@camstack/server 1.2.663 → 1.2.665

package/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.2.665] - 2026-10-28
+
+### Changed
+
+- A shared events link can open a track's detail page, and shared links now use the operator's colour palette
+
+## [1.2.664] - 2026-10-27
+
+### Changed
+
+- Rebuilt against updated dependencies.
+
 ## [1.2.663] - 2026-10-27
 
 ### Changed

package/dist/api/trpc/share-view-access.js

@@ -16,6 +16,8 @@ const GRID_VIEW_OPEN_METHODS = new Set([
     'deviceManager.listAll',
     'turnProvider.getTurnServers',
     'live.onEvent',
+    // Display data only: preset id + hex swatches, no device or secret.
+    'displayPalette.getPalette',
 ]);
 /**
  * Talk-back, callable only on a token minted with `scope.talk` AND only for an
@@ -58,13 +60,19 @@ function extractDeviceId(input) {
  *   • `pipelineAnalytics.listRecentTracks`     — the feed itself
  *   • `pipelineAnalytics.listEventKindsBatch`  — the class→macro taxonomy
  *   • `pipelineAnalytics.searchObjectEvents`   — CLIP text search
+ *   • `pipelineAnalytics.getTrack` / `listTrackMedia` — the track detail page
  *
  * Intentionally NOT here: everything the grid link gets (WebRTC signalling,
  * snapshots, TURN, camera metrics) — a shared events page is not a camera
  * wall — and every mutating analytics method (`deleteTracks`, `setTrackFlags`,
  * the retrain surface, the export planes).
  */
-const EVENTS_VIEW_OPEN_METHODS = new Set(['auth.me', 'deviceManager.listAll']);
+const EVENTS_VIEW_OPEN_METHODS = new Set([
+    'auth.me',
+    'deviceManager.listAll',
+    // Display data only: preset id + hex swatches, no device or secret.
+    'displayPalette.getPalette',
+]);
 /**
  * Methods whose input carries a `deviceIds` ARRAY. The rule is INTERSECTION,
  * and the outcome is FILTER-AND-SERVE: a request that names at least one
@@ -95,6 +103,21 @@ const EVENTS_VIEW_DEVICE_ARRAY_METHODS = new Set([
 const EVENTS_VIEW_OPTIONAL_DEVICE_METHODS = new Set([
     'pipelineAnalytics.searchObjectEvents',
 ]);
+/**
+ * Methods that read ONE track (or its media manifest) and REQUIRE a single
+ * numeric `input.deviceId` that is inside the scope. Used by the embed's track
+ * detail page (`?mode=track`).
+ *
+ * Unlike {@link EVENTS_VIEW_OPTIONAL_DEVICE_METHODS} an absent id is DENIED
+ * (fail closed): the answer is one row, not a list the response filter could
+ * cut. The provider must return null when the stored track belongs to another
+ * device than `input.deviceId` — the gate vouches for the id the caller named,
+ * the provider vouches that it is the track's own.
+ */
+const EVENTS_VIEW_REQUIRED_DEVICE_METHODS = new Set([
+    'pipelineAnalytics.getTrack',
+    'pipelineAnalytics.listTrackMedia',
+]);
 /** Pull a `deviceIds` array off a raw tRPC input. Null when absent/malformed. */
 function extractDeviceIds(input) {
     if (input === null || typeof input !== 'object')
@@ -133,6 +156,16 @@ function checkEventsViewAccess(scope, path, input) {
         }
         return { ok: true };
     }
+    if (EVENTS_VIEW_REQUIRED_DEVICE_METHODS.has(path)) {
+        const deviceId = extractDeviceId(input);
+        if (deviceId === null) {
+            return { ok: false, reason: `'${path}' requires a numeric deviceId for share-view access` };
+        }
+        if (!scope.deviceIds.includes(deviceId)) {
+            return { ok: false, reason: `Device ${deviceId} is outside this share link's scope` };
+        }
+        return { ok: true };
+    }
     return { ok: false, reason: `'${path}' is not available to share-view tokens` };
 }
 function checkShareViewAccess(scope, path, input) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.663",
+  "version": "1.2.665",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -49,20 +49,20 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.496",
-    "@camstack/addon-agent-ui": "1.2.282",
+    "@camstack/addon-admin-ui": "1.2.498",
+    "@camstack/addon-agent-ui": "1.2.283",
     "@camstack/addon-auth": "1.2.170",
-    "@camstack/addon-benchmark": "1.2.282",
+    "@camstack/addon-benchmark": "1.2.284",
     "@camstack/addon-decoder-nodeav": "1.2.144",
     "@camstack/addon-notifiers": "1.2.623",
     "@camstack/addon-pipeline": "1.2.631",
-    "@camstack/addon-pipeline-orchestrator": "1.2.632",
-    "@camstack/addon-post-analysis": "1.2.644",
+    "@camstack/addon-pipeline-orchestrator": "1.2.633",
+    "@camstack/addon-post-analysis": "1.2.645",
     "@camstack/develop": "0.1.38",
     "@camstack/sdk": "1.2.154",
-    "@camstack/system": "1.2.500",
-    "@camstack/types": "1.2.430",
-    "@camstack/ui-library": "1.2.339",
+    "@camstack/system": "1.2.502",
+    "@camstack/types": "1.2.432",
+    "@camstack/ui-library": "1.2.341",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",