@camstack/server 1.2.604 → 1.2.606

package/dist/api/core/auth.router.js

@@ -32,11 +32,10 @@ const session_cookie_js_1 = require("../../auth/session-cookie.js");
 const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
 const session_mint_js_1 = require("../../auth/session-mint.js");
 const handoff_code_service_js_1 = require("../../core/auth/handoff-code.service.js");
-const share_token_service_js_1 = require("../../core/auth/share-token.service.js");
-const principal_visibility_js_1 = require("../trpc/principal-visibility.js");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
 const auth_limits_js_1 = require("./auth-limits.js");
-const auth_admin_tokens_procedures_js_1 = require("./auth-admin-tokens.procedures.js");
+const auth_audit_procedures_js_1 = require("./auth-audit.procedures.js");
+const auth_tokens_procedures_js_1 = require("./auth-tokens.procedures.js");
 const auth_revoke_credentials_procedures_js_1 = require("./auth-revoke-credentials.procedures.js");
 const auth_reauth_procedures_js_1 = require("./auth-reauth.procedures.js");
 const auth_device_cert_procedures_js_1 = require("./auth-device-cert.procedures.js");
@@ -169,59 +168,17 @@ const OwnExternalIdentitySchema = zod_1.z.object({
     /** Whether the provider instance is configured and enabled right now. */
     available: zod_1.z.boolean(),
 });
-// ── Share tokens (grid-view standalone share links) ──────────────────
-//
-// Wire schemas for the `csv_*` share-token surface. The summary shape
-// deliberately omits `tokenHash` — the raw token is returned exactly
-// once (at mint); afterwards only prefix + scope + timestamps are
-// visible.
-//
-// TTL: a bounded number of seconds, or the EXPLICIT literal `'never'`
-// for a permanently-shared grid (revocation is the kill switch).
-// Omitted → 7-day default; infinite is never a silent default.
-const CreateShareTokenInputSchema = zod_1.z.object({
-    scope: share_token_service_js_1.ShareTokenScopeSchema,
-    ttlSec: zod_1.z
-        .union([
-        zod_1.z.number().int().min(share_token_service_js_1.SHARE_TOKEN_TTL_MIN_SEC).max(share_token_service_js_1.SHARE_TOKEN_TTL_MAX_SEC),
-        zod_1.z.literal('never'),
-    ])
-        .optional(),
-});
-const ShareTokenSummarySchema = zod_1.z.object({
-    id: zod_1.z.string(),
-    userId: zod_1.z.string(),
-    tokenPrefix: zod_1.z.string(),
-    scope: share_token_service_js_1.ShareTokenScopeSchema,
-    createdAt: zod_1.z.number(),
-    /** Epoch ms, or `null` for never-expiring tokens. */
-    expiresAt: zod_1.z.number().nullable(),
-    /** Derived convenience flag so listings surface infinite tokens clearly. */
-    neverExpires: zod_1.z.boolean(),
-    lastUsedAt: zod_1.z.number().optional(),
-});
-function toShareTokenSummary(record) {
-    return {
-        id: record.id,
-        userId: record.userId,
-        tokenPrefix: record.tokenPrefix,
-        scope: record.scope,
-        createdAt: record.createdAt,
-        expiresAt: record.expiresAt,
-        neverExpires: record.expiresAt === null,
-        ...(record.lastUsedAt !== undefined ? { lastUsedAt: record.lastUsedAt } : {}),
-    };
-}
 /**
  * Token minting/management surfaces are for REAL user sessions only.
- * Scoped API tokens (`cst_*`) and share-view principals (`csv_*`) must
- * never mint, list, or revoke share links — nor mint handoff codes —
- * a leaked restricted token would otherwise widen its own reach.
+ * A minted token — whatever its scopes — must never mint handoff codes or
+ * link sign-in accounts: a leaked restricted token would otherwise widen its
+ * own reach.
  */
-function assertRealUserSession(user, what = 'Share-token management') {
-    // An admin token is a script's credential, never a person's session: it
-    // must not turn itself into a session (handoff codes) or mint links.
-    if (user.isScoped || user.shareView || user.adminTokenId !== undefined) {
+function assertRealUserSession(user, what) {
+    // A minted token (admin, scoped or share-view) is a script's
+    // credential, never a person's: it must not turn itself into a session
+    // (handoff codes) or mint links. Provenance, not permission (D892).
+    if (user.userDelegated !== true) {
         throw new server_1.TRPCError({
             code: 'FORBIDDEN',
             message: `${what} requires a real user session`,
@@ -297,19 +254,14 @@ const MeSchema = zod_1.z
     scope: EffectiveScopeSchema.optional(),
 })
     .nullable();
-function createAuthRouter(auth, registry, moleculer = null, shareTokens = null, handoffCodes = new handoff_code_service_js_1.HandoffCodeService(), linkIntents = new external_link_intents_js_1.ExternalLinkIntents(), nativeLink = null, options = {}) {
+function createAuthRouter(auth, registry, moleculer = null, handoffCodes = new handoff_code_service_js_1.HandoffCodeService(), linkIntents = new external_link_intents_js_1.ExternalLinkIntents(), nativeLink = null, options = {}) {
     const network = options.network ?? auth_network_policy_js_1.DEFAULT_AUTH_NETWORK_POLICY;
     const limiters = options.limiters ?? auth_limits_js_1.PROCESS_AUTH_LIMITERS;
     /** Secret-verifying legs (password / TOTP / passkey assertion / codes). */
     const credentialProcedure = makeRateLimitedProcedure(limiters.credential, network);
     /** Challenge-minting begin-legs — looser, they verify nothing. */
     const ceremonyProcedure = makeRateLimitedProcedure(limiters.ceremony, network);
-    const requireShareTokens = () => {
-        if (!shareTokens) {
-            throw new Error('Share tokens unavailable — service not wired on this node');
-        }
-        return shareTokens;
-    };
+    const credentialTokens = options.credentialTokens ?? null;
     /**
      * THE session mint (`auth/session-mint.ts`, D712) — the single shared tail
      * of every successful login leg, including `/api/auth/sso/finish`. It
@@ -787,8 +739,8 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          *     semantics (see `buildSessionCookie` — Lax already withholds
          *     the cookie from cross-site POSTs).
          *   • Only REAL session JWTs qualify: bridge tokens (`kind:
-         *     'totp-challenge'` / `'sso-bridge'`) and `cst_`/`csv_` opaque
-         *     tokens are rejected — the cookie must carry a v2 session.
+         *     'totp-challenge'` / `'sso-bridge'`) and minted tokens are
+         *     rejected — the cookie must carry a v2 session.
          *   • The returned bearer is minted FRESH through the shared
          *     `mintSessionForUserId` tail (re-fetched user → up-to-date
          *     scopes), equivalent to what `auth.login` hands out.
@@ -838,8 +790,8 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         // for a real session. TTL 60s, single-use, bound to the minting
         // user — see `HandoffCodeService`.
         /** Mint a one-time handoff code for the CALLING user. Real user
-         *  sessions only — scoped (`cst_`) and share-view (`csv_`) callers
-         *  must never convert themselves into a full session. */
+         *  sessions only — a minted token (scoped, admin or share-view)
+         *  must never convert itself into a full session. */
         createHandoffCode: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z
             .object({
@@ -957,7 +909,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             // hide surfaces from a single probe (F1 #5). Admins summarise to
             // "everything"; a scoped principal's selectors expand to counts.
             const fleet = ctx.deviceFleet?.() ?? [];
-            const scope = (0, types_1.summarizeEffectiveScope)(ctx.user.scopes ?? [], fleet, ctx.user.isAdmin);
+            const scope = (0, types_1.summarizeEffectiveScope)((0, types_2.capabilityScopesOf)(ctx.user.scopes ?? []), fleet, ctx.user.isAdmin);
             return { ...ctx.user, scope };
         }),
         /**
@@ -1178,142 +1130,6 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 enabled: input.enabled,
             });
         }),
-        // ── Share tokens — scoped, TTL'd view tokens for standalone share
-        //    links (grid rework R6). Minted by any REAL user session (admin
-        //    or regular); the resulting `csv_*` token authenticates as a
-        //    restricted `share-view` principal limited to the embed surface
-        //    + its in-scope devices (see `share-view-access.ts`). ──────────
-        createShareToken: trpc_middleware_js_1.protectedProcedure
-            .input(CreateShareTokenInputSchema)
-            .output(zod_1.z.object({ id: zod_1.z.string(), token: zod_1.z.string(), expiresAt: zod_1.z.number().nullable() }))
-            .mutation(async ({ input, ctx }) => {
-            assertRealUserSession(ctx.user);
-            const service = requireShareTokens();
-            // SECURITY (F0.4): a share token is a PRIVILEGE HANDOFF — it authorises
-            // whoever holds the link to view its devices with no further auth. A
-            // scoped (non-admin) minter must therefore not be able to mint for a
-            // device it cannot itself see: without this, a `device:[5]` token could
-            // mint a `csv_*` grid link for cameras 5..99. Admins mint anything;
-            // every other caller's requested deviceIds are INTERSECTED with what
-            // they can view (device:[parent] covers child accessories via the
-            // ancestor walk). An empty intersection is a refusal, not a silent
-            // "share nothing".
-            const scope = ctx.user.isAdmin
-                ? input.scope
-                : {
-                    ...input.scope,
-                    deviceIds: (0, principal_visibility_js_1.filterViewableDeviceIds)(ctx.user.scopes ?? [], input.scope.deviceIds, ctx.deviceScopeLookup),
-                };
-            if (scope.deviceIds.length === 0) {
-                throw new server_1.TRPCError({
-                    code: 'FORBIDDEN',
-                    message: 'None of the requested devices are within your scope — you cannot mint a share token for devices you cannot see',
-                });
-            }
-            const { token, record } = await service.create({
-                userId: ctx.user.id,
-                scope,
-                ...(input.ttlSec !== undefined ? { ttlSec: input.ttlSec } : {}),
-            });
-            return { id: record.id, token, expiresAt: record.expiresAt };
-        }),
-        /**
-         * Slide expiry on a still-valid share token (same `csv_*`). Used by the
-         * Home Assistant embed cache so a long-lived dashboard does not mint a
-         * new row every hour. Expired / missing → NOT_FOUND (caller must create).
-         */
-        extendShareToken: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({
-            id: zod_1.z.string().min(1),
-            ttlSec: zod_1.z.number().int().min(share_token_service_js_1.SHARE_TOKEN_TTL_MIN_SEC).max(share_token_service_js_1.SHARE_TOKEN_TTL_MAX_SEC),
-        }))
-            .output(zod_1.z.object({ id: zod_1.z.string(), expiresAt: zod_1.z.number() }))
-            .mutation(async ({ input, ctx }) => {
-            assertRealUserSession(ctx.user);
-            const service = requireShareTokens();
-            try {
-                const record = await service.extend({
-                    id: input.id,
-                    ttlSec: input.ttlSec,
-                    callerUserId: ctx.user.id,
-                    callerIsAdmin: ctx.user.isAdmin,
-                });
-                if (record.expiresAt === null) {
-                    throw (0, user_error_js_1.trpcUserError)('BAD_REQUEST', 'auth.share-never-expiring-extend', undefined, 'A never-expiring share token cannot be extended');
-                }
-                return { id: record.id, expiresAt: record.expiresAt };
-            }
-            catch (error) {
-                const message = error instanceof Error ? error.message : 'Share token extend failed';
-                if (/not found|expired/i.test(message)) {
-                    throw new server_1.TRPCError({ code: 'NOT_FOUND', message });
-                }
-                if (/owner or an admin|never-expiring/i.test(message)) {
-                    throw new server_1.TRPCError({ code: 'FORBIDDEN', message });
-                }
-                throw new server_1.TRPCError({ code: 'BAD_REQUEST', message });
-            }
-        }),
-        revokeShareToken: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({ id: zod_1.z.string().min(1) }))
-            .output(zod_1.z.object({ success: zod_1.z.boolean() }))
-            .mutation(async ({ input, ctx }) => {
-            assertRealUserSession(ctx.user);
-            const service = requireShareTokens();
-            try {
-                const removed = await service.revoke({
-                    id: input.id,
-                    callerUserId: ctx.user.id,
-                    callerIsAdmin: ctx.user.isAdmin,
-                });
-                if (removed) {
-                    const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
-                    if (internal !== null) {
-                        const ip = network.clientAddress(ctx.req).ip;
-                        await internal.audit.record({
-                            action: 'credentials-revoked',
-                            userId: ctx.user.id,
-                            ...(ip !== null ? { ip } : {}),
-                            detail: {
-                                kind: 'share-link',
-                                requested: 1,
-                                revoked: 1,
-                                skipped: 0,
-                                ids: input.id,
-                            },
-                        });
-                    }
-                }
-                return { success: removed };
-            }
-            catch (error) {
-                throw new server_1.TRPCError({
-                    code: 'FORBIDDEN',
-                    message: error instanceof Error ? error.message : 'Share token revoke failed',
-                });
-            }
-        }),
-        /**
-         * Share links. `owner: 'self'` — the caller's own (My access);
-         * `owner: 'all'` — every user's, admin only. Omitted keeps the original
-         * answer (own for a user, all for an admin) for clients that predate it.
-         */
-        listShareTokens: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({ owner: zod_1.z.enum(['self', 'all']).optional() }).optional())
-            .output(zod_1.z.array(ShareTokenSummarySchema))
-            .query(async ({ ctx, input }) => {
-            assertRealUserSession(ctx.user);
-            const service = requireShareTokens();
-            const owner = input?.owner ?? (ctx.user.isAdmin ? 'all' : 'self');
-            if (owner === 'all' && !ctx.user.isAdmin) {
-                throw new server_1.TRPCError({
-                    code: 'FORBIDDEN',
-                    message: "Listing every user's share links requires an admin",
-                });
-            }
-            const records = owner === 'all' ? await service.listAll() : await service.listForUser(ctx.user.id);
-            return records.map(toShareTokenSummary);
-        }),
         ...(0, auth_sessions_procedures_js_1.createSessionProcedures)({ registry, minter, credentialProcedure }),
         ...(0, auth_device_cert_procedures_js_1.createDeviceCertProcedures)({
             registry,
@@ -1331,8 +1147,9 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             issueFor,
         }),
         ...(0, auth_reauth_procedures_js_1.createReauthProcedures)({ auth, registry, moleculer, limiters }),
-        ...(0, auth_admin_tokens_procedures_js_1.createAdminTokenProcedures)({ auth, registry, network }),
-        ...(0, auth_revoke_credentials_procedures_js_1.createRevokeCredentialsProcedures)({ registry, shareTokens, network }),
+        ...(0, auth_audit_procedures_js_1.createAuthAuditProcedures)({ registry }),
+        ...(0, auth_tokens_procedures_js_1.createTokenProcedures)({ auth, registry, network, credentialTokens }),
+        ...(0, auth_revoke_credentials_procedures_js_1.createRevokeCredentialsProcedures)({ registry, network, credentialTokens }),
         // ── External sign-in identities (D782) ────────────────────────
         //
         // A signed-in user links an OIDC identity to THEIR OWN account. The

package/dist/api/core/live-events.router.js

@@ -45,7 +45,7 @@ function createLiveEventsRouter(eb, ar) {
             // Share-view principals get a device-filtered stream: only events
             // attributable to an in-scope device are pushed (fail closed —
             // unattributable events are dropped).
-            const shareScope = ctx.user.shareView?.scope ?? null;
+            const shareScope = (0, types_1.shareViewGrantOf)(ctx.user.scopes ?? []);
             // Non-share scoped tokens get the SAME projection keyed to what they may
             // view (F0.5); admins and broad category-view operators are unfiltered.
             const scopedKeep = shareScope

package/dist/api/core/preferences.router.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.preferencesFromRegistry = preferencesFromRegistry;
+exports.preferencesOwnerOf = preferencesOwnerOf;
+exports.createPreferencesRouter = createPreferencesRouter;
+/**
+ * Account preferences — fixed core API (D894), not a capability.
+ *
+ *   get           the caller's rows (all, or the namespaces asked)
+ *   put           write one namespace; `baseRevision` turns it into a
+ *                 compare-and-set that answers `conflict` with the current row
+ *   delete        remove one namespace
+ *   changedSince  the cheap poll: only rows the client does not hold yet
+ *
+ * There is no `userId` input anywhere: every call acts on the PRINCIPAL's own
+ * rows, admin included — an admin cannot read another user's preferences
+ * through this router, and nothing else serves them. The principal must hold
+ * `preferences-self` (every person's session does; a unified token only when
+ * minted with it), so a share link, a legacy token, an account link and the
+ * hub's own mesh principal are refused.
+ *
+ * Sync is by polling `changedSince`: there is no per-user push channel to a
+ * user's sessions, and the event bus is fleet-wide telemetry (D8).
+ *
+ * The rows live in `local-auth` (it owns the users, and a user's delete wipes
+ * them), reached through the hub-internal half of `user-management`.
+ */
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const user_error_js_1 = require("../trpc/user-error.js");
+/** The store behind the hub's in-process `user-management` provider. */
+function preferencesFromRegistry(registry) {
+    return () => registry === null
+        ? null
+        : ((0, system_1.getUserManagementInternal)(registry.getSingleton('user-management'))?.preferences ?? null);
+}
+/** The user whose rows this call may touch: the principal itself, or a refusal. */
+function preferencesOwnerOf(principal) {
+    if (!(0, types_1.scopesAllowOwnPreferences)(principal.scopes ?? [])) {
+        throw (0, user_error_js_1.trpcUserError)('FORBIDDEN', 'preferences.forbidden', undefined, 'This credential cannot reach account preferences');
+    }
+    return principal.id;
+}
+function storeOf(deps) {
+    const store = deps.preferences();
+    if (store === null) {
+        throw (0, user_error_js_1.trpcUserError)('PRECONDITION_FAILED', 'preferences.unavailable', undefined, 'Account preferences are not available');
+    }
+    return store;
+}
+function limitRefusal(error) {
+    const reason = (0, system_1.preferencesLimitReasonOf)(error);
+    if (reason === 'value-too-large') {
+        throw (0, user_error_js_1.trpcUserError)('PAYLOAD_TOO_LARGE', 'preferences.value-too-large', undefined, 'This preference value is too large');
+    }
+    if (reason === 'too-many-namespaces') {
+        throw (0, user_error_js_1.trpcUserError)('BAD_REQUEST', 'preferences.too-many-namespaces', undefined, 'Too many preference namespaces for this account');
+    }
+    throw error;
+}
+function createPreferencesRouter(deps) {
+    return (0, trpc_middleware_js_1.trpcRouter)({
+        get: trpc_middleware_js_1.protectedProcedure
+            .input(types_1.PreferencesGetInputSchema)
+            .output(types_1.PreferencesGetOutputSchema)
+            .query(async ({ ctx, input }) => {
+            const owner = preferencesOwnerOf(ctx.user);
+            return { rows: [...(await storeOf(deps).get(owner, input.namespaces))] };
+        }),
+        put: trpc_middleware_js_1.protectedProcedure
+            .input(types_1.PreferencesPutInputSchema)
+            .output(types_1.PreferencesPutOutputSchema)
+            .mutation(async ({ ctx, input }) => {
+            const owner = preferencesOwnerOf(ctx.user);
+            try {
+                return await storeOf(deps).put(owner, input);
+            }
+            catch (error) {
+                return limitRefusal(error);
+            }
+        }),
+        delete: trpc_middleware_js_1.protectedProcedure
+            .input(types_1.PreferencesDeleteInputSchema)
+            .output(types_1.PreferencesDeleteOutputSchema)
+            .mutation(async ({ ctx, input }) => {
+            const owner = preferencesOwnerOf(ctx.user);
+            return { deleted: await storeOf(deps).delete(owner, input.namespace) };
+        }),
+        changedSince: trpc_middleware_js_1.protectedProcedure
+            .input(types_1.PreferencesChangedSinceInputSchema)
+            .output(types_1.PreferencesChangedSinceOutputSchema)
+            .query(async ({ ctx, input }) => {
+            const owner = preferencesOwnerOf(ctx.user);
+            return storeOf(deps).changedSince(owner, input.revisionByNamespace);
+        }),
+    });
+}

package/dist/api/oauth2/oauth2-routes.js

@@ -269,6 +269,35 @@ function answerRefusal(request, reply, status, body, reason, integration) {
     }
     return reply.status(status).send(body);
 }
+/**
+ * Who consents. ONLY a person's login session: a session-grade JWT (no
+ * `kind` — not a bridge, a challenge or a minted token) naming a user that
+ * still exists. Anything else this hub signed — a share link, a script's
+ * token, an account link — is refused, because a consent mints an account
+ * link with the integration's whole grant (security review 2026-10-21: a
+ * share link set as the cookie reached `consent=allow` and came back with a
+ * fleet-wide device grant for `userId: ''`).
+ */
+async function consentingUserOf(deps, cookie) {
+    let payload;
+    try {
+        payload = deps.verifyToken(cookie);
+    }
+    catch {
+        return { ok: false, reason: 'session-invalid' };
+    }
+    if (typeof payload !== 'object' || payload === null || !(0, session_cookie_js_1.isSessionGradeJwtPayload)(payload)) {
+        return { ok: false, reason: 'not-a-login-session' };
+    }
+    const userId = Reflect.get(payload, 'userId');
+    const username = Reflect.get(payload, 'username');
+    if (typeof userId !== 'string' || userId === '') {
+        return { ok: false, reason: 'not-a-login-session' };
+    }
+    if (!(await deps.isLiveUser(userId)))
+        return { ok: false, reason: 'user-gone' };
+    return { ok: true, user: { userId, username: typeof username === 'string' ? username : '' } };
+}
 /**
  * An authorize call turned away for want of a usable session.
  *
@@ -330,13 +359,11 @@ function registerOauth2Routes(fastify, deps) {
         if (!cookie) {
             return refuseUnauthenticated(request, reply, deps.logger, call, 'no-session-cookie');
         }
-        let tokenInfo;
-        try {
-            tokenInfo = deps.verifyToken(cookie);
-        }
-        catch {
-            return refuseUnauthenticated(request, reply, deps.logger, call, 'session-invalid');
+        const consenting = await consentingUserOf(deps, cookie);
+        if (!consenting.ok) {
+            return refuseUnauthenticated(request, reply, deps.logger, call, consenting.reason);
         }
+        const tokenInfo = consenting.user;
         const registry = deps.getRegistry();
         if (!registry) {
             return answerRefusal(request, reply, 503, { error: 'service_unavailable' }, 'unavailable');
@@ -367,7 +394,7 @@ function registerOauth2Routes(fastify, deps) {
                 acceptLanguage: request.headers['accept-language'],
             }),
             displayName: descriptor.displayName,
-            username: tokenInfo.username ?? '',
+            username: tokenInfo.username,
             scopeSummary: summariseScopes(descriptor.requestedScopes),
             // Shown, not merely validated. A `redirect_uri` on a private host is
             // admitted by pattern rather than by registration, so the operator is
@@ -428,13 +455,11 @@ function registerOauth2Routes(fastify, deps) {
         if (!cookie) {
             return refuseUnauthenticated(request, reply, deps.logger, call, 'no-session-cookie');
         }
-        let tokenInfo;
-        try {
-            tokenInfo = deps.verifyToken(cookie);
-        }
-        catch {
-            return refuseUnauthenticated(request, reply, deps.logger, call, 'session-invalid');
+        const consenting = await consentingUserOf(deps, cookie);
+        if (!consenting.ok) {
+            return refuseUnauthenticated(request, reply, deps.logger, call, consenting.reason);
         }
+        const tokenInfo = consenting.user;
         const registry = deps.getRegistry();
         if (!registry) {
             return answerRefusal(request, reply, 503, { error: 'service_unavailable' }, 'unavailable');
@@ -478,8 +503,8 @@ function registerOauth2Routes(fastify, deps) {
         }
         const { code } = await userMgmt.oauthIssueCode({
             integrationId: v.integration,
-            userId: tokenInfo.userId ?? '',
-            username: tokenInfo.username ?? '',
+            userId: tokenInfo.userId,
+            username: tokenInfo.username,
             scopes: descriptor.requestedScopes,
             redirectUri: v.redirectUri,
             // Prefer the integration's own public origin (e.g. the operator-selected

package/dist/api/trpc/device-config-secret-redaction.js

@@ -10,7 +10,7 @@
  *
  * Those methods are declared `auth: 'protected'` (the default in
  * `capability-definition.ts`), which is NOT admin — it is "authenticated, and
- * scope-matched". Measured against the live hub: a `cst_*` scoped token
+ * scope-matched". Measured against the live hub: a scoped token
  * carrying nothing but `category:system` + `view` — a READ-ONLY grant, the one
  * the deploy runbook mints for CI — read `deviceManager.getDevice` and received
  * `config.password` verbatim, and `deviceManager.listAll` answered with a
@@ -31,7 +31,7 @@
  * write-only for admins too is a bigger, UI-side change; it is not needed to
  * close this hole and would regress the form.
  *
- * Share-view (`csv_*`) principals never reach this code — they are gated
+ * Share-view principals never reach this code — they are gated
  * earlier by the fail-closed allowlist in `share-view-access.ts`, which does
  * not expose `getDevice` at all and projects `listAll` down to seven presentation
  * fields. This module is the gate for the tier BETWEEN a share link and an admin.

package/dist/api/trpc/generated-cap-mounts.js

@@ -314,7 +314,6 @@ function mountAllCaps(services) {
                 ...first,
                 listProfileKinds: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'listProfileKinds'),
                 listProfiles: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'listProfiles'),
-                listModels: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'listModels'),
                 getDefaults: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'getDefaults'),
                 getUsage: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'getUsage'),
                 listModelCatalog: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'listModelCatalog'),

package/dist/api/trpc/generated-cap-routers.js

@@ -5300,10 +5300,10 @@ function createCapRouter_llm(getProvider, _createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.testProfile(input);
         }),
-        listModels: trpc_middleware_js_1.protectedProcedure
+        listModels: trpc_middleware_js_1.adminProcedure
             .input(types_69.llmCapability.methods.listModels.input.loose())
             .output(types_69.llmCapability.methods.listModels.output)
-            .query(async ({ input, ctx }) => {
+            .mutation(async ({ input, ctx }) => {
             const p = requireCapProvider('llm', () => getProvider(ctx));
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.listModels(input);
@@ -12446,42 +12446,6 @@ function createCapRouter_userManagement(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.revokeApiKey(methodInput);
         }),
-        createScopedToken: trpc_middleware_js_1.adminProcedure
-            .input(types_142.userManagementCapability.methods.createScopedToken.input.loose())
-            .output(types_142.userManagementCapability.methods.createScopedToken.output)
-            .mutation(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('user-management', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.createScopedToken(methodInput);
-        }),
-        revokeScopedToken: trpc_middleware_js_1.adminProcedure
-            .input(types_142.userManagementCapability.methods.revokeScopedToken.input.loose())
-            .output(types_142.userManagementCapability.methods.revokeScopedToken.output)
-            .mutation(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('user-management', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.revokeScopedToken(methodInput);
-        }),
-        validateScopedToken: trpc_middleware_js_1.protectedProcedure
-            .input(types_142.userManagementCapability.methods.validateScopedToken.input.loose())
-            .output(types_142.userManagementCapability.methods.validateScopedToken.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('user-management', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.validateScopedToken(methodInput);
-        }),
-        listScopedTokens: trpc_middleware_js_1.adminProcedure
-            .input(types_142.userManagementCapability.methods.listScopedTokens.input.loose())
-            .output(types_142.userManagementCapability.methods.listScopedTokens.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('user-management', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.listScopedTokens(methodInput);
-        }),
         setupTotp: trpc_middleware_js_1.adminProcedure
             .input(types_142.userManagementCapability.methods.setupTotp.input.loose())
             .output(types_142.userManagementCapability.methods.setupTotp.output)

package/dist/api/trpc/principal-authorization.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authorizeProcedure = authorizeProcedure;
+exports.authorizeAddonRoute = authorizeAddonRoute;
+/**
+ * The ONE scope matcher (D892): every authorization decision about a verified
+ * principal is a function of `principal.scopes`, here. It answers for a tRPC
+ * procedure and for an addon's own HTTP surface (routes and data planes);
+ * neither asks what kind of credential the principal came from.
+ *
+ * Order, the same on both surfaces:
+ *   1. a `share-view` grant RESTRICTS the principal to its fail-closed
+ *      perimeter — nothing else it holds is honoured;
+ *   2. `'*'` passes;
+ *   3. the capability / addon grants decide.
+ */
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
+const addon_route_share_gate_js_1 = require("../../auth/addon-route-share-gate.js");
+const scope_access_js_1 = require("./scope-access.js");
+const share_view_access_js_1 = require("./share-view-access.js");
+/**
+ * May a principal holding `scopes` call the tRPC procedure at `path`?
+ *
+ * A hand-written core route (`auth.me`, `system.info`) has no cap entry: the
+ * authentication already passed, and an explicit `adminProcedure` on top of it
+ * gates what is destructive. A share-view principal never reaches that
+ * pass-through — its allowlist is enumerated.
+ */
+function authorizeProcedure(scopes, path, rawInput, lookup) {
+    const grant = (0, types_1.shareViewGrantOf)(scopes);
+    if (grant !== null) {
+        const result = (0, share_view_access_js_1.checkShareViewAccess)(grant, path, rawInput);
+        return result.ok ? { ok: true, mode: 'share', grant } : { ok: false, reason: result.reason };
+    }
+    if ((0, types_1.scopesGrantAdmin)(scopes))
+        return { ok: true, mode: 'all' };
+    const capability = (0, types_1.capabilityScopesOf)(scopes);
+    if (path in system_1.METHOD_ACCESS_MAP) {
+        const result = (0, scope_access_js_1.checkScopeAccess)(capability, path, rawInput, lookup);
+        if (!result.ok)
+            return { ok: false, reason: result.reason };
+    }
+    return { ok: true, mode: 'scoped', scopes: capability };
+}
+/** May a principal holding `scopes` reach `/addon/<addonId>/…` with this verb? */
+function authorizeAddonRoute(scopes, target) {
+    const grant = (0, types_1.shareViewGrantOf)(scopes);
+    if (grant !== null) {
+        if (!(target.share ?? []).includes(grant.kind)) {
+            return {
+                ok: false,
+                status: 403,
+                error: 'Share token not accepted here',
+                reason: `share-view ${grant.kind} not accepted by ${target.addonId}`,
+            };
+        }
+        return {
+            ok: true,
+            shareHeaders: {
+                [addon_route_share_gate_js_1.SHARE_KIND_HEADER]: grant.kind,
+                [addon_route_share_gate_js_1.SHARE_DEVICES_HEADER]: grant.deviceIds.join(','),
+            },
+        };
+    }
+    if ((0, types_1.scopesGrantAdmin)(scopes))
+        return { ok: true, shareHeaders: null };
+    if (target.access === 'admin') {
+        return { ok: false, status: 403, error: 'Admin required', reason: 'admin route' };
+    }
+    const access = (0, types_1.methodAccessForHttpMethod)(target.method);
+    if ((0, types_1.scopesAllowAddonRoutes)(scopes, access) ||
+        (0, types_1.scopesAllowAddon)((0, types_1.capabilityScopesOf)(scopes), target.addonId, access)) {
+        return { ok: true, shareHeaders: null };
+    }
+    return {
+        ok: false,
+        status: 403,
+        error: 'Token scope mismatch',
+        reason: `holds no addon:${target.addonId}[${access}] grant`,
+    };
+}