@camstack/server 1.2.605 → 1.2.607

package/dist/api/core/auth.router.js

@@ -32,11 +32,9 @@ const session_cookie_js_1 = require("../../auth/session-cookie.js");
 const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
 const session_mint_js_1 = require("../../auth/session-mint.js");
 const handoff_code_service_js_1 = require("../../core/auth/handoff-code.service.js");
-const share_token_service_js_1 = require("../../core/auth/share-token.service.js");
-const principal_visibility_js_1 = require("../trpc/principal-visibility.js");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
 const auth_limits_js_1 = require("./auth-limits.js");
-const auth_admin_tokens_procedures_js_1 = require("./auth-admin-tokens.procedures.js");
+const auth_audit_procedures_js_1 = require("./auth-audit.procedures.js");
 const auth_tokens_procedures_js_1 = require("./auth-tokens.procedures.js");
 const auth_revoke_credentials_procedures_js_1 = require("./auth-revoke-credentials.procedures.js");
 const auth_reauth_procedures_js_1 = require("./auth-reauth.procedures.js");
@@ -170,59 +168,14 @@ const OwnExternalIdentitySchema = zod_1.z.object({
     /** Whether the provider instance is configured and enabled right now. */
     available: zod_1.z.boolean(),
 });
-// ── Share tokens (grid-view standalone share links) ──────────────────
-//
-// Wire schemas for the `csv_*` share-token surface. The summary shape
-// deliberately omits `tokenHash` — the raw token is returned exactly
-// once (at mint); afterwards only prefix + scope + timestamps are
-// visible.
-//
-// TTL: a bounded number of seconds, or the EXPLICIT literal `'never'`
-// for a permanently-shared grid (revocation is the kill switch).
-// Omitted → 7-day default; infinite is never a silent default.
-const CreateShareTokenInputSchema = zod_1.z.object({
-    scope: share_token_service_js_1.ShareTokenScopeSchema,
-    ttlSec: zod_1.z
-        .union([
-        zod_1.z.number().int().min(share_token_service_js_1.SHARE_TOKEN_TTL_MIN_SEC).max(share_token_service_js_1.SHARE_TOKEN_TTL_MAX_SEC),
-        zod_1.z.literal('never'),
-    ])
-        .optional(),
-});
-const ShareTokenSummarySchema = zod_1.z.object({
-    id: zod_1.z.string(),
-    userId: zod_1.z.string(),
-    tokenPrefix: zod_1.z.string(),
-    scope: share_token_service_js_1.ShareTokenScopeSchema,
-    createdAt: zod_1.z.number(),
-    /** Epoch ms, or `null` for never-expiring tokens. */
-    expiresAt: zod_1.z.number().nullable(),
-    /** Derived convenience flag so listings surface infinite tokens clearly. */
-    neverExpires: zod_1.z.boolean(),
-    lastUsedAt: zod_1.z.number().optional(),
-    /** A pre-D892 `csv_` link: valid until it expires, never minted again. */
-    legacy: zod_1.z.boolean().optional(),
-});
-function toShareTokenSummary(record) {
-    return {
-        id: record.id,
-        userId: record.userId,
-        tokenPrefix: record.tokenPrefix,
-        scope: record.scope,
-        createdAt: record.createdAt,
-        expiresAt: record.expiresAt,
-        neverExpires: record.expiresAt === null,
-        ...(record.lastUsedAt !== undefined ? { lastUsedAt: record.lastUsedAt } : {}),
-    };
-}
 /**
  * Token minting/management surfaces are for REAL user sessions only.
- * Scoped API tokens (`cst_*`) and share-view principals (`csv_*`) must
- * never mint, list, or revoke share links — nor mint handoff codes —
- * a leaked restricted token would otherwise widen its own reach.
+ * A minted token — whatever its scopes — must never mint handoff codes or
+ * link sign-in accounts: a leaked restricted token would otherwise widen its
+ * own reach.
  */
-function assertRealUserSession(user, what = 'Share-token management') {
-    // A minted token (admin, scoped, share — legacy or unified) is a script's
+function assertRealUserSession(user, what) {
+    // A minted token (admin, scoped or share-view) is a script's
     // credential, never a person's: it must not turn itself into a session
     // (handoff codes) or mint links. Provenance, not permission (D892).
     if (user.userDelegated !== true) {
@@ -301,7 +254,7 @@ const MeSchema = zod_1.z
     scope: EffectiveScopeSchema.optional(),
 })
     .nullable();
-function createAuthRouter(auth, registry, moleculer = null, shareTokens = null, handoffCodes = new handoff_code_service_js_1.HandoffCodeService(), linkIntents = new external_link_intents_js_1.ExternalLinkIntents(), nativeLink = null, options = {}) {
+function createAuthRouter(auth, registry, moleculer = null, handoffCodes = new handoff_code_service_js_1.HandoffCodeService(), linkIntents = new external_link_intents_js_1.ExternalLinkIntents(), nativeLink = null, options = {}) {
     const network = options.network ?? auth_network_policy_js_1.DEFAULT_AUTH_NETWORK_POLICY;
     const limiters = options.limiters ?? auth_limits_js_1.PROCESS_AUTH_LIMITERS;
     /** Secret-verifying legs (password / TOTP / passkey assertion / codes). */
@@ -309,20 +262,6 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
     /** Challenge-minting begin-legs — looser, they verify nothing. */
     const ceremonyProcedure = makeRateLimitedProcedure(limiters.ceremony, network);
     const credentialTokens = options.credentialTokens ?? null;
-    const tokenDeps = { auth, registry, network, credentialTokens, shareTokens };
-    /** The unified share link behind `id`, or `null` (a legacy `csv_`, or none). */
-    const unifiedShare = async (id) => {
-        if (credentialTokens === null)
-            return null;
-        const record = await credentialTokens.get(id);
-        return record !== null && (0, types_2.shareViewGrantOf)(record.scopes) !== null ? record : null;
-    };
-    const requireShareTokens = () => {
-        if (!shareTokens) {
-            throw new Error('Share tokens unavailable — service not wired on this node');
-        }
-        return shareTokens;
-    };
     /**
      * THE session mint (`auth/session-mint.ts`, D712) — the single shared tail
      * of every successful login leg, including `/api/auth/sso/finish`. It
@@ -800,8 +739,8 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          *     semantics (see `buildSessionCookie` — Lax already withholds
          *     the cookie from cross-site POSTs).
          *   • Only REAL session JWTs qualify: bridge tokens (`kind:
-         *     'totp-challenge'` / `'sso-bridge'`) and `cst_`/`csv_` opaque
-         *     tokens are rejected — the cookie must carry a v2 session.
+         *     'totp-challenge'` / `'sso-bridge'`) and minted tokens are
+         *     rejected — the cookie must carry a v2 session.
          *   • The returned bearer is minted FRESH through the shared
          *     `mintSessionForUserId` tail (re-fetched user → up-to-date
          *     scopes), equivalent to what `auth.login` hands out.
@@ -851,8 +790,8 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         // for a real session. TTL 60s, single-use, bound to the minting
         // user — see `HandoffCodeService`.
         /** Mint a one-time handoff code for the CALLING user. Real user
-         *  sessions only — scoped (`cst_`) and share-view (`csv_`) callers
-         *  must never convert themselves into a full session. */
+         *  sessions only — a minted token (scoped, admin or share-view)
+         *  must never convert itself into a full session. */
         createHandoffCode: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z
             .object({
@@ -1191,211 +1130,6 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 enabled: input.enabled,
             });
         }),
-        // ── Share tokens — scoped, TTL'd view tokens for standalone share
-        //    links (grid rework R6). Minted by any REAL user session (admin
-        //    or regular); the resulting `csv_*` token authenticates as a
-        //    restricted `share-view` principal limited to the embed surface
-        //    + its in-scope devices (see `share-view-access.ts`). ──────────
-        createShareToken: trpc_middleware_js_1.protectedProcedure
-            .input(CreateShareTokenInputSchema)
-            .output(zod_1.z.object({ id: zod_1.z.string(), token: zod_1.z.string(), expiresAt: zod_1.z.number().nullable() }))
-            .mutation(async ({ input, ctx }) => {
-            assertRealUserSession(ctx.user);
-            // SECURITY (F0.4): a share token is a PRIVILEGE HANDOFF — it authorises
-            // whoever holds the link to view its devices with no further auth. A
-            // scoped (non-admin) minter must therefore not be able to mint for a
-            // device it cannot itself see: without this, a `device:[5]` token could
-            // mint a `csv_*` grid link for cameras 5..99. Admins mint anything;
-            // every other caller's requested deviceIds are INTERSECTED with what
-            // they can view (device:[parent] covers child accessories via the
-            // ancestor walk). An empty intersection is a refusal, not a silent
-            // "share nothing".
-            const scope = ctx.user.isAdmin
-                ? input.scope
-                : {
-                    ...input.scope,
-                    deviceIds: (0, principal_visibility_js_1.filterViewableDeviceIds)((0, types_2.capabilityScopesOf)(ctx.user.scopes ?? []), input.scope.deviceIds, ctx.deviceScopeLookup),
-                };
-            if (scope.deviceIds.length === 0) {
-                throw new server_1.TRPCError({
-                    code: 'FORBIDDEN',
-                    message: 'None of the requested devices are within your scope — you cannot mint a share token for devices you cannot see',
-                });
-            }
-            // A thin wrapper for one release (D892): the link is a unified token
-            // whose only scope is the share-view grant. Without the store (a
-            // node that cannot mint) it is still a legacy `csv_`.
-            if (credentialTokens !== null) {
-                const ttl = input.ttlSec ?? share_token_service_js_1.SHARE_TOKEN_TTL_DEFAULT_SEC;
-                const minted = await (0, auth_tokens_procedures_js_1.mintFor)(tokenDeps, ctx, {
-                    scopes: [{ type: 'share-view', grant: scope }],
-                    expiresIn: ttl,
-                    label: `share ${scope.kind}`,
-                    allowAccountLink: true,
-                });
-                return { id: minted.record.id, token: minted.token, expiresAt: minted.record.expiresAt };
-            }
-            const { token, record } = await requireShareTokens().create({
-                userId: ctx.user.id,
-                scope,
-                ...(input.ttlSec !== undefined ? { ttlSec: input.ttlSec } : {}),
-            });
-            return { id: record.id, token, expiresAt: record.expiresAt };
-        }),
-        /**
-         * Slide expiry on a still-valid share token (same `csv_*`). Used by the
-         * Home Assistant embed cache so a long-lived dashboard does not mint a
-         * new row every hour. Expired / missing → NOT_FOUND (caller must create).
-         */
-        extendShareToken: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({
-            id: zod_1.z.string().min(1),
-            ttlSec: zod_1.z.number().int().min(share_token_service_js_1.SHARE_TOKEN_TTL_MIN_SEC).max(share_token_service_js_1.SHARE_TOKEN_TTL_MAX_SEC),
-        }))
-            .output(zod_1.z.object({ id: zod_1.z.string(), expiresAt: zod_1.z.number() }))
-            .mutation(async ({ input, ctx }) => {
-            assertRealUserSession(ctx.user);
-            const unified = await unifiedShare(input.id);
-            if (unified !== null && credentialTokens !== null) {
-                if (!ctx.user.isAdmin && unified.subjectId !== ctx.user.id) {
-                    throw new server_1.TRPCError({
-                        code: 'FORBIDDEN',
-                        message: 'Only the token owner or an admin can extend a share token',
-                    });
-                }
-                if (unified.expiresAt === null) {
-                    throw (0, user_error_js_1.trpcUserError)('BAD_REQUEST', 'auth.share-never-expiring-extend', undefined, 'A never-expiring share token cannot be extended');
-                }
-                const moved = await credentialTokens.setExpiry(input.id, Date.now() + input.ttlSec * 1000);
-                if (moved === null || moved.expiresAt === null) {
-                    throw new server_1.TRPCError({ code: 'NOT_FOUND', message: `Share token expired: ${input.id}` });
-                }
-                return { id: moved.id, expiresAt: moved.expiresAt };
-            }
-            const service = requireShareTokens();
-            try {
-                const record = await service.extend({
-                    id: input.id,
-                    ttlSec: input.ttlSec,
-                    callerUserId: ctx.user.id,
-                    callerIsAdmin: ctx.user.isAdmin,
-                });
-                if (record.expiresAt === null) {
-                    throw (0, user_error_js_1.trpcUserError)('BAD_REQUEST', 'auth.share-never-expiring-extend', undefined, 'A never-expiring share token cannot be extended');
-                }
-                return { id: record.id, expiresAt: record.expiresAt };
-            }
-            catch (error) {
-                const message = error instanceof Error ? error.message : 'Share token extend failed';
-                if (/not found|expired/i.test(message)) {
-                    throw new server_1.TRPCError({ code: 'NOT_FOUND', message });
-                }
-                if (/owner or an admin|never-expiring/i.test(message)) {
-                    throw new server_1.TRPCError({ code: 'FORBIDDEN', message });
-                }
-                throw new server_1.TRPCError({ code: 'BAD_REQUEST', message });
-            }
-        }),
-        revokeShareToken: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({ id: zod_1.z.string().min(1) }))
-            .output(zod_1.z.object({ success: zod_1.z.boolean() }))
-            .mutation(async ({ input, ctx }) => {
-            assertRealUserSession(ctx.user);
-            const unified = await unifiedShare(input.id);
-            if (unified !== null && credentialTokens !== null) {
-                if (!ctx.user.isAdmin && unified.subjectId !== ctx.user.id) {
-                    throw new server_1.TRPCError({
-                        code: 'FORBIDDEN',
-                        message: 'Only the token owner or an admin can revoke a share token',
-                    });
-                }
-                return { success: await credentialTokens.revoke(input.id) };
-            }
-            const service = requireShareTokens();
-            try {
-                const removed = await service.revoke({
-                    id: input.id,
-                    callerUserId: ctx.user.id,
-                    callerIsAdmin: ctx.user.isAdmin,
-                });
-                if (removed) {
-                    const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
-                    if (internal !== null) {
-                        const ip = network.clientAddress(ctx.req).ip;
-                        await internal.audit.record({
-                            action: 'credentials-revoked',
-                            userId: ctx.user.id,
-                            ...(ip !== null ? { ip } : {}),
-                            detail: {
-                                kind: 'share-link',
-                                requested: 1,
-                                revoked: 1,
-                                skipped: 0,
-                                ids: input.id,
-                            },
-                        });
-                    }
-                }
-                return { success: removed };
-            }
-            catch (error) {
-                throw new server_1.TRPCError({
-                    code: 'FORBIDDEN',
-                    message: error instanceof Error ? error.message : 'Share token revoke failed',
-                });
-            }
-        }),
-        /**
-         * Share links. `owner: 'self'` — the caller's own (My access);
-         * `owner: 'all'` — every user's, admin only. Omitted keeps the original
-         * answer (own for a user, all for an admin) for clients that predate it.
-         */
-        listShareTokens: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({ owner: zod_1.z.enum(['self', 'all']).optional() }).optional())
-            .output(zod_1.z.array(ShareTokenSummarySchema))
-            .query(async ({ ctx, input }) => {
-            assertRealUserSession(ctx.user);
-            // The legacy `csv_` store, or — on a node with only the unified store —
-            // none; with neither, the clear refusal below.
-            const service = credentialTokens === null ? requireShareTokens() : shareTokens;
-            const owner = input?.owner ?? (ctx.user.isAdmin ? 'all' : 'self');
-            if (owner === 'all' && !ctx.user.isAdmin) {
-                throw new server_1.TRPCError({
-                    code: 'FORBIDDEN',
-                    message: "Listing every user's share links requires an admin",
-                });
-            }
-            const records = service === null
-                ? []
-                : owner === 'all'
-                    ? await service.listAll()
-                    : await service.listForUser(ctx.user.id);
-            const unified = credentialTokens === null
-                ? []
-                : await credentialTokens.list(owner === 'all' ? undefined : ctx.user.id);
-            const unifiedRows = unified.flatMap((record) => {
-                const grant = (0, types_2.shareViewGrantOf)(record.scopes);
-                if (grant === null || record.revokedAt !== null)
-                    return [];
-                return [
-                    {
-                        id: record.id,
-                        userId: record.subjectId,
-                        tokenPrefix: `token:${record.id.slice(0, 8)}`,
-                        scope: grant,
-                        createdAt: record.createdAt,
-                        expiresAt: record.expiresAt,
-                        neverExpires: record.expiresAt === null,
-                        ...(record.lastUsedAt !== null ? { lastUsedAt: record.lastUsedAt } : {}),
-                        legacy: false,
-                    },
-                ];
-            });
-            return [
-                ...unifiedRows,
-                ...records.map((record) => ({ ...toShareTokenSummary(record), legacy: true })),
-            ];
-        }),
         ...(0, auth_sessions_procedures_js_1.createSessionProcedures)({ registry, minter, credentialProcedure }),
         ...(0, auth_device_cert_procedures_js_1.createDeviceCertProcedures)({
             registry,
@@ -1413,9 +1147,9 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             issueFor,
         }),
         ...(0, auth_reauth_procedures_js_1.createReauthProcedures)({ auth, registry, moleculer, limiters }),
-        ...(0, auth_admin_tokens_procedures_js_1.createAdminTokenProcedures)({ auth, registry, network, credentialTokens, shareTokens }),
-        ...(0, auth_tokens_procedures_js_1.createTokenProcedures)({ auth, registry, network, credentialTokens, shareTokens }),
-        ...(0, auth_revoke_credentials_procedures_js_1.createRevokeCredentialsProcedures)({ registry, shareTokens, network, credentialTokens }),
+        ...(0, auth_audit_procedures_js_1.createAuthAuditProcedures)({ registry }),
+        ...(0, auth_tokens_procedures_js_1.createTokenProcedures)({ auth, registry, network, credentialTokens }),
+        ...(0, auth_revoke_credentials_procedures_js_1.createRevokeCredentialsProcedures)({ registry, network, credentialTokens }),
         // ── External sign-in identities (D782) ────────────────────────
         //
         // A signed-in user links an OIDC identity to THEIR OWN account. The

package/dist/api/core/cap-providers.js

@@ -719,6 +719,28 @@ function buildNodesProvider(agentRegistry, moleculer, addonRegistry, getNodeRoot
 function ownerSecrets(ar, owner) {
     return typeof ar.secretsForOwner === 'function' ? ar.secretsForOwner(owner) : null;
 }
+/**
+ * The integration settings keys the addon's own form stores in the keychain
+ * (by schema type, D783) — so the admin read can withhold a plaintext under one
+ * of them. Empty when the schema cannot be read (logged): markers are still
+ * withheld, and a coerced marker is caught without a schema.
+ */
+async function integrationSecretKeys(ar, addonId, logger) {
+    try {
+        const provider = ar
+            .getCapabilityRegistry()
+            .getSingleton('addon-settings');
+        const schema = await provider?.getGlobalSettings({ addonId, nodeId: 'hub' });
+        return (0, types_1.collectKeychainStoredKeys)(schema ?? null);
+    }
+    catch (err) {
+        logger.warn('integration settings: addon schema unreadable — plaintext secrets not detectable', {
+            tags: { addonId },
+            meta: { phase: 'getSettings', error: (0, types_1.errMsg)(err) },
+        });
+        return new Set();
+    }
+}
 function requireIntegrationRegistry(ar) {
     const reg = ar.getIntegrationRegistry();
     if (!reg)
@@ -1143,7 +1165,22 @@ function buildIntegrationsProvider(ar, eb, loggingService, capabilityRegistry) {
             const caller = Reflect.get(input, 'callerAddonId');
             const forOwner = typeof caller === 'string' &&
                 (caller === integration.addonId || ar.runnerIdFor(integration.addonId) === caller);
-            return (0, integration_secrets_1.readIntegrationSettings)({ registry: reg, secrets: forOwner ? ownerSecrets(ar, integration.addonId) : null }, { integrationId: input.id, forOwner });
+            // The schema is asked only for the admin read: the owner reads this at
+            // its own boot, and asking it for its schema then would call back into it.
+            const secretKeys = forOwner
+                ? undefined
+                : await integrationSecretKeys(ar, integration.addonId, logger);
+            return (0, integration_secrets_1.readIntegrationSettings)({ registry: reg, secrets: forOwner ? ownerSecrets(ar, integration.addonId) : null }, {
+                integrationId: input.id,
+                forOwner,
+                ...(secretKeys !== undefined ? { secretKeys } : {}),
+                onSuspectSecret: (suspect) => logger.error(suspect.kind === 'coerced-marker'
+                    ? 'integration secret is "[object Object]" — a keychain marker was coerced to text; the addon is sending it as the credential (repair: scripts/hub/repair-integration-secret-markers.ts, or re-type it)'
+                    : 'integration secret stored as PLAINTEXT under a keychain-declared key — withheld from the form; re-type it to move it into the keychain', {
+                    tags: { integrationId: input.id, addonId: integration.addonId },
+                    meta: { phase: 'getSettings', key: suspect.key, kind: suspect.kind, forOwner },
+                }),
+            });
         },
         setSettings: async (input) => {
             const reg = requireIntegrationRegistry(ar);

package/dist/api/core/integration-secrets.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.COERCED_MARKER_TEXT = void 0;
 exports.writeIntegrationSettings = writeIntegrationSettings;
 exports.readIntegrationSettings = readIntegrationSettings;
 /**
@@ -45,16 +46,36 @@ async function writeIntegrationSettings(deps, input) {
     if (orphaned.length > 0)
         deps.onOrphaned?.(orphaned);
 }
+/** The text `String(...)` makes of an object — a keychain marker some copy coerced. */
+exports.COERCED_MARKER_TEXT = '[object Object]';
+function suspectKind(key, value, secretKeys) {
+    if (value === exports.COERCED_MARKER_TEXT)
+        return 'coerced-marker';
+    if (secretKeys?.has(key) === true && typeof value === 'string' && value.length > 0) {
+        return 'plaintext';
+    }
+    return null;
+}
 async function readIntegrationSettings(deps, input) {
     const stored = await deps.registry.getIntegrationSettings(input.integrationId);
+    const suspects = new Set();
+    for (const [key, value] of Object.entries(stored)) {
+        const kind = suspectKind(key, value, input.secretKeys);
+        if (kind === null)
+            continue;
+        suspects.add(key);
+        input.onSuspectSecret?.({ key, kind });
+    }
     if (input.forOwner) {
         if (deps.secrets === null)
             return stored;
         return (await (0, types_1.resolveSecretMarkers)(stored, deps.secrets)).value;
     }
+    // Anyone but the owner — the admin form — never receives a secret's text:
+    // a marker becomes its "set" view, and so does a suspect plaintext.
     const out = {};
     for (const [key, value] of Object.entries(stored)) {
-        out[key] = (0, types_1.isSecretMarker)(value) ? (0, types_1.toSecretFieldView)(value) : value;
+        out[key] = (0, types_1.isSecretMarker)(value) || suspects.has(key) ? (0, types_1.toSecretFieldView)(value) : value;
     }
     return out;
 }