@camstack/server 1.2.604 → 1.2.606

package/dist/api/trpc/principal-visibility.js

@@ -10,7 +10,7 @@ exports.scopedEventVisibility = scopedEventVisibility;
  * Non-admin principal device visibility — the shared answer to "which cameras
  * may this scoped caller see?", reused by two hotfixes:
  *
- *   - F0.4 `auth.createShareToken` — a scoped user must not mint a `csv_*`
+ *   - F0.4 `auth.mintToken` (a share-view grant) — a scoped user must not mint a share link
  *     share token for a device it cannot see. The requested deviceIds are
  *     INTERSECTED with what the caller can view.
  *   - F0.5 the event firehose (`live.onEvent`, `systemEvents.subscribe`, …) —
@@ -141,13 +141,13 @@ function projectListAllForPrincipal(data, isAdmin, scopes, fleet) {
  * view; an event with NO device identity is DROPPED (fail closed — "probably in
  * scope" is not a security argument).
  *
- * Share-view (`csv_*`) principals are NOT handled here — they keep their own,
+ * Share-view principals are NOT handled here — they keep their own,
  * stricter `liveEventInShareScope` filter, applied by the routers first.
  */
 function scopedEventVisibility(user, lookup) {
     if (user.isAdmin)
         return null;
-    const scopes = user.scopes ?? [];
+    const scopes = (0, types_1.capabilityScopesOf)(user.scopes ?? []);
     if (isBroadEventViewer(scopes))
         return null;
     return (evt) => {

package/dist/api/trpc/share-view-access.js

@@ -181,7 +181,7 @@ function projectListAllForShareScope(data, scope) {
  * The projection ENGINE: drop every `listAll` row whose id is not in
  * `allowed`, and project the survivors onto the whitelisted row.
  *
- * Shared by the `csv_*` share path ({@link projectListAllForShareScope}) and
+ * Shared by the share-link path ({@link projectListAllForShareScope}) and
  * the scoped-principal path (`projectListAllForPrincipal` in
  * `principal-visibility.ts`) so enumeration is cut ONE way. Two projectors
  * would be two chances to forget `config` — which carries the camera

package/dist/api/trpc/trpc-error-principal.js

@@ -29,12 +29,13 @@ function readCredentialIdentity(claims) {
 /**
  * Render a principal for one log line.
  *
- * Shapes, in the order they are distinguished:
+ * Shapes, in the order they are distinguished (the label comes from the
+ * principal's audit tag — attribution only, D892):
  *
  *   anonymous
  *   apocaliss92 (admin)
- *   share:ab12cd34 (share-view)
- *   scoped:1a2b3c4d (scoped-token)
+ *   token:ci (token)
+ *   token:ops (token admin)
  *   apocaliss92 (oauth-access session=910a6179-…)
  *   apocaliss92 (session)
  */
@@ -44,15 +45,14 @@ function describeTrpcPrincipal(user) {
     if (!user)
         return 'anonymous';
     const name = user.username || user.id || 'unknown';
-    if (user.shareView)
-        return `${name} (share-view)`;
-    if (user.isAdmin)
+    if (user.auditTag === 'session' && user.isAdmin)
         return `${name} (admin)`;
     if (user.credential) {
         const session = user.oauthSessionId ? ` session=${user.oauthSessionId}` : '';
         return `${name} (${user.credential}${session})`;
     }
-    if (user.isScoped)
-        return `${name} (scoped-token)`;
-    return `${name} (session)`;
+    if (user.auditTag !== undefined) {
+        return `${name} (${user.auditTag}${user.isAdmin && user.auditTag !== 'session' ? ' admin' : ''})`;
+    }
+    return user.isAdmin ? `${name} (admin)` : `${name} (session)`;
 }

package/dist/api/trpc/trpc.context.js

@@ -1,56 +1,65 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.agentFromPrincipal = agentFromPrincipal;
+exports.bindHubCredentialStores = bindHubCredentialStores;
+exports.hubCredentialVerifier = hubCredentialVerifier;
+exports.requestFacts = requestFacts;
 exports.createMeshTrpcContext = createMeshTrpcContext;
 exports.createTrpcContext = createTrpcContext;
 exports.createWsTrpcContext = createWsTrpcContext;
 const system_1 = require("@camstack/system");
-const types_1 = require("@camstack/types");
 const auth_network_policy_js_1 = require("../../auth/auth-network-policy.js");
-const share_token_service_js_1 = require("../../core/auth/share-token.service.js");
+const credential_verifier_js_1 = require("../../auth/credential-verifier.js");
 const request_lang_js_1 = require("../../i18n/request-lang.js");
-const trpc_error_principal_js_1 = require("./trpc-error-principal.js");
+/** The tRPC principal a verified credential becomes. */
+function agentFromPrincipal(principal) {
+    return {
+        id: principal.subjectId,
+        username: principal.username,
+        isAdmin: principal.isAdmin,
+        permissions: { isAdmin: principal.isAdmin, allowedProviders: '*', allowedDevices: {} },
+        isApiKey: !principal.interactive,
+        scopes: principal.scopes,
+        credentialId: principal.credentialId,
+        auditTag: principal.auditTag,
+        interactive: principal.interactive,
+        userDelegated: principal.userDelegated,
+        ...(principal.sessionId !== undefined ? { sessionId: principal.sessionId } : {}),
+        ...(principal.oauthSessionId !== undefined ? { oauthSessionId: principal.oauthSessionId } : {}),
+        ...(principal.credential !== undefined ? { credential: principal.credential } : {}),
+    };
+}
 /**
- * Live-scope refresh memo (see the JWT branch of `resolveUser`).
- *
- * The JWT embeds scopes at login, so an admin's scope edit used to reach a
- * live session only at the next login — a user granted cameras while logged
- * in saw NONE until they signed out and back in (2026-08-15, user report).
- * The store is therefore re-read per user, but memoized: a scope change
- * propagates within {@link SCOPE_REFRESH_TTL_MS} and a busy session costs at
- * most one store read per TTL window, not one per request.
+ * The live-scope memo of non-admin sessions, shared by every verifier this
+ * process builds (a request builds one; the memo must outlive it).
  */
-const SCOPE_REFRESH_TTL_MS = 30_000;
-const SCOPE_REFRESH_MISS_TTL_MS = 5_000;
-const liveScopeMemo = new Map();
-async function refreshScopesFromStore(userId, addonRegistry) {
-    const cached = liveScopeMemo.get(userId);
-    const now = Date.now();
-    if (cached &&
-        now - cached.at < (cached.scopes === null ? SCOPE_REFRESH_MISS_TTL_MS : SCOPE_REFRESH_TTL_MS)) {
-        return cached.scopes;
-    }
-    let scopes = null;
-    try {
-        const userMgmt = addonRegistry.getCapabilityRegistry().getSingleton('user-management');
-        const fresh = typeof userMgmt?.listUsers === 'function'
-            ? (await userMgmt.listUsers()).find((u) => u.id === userId)
-            : null;
-        if (fresh)
-            scopes = (0, types_1.normalizeTokenScopes)(fresh.scopes ?? []);
-    }
-    catch {
-        scopes = null;
-    }
-    liveScopeMemo.set(userId, { at: now, scopes });
-    // Bound the map: sessions come and go, entries are tiny, and a missed
-    // sweep would grow it by one row per distinct user per TTL window.
-    if (liveScopeMemo.size > 512) {
-        for (const [key, entry] of liveScopeMemo) {
-            if (now - entry.at > SCOPE_REFRESH_TTL_MS * 4)
-                liveScopeMemo.delete(key);
-        }
-    }
-    return scopes;
+const hubScopeMemo = new Map();
+/** The user-list memo, shared the same way (every token verify asks "does its subject exist?"). */
+const hubUsersMemo = { entry: null };
+const hubStores = { tokenRows: null };
+function bindHubCredentialStores(stores) {
+    if (stores.tokenRows !== undefined)
+        hubStores.tokenRows = stores.tokenRows;
+}
+/**
+ * The hub's verifier over its own stores — the same one for tRPC and the
+ * addon routes. Documented type boundary: the registry hands the
+ * `user-management` provider back untyped; the one method the verifier reads
+ * (`listUsers`) is asserted here.
+ */
+function hubCredentialVerifier(deps) {
+    const provider = () => deps.addonRegistry.getCapabilityRegistry().getSingleton('user-management');
+    return (0, credential_verifier_js_1.createCredentialVerifier)({
+        verifyJwt: (token) => deps.authService.verifyToken(token),
+        verifyCredentialJwt: (token) => deps.authService.verifyCredentialToken(token),
+        users: () => provider() ?? null,
+        internal: () => (0, system_1.getUserManagementInternal)(provider()),
+        tokenRows: () => deps.tokenRows ?? hubStores.tokenRows,
+        logger: deps.logger ?? null,
+        scopeMemo: hubScopeMemo,
+        usersMemo: hubUsersMemo,
+        ...(deps.deviceScopeLookup !== undefined ? { deviceScopeLookup: deps.deviceScopeLookup } : {}),
+    });
 }
 /** Read `req.query` if present (Fastify-only) without losing type safety. */
 function readQuery(req) {
@@ -62,7 +71,7 @@ function readQuery(req) {
     return { ...q };
 }
 /**
- * Extract a JWT token from an HTTP request.
+ * Extract a bearer from an HTTP request.
  * Priority: Authorization header → Fastify req.query → URL query string
  */
 function extractTokenFromRequest(req) {
@@ -89,6 +98,7 @@ function extractTokenFromRequest(req) {
     }
     return null;
 }
+/** What the audit of an admin-capable token's use records about the request. */
 function requestFacts(req) {
     if (req === undefined)
         return {};
@@ -97,203 +107,9 @@ function requestFacts(req) {
     const path = typeof url === 'string' ? url.split('?')[0] : undefined;
     return { ...(path !== undefined ? { path } : {}), ...(ip !== null ? { ip } : {}) };
 }
-/**
- * An admin token (`csa_`): an ADMIN principal, attributed to the admin who
- * created it, every use audited. Validation (owner still exists and is still
- * an admin, not revoked, not expired) is local-auth's (`AdminTokenManager`).
- */
-async function resolveAdminToken(token, addonRegistry, facts) {
-    const internal = (0, system_1.getUserManagementInternal)(addonRegistry.getCapabilityRegistry().getSingleton('user-management'));
-    if (internal === null)
-        return null;
-    const record = await internal.adminTokens.validate(token).catch(() => null);
-    if (record === null)
-        return null;
-    void internal.audit.record({
-        action: 'admin-token-used',
-        userId: record.createdBy,
-        ...(facts.ip !== undefined ? { ip: facts.ip } : {}),
-        detail: {
-            tokenId: record.id,
-            name: record.name,
-            prefix: record.tokenPrefix,
-            ...(facts.path !== undefined ? { path: facts.path } : {}),
-        },
-    });
-    return {
-        id: record.createdBy,
-        username: `admin-token:${record.name}`,
-        isAdmin: true,
-        permissions: { isAdmin: true, allowedProviders: '*', allowedDevices: {} },
-        isApiKey: true,
-        credential: 'admin-token',
-        adminTokenId: record.id,
-    };
-}
-async function resolveUser(token, authService, addonRegistry, shareTokens = null, logger = null, facts = {}) {
-    if (!token)
-        return null;
-    if (token.startsWith(system_1.ADMIN_TOKEN_PREFIX))
-        return resolveAdminToken(token, addonRegistry, facts);
-    // Share-token path (`csv_*`): resolve through the ShareTokenService.
-    // The synthetic principal is maximally restricted — non-admin, no
-    // scopes; the `shareView` grant routes it into the fail-closed
-    // allowlist in `protectedProcedure` instead of the scope matcher.
-    if (token.startsWith(share_token_service_js_1.SHARE_TOKEN_PREFIX)) {
-        if (!shareTokens)
-            return null;
-        try {
-            const record = await shareTokens.validate(token);
-            if (!record)
-                return null;
-            return {
-                id: record.userId,
-                // Display label — `share:<prefix>` keeps audit logs readable
-                // without exposing the token hash.
-                username: `share:${record.tokenPrefix}`,
-                isAdmin: false,
-                permissions: {
-                    isAdmin: false,
-                    allowedProviders: '*',
-                    allowedDevices: {},
-                },
-                isApiKey: true,
-                shareView: { tokenId: record.id, scope: record.scope },
-            };
-        }
-        catch {
-            return null;
-        }
-    }
-    // Scoped-token path: hit the user-management cap. Synthetic user
-    // with `isAdmin: false` so admin-gated procedures bounce while
-    // protectedProcedure can still gate by scope match.
-    if (token.startsWith('cst_')) {
-        try {
-            const userMgmt = addonRegistry.getCapabilityRegistry().getSingleton('user-management');
-            if (!userMgmt)
-                return null;
-            const record = await userMgmt.validateScopedToken({ token });
-            if (!record)
-                return null;
-            return {
-                id: record.userId,
-                // Display label — `scoped:<prefix>` makes audit logs read
-                // naturally without exposing the token hash.
-                username: `scoped:${record.tokenPrefix}`,
-                isAdmin: false,
-                permissions: {
-                    isAdmin: false,
-                    allowedProviders: '*',
-                    allowedDevices: {},
-                },
-                isApiKey: true,
-                isScoped: true,
-                // Migrate any v2 `device:targets` grant to a v3 selector at the
-                // boundary so the enforcement matcher only ever sees v3.
-                scopes: (0, types_1.normalizeTokenScopes)(record.scopes),
-            };
-        }
-        catch {
-            return null;
-        }
-    }
-    // JWT path.
-    try {
-        const payload = authService.verifyToken(token);
-        // Reject pre-v2 JWTs at the boundary. Tokens issued before the
-        // role → isAdmin migration don't carry the `isAdmin` field, so
-        // letting them through would degrade silently into "non-admin
-        // with no scopes" → locked out of every cap. Returning null forces
-        // the client to land on 401 → re-login, where it picks up a fresh
-        // v2 token. No back-compat shim — the role enum is gone.
-        if (typeof payload.isAdmin !== 'boolean') {
-            return null;
-        }
-        // What the token IS decides both WHETHER it authenticates at all and
-        // WHERE its scopes come from.
-        const principal = (0, types_1.classifyBearerPrincipal)(payload);
-        // ── The allowlist ────────────────────────────────────────────────
-        // Every token this hub mints verifies under the same `auth.jwtSecret`, so
-        // `verifyToken` succeeding means "we minted this", never "this is an API
-        // credential" (D103). Exactly two kinds are credentials here:
-        //
-        //   • `session` — no `kind` claim: `auth.login`'s JWT and the SSO-minted
-        //     session from `/api/auth/sso/finish`.
-        //   • `integration` — `provider: 'oauth-access'`: the account-link
-        //     credential a component (Home Assistant) calls `/trpc` with.
-        //
-        // Everything else is minted for ONE hand-off step and is refused: an
-        // `oauth-code` is single-use, lives 60s and travels in a browser redirect
-        // URL (history, referrers, proxy logs); an `oauth-refresh` belongs to
-        // `POST /oauth/token`; an `oidc` login bridge belongs to
-        // `?bridge=` on `/api/auth/sso/finish`; a `totp-challenge` is login leg 1.
-        // `/addon/:addonId/*` has refused these since D103 — this closes the same
-        // hole on the other surface.
-        //
-        // The TOTP login is unaffected BY CONSTRUCTION: `loginVerifyTotp` takes
-        // the challenge as procedure INPUT on a public rate-limited procedure, and
-        // neither the SDK (`login()` calls `setToken` only when
-        // `!requiresSecondFactor`) nor the admin UI ever puts it in a header.
-        if (principal.kind === 'not-a-credential') {
-            logger?.warn('trpc: refused a bearer that is not an API credential', {
-                meta: { reason: principal.reason, userId: payload.userId ?? 'unknown' },
-            });
-            return null;
-        }
-        // What the token says it IS. An `oauth-access` token is an account link,
-        // and until this was carried onto the principal a refusal of one was
-        // indistinguishable in the logs from a refusal of a browser session.
-        const credential = (0, trpc_error_principal_js_1.readCredentialIdentity)(payload);
-        return {
-            id: payload.userId ?? 'unknown',
-            username: payload.username ?? 'unknown',
-            isAdmin: payload.isAdmin,
-            permissions: {
-                isAdmin: payload.isAdmin,
-                allowedProviders: payload.allowedProviders,
-                allowedDevices: payload.allowedDevices,
-            },
-            isApiKey: false,
-            ...(principal.kind === 'session' && typeof payload.sid === 'string'
-                ? { sessionId: payload.sid }
-                : {}),
-            // Scopes are baked into the JWT at login; the middleware uses
-            // them to gate every call until the user re-logs. Normalised at the
-            // boundary — a v2 `device:targets` JWT (issued before the v3 model)
-            // migrates to a selector here, so a pre-v3 token keeps working.
-            //
-            // …but a login-time snapshot is exactly the bug: an admin editing a
-            // user's scopes expects the change to APPLY, and the live session
-            // kept gating on the old set until re-login (2026-08-15: a user
-            // granted the whole fleet kept seeing zero cameras). For non-admin
-            // SESSION principals the store's current scopes win when readable
-            // (memoized — see above); the JWT's copy is the fallback when the
-            // user-management cap is unreachable, so a store hiccup never
-            // locks anybody out mid-request.
-            //
-            // `session` ONLY, and that word is the whole fix. An ACCOUNT-LINK token
-            // is governed by the grant the operator consented to, not by the linking
-            // user's record: it always carries `isAdmin: false` (`oauth-grants.ts`
-            // → `baseClaims`) and its owner is normally an admin, whose record is
-            // deliberately unscoped — so the refresh replaced a six-scope Home
-            // Assistant grant with `[]` and the hub refused the component's first
-            // call with `Have: (none)` (2026-08-19). The user store knows nothing
-            // about a link and must not get a vote on one.
-            ...(payload.scopes !== undefined ? { scopes: (0, types_1.normalizeTokenScopes)(payload.scopes) } : {}),
-            ...(!payload.isAdmin && principal.kind === 'session'
-                ? await (async () => {
-                    const fresh = await refreshScopesFromStore(payload.userId ?? 'unknown', addonRegistry);
-                    return fresh !== null ? { scopes: fresh } : {};
-                })()
-                : {}),
-            ...(credential.credential !== undefined ? { credential: credential.credential } : {}),
-            ...(credential.sessionId !== undefined ? { oauthSessionId: credential.sessionId } : {}),
-        };
-    }
-    catch {
-        return null;
-    }
+async function resolveUser(token, verifier, facts) {
+    const principal = await verifier.verify(token, facts);
+    return principal === null ? null : agentFromPrincipal(principal);
 }
 /**
  * Build the parent-chain walker for the scope-access matcher. Returns every
@@ -304,8 +120,7 @@ async function resolveUser(token, authService, addonRegistry, shareTokens = null
  * the device-manager's PERSISTED parentage (F0.6). It MUST NOT walk the hub
  * `DeviceRegistry` directly: that registry only holds hub-local devices, so it
  * is empty for every forked provider and the inheritance this function exists to
- * provide silently did nothing (0/6 providers inherited). The mirror is warmed
- * off the event path and read synchronously here.
+ * provide silently did nothing (0/6 providers inherited).
  */
 function makeDeviceScopeLookup(addonRegistry) {
     return {
@@ -321,15 +136,12 @@ function makeDeviceScopeLookup(addonRegistry) {
  * `principal` names WHO is calling (D802): `mesh` for the hub's own runners
  * (they reach the bridge over UDS, inside the hub's trust boundary), and
  * `node:<nodeId>` for another node — whose id the hub's mesh gate has bound
- * to its CERTIFICATE before the call got here (`createMeshAccessMiddleware`:
- * the TLS handshake chained to the mesh CA, the leaf CN is that id, D857).
+ * to its CERTIFICATE before the call got here (D857).
  *
- * Both principals are still admins: that keeps every `adminProcedure` an
- * agent's addons call working. What is NOT reachable from another node is
- * decided by the bridge itself (`REMOTE_DENIED_NAMESPACES`), and `repl` is not
- * bridged at all. Narrowing the remote principal to a per-method grant is the
- * next step once the mesh census has measured what each node calls (D802).
- * There is no HTTP request behind the call.
+ * Both principals hold `'*'`: that keeps every `adminProcedure` an agent's
+ * addons call working. What is NOT reachable from another node is decided by
+ * the bridge itself (`REMOTE_DENIED_NAMESPACES`), and `repl` is not bridged at
+ * all. There is no HTTP request behind the call.
  */
 function createMeshTrpcContext(principal = 'mesh') {
     const user = {
@@ -338,17 +150,26 @@ function createMeshTrpcContext(principal = 'mesh') {
         isAdmin: true,
         permissions: { isAdmin: true, allowedProviders: '*', allowedDevices: {} },
         isApiKey: true,
+        scopes: ['*'],
+        credentialId: principal,
     };
     return { user };
 }
 /** Context factory for HTTP tRPC requests (Fastify adapter). */
-async function createTrpcContext(req, authService, addonRegistry, shareTokens = null, logger = null) {
-    const token = extractTokenFromRequest(req);
+async function createTrpcContext(req, authService, addonRegistry, logger = null, tokenRows = null) {
+    const deviceScopeLookup = makeDeviceScopeLookup(addonRegistry);
+    const verifier = hubCredentialVerifier({
+        authService,
+        addonRegistry,
+        tokenRows,
+        logger,
+        deviceScopeLookup,
+    });
     return {
-        user: await resolveUser(token, authService, addonRegistry, shareTokens, logger, requestFacts(req)),
+        user: await resolveUser(extractTokenFromRequest(req), verifier, requestFacts(req)),
         req,
         lang: (0, request_lang_js_1.resolveRequestLang)((0, request_lang_js_1.requestLangInputFrom)(req.headers, readQuery(req))),
-        deviceScopeLookup: makeDeviceScopeLookup(addonRegistry),
+        deviceScopeLookup,
         deviceFleet: () => addonRegistry.getPersistedDeviceList(),
     };
 }
@@ -357,11 +178,19 @@ async function createTrpcContext(req, authService, addonRegistry, shareTokens =
  * Token is sent via tRPC connectionParams (a JSON message sent right after
  * the WS handshake), which is more reliable than query params through proxies.
  */
-async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens = null, logger = null) {
+async function createWsTrpcContext(opts, authService, addonRegistry, logger = null, tokenRows = null) {
     // 1. connectionParams.token (sent by BackendClient's createWSClient)
     const paramToken = opts.info.connectionParams?.['token'];
     const token = (typeof paramToken === 'string' ? paramToken : null) ?? extractTokenFromRequest(opts.req);
-    const user = await resolveUser(token, authService, addonRegistry, shareTokens, logger, requestFacts(opts.req));
+    const deviceScopeLookup = makeDeviceScopeLookup(addonRegistry);
+    const verifier = hubCredentialVerifier({
+        authService,
+        addonRegistry,
+        tokenRows,
+        logger,
+        deviceScopeLookup,
+    });
+    const user = await resolveUser(token, verifier, requestFacts(opts.req));
     const sessionId = user?.sessionId;
     return {
         user,
@@ -379,7 +208,7 @@ async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens
                 }) === null,
             }
             : {}),
-        deviceScopeLookup: makeDeviceScopeLookup(addonRegistry),
+        deviceScopeLookup,
         deviceFleet: () => addonRegistry.getPersistedDeviceList(),
     };
 }