@camstack/server 1.2.77 → 1.2.79

package/dist/api/trpc/device-config-secret-redaction.js

@@ -0,0 +1,191 @@
+"use strict";
+/**
+ * Device-config secret redaction for NON-ADMIN principals.
+ *
+ * A device's `config` blob is the driver's connection record — host, port,
+ * username and, for every IP camera in the deployment, the camera's
+ * `password` in plaintext. It rides the wire on every device-manager read:
+ * `getDevice`, `listAll`, `getChildren`, and the three settings surfaces that
+ * project the same values into form fields.
+ *
+ * Those methods are declared `auth: 'protected'` (the default in
+ * `capability-definition.ts`), which is NOT admin — it is "authenticated, and
+ * scope-matched". Measured against the live hub: a `cst_*` scoped token
+ * carrying nothing but `category:system` + `view` — a READ-ONLY grant, the one
+ * the deploy runbook mints for CI — read `deviceManager.getDevice` and received
+ * `config.password` verbatim, and `deviceManager.listAll` answered with a
+ * populated password for every camera at once. Read-only access to a device
+ * list is not consent to hand over the credentials that open those cameras.
+ *
+ * WHY HERE, and not at the provider. `toDeviceInfo()` builds one `config` for
+ * everybody, and its in-process consumers need the real thing: the pipeline
+ * orchestrator's per-camera `getDevice`, dispatch routing, the drivers that
+ * actually connect. Those callers arrive through `ctx.api` / UDS and never
+ * touch this middleware, so redacting here withholds the secret from the WIRE
+ * without blinding the system to its own credentials. The transport boundary
+ * is also the only layer that knows the principal.
+ *
+ * WHY ADMINS ARE UNTOUCHED. The settings form renders the current value into a
+ * password field, and `updateConfig` is `auth: 'admin'`, so a redacted value
+ * can never be written back by a caller who received one. Making the field
+ * write-only for admins too is a bigger, UI-side change; it is not needed to
+ * close this hole and would regress the form.
+ *
+ * Share-view (`csv_*`) principals never reach this code — they are gated
+ * earlier by the fail-closed allowlist in `share-view-access.ts`, which does
+ * not expose `getDevice` at all and projects `listAll` down to seven presentation
+ * fields. This module is the gate for the tier BETWEEN a share link and an admin.
+ *
+ * Pure module — no tRPC machinery — so the spec exercises it directly (same
+ * pattern as `scope-access.ts` and `share-view-access.ts`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NON_ADMIN_CONFIG_REDACTED_METHODS = exports.REDACTED_SECRET = void 0;
+exports.isSecretConfigKey = isSecretConfigKey;
+exports.redactDeviceInfoSecrets = redactDeviceInfoSecrets;
+exports.redactSettingsSections = redactSettingsSections;
+exports.redactSettingsAggregate = redactSettingsAggregate;
+exports.redactConfigEntries = redactConfigEntries;
+/** What a non-admin sees instead of the value. Matches the `***` convention
+ *  `maskUrlCredentials` already uses for credentials in log output, so one
+ *  redaction marker means one thing across the system. */
+exports.REDACTED_SECRET = '***';
+/**
+ * Config keys whose VALUE is a credential.
+ *
+ * Deliberately the same rule the settings UI uses to decide that a field
+ * renders as a password input (`zodEntriesToConfigUI` in
+ * `packages/types/src/device/zod-to-config-ui.ts`). The two are pinned
+ * together by an assertion in `device-config-secret-redaction.spec.ts`: a
+ * keyword added to one and forgotten in the other fails the suite instead of
+ * leaking. It is duplicated rather than imported because `@camstack/types` is
+ * a framework package on the publish train, and a redaction fix must not have
+ * to wait for one.
+ */
+const SECRET_KEY_SUBSTRINGS = [
+    'password',
+    'secret',
+    'token',
+    'apikey',
+    'api_key',
+];
+/** True when a config key names a credential. Case-insensitive substring match. */
+function isSecretConfigKey(key) {
+    const lower = key.toLowerCase();
+    return SECRET_KEY_SUBSTRINGS.some((needle) => lower.includes(needle));
+}
+/** Non-null, non-array plain object. */
+function isRecord(x) {
+    return x !== null && typeof x === 'object' && !Array.isArray(x);
+}
+/**
+ * Replace the value of every credential-named key with {@link REDACTED_SECRET}.
+ *
+ * An EMPTY value stays empty: "not configured" and "configured, withheld" are
+ * different facts, and flattening them would make a broken camera look set up.
+ * A non-string value is left alone — a numeric `maxTokens` is not a secret, and
+ * the only credentials this repo persists are strings.
+ */
+function redactRecord(config) {
+    const out = {};
+    for (const [key, value] of Object.entries(config)) {
+        out[key] =
+            isSecretConfigKey(key) && typeof value === 'string' && value.length > 0
+                ? exports.REDACTED_SECRET
+                : value;
+    }
+    return out;
+}
+/**
+ * Project a `DeviceInfo` (or an array of them) with its `config` redacted.
+ * Anything that is not a device row passes through untouched — a route that
+ * errored upstream must not be rewritten into a plausible-looking shape.
+ */
+function redactDeviceInfoSecrets(data) {
+    if (Array.isArray(data))
+        return data.map((row) => redactDeviceInfoSecrets(row));
+    if (!isRecord(data))
+        return data;
+    const config = data['config'];
+    if (!isRecord(config))
+        return data;
+    return { ...data, config: redactRecord(config) };
+}
+/** One settings field as the aggregate emits it: `{ key, value, … }`. */
+function redactField(field) {
+    if (!isRecord(field))
+        return field;
+    const key = field['key'];
+    if (typeof key !== 'string' || !isSecretConfigKey(key))
+        return field;
+    const value = field['value'];
+    if (typeof value !== 'string' || value.length === 0)
+        return field;
+    return { ...field, value: exports.REDACTED_SECRET };
+}
+/**
+ * Project a `SettingsSchemaWithValues` (`{ sections: [{ fields: [...] }] }`).
+ * Used by `getDeviceSettingsAggregate` and `getSettingsSchema`.
+ */
+function redactSettingsSections(data) {
+    if (!isRecord(data))
+        return data;
+    const sections = data['sections'];
+    if (!Array.isArray(sections))
+        return data;
+    return {
+        ...data,
+        sections: sections.map((section) => {
+            if (!isRecord(section))
+                return section;
+            const fields = section['fields'];
+            if (!Array.isArray(fields))
+                return section;
+            return { ...section, fields: fields.map(redactField) };
+        }),
+    };
+}
+/**
+ * Project the combined aggregate, whose settings live one level down under
+ * `settings`. The live half carries no config blob.
+ */
+function redactSettingsAggregate(data) {
+    if (!isRecord(data))
+        return data;
+    const settings = data['settings'];
+    if (!isRecord(settings))
+        return data;
+    return { ...data, settings: redactSettingsSections(settings) };
+}
+/** Project a flat `ConfigEntry[]` — `getConfigSchema`'s `{ key, value }` rows. */
+function redactConfigEntries(data) {
+    if (!Array.isArray(data))
+        return data;
+    return data.map(redactField);
+}
+/**
+ * Every device-manager read whose response carries a device `config` blob, and
+ * the projection that cuts it.
+ *
+ * ENUMERATED rather than applied blanket-wise on purpose: a structural
+ * "redact anything credential-named" pass over every non-admin response would
+ * also strip `turnProvider.getTurnServers().credential` (the browser needs it),
+ * `auth.listShareTokens().tokenPrefix`, and a notification rule's
+ * `conditions.eventTypeTokens` — breaking live surfaces to fix a leak that
+ * lives in one cap.
+ *
+ * `deviceManager.listPersistedByAddon` is absent by inspection, not omission:
+ * `SavedDeviceRowSchema` has no `config` field, confirmed against the live hub.
+ * A new device-manager method returning `DeviceInfoSchema` must be added here —
+ * `device-config-secret-redaction.spec.ts` pins the list so the addition is a
+ * failing test rather than a silent leak.
+ */
+exports.NON_ADMIN_CONFIG_REDACTED_METHODS = new Map([
+    ['deviceManager.getDevice', redactDeviceInfoSecrets],
+    ['deviceManager.listAll', redactDeviceInfoSecrets],
+    ['deviceManager.getChildren', redactDeviceInfoSecrets],
+    ['deviceManager.getDeviceSettingsAggregate', redactSettingsSections],
+    ['deviceManager.getSettingsSchema', redactSettingsSections],
+    ['deviceManager.getDeviceAggregate', redactSettingsAggregate],
+    ['deviceManager.getConfigSchema', redactConfigEntries],
+]);

package/dist/api/trpc/share-view-access.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHARE_SCOPE_PROJECTED_METHODS = void 0;
 exports.checkShareViewAccess = checkShareViewAccess;
 exports.projectListAllForShareScope = projectListAllForShareScope;
+exports.projectShareScopeRows = projectShareScopeRows;
 exports.liveEventInShareScope = liveEventInShareScope;
 /**
  * Methods callable WITHOUT a per-device check — their input carries no
@@ -37,7 +39,95 @@ function extractDeviceId(input) {
     const candidate = Reflect.get(input, 'deviceId');
     return typeof candidate === 'number' && Number.isFinite(candidate) ? candidate : null;
 }
+/**
+ * The EVENTS embed's real call graph (`events-client.ts` in the embed):
+ *   • `auth.me`                                — SDK boot/auth probe
+ *   • `deviceManager.listAll`                  — camera names + the "all
+ *     cameras" resolution (already projected to the scope)
+ *   • `pipelineAnalytics.listRecentTracks`     — the feed itself
+ *   • `pipelineAnalytics.listEventKindsBatch`  — the class→macro taxonomy
+ *   • `pipelineAnalytics.searchObjectEvents`   — CLIP text search
+ *
+ * Intentionally NOT here: everything the grid link gets (WebRTC signalling,
+ * snapshots, TURN, camera metrics) — a shared events page is not a camera
+ * wall — and every mutating analytics method (`deleteTracks`, `setTrackFlags`,
+ * the retrain surface, the export planes).
+ */
+const EVENTS_VIEW_OPEN_METHODS = new Set(['auth.me', 'deviceManager.listAll']);
+/**
+ * Methods whose input carries a `deviceIds` ARRAY. The rule is INTERSECTION,
+ * and the outcome is FILTER-AND-SERVE: a request that names at least one
+ * in-scope device passes, and the RESPONSE is stripped to the scope by
+ * {@link projectShareScopeRows}.
+ *
+ * Filter rather than reject, because a multi-camera link whose owner later
+ * narrowed the share must keep working for the cameras it still covers —
+ * rejecting the whole page would break the link on a change that only removed
+ * one camera. A FULLY disjoint request is still denied: there is nothing to
+ * serve, and answering `[]` would read as "these cameras had no events" rather
+ * than "you cannot see these cameras".
+ */
+const EVENTS_VIEW_DEVICE_ARRAY_METHODS = new Set([
+    'pipelineAnalytics.listRecentTracks',
+    'pipelineAnalytics.listEventKindsBatch',
+]);
+/**
+ * Methods whose input carries an OPTIONAL single `deviceId`, where omitting it
+ * means EVERY camera in the deployment.
+ *
+ * A present id must be in scope. An ABSENT id is allowed — and that is safe
+ * only because the response is filtered server-side
+ * ({@link projectShareScopeRows}); the caller is never trusted to have scoped
+ * its own query. Rejecting the absent case instead would leave a multi-camera
+ * share link unable to search at all, and would not be one bit safer.
+ */
+const EVENTS_VIEW_OPTIONAL_DEVICE_METHODS = new Set([
+    'pipelineAnalytics.searchObjectEvents',
+]);
+/** Pull a `deviceIds` array off a raw tRPC input. Null when absent/malformed. */
+function extractDeviceIds(input) {
+    if (input === null || typeof input !== 'object')
+        return null;
+    const candidate = Reflect.get(input, 'deviceIds');
+    if (!Array.isArray(candidate))
+        return null;
+    const ids = candidate.filter((x) => typeof x === 'number' && Number.isFinite(x));
+    return ids.length === candidate.length ? ids : null;
+}
+function checkEventsViewAccess(scope, path, input) {
+    if (EVENTS_VIEW_OPEN_METHODS.has(path)) {
+        return { ok: true };
+    }
+    if (EVENTS_VIEW_DEVICE_ARRAY_METHODS.has(path)) {
+        const requested = extractDeviceIds(input);
+        if (requested === null || requested.length === 0) {
+            return { ok: false, reason: `'${path}' requires a deviceIds array for share-view access` };
+        }
+        const allowed = new Set(scope.deviceIds);
+        if (!requested.some((id) => allowed.has(id))) {
+            return {
+                ok: false,
+                reason: `Devices ${requested.join(', ')} are outside this share link's scope`,
+            };
+        }
+        return { ok: true };
+    }
+    if (EVENTS_VIEW_OPTIONAL_DEVICE_METHODS.has(path)) {
+        const deviceId = extractDeviceId(input);
+        // Absent = every camera; the RESPONSE filter is what scopes it.
+        if (deviceId === null)
+            return { ok: true };
+        if (!scope.deviceIds.includes(deviceId)) {
+            return { ok: false, reason: `Device ${deviceId} is outside this share link's scope` };
+        }
+        return { ok: true };
+    }
+    return { ok: false, reason: `'${path}' is not available to share-view tokens` };
+}
 function checkShareViewAccess(scope, path, input) {
+    if (scope.kind === 'events-view') {
+        return checkEventsViewAccess(scope, path, input);
+    }
     if (scope.kind !== 'grid-view') {
         return { ok: false, reason: `Unknown share scope kind '${String(scope.kind)}'` };
     }
@@ -88,6 +178,58 @@ function projectListAllForShareScope(data, scope) {
     }
     return rows;
 }
+/**
+ * Strip every row a share token may not see, by `deviceId`.
+ *
+ * This is the half that makes the events surface safe, and it is not
+ * defence-in-depth — it is the ACTUAL enforcement for two of the three
+ * methods:
+ *
+ *  - `searchObjectEvents` with no `deviceId` searches the whole deployment.
+ *    The call is allowed (see the enumeration) precisely because the answer is
+ *    cut here; trusting the caller to scope its own query would be trusting a
+ *    URL a third party is holding.
+ *  - `listRecentTracks` / `listEventKindsBatch` pass the intersection check, so
+ *    a partially in-scope request reaches the provider — and comes back with
+ *    rows the link may not see. Those are removed here.
+ *
+ * Two payload shapes, because the methods answer differently: a bare array of
+ * rows (`searchObjectEvents`, `listEventKindsBatch`) and a PAGED envelope
+ * (`listRecentTracks` → `{tracks, nextCursor}`). The cursor is preserved —
+ * dropping it would silently end a shared page's infinite scroll at page one.
+ *
+ * A row with NO numeric `deviceId` is DROPPED, never kept: "it probably
+ * belongs to a device in scope" is not a security argument.
+ *
+ * Anything that is not a row payload passes through untouched (the route
+ * errored upstream, and rewriting an error into `[]` would hide it).
+ */
+function projectShareScopeRows(data, scope) {
+    const allowed = new Set(scope.deviceIds);
+    const keep = (row) => {
+        if (row === null || typeof row !== 'object')
+            return false;
+        const id = Reflect.get(row, 'deviceId');
+        return typeof id === 'number' && allowed.has(id);
+    };
+    if (Array.isArray(data))
+        return data.filter(keep);
+    if (data !== null && typeof data === 'object') {
+        const tracks = Reflect.get(data, 'tracks');
+        if (Array.isArray(tracks)) {
+            return { ...data, tracks: tracks.filter(keep) };
+        }
+    }
+    return data;
+}
+/** Paths whose RESPONSE must be cut to the share scope before it leaves the
+ *  server. Kept beside the enumeration so a method added to one and forgotten
+ *  in the other is visible in a single file. */
+exports.SHARE_SCOPE_PROJECTED_METHODS = new Set([
+    'pipelineAnalytics.listRecentTracks',
+    'pipelineAnalytics.listEventKindsBatch',
+    'pipelineAnalytics.searchObjectEvents',
+]);
 /**
  * Whether a live event belongs to a device inside the share scope.
  * Matches the device identity two ways (fail closed — no match, no push):

package/dist/api/trpc/trpc.middleware.js

@@ -6,12 +6,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.agentProcedure = exports.adminProcedure = exports.protectedProcedure = exports.createCallerFactory = exports.publicProcedure = exports.trpcRouter = void 0;
 exports.iterableSubscription = iterableSubscription;
 exports.iterableInterval = iterableInterval;
+const system_1 = require("@camstack/system");
 const server_1 = require("@trpc/server");
 const superjson_1 = __importDefault(require("superjson"));
-const system_1 = require("@camstack/system");
+const cap_route_error_formatter_js_1 = require("./cap-route-error-formatter.js");
+const device_config_secret_redaction_js_1 = require("./device-config-secret-redaction.js");
 const scope_access_js_1 = require("./scope-access.js");
 const share_view_access_js_1 = require("./share-view-access.js");
-const cap_route_error_formatter_js_1 = require("./cap-route-error-formatter.js");
 const t = server_1.initTRPC.context().create({
     transformer: superjson_1.default,
     errorFormatter: cap_route_error_formatter_js_1.formatTrpcError,
@@ -114,6 +115,20 @@ exports.protectedProcedure = t.procedure.use(async ({ ctx, next, path, getRawInp
             }
             return out;
         }
+        // The events surface answers with ROWS carrying a `deviceId`, and two of
+        // its three methods can legitimately reach devices outside the scope: a
+        // partially in-scope `listRecentTracks`, and a `searchObjectEvents` with
+        // no `deviceId` at all (which means EVERY camera). The enumeration lets
+        // those calls through — this is where the answer is cut. Without it the
+        // allowlist would be a doorman who checks the ticket and then hands over
+        // the whole building.
+        if (share_view_access_js_1.SHARE_SCOPE_PROJECTED_METHODS.has(path)) {
+            const out = await next({ ctx: { ...ctx, user: ctx.user } });
+            if (out.ok) {
+                return { ...out, data: (0, share_view_access_js_1.projectShareScopeRows)(out.data, ctx.user.shareView.scope) };
+            }
+            return out;
+        }
         return next({ ctx: { ...ctx, user: ctx.user } });
     }
     // Spread+reassign of `user` narrows downstream ctx from `User | null`
@@ -122,23 +137,37 @@ exports.protectedProcedure = t.procedure.use(async ({ ctx, next, path, getRawInp
     if (ctx.user.isAdmin) {
         return next({ ctx: { ...ctx, user: ctx.user } });
     }
-    // Hand-written core route — no cap entry. Authentication has already
-    // passed; defer further gating to any explicit `adminProcedure`
-    // chained on top of this one.
-    if (!(path in system_1.METHOD_ACCESS_MAP)) {
-        return next({ ctx: { ...ctx, user: ctx.user } });
+    // Everything below this line is a NON-ADMIN principal.
+    //
+    // A hand-written core route has no cap entry. Authentication has
+    // already passed; defer further gating to any explicit
+    // `adminProcedure` chained on top of this one. A cap route is
+    // scope-matched first.
+    if (path in system_1.METHOD_ACCESS_MAP) {
+        // Device-scope caps may be gated by a `device:N` scope. Resolve the
+        // raw input once so the matcher can read `input.deviceId` without
+        // re-doing the Zod parse (tRPC caches the parsed input downstream).
+        // The `getDeviceAncestors` hook lets the matcher walk parent → child
+        // accessory inheritance (grant on Reolink also covers its siren / PIR).
+        const rawInput = await getRawInput();
+        const result = (0, scope_access_js_1.checkScopeAccess)(ctx.user.scopes ?? [], path, rawInput, ctx.getDeviceAncestors);
+        if (!result.ok) {
+            throw new server_1.TRPCError({ code: 'FORBIDDEN', message: result.reason });
+        }
     }
-    // Device-scope caps may be gated by a `device:N` scope. Resolve the
-    // raw input once so the matcher can read `input.deviceId` without
-    // re-doing the Zod parse (tRPC caches the parsed input downstream).
-    // The `getDeviceAncestors` hook lets the matcher walk parent → child
-    // accessory inheritance (grant on Reolink also covers its siren / PIR).
-    const rawInput = await getRawInput();
-    const result = (0, scope_access_js_1.checkScopeAccess)(ctx.user.scopes ?? [], path, rawInput, ctx.getDeviceAncestors);
-    if (!result.ok) {
-        throw new server_1.TRPCError({ code: 'FORBIDDEN', message: result.reason });
+    // A non-admin who is allowed to READ a device is not thereby allowed to
+    // read the credential that opens it. `deviceManager.getDevice` &co. are
+    // `auth: 'protected'`, so a read-only `category:system` grant reaches
+    // them — and the raw row carries `config.password` in plaintext for
+    // every camera in the deployment. The value is withheld HERE, at the
+    // transport boundary, so in-process callers (`ctx.api`, the pipeline
+    // orchestrator, the drivers that must actually connect) are unaffected.
+    const redactConfigSecrets = device_config_secret_redaction_js_1.NON_ADMIN_CONFIG_REDACTED_METHODS.get(path);
+    const out = await next({ ctx: { ...ctx, user: ctx.user } });
+    if (redactConfigSecrets && out.ok) {
+        return { ...out, data: redactConfigSecrets(out.data) };
     }
-    return next({ ctx: { ...ctx, user: ctx.user } });
+    return out;
 });
 /**
  * Destructive-ops gate. Adds an explicit admin check on top of

package/dist/core/auth/share-token.service.js

@@ -69,12 +69,25 @@ exports.SHARE_TOKEN_TTL_MAX_SEC = 30 * 24 * 60 * 60; // 30 days
 exports.SHARE_TOKEN_TTL_DEFAULT_SEC = 7 * 24 * 60 * 60; // 7 days
 exports.SHARE_TOKEN_MAX_DEVICES = 64;
 /**
- * What a share token is allowed to see. Discriminated on `kind` so future
- * share surfaces (single-camera view, recording clip, …) extend the union
- * without touching verification plumbing.
+ * What a share token is allowed to see. Keyed on `kind` so future share
+ * surfaces (single-camera view, recording clip, …) extend the set without
+ * touching verification plumbing.
+ */
+/**
+ * `grid-view` — the live camera wall (WebRTC + snapshots).
+ * `events-view` — the events embed (track feed, kind taxonomy, CLIP search).
+ *
+ * They are SEPARATE kinds, not one kind with a bigger surface. Adding the
+ * track methods to `grid-view` would retroactively widen every share link an
+ * operator has already handed out: a link minted to show a camera wall would
+ * silently start serving that camera's event history. A token keeps the
+ * perimeter it was minted with, and a new perimeter needs a new mint.
+ *
+ * Neither kind is a superset of the other — an events link cannot open a
+ * WebRTC session, and a grid link cannot read a track.
  */
 exports.ShareTokenScopeSchema = zod_1.z.object({
-    kind: zod_1.z.literal('grid-view'),
+    kind: zod_1.z.enum(['grid-view', 'events-view']),
     deviceIds: zod_1.z.array(zod_1.z.number().int().nonnegative()).min(1).max(exports.SHARE_TOKEN_MAX_DEVICES),
 });
 /** Persisted record — never leaves the server with `tokenHash` attached. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.77",
+  "version": "1.2.79",
   "private": false,
   "files": [
     "dist",
@@ -33,19 +33,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.37",
+    "@camstack/addon-admin-ui": "1.2.39",
     "@camstack/addon-agent-ui": "1.2.10",
     "@camstack/addon-auth": "1.2.11",
     "@camstack/addon-decoder-nodeav": "1.2.9",
     "@camstack/addon-notifiers": "1.2.13",
-    "@camstack/addon-pipeline": "1.2.48",
-    "@camstack/addon-pipeline-orchestrator": "1.2.31",
-    "@camstack/addon-post-analysis": "1.2.53",
+    "@camstack/addon-pipeline": "1.2.51",
+    "@camstack/addon-pipeline-orchestrator": "1.2.33",
+    "@camstack/addon-post-analysis": "1.2.54",
     "@camstack/sdk": "1.2.10",
     "@camstack/shm-ring": "1.1.9",
-    "@camstack/system": "1.2.63",
-    "@camstack/types": "1.2.47",
-    "@camstack/ui-library": "1.2.35",
+    "@camstack/system": "1.2.66",
+    "@camstack/types": "1.2.50",
+    "@camstack/ui-library": "1.2.36",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",