@camstack/server 1.2.621 → 1.2.622

package/dist/api/core/auth-tokens.procedures.js

@@ -232,7 +232,10 @@ function createTokenProcedures(deps) {
             assertLifetime(record.scopes, input.expiresIn);
             const moved = await service.setExpiry(input.id, expiryOf(input.expiresIn));
             if (moved === null) {
-                throw new server_1.TRPCError({ code: 'NOT_FOUND', message: `Token expired or revoked: ${input.id}` });
+                throw new server_1.TRPCError({
+                    code: 'NOT_FOUND',
+                    message: `Token expired or revoked: ${input.id}`,
+                });
             }
             return summarizeToken(moved);
         }),

package/dist/api/trpc/generated-cap-mounts.js

@@ -34,7 +34,9 @@ function mountAllCaps(services) {
     // to materialise a Moleculer-bridged proxy. The factory return
     // type is parametric — the runtime Proxy is structurally
     // compatible with every `InferProvider<typeof cap>` shape so a
-    // single generic helper covers every mount.
+    // single generic helper covers every mount. This is the one type
+    // boundary: a single assertion to the unconstrained `T`, never a
+    // double cast through `unknown`.
     const remoteCapProxy = (capName, nodeId) => services.moleculer.createCapabilityProxy(capName, nodeId);
     return {
         accessories: (0, generated_cap_routers_js_1.createCapRouter_accessories)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'accessories'), remoteCapProxy),

package/dist/api/trpc/person-without-viewer.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logPersonWithoutViewer = logPersonWithoutViewer;
+exports.resetPersonWithoutViewerLog = resetPersonWithoutViewerLog;
+const logged = new Set();
+function logPersonWithoutViewer(logger, userId) {
+    if (logger == null || logged.has(userId))
+        return;
+    logged.add(userId);
+    logger.warn('auth: a person with no viewer grant was refused', { tags: { userId } });
+}
+/** Test seam — the set is process-wide. */
+function resetPersonWithoutViewerLog() {
+    logged.clear();
+}

package/dist/api/trpc/principal-visibility.js

@@ -29,6 +29,7 @@ exports.scopedEventVisibility = scopedEventVisibility;
  */
 const system_1 = require("@camstack/system");
 const types_1 = require("@camstack/types");
+const person_session_scopes_js_1 = require("../../auth/person-session-scopes.js");
 const scope_access_js_1 = require("./scope-access.js");
 const share_view_access_js_1 = require("./share-view-access.js");
 /**
@@ -141,6 +142,12 @@ function projectListAllForPrincipal(data, isAdmin, scopes, fleet) {
     const viewable = (0, types_1.resolveViewableDeviceIds)(scopes, fleet, 'view');
     return (0, share_view_access_js_1.projectListAllForDeviceIds)(data, viewable);
 }
+/** Grant rows a principal is decided by. A person contributes only its viewer row. */
+function decisionScopes(user) {
+    const raw = user.scopes ?? [];
+    const scopes = user.interactive === true ? (0, person_session_scopes_js_1.personSessionScopes)(raw) : raw;
+    return (0, types_1.capabilityScopesOf)(scopes);
+}
 /**
  * Build the event-stream predicate for a NON-share principal (F0.5).
  *
@@ -156,7 +163,7 @@ function projectListAllForPrincipal(data, isAdmin, scopes, fleet) {
 function scopedEventVisibility(user, lookup) {
     if (user.isAdmin)
         return null;
-    const scopes = (0, types_1.capabilityScopesOf)(user.scopes ?? []);
+    const scopes = decisionScopes(user);
     if (isBroadEventViewer(scopes))
         return null;
     return (evt) => {

package/dist/api/trpc/trpc.context.js

@@ -171,6 +171,7 @@ async function createTrpcContext(req, authService, addonRegistry, logger = null,
         lang: (0, request_lang_js_1.resolveRequestLang)((0, request_lang_js_1.requestLangInputFrom)(req.headers, readQuery(req))),
         deviceScopeLookup,
         deviceFleet: () => addonRegistry.getPersistedDeviceList(),
+        logger,
     };
 }
 /**
@@ -210,5 +211,6 @@ async function createWsTrpcContext(opts, authService, addonRegistry, logger = nu
             : {}),
         deviceScopeLookup,
         deviceFleet: () => addonRegistry.getPersistedDeviceList(),
+        logger,
     };
 }

package/dist/api/trpc/trpc.middleware.js

@@ -8,6 +8,8 @@ exports.iterableSubscription = iterableSubscription;
 exports.iterableInterval = iterableInterval;
 const system_1 = require("@camstack/system");
 const types_1 = require("@camstack/types");
+const person_session_scopes_js_1 = require("../../auth/person-session-scopes.js");
+const person_without_viewer_js_1 = require("./person-without-viewer.js");
 const server_1 = require("@trpc/server");
 const superjson_1 = __importDefault(require("superjson"));
 const cap_route_error_formatter_js_1 = require("./cap-route-error-formatter.js");
@@ -118,8 +120,18 @@ exports.protectedProcedure = localized.use(async ({ ctx, next, path, getRawInput
         throw (0, user_error_js_1.trpcUserError)('UNAUTHORIZED', 'auth.session-ended', undefined, 'Session ended — sign in again');
     }
     const user = ctx.user;
-    const verdict = (0, principal_authorization_js_1.authorizeProcedure)(user.scopes ?? [], path, await getRawInput(), ctx.deviceScopeLookup);
+    const rawScopes = user.scopes ?? [];
+    // A person is an admin or a viewer (D921). Grant rows on the user record
+    // are not a role: the session is decided by its viewer row alone, and a
+    // person with none reaches no labelled method. Tokens keep their rows.
+    const scopes = user.interactive === true && !user.isAdmin ? (0, person_session_scopes_js_1.personSessionScopes)(rawScopes) : rawScopes;
+    const verdict = (0, principal_authorization_js_1.authorizeProcedure)(scopes, path, await getRawInput(), ctx.deviceScopeLookup);
     if (!verdict.ok) {
+        if (user.interactive === true &&
+            !user.isAdmin &&
+            (0, types_1.viewerScopeOf)((0, types_1.capabilityScopesOf)(rawScopes)) === null) {
+            (0, person_without_viewer_js_1.logPersonWithoutViewer)(ctx.logger, user.id);
+        }
         throw new server_1.TRPCError({ code: 'FORBIDDEN', message: verdict.reason });
     }
     // Spread+reassign of `user` narrows downstream ctx from `User | null` to

package/dist/auth/credential-verifier.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createCredentialVerifier = createCredentialVerifier;
 const types_1 = require("@camstack/types");
 const trpc_error_principal_js_1 = require("../api/trpc/trpc-error-principal.js");
+const person_session_scopes_js_1 = require("./person-session-scopes.js");
 const scope_escalation_js_1 = require("./scope-escalation.js");
 function stringClaim(value) {
     return typeof value === 'string' ? value : undefined;
@@ -217,7 +218,9 @@ function createCredentialVerifier(deps) {
         const capability = fresh ?? (0, types_1.normalizeTokenScopes)(payload.scopes ?? []);
         return {
             ...base,
-            scopes: [...capability, SESSION_ADDON_ROUTES, types_1.PREFERENCES_SELF_SCOPE],
+            // The stored rows may still be a pre-viewer grant set. A person is
+            // decided by the viewer row alone; the rest is not a role.
+            scopes: (0, person_session_scopes_js_1.personSessionScopes)([...capability, SESSION_ADDON_ROUTES, types_1.PREFERENCES_SELF_SCOPE]),
             isAdmin: false,
         };
     };

package/dist/auth/embed-auth-route.js

@@ -25,9 +25,7 @@ async function sessionCookieTtl(deps, token) {
 function registerEmbedAuthRoute(fastify, deps) {
     fastify.get('/api/embed-auth', async (request, reply) => {
         const authHeader = request.headers.authorization;
-        const token = authHeader?.startsWith('Bearer ')
-            ? authHeader.slice('Bearer '.length)
-            : undefined;
+        const token = authHeader?.startsWith('Bearer ') ? authHeader.slice('Bearer '.length) : undefined;
         if (!token)
             return reply.status(401).send({ error: 'Bearer token required' });
         const next = request.query?.next ?? '';

package/dist/auth/person-session-scopes.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.personSessionScopes = personSessionScopes;
+/**
+ * A person's session (D921, amended 2026-10-24) is decided by its viewer row
+ * alone. Grant rows (`device`, `category`, `capability`, `addon`) are the
+ * vocabulary of tokens and account links; they never reach the matcher for a
+ * person. A person with no viewer row keeps only the session extras (addon
+ * routes, own preferences) and is refused every labelled method.
+ */
+const types_1 = require("@camstack/types");
+/** A session extra a person keeps. `'*'` is not one: only an admin session carries it. */
+function isSessionExtra(scope) {
+    return (scope !== '*' &&
+        (scope.type === 'share-view' ||
+            scope.type === 'addon-routes' ||
+            scope.type === 'preferences-self'));
+}
+/** Drop every grant row but the viewer row, if the set holds one. */
+function personSessionScopes(scopes) {
+    const viewer = (0, types_1.viewerScopeOf)((0, types_1.capabilityScopesOf)(scopes));
+    const extras = scopes.filter(isSessionExtra);
+    return viewer === null ? extras : [viewer, ...extras];
+}

package/dist/closure-patches/patch-reach.json

@@ -23,7 +23,10 @@
       "package": "moleculer",
       "version": "0.15.0",
       "reach": "bundled",
-      "bundledInto": ["packages/system/dist/index.js", "packages/system/dist/index.mjs"],
+      "bundledInto": [
+        "packages/system/dist/builtins/system-config/system-config.addon.js",
+        "packages/system/dist/builtins/system-config/system-config.addon.mjs"
+      ],
       "markers": ["rest.buffer.byteLength"],
       "why": [
         "`moleculer` is NOT in the vite preset's externals, so rolldown inlines",
@@ -44,7 +47,12 @@
         "The marker is `rest.buffer.byteLength`, NOT the `pinsTooMuch` identifier",
         "the patch spells: rolldown inlines a single-use const, so `pinsTooMuch`",
         "is absent from every bundle including the correct ones. A marker that a",
-        "bundler can erase cannot answer this question."
+        "bundler can erase cannot answer this question.",
+        "",
+        "The artifact is wherever rolldown puts the shared moleculer chunk, not",
+        "necessarily `index`: today it lands in the",
+        "`builtins/system-config/system-config.addon` entry (re-checked",
+        "2026-10-24 on a fresh build: the only TCP parser in `dist/`, patched)."
       ]
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.621",
+  "version": "1.2.622",
   "license": "MIT",
   "private": false,
   "files": [
@@ -38,20 +38,20 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.458",
-    "@camstack/addon-agent-ui": "1.2.262",
+    "@camstack/addon-admin-ui": "1.2.459",
+    "@camstack/addon-agent-ui": "1.2.263",
     "@camstack/addon-auth": "1.2.166",
-    "@camstack/addon-benchmark": "1.2.262",
+    "@camstack/addon-benchmark": "1.2.263",
     "@camstack/addon-decoder-nodeav": "1.2.141",
     "@camstack/addon-notifiers": "1.2.619",
-    "@camstack/addon-pipeline": "1.2.622",
-    "@camstack/addon-pipeline-orchestrator": "1.2.623",
-    "@camstack/addon-post-analysis": "1.2.628",
+    "@camstack/addon-pipeline": "1.2.623",
+    "@camstack/addon-pipeline-orchestrator": "1.2.624",
+    "@camstack/addon-post-analysis": "1.2.629",
     "@camstack/develop": "0.1.31",
     "@camstack/sdk": "1.2.151",
-    "@camstack/system": "1.2.472",
-    "@camstack/types": "1.2.404",
-    "@camstack/ui-library": "1.2.319",
+    "@camstack/system": "1.2.473",
+    "@camstack/types": "1.2.405",
+    "@camstack/ui-library": "1.2.320",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",