonRouteCaller)(auth.principal),
+                };
+                const addonReply = buildAddonReply(reply);
+                return match.route.handler(addonRequest, addonReply);
             }
             // Public route — no auth required
             const addonRequest = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.603",
+  "version": "1.2.605",
   "license": "MIT",
   "private": false,
   "files": [
@@ -38,19 +38,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.440",
-    "@camstack/addon-agent-ui": "1.2.246",
-    "@camstack/addon-auth": "1.2.151",
-    "@camstack/addon-decoder-nodeav": "1.2.125",
-    "@camstack/addon-notifiers": "1.2.603",
-    "@camstack/addon-pipeline": "1.2.603",
-    "@camstack/addon-pipeline-orchestrator": "1.2.604",
-    "@camstack/addon-post-analysis": "1.2.608",
-    "@camstack/develop": "0.1.15",
-    "@camstack/sdk": "1.2.135",
-    "@camstack/system": "1.2.454",
-    "@camstack/types": "1.2.385",
-    "@camstack/ui-library": "1.2.302",
+    "@camstack/addon-admin-ui": "1.2.441",
+    "@camstack/addon-agent-ui": "1.2.247",
+    "@camstack/addon-auth": "1.2.152",
+    "@camstack/addon-decoder-nodeav": "1.2.126",
+    "@camstack/addon-notifiers": "1.2.604",
+    "@camstack/addon-pipeline": "1.2.604",
+    "@camstack/addon-pipeline-orchestrator": "1.2.605",
+    "@camstack/addon-post-analysis": "1.2.610",
+    "@camstack/develop": "0.1.16",
+    "@camstack/sdk": "1.2.136",
+    "@camstack/system": "1.2.455",
+    "@camstack/types": "1.2.386",
+    "@camstack/ui-library": "1.2.303",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",

package/dist/auth/addon-route-jwt-gate.js

@@ -1,59 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.gateAddonJwt = gateAddonJwt;
-/**
- * The JWT half of the `/addon/:addonId/*` gate — shared by the HTTP data-plane
- * branch and the addon-route branch so there is exactly ONE answer to "may this
- * bearer reach this addon".
- *
- * Before this existed the two branches disagreed with themselves and with the
- * `cst_` branch: a scoped token needed an `addon:<id>` grant, while ANY valid
- * hub JWT passed on nothing but a signature check. Measured on the live hub
- * 2026-08-09, that let an `oauth-access` token minted for the `export-alexa`
- * account link drive `POST /addon/homeassistant-export/command` — PTZ, reboot,
- * the per-camera switches and notification snooze. A 60-second authorization
- * CODE and a 30-day refresh token passed the same way. See D103.
- */
-const types_1 = require("@camstack/types");
-function readScopes(raw) {
-    return Array.isArray(raw) ? raw : [];
-}
-/**
- * Decide, and REPORT. A refusal always returns its reason to the log — a branch
- * that drops a request silently reads as "never happened", and this one drops
- * requests an operator will be trying to explain.
- *
- * Order is deliberate. `Admin required` is answered before the scope check so
- * an admin-only route keeps the response it already had; nothing that is not a
- * session or an `oauth-access` token gets that far at all.
- */
-function gateAddonJwt(input, logger) {
-    const principal = (0, types_1.classifyBearerPrincipal)(input.payload);
-    const isAdmin = input.payload.isAdmin === true;
-    if (principal.kind === 'not-a-credential') {
-        logger.warn('addon route: refused a bearer that is not an API credential', {
-            meta: { addonId: input.addonId, method: input.method, reason: principal.reason },
-        });
-        return { ok: false, status: 401, error: 'Invalid token' };
-    }
-    if (input.access === 'admin' && !isAdmin) {
-        logger.warn('addon route: refused a non-admin bearer on an admin route', {
-            meta: { addonId: input.addonId, method: input.method, principal: principal.kind },
-        });
-        return { ok: false, status: 403, error: 'Admin required' };
-    }
-    const verdict = (0, types_1.principalMayReachAddon)({
-        principal,
-        scopes: readScopes(input.payload.scopes),
-        isAdmin,
-        addonId: input.addonId,
-        method: input.method,
-    });
-    if (!verdict.allowed) {
-        logger.warn('addon route: refused an integration token outside its declared grant', {
-            meta: { addonId: input.addonId, method: input.method, reason: verdict.reason },
-        });
-        return { ok: false, status: 403, error: 'Token scope mismatch' };
-    }
-    return { ok: true };
-}