@camstack/server 1.2.605 → 1.2.606

package/dist/api/auth-whoami.js

@@ -17,7 +17,6 @@ async function resolveWhoami(deps, bearer) {
         scopes: principal.scopes,
         credentialId: principal.credentialId,
         credential: principal.auditTag,
-        legacy: principal.legacy,
     };
 }
 async function registerAuthWhoamiRoute(fastify, authService, addonRegistry) {

package/dist/api/core/auth-audit.procedures.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthAuditRecordSchema = void 0;
+exports.createAuthAuditProcedures = createAuthAuditProcedures;
+const server_1 = require("@trpc/server");
+const zod_1 = require("zod");
+const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+exports.AuthAuditRecordSchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    at: zod_1.z.number(),
+    action: zod_1.z.string(),
+    userId: zod_1.z.string().optional(),
+    ip: zod_1.z.string().optional(),
+    detail: zod_1.z.record(zod_1.z.string(), zod_1.z.union([zod_1.z.string(), zod_1.z.number(), zod_1.z.boolean()])).optional(),
+});
+function createAuthAuditProcedures(deps) {
+    return {
+        /** ADMIN — the authentication audit trail, newest first. */
+        listAuthAudit: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z
+            .object({
+            limit: zod_1.z.number().int().min(1).max(500).optional(),
+            userId: zod_1.z.string().min(1).optional(),
+        })
+            .optional())
+            .output(zod_1.z.array(exports.AuthAuditRecordSchema))
+            .query(async ({ input }) => {
+            const internal = deps.registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(deps.registry);
+            if (internal === null) {
+                throw new server_1.TRPCError({
+                    code: 'PRECONDITION_FAILED',
+                    message: 'User management is not available',
+                });
+            }
+            return [
+                ...(await internal.audit.list({
+                    ...(input?.limit !== undefined ? { limit: input.limit } : {}),
+                    ...(input?.userId !== undefined ? { userId: input.userId } : {}),
+                })),
+            ];
+        }),
+    };
+}

package/dist/api/core/auth-revoke-credentials.procedures.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RevokeSkipReasonSchema = exports.RevocableCredentialKindSchema = exports.REVOKE_CREDENTIALS_MAX = void 0;
+exports.RevokeSkipReasonSchema = exports.REVOKE_CREDENTIALS_MAX = void 0;
 exports.createRevokeCredentialsProcedures = createRevokeCredentialsProcedures;
 const server_1 = require("@trpc/server");
 const zod_1 = require("zod");
@@ -8,25 +8,9 @@ const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
 /** Upper bound of one bulk call — a page of a table, several times over. */
 exports.REVOKE_CREDENTIALS_MAX = 500;
-/** What a bulk revoke can target. Each has a per-row revoke on the server. */
-exports.RevocableCredentialKindSchema = zod_1.z.enum([
-    'token',
-    'share-link',
-    'admin-token',
-    'login-session',
-    'scoped-token',
-    'oauth-session',
-]);
 exports.RevokeSkipReasonSchema = zod_1.z.enum(['current-session', 'not-active']);
 const RevokeCredentialsInputSchema = zod_1.z
     .object({
-    /**
-     * Deprecated (D892): revocation is by CREDENTIAL ID. Omitted, each id is
-     * resolved against every store — unified tokens, login sessions, legacy
-     * admin / share / scoped tokens, account links. Kept one release for the
-     * clients that still send it; it then restricts the lookup to that store.
-     */
-    kind: exports.RevocableCredentialKindSchema.optional(),
     ids: zod_1.z.array(zod_1.z.string().min(1)).min(1).max(exports.REVOKE_CREDENTIALS_MAX),
     /** The count the operator confirmed. Must equal `ids.length`. */
     confirmCount: zod_1.z.number().int().min(1),
@@ -49,52 +33,6 @@ function assertSignedInAdminSession(user) {
         });
     }
 }
-function requireInternal(registry) {
-    const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
-    if (internal === null) {
-        throw new server_1.TRPCError({
-            code: 'PRECONDITION_FAILED',
-            message: 'User management is not available',
-        });
-    }
-    return internal;
-}
-/** The per-row revoke for `kind`, bound to the caller. `null` = revoked. */
-function revokerFor(kind, caller, deps) {
-    if (kind === 'token') {
-        const service = deps.credentialTokens ?? null;
-        if (service === null) {
-            throw new server_1.TRPCError({ code: 'PRECONDITION_FAILED', message: 'Tokens are not available' });
-        }
-        return async (id) => ((await service.revoke(id)) ? null : 'not-active');
-    }
-    if (kind === 'share-link') {
-        const service = deps.shareTokens;
-        if (service === null) {
-            throw new server_1.TRPCError({ code: 'PRECONDITION_FAILED', message: 'Share links are not available' });
-        }
-        return async (id) => (await service.revoke({ id, callerUserId: caller.id, callerIsAdmin: true }))
-            ? null
-            : 'not-active';
-    }
-    const internal = requireInternal(deps.registry);
-    if (kind === 'admin-token') {
-        return async (id) => ((await internal.adminTokens.revoke(id)) ? null : 'not-active');
-    }
-    if (kind === 'scoped-token') {
-        return async (id) => ((await internal.scopedTokens.revoke(id)) ? null : 'not-active');
-    }
-    if (kind === 'oauth-session') {
-        return async (id) => ((await internal.oauthSessions.revoke(id)) ? null : 'not-active');
-    }
-    return async (id) => {
-        if (id === caller.sessionId)
-            return 'current-session';
-        if (internal.sessions.check(id).state !== 'active')
-            return 'not-active';
-        return (await internal.sessions.revoke(id, 'revoked-by-admin')) ? null : 'not-active';
-    };
-}
 /**
  * Revoke one credential BY ITS ID, whatever it is (D892). Every store is asked
  * in turn; ids are random UUIDs per store, so at most one knows it. The
@@ -113,16 +51,6 @@ function revokerById(caller, deps) {
             if (internal.sessions.check(id).state === 'active') {
                 return (await internal.sessions.revoke(id, 'revoked-by-admin')) ? null : 'not-active';
             }
-            if (await internal.adminTokens.revoke(id))
-                return null;
-        }
-        if (deps.shareTokens !== null &&
-            (await deps.shareTokens.revoke({ id, callerUserId: caller.id, callerIsAdmin: true }))) {
-            return null;
-        }
-        if (internal !== null) {
-            if (await internal.scopedTokens.revoke(id))
-                return null;
             if (await internal.oauthSessions.revoke(id))
                 return null;
         }
@@ -135,7 +63,7 @@ function auditIds(ids) {
 }
 function createRevokeCredentialsProcedures(deps) {
     return {
-        /** ADMIN — revoke exactly `ids` of one kind; see the module header. */
+        /** ADMIN — revoke exactly `ids`, by credential id; see the module header. */
         revokeCredentials: trpc_middleware_js_1.adminProcedure
             .input(RevokeCredentialsInputSchema)
             .output(RevokeCredentialsOutputSchema)
@@ -147,9 +75,7 @@ function createRevokeCredentialsProcedures(deps) {
                     message: `Confirmed ${input.confirmCount} but ${input.ids.length} were listed — nothing was revoked`,
                 });
             }
-            const revokeOne = input.kind === undefined
-                ? revokerById(ctx.user, deps)
-                : revokerFor(input.kind, ctx.user, deps);
+            const revokeOne = revokerById(ctx.user, deps);
             const revoked = [];
             const skipped = [];
             // Sequential on purpose: the stores are single-writer, and a partial
@@ -169,7 +95,7 @@ function createRevokeCredentialsProcedures(deps) {
                     userId: ctx.user.id,
                     ...(ip !== null ? { ip } : {}),
                     detail: {
-                        kind: input.kind ?? 'by-id',
+                        kind: 'by-id',
                         requested: input.ids.length,
                         revoked: revoked.length,
                         skipped: skipped.length,

package/dist/api/core/auth-tokens.procedures.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TokenSummarySchema = exports.TokenFormatSchema = exports.MintTokenInputSchema = exports.TokenExpiresInSchema = exports.TOKEN_MAX_LIFETIME_SEC = void 0;
+exports.TokenSummarySchema = exports.ExtendTokenInputSchema = exports.ListTokensInputSchema = exports.MintTokenInputSchema = exports.TokenExpiresInSchema = exports.TOKEN_MAX_LIFETIME_SEC = void 0;
 exports.summarizeToken = summarizeToken;
 exports.requireCredentialTokens = requireCredentialTokens;
 exports.mintFor = mintFor;
@@ -29,9 +29,24 @@ exports.MintTokenInputSchema = zod_1.z.object({
     label: zod_1.z.string().trim().min(1).max(80),
     /** Required when `scopes` holds `'*'`. */
     reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput.optional(),
+    /**
+     * The user the token acts for — an admin only; omitted, the caller. Its
+     * scopes are cut to what that user holds at every verify (a token never
+     * outgrows its subject).
+     */
+    subjectId: zod_1.z.string().min(1).optional(),
+});
+exports.ListTokensInputSchema = zod_1.z
+    .object({
+    /** Only the tokens with exactly this label — how a client finds the one it minted. */
+    label: zod_1.z.string().trim().min(1).max(80).optional(),
+})
+    .optional();
+exports.ExtendTokenInputSchema = zod_1.z.object({
+    id: zod_1.z.string().min(1),
+    /** Seconds from now, or `'never'` (a lone share-view token only). */
+    expiresIn: exports.TokenExpiresInSchema,
 });
-/** Where a listed token comes from: the unified format, or a legacy table still honoured. */
-exports.TokenFormatSchema = zod_1.z.enum(['token', 'csa', 'cst', 'csv']);
 exports.TokenSummarySchema = zod_1.z.object({
     id: zod_1.z.string(),
     subjectId: zod_1.z.string(),
@@ -41,9 +56,6 @@ exports.TokenSummarySchema = zod_1.z.object({
     expiresAt: zod_1.z.number().nullable(),
     lastUsedAt: zod_1.z.number().nullable(),
     revokedAt: zod_1.z.number().nullable(),
-    /** A pre-D892 token: valid until it expires, never minted again. */
-    legacy: zod_1.z.boolean(),
-    format: exports.TokenFormatSchema,
 });
 function summarizeToken(record) {
     return {
@@ -55,8 +67,6 @@ function summarizeToken(record) {
         expiresAt: record.expiresAt,
         lastUsedAt: record.lastUsedAt,
         revokedAt: record.revokedAt,
-        legacy: false,
-        format: 'token',
     };
 }
 function requireCredentialTokens(service) {
@@ -66,13 +76,34 @@ function requireCredentialTokens(service) {
     return service;
 }
 /**
- * The one mint, shared by `auth.mintToken` and every wrapper that kept its
- * route (`createAdminToken`, `createShareToken`). Refuses; never trims.
+ * May `user` mint (or extend) a token carrying `scopes`? A person's login
+ * session may mint anything within its reach; an account link only a lone
+ * share-view grant (D895 — the reach the share-link route always gave it);
+ * a minted token never.
+ */
+function provenanceAllows(user, scopes) {
+    if (user.interactive === true)
+        return true;
+    return user.userDelegated === true && scopes.length === 1 && (0, types_1.shareViewGrantOf)(scopes) !== null;
+}
+/** The lifetime rules every mint and every extend obey. Throws a BAD_REQUEST. */
+function assertLifetime(scopes, expiresIn) {
+    if (expiresIn === 'never' && (0, types_1.shareViewGrantOf)(scopes) === null) {
+        throw new server_1.TRPCError({
+            code: 'BAD_REQUEST',
+            message: 'Only a share link may be minted without an expiry',
+        });
+    }
+}
+function expiryOf(expiresIn) {
+    return expiresIn === 'never' ? null : Date.now() + expiresIn * 1000;
+}
+/**
+ * The one mint behind `auth.mintToken`. Refuses; never trims.
  */
 async function mintFor(deps, ctx, request) {
     const user = ctx.user;
-    const provenanceOk = request.allowAccountLink === true ? user.userDelegated === true : user.interactive === true;
-    if (!provenanceOk) {
+    if (!provenanceAllows(user, request.scopes)) {
         throw new server_1.TRPCError({
             code: 'FORBIDDEN',
             message: 'A token can only be minted from a signed-in session',
@@ -85,12 +116,7 @@ async function mintFor(deps, ctx, request) {
             message: 'A share-view grant must be the token’s only scope',
         });
     }
-    if (request.expiresIn === 'never' && share === null) {
-        throw new server_1.TRPCError({
-            code: 'BAD_REQUEST',
-            message: 'Only a share link may be minted without an expiry',
-        });
-    }
+    assertLifetime(request.scopes, request.expiresIn);
     const verdict = (0, scope_escalation_js_1.scopesWithin)(request.scopes, user.scopes ?? [], ctx.deviceScopeLookup);
     if (!verdict.ok) {
         throw new server_1.TRPCError({
@@ -105,13 +131,19 @@ async function mintFor(deps, ctx, request) {
     if (subjectId !== user.id && !user.isAdmin) {
         throw new server_1.TRPCError({ code: 'FORBIDDEN', message: 'Only an admin mints for another user' });
     }
+    if (subjectId !== user.id && (0, types_1.scopesGrantAdmin)(request.scopes)) {
+        throw new server_1.TRPCError({
+            code: 'BAD_REQUEST',
+            message: "A '*' token acts for the admin who mints it, never for another user",
+        });
+    }
     const service = requireCredentialTokens(deps.credentialTokens);
     const minted = await service.mint({
         subjectId,
         createdBy: user.id,
         label: request.label,
         scopes: request.scopes,
-        expiresAt: request.expiresIn === 'never' ? null : Date.now() + request.expiresIn * 1000,
+        expiresAt: expiryOf(request.expiresIn),
     });
     const internal = deps.registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(deps.registry);
     if (internal !== null) {
@@ -134,49 +166,6 @@ async function mintFor(deps, ctx, request) {
     }
     return minted;
 }
-async function legacyRows(deps, caller) {
-    const out = [];
-    const own = (subjectId) => caller.isAdmin || subjectId === caller.id;
-    const internal = deps.registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(deps.registry);
-    if (internal !== null && caller.isAdmin) {
-        for (const row of await internal.adminTokens.list()) {
-            out.push({
-                id: row.id,
-                subjectId: row.createdBy,
-                label: row.name,
-                scopes: ['*'],
-                createdAt: row.createdAt,
-                expiresAt: row.expiresAt,
-                lastUsedAt: row.lastUsedAt,
-                revokedAt: row.revokedAt,
-                legacy: true,
-                format: 'csa',
-            });
-        }
-    }
-    if (deps.shareTokens !== null) {
-        const rows = caller.isAdmin
-            ? await deps.shareTokens.listAll()
-            : await deps.shareTokens.listForUser(caller.id);
-        for (const row of rows) {
-            if (!own(row.userId))
-                continue;
-            out.push({
-                id: row.id,
-                subjectId: row.userId,
-                label: `share ${row.tokenPrefix}`,
-                scopes: [{ type: 'share-view', grant: row.scope }],
-                createdAt: row.createdAt,
-                expiresAt: row.expiresAt,
-                lastUsedAt: row.lastUsedAt ?? null,
-                revokedAt: null,
-                legacy: true,
-                format: 'csv',
-            });
-        }
-    }
-    return out;
-}
 function createTokenProcedures(deps) {
     return {
         /** Issue a token carrying `scopes` (see the module header). Shown once. */
@@ -189,27 +178,65 @@ function createTokenProcedures(deps) {
                 expiresIn: input.expiresIn,
                 label: input.label,
                 ...(input.reauthToken !== undefined ? { reauthToken: input.reauthToken } : {}),
+                ...(input.subjectId !== undefined ? { subjectId: input.subjectId } : {}),
             });
             return { token: minted.token, record: summarizeToken(minted.record) };
         }),
         /**
-         * The caller's tokens (an admin: everyone's) — unified and legacy alike,
-         * a legacy row flagged. No secret is ever listed. (The legacy `cst_`
-         * rows are listed by `userManagement.listScopedTokens`, as before.)
+         * The caller's tokens (an admin: everyone's). No secret is ever listed.
          */
         listTokens: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.void())
+            .input(exports.ListTokensInputSchema)
             .output(zod_1.z.array(exports.TokenSummarySchema))
-            .query(async ({ ctx }) => {
+            .query(async ({ ctx, input }) => {
             if (ctx.user.userDelegated !== true) {
                 throw new server_1.TRPCError({ code: 'FORBIDDEN', message: 'Requires a signed-in user session' });
             }
-            const unified = deps.credentialTokens === null
-                ? []
-                : await deps.credentialTokens.list(ctx.user.isAdmin ? undefined : ctx.user.id);
-            return [...unified.map(summarizeToken), ...(await legacyRows(deps, ctx.user))];
+            const rows = await requireCredentialTokens(deps.credentialTokens).list(ctx.user.isAdmin ? undefined : ctx.user.id);
+            const label = input?.label;
+            // An account link manages share links only, so it lists only those.
+            const shareOnly = ctx.user.interactive !== true;
+            return rows
+                .filter((row) => label === undefined || row.label === label)
+                .filter((row) => !shareOnly || provenanceAllows(ctx.user, row.scopes))
+                .map(summarizeToken);
+        }),
+        /**
+         * Move one live token's expiry, in place: the same token keeps working
+         * with the new lifetime, so a client renews instead of minting another.
+         * The owner or an admin; the same provenance and lifetime rules as a mint
+         * (an account link renews only its share links; `'never'` only for one).
+         * Shortening is allowed; a revoked or expired token is NOT_FOUND.
+         */
+        extendToken: trpc_middleware_js_1.protectedProcedure
+            .input(exports.ExtendTokenInputSchema)
+            .output(exports.TokenSummarySchema)
+            .mutation(async ({ ctx, input }) => {
+            const service = requireCredentialTokens(deps.credentialTokens);
+            const record = await service.get(input.id);
+            if (record === null) {
+                throw new server_1.TRPCError({ code: 'NOT_FOUND', message: `Token not found: ${input.id}` });
+            }
+            if (!ctx.user.isAdmin && record.subjectId !== ctx.user.id) {
+                throw new server_1.TRPCError({
+                    code: 'FORBIDDEN',
+                    message: 'Only the owner or an admin extends a token',
+                });
+            }
+            if (!provenanceAllows(ctx.user, record.scopes)) {
+                throw new server_1.TRPCError({
+                    code: 'FORBIDDEN',
+                    message: 'A token can only be extended from a signed-in session',
+                });
+            }
+            assertLifetime(record.scopes, input.expiresIn);
+            const moved = await service.setExpiry(input.id, expiryOf(input.expiresIn));
+            if (moved === null) {
+                throw new server_1.TRPCError({ code: 'NOT_FOUND', message: `Token expired or revoked: ${input.id}` });
+            }
+            return summarizeToken(moved);
         }),
-        /** Revoke one unified token: its owner or an admin. It stops working at once. */
+        /** Revoke one token: its owner or an admin. It stops working at once. */
         revokeToken: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.object({ id: zod_1.z.string().min(1) }))
             .output(zod_1.z.object({ success: zod_1.z.boolean() }))
@@ -227,6 +254,12 @@ function createTokenProcedures(deps) {
                     message: 'Only the owner or an admin revokes a token',
                 });
             }
+            if (!provenanceAllows(ctx.user, record.scopes)) {
+                throw new server_1.TRPCError({
+                    code: 'FORBIDDEN',
+                    message: 'An account link revokes only its share links',
+                });
+            }
             const success = await service.revoke(input.id);
             const internal = deps.registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(deps.registry);
             if (success && internal !== null) {