@camstack/server 1.2.79 → 1.2.81

package/dist/api/oauth2/oauth2-routes.js

@@ -7,6 +7,43 @@ exports.registerOauth2Routes = registerOauth2Routes;
 const session_cookie_js_1 = require("../../auth/session-cookie.js");
 const consent_page_js_1 = require("./consent-page.js");
 const private_host_js_1 = require("./private-host.js");
+/** Longest caller-supplied `integration` value echoed back in an error. */
+const MAX_ECHOED_INTEGRATION_LEN = 100;
+/** Render the received `integration` for a human, bounded. */
+function describeReceivedIntegration(raw) {
+    if (raw === undefined)
+        return null;
+    const joined = typeof raw === 'string' ? raw : raw.join(',');
+    if (joined === '')
+        return null;
+    return joined.length > MAX_ECHOED_INTEGRATION_LEN
+        ? `${joined.slice(0, MAX_ECHOED_INTEGRATION_LEN)}…`
+        : joined;
+}
+/**
+ * Resolve the `integration` parameter to a single id.
+ *
+ * A repeat carrying ONE distinct value is collapsed rather than refused:
+ * every layer that parses the query — proxy, framework, app — necessarily
+ * agrees on the value, so there is no parameter-pollution ambiguity to
+ * protect against, and refusing would strand a client whose request is
+ * merely redundant. A repeat whose values DISAGREE is exactly that
+ * ambiguity, and is refused.
+ */
+function resolveIntegrationParam(raw) {
+    if (raw === undefined)
+        return { ok: false, reason: 'missing' };
+    if (typeof raw === 'string') {
+        return raw === '' ? { ok: false, reason: 'missing' } : { ok: true, value: raw };
+    }
+    const distinct = [...new Set(raw.filter((v) => v !== ''))];
+    const [first] = distinct;
+    if (first === undefined)
+        return { ok: false, reason: 'missing' };
+    if (distinct.length > 1)
+        return { ok: false, reason: 'conflicting-repeat' };
+    return { ok: true, value: first };
+}
 /** Validate the inbound authorize query. `client_id` is intentionally
  *  NOT checked — that pair is verified only at the Lambda boundary, and a
  *  PUBLIC client (`requiresPkce`) has no secret to check it against at all;
@@ -14,9 +51,24 @@ const private_host_js_1 = require("./private-host.js");
 function validateAuthorizeQuery(q, knownIntegrations) {
     if (q.response_type !== 'code')
         return { ok: false, status: 400, error: 'unsupported_response_type' };
-    const policy = q.integration ? knownIntegrations.get(q.integration) : undefined;
-    if (!q.integration || !policy)
-        return { ok: false, status: 400, error: 'invalid_request — unknown integration' };
+    // Three distinct client faults used to collapse into one opaque string.
+    // Alexa linking was down for a day because the message named neither what
+    // arrived nor what would have been accepted.
+    const detail = {
+        received: describeReceivedIntegration(q.integration),
+        known_integrations: [...knownIntegrations.keys()],
+    };
+    const param = resolveIntegrationParam(q.integration);
+    if (!param.ok) {
+        const error = param.reason === 'missing'
+            ? 'invalid_request — integration parameter missing'
+            : 'invalid_request — integration parameter repeated with conflicting values';
+        return { ok: false, status: 400, error, detail };
+    }
+    const policy = knownIntegrations.get(param.value);
+    if (!policy) {
+        return { ok: false, status: 400, error: 'invalid_request — unknown integration', detail };
+    }
     if (!q.redirect_uri)
         return { ok: false, status: 400, error: 'invalid_request — redirect_uri required' };
     if (!q.state)
@@ -32,7 +84,7 @@ function validateAuthorizeQuery(q, knownIntegrations) {
     }
     return {
         ok: true,
-        integration: q.integration,
+        integration: param.value,
         redirectUri: q.redirect_uri,
         state: q.state,
         codeChallenge: challenge,
@@ -76,6 +128,20 @@ function summariseScopes(scopes) {
     }
     return scopes.map((s) => s.type).join(', ') || 'no permissions';
 }
+/** A refused `/authorize`. Logged at `warn` and echoed to the caller: both
+ *  halves name the value that ARRIVED and the ids that would have worked, so
+ *  neither the operator nor the log reader has to guess which of them is
+ *  wrong. */
+function refuseAuthorize(reply, logger, method, refusal) {
+    logger.warn(`oauth2 authorize refused: ${refusal.error}`, {
+        meta: {
+            method,
+            received: refusal.detail?.received ?? null,
+            knownIntegrations: refusal.detail?.known_integrations ?? [],
+        },
+    });
+    return reply.status(refusal.status).send({ error: refusal.error, ...refusal.detail });
+}
 /** Build a map of integrationId → descriptor from all registered oauth-integration providers. */
 async function buildIntegrationMap(registry) {
     const entries = registry.getCollectionEntries('oauth-integration');
@@ -137,10 +203,19 @@ function registerOauth2Routes(fastify, deps) {
         const query = request.query;
         const v = validateAuthorizeQuery(query, descriptorMap);
         if (!v.ok) {
-            return reply.status(v.status).send({ error: v.error });
+            return refuseAuthorize(reply, deps.logger, 'GET', v);
         }
         const descriptor = descriptorMap.get(v.integration);
         if (!isRedirectUriAllowed(v.redirectUri, descriptor.allowedRedirectPrefixes, descriptor.allowedPrivateHostPaths ?? [])) {
+            deps.logger.warn('oauth2 authorize refused: redirect_uri not allowed', {
+                meta: {
+                    method: 'GET',
+                    integration: v.integration,
+                    redirectUri: v.redirectUri,
+                    allowedPrefixes: descriptor.allowedRedirectPrefixes,
+                    allowedPrivateHostPaths: descriptor.allowedPrivateHostPaths ?? [],
+                },
+            });
             return reply
                 .status(400)
                 .send({ error: 'invalid_request — redirect_uri not allowed for this integration' });
@@ -223,10 +298,19 @@ function registerOauth2Routes(fastify, deps) {
         // and every one of them is attacker-editable.
         const v = validateAuthorizeQuery(formQuery, descriptorMap);
         if (!v.ok) {
-            return reply.status(v.status).send({ error: v.error });
+            return refuseAuthorize(reply, deps.logger, 'POST', v);
         }
         const descriptor = descriptorMap.get(v.integration);
         if (!isRedirectUriAllowed(v.redirectUri, descriptor.allowedRedirectPrefixes, descriptor.allowedPrivateHostPaths ?? [])) {
+            deps.logger.warn('oauth2 authorize refused: redirect_uri not allowed', {
+                meta: {
+                    method: 'POST',
+                    integration: v.integration,
+                    redirectUri: v.redirectUri,
+                    allowedPrefixes: descriptor.allowedRedirectPrefixes,
+                    allowedPrivateHostPaths: descriptor.allowedPrivateHostPaths ?? [],
+                },
+            });
             return reply
                 .status(400)
                 .send({ error: 'invalid_request — redirect_uri not allowed for this integration' });

package/dist/api/trpc/cap-router-runtime.js

@@ -181,9 +181,43 @@ function createCapRouterServices(deps) {
                 return reg?.getSingleton(capName) ?? null;
         }
     };
+    /**
+     * An explicit `{ addonId }` collection pin that no registered provider owns
+     * must REFUSE — never degrade into another provider's answer.
+     *
+     * The hole this closes: `getProviderByAddonId` returns null for an unknown
+     * id, which the router could not tell apart from "this cap is resident in a
+     * forked hub worker", so it fell through to `remoteProxy(cap, 'hub')` and
+     * answered from the FIRST hub-side provider. Measured live: a fabricated
+     * `addonId` on `deviceExport.getStatus` returned Alexa's `linked / 3`. The
+     * Home Assistant component pins `homeassistant-export` precisely to avoid
+     * the merged aggregate — one missing/renamed/undeployed addon and it would
+     * have silently imported Alexa's devices while looking like success.
+     *
+     * Refuses ONLY when the cap has providers and none matches: with zero local
+     * providers the fallthrough is the legitimate forked-worker route and stays.
+     */
+    const rejectUnresolvedAddonPin = (capName, addonId) => {
+        if (!reg)
+            return;
+        const known = reg.getProviderAddonIds(capName);
+        if (known.length === 0)
+            return;
+        deps.logger?.warn('Refusing cap call: pinned addonId is not a provider of this capability', {
+            tags: { addonId },
+            meta: { capability: capName, validAddonIds: [...known] },
+        });
+        throw new server_1.TRPCError({
+            code: 'BAD_REQUEST',
+            message: `Capability "${capName}" has no provider with addonId "${addonId}". ` +
+                `Valid addonId(s): ${known.join(', ')}. ` +
+                `An unresolvable addonId is refused rather than answered by another provider.`,
+        });
+    };
     return {
         getLocalProvider,
         remoteProxy,
+        rejectUnresolvedAddonPin,
         noProvider: (capName, nodeId) => {
             if (nodeId !== undefined && nodeId !== 'hub') {
                 throw new server_1.TRPCError({

package/dist/api/trpc/generated-cap-routers.js

@@ -7794,6 +7794,15 @@ function createCapRouter_snapshot(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.getSnapshotOverview(methodInput);
         }),
+        getSnapshotLinks: trpc_middleware_js_1.protectedProcedure
+            .input(types_98.snapshotCapability.methods.getSnapshotLinks.input.loose())
+            .output(types_98.snapshotCapability.methods.getSnapshotLinks.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('snapshot', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.getSnapshotLinks(methodInput);
+        }),
     });
 }
 function createCapRouter_ssoBridge(getProvider, createRemoteProxy) {

package/dist/api/trpc/trpc.router.js

@@ -243,6 +243,7 @@ function buildCapabilityRouters(services) {
         capabilityRegistry: services.capabilityRegistry,
         moleculer: services.moleculer,
         serverProviders: buildServerProviders(services),
+        logger: services.loggingService.createLogger('cap-router'),
     });
     return {
         // ── Runtime-built cap routers: EVERY cap whose mount is

package/dist/core/addon/addon-registry.service.js

@@ -55,6 +55,7 @@ const fs = __importStar(require("node:fs"));
 const node_url_1 = require("node:url");
 const require_cache_js_1 = require("./require-cache.js");
 const addon_settings_provider_js_1 = require("./addon-settings-provider.js");
+const integration_visibility_js_1 = require("./integration-visibility.js");
 const addon_call_gateway_js_1 = require("./addon-call-gateway.js");
 const system_6 = require("@camstack/system");
 const types_2 = require("@camstack/types");
@@ -1053,73 +1054,20 @@ class AddonRegistryService {
     getRawIntegrationRegistry() {
         return this.integrationRegistry;
     }
+    /**
+     * The installed-addon VIEW over the integration store. The rule it enforces
+     * — a principal that cannot read an integration must not create one, and a
+     * read that hides an existing row says so — lives in
+     * `integration-visibility.ts`, on its own, with its own tests.
+     */
     createFilteredRegistry(raw) {
-        const installedAddonIds = new Set(this.addonEntries.keys());
-        // Build set of integration IDs whose addon IS installed
-        // Cache per call — lightweight, called infrequently
-        let activeIntegrationIds = null;
-        const ensureActiveIds = async () => {
-            if (activeIntegrationIds)
-                return activeIntegrationIds;
-            const all = await raw.listIntegrations();
-            activeIntegrationIds = new Set(all.filter((i) => installedAddonIds.has(i.addonId)).map((i) => i.id));
-            return activeIntegrationIds;
-        };
-        return {
-            // Integrations: filter out orphaned
-            createIntegration: (input) => raw.createIntegration(input),
-            getIntegration: async (id) => {
-                const i = await raw.getIntegration(id);
-                return i && installedAddonIds.has(i.addonId) ? i : null;
-            },
-            getIntegrationByAddonId: async (addonId) => {
-                if (!installedAddonIds.has(addonId))
-                    return null;
-                return raw.getIntegrationByAddonId(addonId);
-            },
-            listIntegrations: async () => {
-                const all = await raw.listIntegrations();
-                return all.filter((i) => installedAddonIds.has(i.addonId));
-            },
-            updateIntegration: (id, updates) => raw.updateIntegration(id, updates),
-            deleteIntegration: (id) => raw.deleteIntegration(id),
-            // Integration settings: passthrough (already gated by getIntegration)
-            getIntegrationSettings: (id) => raw.getIntegrationSettings(id),
-            setIntegrationSetting: (id, key, value) => raw.setIntegrationSetting(id, key, value),
-            setIntegrationSettings: (id, settings) => raw.setIntegrationSettings(id, settings),
-            // Devices: filter out devices belonging to orphaned integrations
-            createDevice: (input) => raw.createDevice(input),
-            getDevice: async (id) => {
-                const d = await raw.getDevice(id);
-                if (!d)
-                    return null;
-                const ids = await ensureActiveIds();
-                return ids.has(d.integrationId) ? d : null;
-            },
-            getDeviceByStableId: async (stableId) => {
-                const d = await raw.getDeviceByStableId(stableId);
-                if (!d)
-                    return null;
-                const ids = await ensureActiveIds();
-                return ids.has(d.integrationId) ? d : null;
-            },
-            listDevices: async (integrationId) => {
-                const devices = await raw.listDevices(integrationId);
-                const ids = await ensureActiveIds();
-                return devices.filter((d) => ids.has(d.integrationId));
-            },
-            listCameras: async () => {
-                const cameras = await raw.listCameras();
-                const ids = await ensureActiveIds();
-                return cameras.filter((d) => ids.has(d.integrationId));
-            },
-            updateDevice: (id, updates) => raw.updateDevice(id, updates),
-            deleteDevice: (id) => raw.deleteDevice(id),
-            // Device settings: passthrough
-            getDeviceSettings: (id) => raw.getDeviceSettings(id),
-            setDeviceSetting: (id, key, value) => raw.setDeviceSetting(id, key, value),
-            setDeviceSettings: (id, settings) => raw.setDeviceSettings(id, settings),
-        };
+        return (0, integration_visibility_js_1.createFilteredIntegrationRegistry)({
+            raw,
+            // The LIVE map, not a snapshot: an addon registered after this wrapper
+            // was built is installed, and a stale copy would refuse its first write.
+            isAddonInstalled: (addonId) => this.addonEntries.has(addonId),
+            logger: this.logger,
+        });
     }
     // InferenceCapabilitiesService removed — now lives in pipeline-executor addon.
     // Use capabilityRegistry.getSingleton('pipeline-executor') instead.

package/dist/core/addon/integration-visibility.js

@@ -0,0 +1,142 @@
+"use strict";
+/**
+ * Who may see, and who may mint, an integration.
+ *
+ * The integration store is shared by every addon on the node, so the registry
+ * handed out to callers is a VIEW: rows whose declaring addon is not installed
+ * are hidden, and the data stays in the database so a reinstall reconnects to
+ * it rather than starting empty.
+ *
+ * That filter had a hole, and it was the silent, accumulating kind. Extracted
+ * here verbatim from `AddonRegistryService.createFilteredRegistry` so the rule
+ * is testable on its own.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createFilteredIntegrationRegistry = createFilteredIntegrationRegistry;
+const types_1 = require("@camstack/types");
+/**
+ * Wrap `raw` in the installed-addon view.
+ *
+ * Two rules, and they are the same rule read in both directions:
+ *
+ * 1. **A principal that cannot READ an integration may not CREATE one.**
+ *    Until this guard existed, `createIntegration` was the only unfiltered
+ *    entry point in the whole surface. A core block — addon id
+ *    `core-block-<uuid>`, never in the installed set — therefore minted a fresh
+ *    row on EVERY start: `getIntegrationByAddonId` answered null forever, so
+ *    the get-or-create above it never found what it had just made.
+ *    `listIntegrations` hid the row from the operator and `integrations.delete`
+ *    answered *"not found"* for the same reason, so nothing could ever remove
+ *    it. Measured on the live hub: `int_0021` and `int_0022`, two starts of one
+ *    block, invisible and undeletable. A declarer that is not an installed
+ *    addon hangs its devices off an integration somebody else owns —
+ *    `DeclaredDevicesSpec.integrationId`.
+ *
+ * 2. **Hidden is not absent.** A read that suppresses a row that EXISTS logs
+ *    it. Both branches returned a bare `null`, and that indistinguishability is
+ *    precisely what kept rule 1's breach invisible for as long as it lasted.
+ */
+function createFilteredIntegrationRegistry(deps) {
+    const { raw, logger } = deps;
+    // A co-located builtin's `ctx.id` is `addon:<manifest id>`; every registry
+    // key is bare (D72). Normalise on the way in, or the create guard rejects
+    // exactly the builtins that legitimately declare an integration.
+    const isInstalled = (addonId) => deps.isAddonInstalled((0, types_1.bareAddonId)(addonId));
+    // Integration ids whose addon IS installed. Cached per wrapper — these
+    // wrappers are built per `getIntegrationRegistry()` call, so the cache never
+    // outlives a request path.
+    let activeIntegrationIds = null;
+    const ensureActiveIds = async () => {
+        if (activeIntegrationIds)
+            return activeIntegrationIds;
+        const all = await raw.listIntegrations();
+        activeIntegrationIds = new Set(all.filter((i) => isInstalled(i.addonId)).map((i) => i.id));
+        return activeIntegrationIds;
+    };
+    /** The suppression log line. Only ever called when the row EXISTS. */
+    const logHidden = (integration, phase) => {
+        logger.warn('integration hidden — its addon is not installed, so this read answers null even though the row exists', {
+            tags: { integrationId: integration.id, addonId: integration.addonId },
+            meta: { phase, name: integration.name },
+        });
+    };
+    const createIntegration = async (input) => {
+        if (!isInstalled(input.addonId)) {
+            // Refuse, loudly. The alternative is not "it works": it is a row this
+            // same wrapper will hide from every later read, from the operator's list
+            // and from delete — the row can only accumulate.
+            logger.error('refused to mint an integration for a principal that cannot read one', {
+                tags: { addonId: input.addonId },
+                meta: { phase: 'create', name: input.name },
+            });
+            throw new Error(`addon "${input.addonId}" is not installed, so it cannot read an integration — ` +
+                'and a principal that cannot read one must not create one (it would be invisible ' +
+                'and undeletable). Hang the devices off an existing integration instead: ' +
+                'DeclaredDevicesSpec.integrationId.');
+        }
+        return raw.createIntegration(input);
+    };
+    return {
+        createIntegration,
+        getIntegration: async (id) => {
+            const i = await raw.getIntegration(id);
+            if (i === null)
+                return null;
+            if (isInstalled(i.addonId))
+                return i;
+            logHidden(i, 'getIntegration');
+            return null;
+        },
+        getIntegrationByAddonId: async (addonId) => {
+            const i = await raw.getIntegrationByAddonId(addonId);
+            if (i === null)
+                return null;
+            if (isInstalled(i.addonId))
+                return i;
+            logHidden(i, 'getIntegrationByAddonId');
+            return null;
+        },
+        listIntegrations: async () => {
+            const all = await raw.listIntegrations();
+            return all.filter((i) => isInstalled(i.addonId));
+        },
+        updateIntegration: (id, updates) => raw.updateIntegration(id, updates),
+        deleteIntegration: (id) => raw.deleteIntegration(id),
+        // Integration settings: passthrough (already gated by getIntegration)
+        getIntegrationSettings: (id) => raw.getIntegrationSettings(id),
+        setIntegrationSetting: (id, key, value) => raw.setIntegrationSetting(id, key, value),
+        setIntegrationSettings: (id, settings) => raw.setIntegrationSettings(id, settings),
+        // Devices: filter out devices belonging to hidden integrations
+        createDevice: (input) => raw.createDevice(input),
+        getDevice: async (id) => {
+            const d = await raw.getDevice(id);
+            if (!d)
+                return null;
+            const ids = await ensureActiveIds();
+            return ids.has(d.integrationId) ? d : null;
+        },
+        getDeviceByStableId: async (stableId) => {
+            const d = await raw.getDeviceByStableId(stableId);
+            if (!d)
+                return null;
+            const ids = await ensureActiveIds();
+            return ids.has(d.integrationId) ? d : null;
+        },
+        listDevices: async (integrationId) => {
+            const devices = await raw.listDevices(integrationId);
+            const ids = await ensureActiveIds();
+            return devices.filter((d) => ids.has(d.integrationId));
+        },
+        listCameras: async () => {
+            const cameras = await raw.listCameras();
+            const ids = await ensureActiveIds();
+            return cameras.filter((d) => ids.has(d.integrationId));
+        },
+        updateDevice: (id, updates) => raw.updateDevice(id, updates),
+        deleteDevice: (id) => raw.deleteDevice(id),
+        // Device settings: passthrough
+        getDeviceSettings: (id) => raw.getDeviceSettings(id),
+        setDeviceSetting: (id, key, value) => raw.setDeviceSetting(id, key, value),
+        setDeviceSettings: (id, settings) => raw.setDeviceSettings(id, settings),
+    };
+}

package/dist/main.js

@@ -958,6 +958,10 @@ async function bootstrap() {
             getRegistry: () => capabilityRegistry,
             verifyToken: (t) => authService.verifyToken(t),
             publicHubUrl: () => process.env.CAMSTACK_PUBLIC_ORIGIN ?? `https://localhost:${port}`,
+            // Every /authorize refusal is a dropped account-linking attempt. Without
+            // this scope the drop is invisible in Loki and the only signal left is an
+            // operator noticing that linking stopped working.
+            logger: app.get(logging_service_1.LoggingService).createLogger('oauth2'),
         });
         console.log('[bootstrap] OAuth2 routes registered at /api/oauth2/*');
         // Attach tRPC WebSocket handler using noServer mode to avoid

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.79",
+  "version": "1.2.81",
   "private": false,
   "files": [
     "dist",
@@ -33,19 +33,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.39",
+    "@camstack/addon-admin-ui": "1.2.40",
     "@camstack/addon-agent-ui": "1.2.10",
     "@camstack/addon-auth": "1.2.11",
     "@camstack/addon-decoder-nodeav": "1.2.9",
     "@camstack/addon-notifiers": "1.2.13",
-    "@camstack/addon-pipeline": "1.2.51",
+    "@camstack/addon-pipeline": "1.2.52",
     "@camstack/addon-pipeline-orchestrator": "1.2.33",
-    "@camstack/addon-post-analysis": "1.2.54",
+    "@camstack/addon-post-analysis": "1.2.56",
     "@camstack/sdk": "1.2.10",
     "@camstack/shm-ring": "1.1.9",
-    "@camstack/system": "1.2.66",
-    "@camstack/types": "1.2.50",
-    "@camstack/ui-library": "1.2.36",
+    "@camstack/system": "1.2.68",
+    "@camstack/types": "1.2.52",
+    "@camstack/ui-library": "1.2.37",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",