@camstack/server 1.2.619 → 1.2.620

package/dist/api/core/auth.router.js

@@ -224,6 +224,10 @@ const ScopeGrantSummarySchema = zod_1.z.object({
  */
 const EffectiveScopeSchema = zod_1.z.object({
     isAdmin: zod_1.z.boolean(),
+    /** `admin`, `viewer` (D921), or `scoped` — a legacy grant set not yet converted. */
+    role: zod_1.z.enum(['admin', 'viewer', 'scoped']),
+    /** The viewer features granted (D921); empty for every other role. */
+    features: zod_1.z.array(types_1.ViewerFeatureIdSchema).readonly(),
     allDevicesViewable: zod_1.z.boolean(),
     viewableDeviceCount: zod_1.z.number().int(),
     device: zod_1.z.object({
@@ -935,7 +939,7 @@ function createAuthRouter(auth, registry, moleculer = null, handoffCodes = new h
          */
         previewScope: trpc_middleware_js_1.adminProcedure
             .input(zod_1.z.object({
-            scopes: zod_1.z.array(types_1.TokenScopeSchema),
+            scopes: zod_1.z.array(types_1.UserScopeSchema),
             isAdmin: zod_1.z.boolean().default(false),
         }))
             .output(EffectiveScopeSchema)

package/dist/api/trpc/principal-authorization.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.authorizeProcedure = authorizeProcedure;
+exports.viewerPassesAdminTier = viewerPassesAdminTier;
 exports.authorizeAddonRoute = authorizeAddonRoute;
 /**
  * The ONE scope matcher (D892): every authorization decision about a verified
@@ -43,6 +44,22 @@ function authorizeProcedure(scopes, path, rawInput, lookup) {
     }
     return { ok: true, mode: 'scoped', scopes: capability };
 }
+/**
+ * May a VIEWER (D921) pass the admin tier of the cap method at `path`? Only
+ * when the method's role is a feature the viewer was granted (or explicitly
+ * `viewer`). `adminProcedure` asks this AFTER `protectedProcedure` ran the
+ * matcher, which already required the role and every named device; a
+ * hand-written admin route has no cap entry and is never passed.
+ */
+function viewerPassesAdminTier(scopes, path) {
+    const viewer = (0, types_1.viewerScopeOf)((0, types_1.capabilityScopesOf)(scopes));
+    if (viewer === null)
+        return false;
+    const meta = system_1.METHOD_ACCESS_MAP[path];
+    if (meta === undefined || meta.role === 'admin')
+        return false;
+    return (0, types_1.viewerHoldsRole)(viewer, meta.role);
+}
 /** May a principal holding `scopes` reach `/addon/<addonId>/…` with this verb? */
 function authorizeAddonRoute(scopes, target) {
     const grant = (0, types_1.shareViewGrantOf)(scopes);
@@ -70,7 +87,7 @@ function authorizeAddonRoute(scopes, target) {
     }
     const access = (0, types_1.methodAccessForHttpMethod)(target.method);
     if ((0, types_1.scopesAllowAddonRoutes)(scopes, access) ||
-        (0, types_1.scopesAllowAddon)((0, types_1.capabilityScopesOf)(scopes), target.addonId, access)) {
+        (0, types_1.scopesAllowAddon)((0, types_1.capabilityScopesOf)(scopes).flatMap((s) => (s.type === 'viewer' ? [] : [s])), target.addonId, access)) {
         return { ok: true, shareHeaders: null };
     }
     return {

package/dist/api/trpc/principal-visibility.js

@@ -69,6 +69,11 @@ function callerCanViewDevice(scopes, deviceId, lookup) {
  * security both point the same way here — broad grant, broad stream.
  */
 function isBroadEventViewer(scopes) {
+    // A viewer (D921) sees the firehose only with every device admitted; any
+    // other row it carries never counts.
+    const viewer = (0, types_1.viewerScopeOf)(scopes);
+    if (viewer !== null)
+        return viewer.allow === '*' && viewer.block.length === 0;
     return scopes.some((s) => s.type === 'category' && s.access.includes('view'));
 }
 /**
@@ -107,9 +112,13 @@ function eventDeviceId(evt) {
 function hasUnrestrictedDeviceView(isAdmin, scopes) {
     if (isAdmin)
         return true;
-    return scopes.some((s) => s.access.includes('view') &&
-        ((s.type === 'category' && s.target === 'device') ||
-            (s.type === 'device' && s.selector.kind === 'all')));
+    // A viewer (D921) is unrestricted only with every device allowed and none
+    // blocked; the rest of its set never counts.
+    const viewer = (0, types_1.viewerScopeOf)(scopes);
+    if (viewer !== null)
+        return viewer.allow === '*' && viewer.block.length === 0;
+    return scopes.some((s) => (s.type === 'category' && s.target === 'device' && s.access.includes('view')) ||
+        (s.type === 'device' && s.selector.kind === 'all' && s.access.includes('view')));
 }
 /**
  * Cut a `deviceManager.listAll` payload to the devices this principal may VIEW

package/dist/api/trpc/scope-access.js

@@ -151,9 +151,8 @@ function referencedDeviceIds(path, input) {
  * selector is `all`. Such a caller is unaffected by the device-reference gate.
  */
 function hasUnrestrictedDeviceReach(scopes, access) {
-    return scopes.some((s) => s.access.includes(access) &&
-        ((s.type === 'category' && s.target === 'device') ||
-            (s.type === 'device' && s.selector.kind === 'all')));
+    return scopes.some((s) => (s.type === 'category' && s.target === 'device' && s.access.includes(access)) ||
+        (s.type === 'device' && s.selector.kind === 'all' && s.access.includes(access)));
 }
 /**
  * The device-reference gate for SYSTEM-scope cap methods (F1 #3).
@@ -189,7 +188,43 @@ function deviceRefsSatisfied(scopes, path, input, access, lookup) {
     }
     return { ok: true };
 }
+/**
+ * The viewer role's matcher (D921). The method's ROLE decides what a viewer
+ * may call (`viewer` baseline, `feature:<id>` when granted, never `admin`),
+ * and every device the request names must be admitted by the viewer's
+ * allow/block lists — through itself or an ancestor, with unknown parentage
+ * failing closed (`viewerAdmitsDevice`). A method that names no device is
+ * cross-device by nature (an enumeration, a gallery): its answer is cut where
+ * one exists (`DEVICE_ENUMERATION_METHODS`, the event firehose filter).
+ */
+function checkViewerAccess(viewer, path, input, lookup) {
+    const meta = system_1.METHOD_ACCESS_MAP[path];
+    if (!meta)
+        return { ok: false, reason: `Unknown method '${path}' — codegen drift` };
+    if (!(0, types_1.viewerHoldsRole)(viewer, meta.role)) {
+        const feature = (0, types_1.featureOfRole)(meta.role);
+        return {
+            ok: false,
+            reason: feature !== null
+                ? `'${path}' needs the '${feature}' feature, which this viewer does not have`
+                : `'${path}' is for administrators — a viewer cannot call it`,
+        };
+    }
+    const ancestors = lookup === undefined
+        ? undefined
+        : (id) => lookup.getType(id) === null ? null : lookup.getAncestors(id);
+    for (const deviceId of referencedDeviceIds(path, input)) {
+        if (!(0, types_1.viewerAdmitsDevice)(viewer, deviceId, ancestors)) {
+            return { ok: false, reason: `Device ${deviceId} is outside this viewer's devices` };
+        }
+    }
+    return { ok: true, access: meta.access };
+}
 function checkScopeAccess(scopes, path, input, lookup) {
+    // A viewer is decided by its own rules, alone (D921).
+    const viewer = (0, types_1.viewerScopeOf)(scopes);
+    if (viewer !== null)
+        return checkViewerAccess(viewer, path, input, lookup);
     const meta = system_1.METHOD_ACCESS_MAP[path];
     if (!meta) {
         return { ok: false, reason: `Unknown method '${path}' — codegen drift` };
@@ -229,6 +264,9 @@ function checkScopeAccess(scopes, path, input, lookup) {
                         : exports.DEVICE_ENUMERATION_METHODS.has(path);
                 break;
             }
+            case 'viewer':
+                // Unreachable: a viewer row is decided above, alone.
+                continue;
         }
         if (!targetMatches)
             continue;
@@ -252,6 +290,8 @@ function checkScopeAccess(scopes, path, input, lookup) {
         ok: false,
         reason: `No scope grants ${meta.access} on '${meta.capName}' (${meta.capScope}-scope cap${deviceId !== null ? `, device=${deviceId}` : ''}). Have: ${scopes
             .map((s) => {
+            if (s.type === 'viewer')
+                return 'viewer';
             const target = s.type === 'device' ? `[${describeSelector(s)}]` : s.target;
             return `${s.type}:${target}[${s.access.join(',')}]`;
         })

package/dist/api/trpc/trpc.middleware.js

@@ -176,8 +176,11 @@ exports.protectedProcedure = localized.use(async ({ ctx, next, path, getRawInput
  * `protectedProcedure`. Useful on hand-written routes whose admin-only
  * nature should be obvious to a code reader.
  */
-exports.adminProcedure = exports.protectedProcedure.use(({ ctx, next }) => {
-    if (!ctx.user.isAdmin) {
+exports.adminProcedure = exports.protectedProcedure.use(({ ctx, next, path }) => {
+    // A viewer passes the admin tier only on a method of a feature it was
+    // granted (D921); the matcher in `protectedProcedure` already checked the
+    // feature and every device the call names.
+    if (!ctx.user.isAdmin && !(0, principal_authorization_js_1.viewerPassesAdminTier)(ctx.user.scopes ?? [], path)) {
         throw (0, user_error_js_1.trpcUserError)('FORBIDDEN', 'auth.admin-required', undefined, 'Admin required');
     }
     return next({ ctx });

package/dist/auth/addon-route-auth.js

@@ -37,7 +37,8 @@ function addonRouteCaller(principal) {
                 scopedToken: {
                     id: principal.credentialId,
                     userId: principal.subjectId,
-                    scopes: [...(0, types_1.capabilityScopesOf)(scoped)],
+                    // Capability rows only: an addon reads grants, never a viewer row (D921).
+                    scopes: (0, types_1.capabilityScopesOf)(scoped).flatMap((s) => (s.type === 'viewer' ? [] : [s])),
                 },
             }),
     };

package/dist/auth/scope-escalation.js

@@ -19,6 +19,10 @@ function accessCovered(asked, held) {
 }
 /** The grant without its access list, as a comparable key. */
 function grantKey(scope) {
+    // A viewer row (D921) is compared WHOLE: its lists and features are the
+    // grant, there is no access flavour to cut.
+    if (scope.type === 'viewer')
+        return JSON.stringify(scope);
     if (scope.type === 'device') {
         return JSON.stringify({
             type: scope.type,
@@ -37,6 +41,8 @@ function describe(scope) {
         return `addon-routes[${scope.access.join(',')}]`;
     if (scope.type === 'preferences-self')
         return 'preferences-self';
+    if (scope.type === 'viewer')
+        return 'viewer';
     if (scope.type === 'device')
         return `device[${scope.access.join(',')}]`;
     return `${scope.type}:${scope.target}[${scope.access.join(',')}]`;
@@ -55,7 +61,10 @@ function scopesWithin(requested, held, lookup) {
                 return { ok: false, reason: 'a share-view grant names a device you cannot view' };
             }
             if (scope.grant.talk === true && !canTalkOn(heldCapability, scope.grant.deviceIds, lookup)) {
-                return { ok: false, reason: 'a share-view grant asks talk-back on a device you cannot talk on' };
+                return {
+                    ok: false,
+                    reason: 'a share-view grant asks talk-back on a device you cannot talk on',
+                };
             }
             continue;
         }
@@ -72,7 +81,18 @@ function scopesWithin(requested, held, lookup) {
             };
         }
         const key = grantKey(scope);
-        const covered = heldCapability.some((h) => grantKey(h) === key && accessCovered(scope.access, h.access));
+        if (scope.type === 'viewer') {
+            // Only the SAME viewer grant the caller holds — a viewer mints a token
+            // for itself, never a wider (or differently shaped) one.
+            if (!heldCapability.some((h) => grantKey(h) === key)) {
+                return {
+                    ok: false,
+                    reason: `you do not hold ${describe(scope)} with these devices and features`,
+                };
+            }
+            continue;
+        }
+        const covered = heldCapability.some((h) => h.type !== 'viewer' && grantKey(h) === key && accessCovered(scope.access, h.access));
         if (!covered)
             return { ok: false, reason: `you do not hold ${describe(scope)}` };
     }
@@ -124,7 +144,15 @@ function intersectScopes(token, held, lookup) {
             continue;
         }
         const key = grantKey(scope);
-        const heldAccess = new Set(held.filter((h) => grantKey(h) === key).flatMap((h) => [...h.access]));
+        if (scope.type === 'viewer') {
+            // Kept only while the subject still holds the identical viewer grant:
+            // an admin who edits a viewer's devices or features ends that viewer's
+            // tokens rather than letting them keep (or gain) another reach.
+            if (held.some((h) => grantKey(h) === key))
+                out.push(scope);
+            continue;
+        }
+        const heldAccess = new Set(held.flatMap((h) => (h.type !== 'viewer' && grantKey(h) === key ? [...h.access] : [])));
         const access = scope.access.filter((a) => heldAccess.has(a));
         if (access.length > 0)
             out.push({ ...scope, access });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.619",
+  "version": "1.2.620",
   "license": "MIT",
   "private": false,
   "files": [
@@ -38,18 +38,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.456",
+    "@camstack/addon-admin-ui": "1.2.457",
     "@camstack/addon-agent-ui": "1.2.261",
     "@camstack/addon-auth": "1.2.166",
     "@camstack/addon-decoder-nodeav": "1.2.141",
     "@camstack/addon-notifiers": "1.2.619",
-    "@camstack/addon-pipeline": "1.2.620",
+    "@camstack/addon-pipeline": "1.2.621",
     "@camstack/addon-pipeline-orchestrator": "1.2.622",
-    "@camstack/addon-post-analysis": "1.2.626",
+    "@camstack/addon-post-analysis": "1.2.627",
     "@camstack/develop": "0.1.31",
     "@camstack/sdk": "1.2.151",
-    "@camstack/system": "1.2.470",
-    "@camstack/types": "1.2.402",
+    "@camstack/system": "1.2.471",
+    "@camstack/types": "1.2.403",
     "@camstack/ui-library": "1.2.318",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",