@camstack/server 1.2.80 → 1.2.81

package/dist/api/oauth2/oauth2-routes.js

@@ -7,6 +7,43 @@ exports.registerOauth2Routes = registerOauth2Routes;
 const session_cookie_js_1 = require("../../auth/session-cookie.js");
 const consent_page_js_1 = require("./consent-page.js");
 const private_host_js_1 = require("./private-host.js");
+/** Longest caller-supplied `integration` value echoed back in an error. */
+const MAX_ECHOED_INTEGRATION_LEN = 100;
+/** Render the received `integration` for a human, bounded. */
+function describeReceivedIntegration(raw) {
+    if (raw === undefined)
+        return null;
+    const joined = typeof raw === 'string' ? raw : raw.join(',');
+    if (joined === '')
+        return null;
+    return joined.length > MAX_ECHOED_INTEGRATION_LEN
+        ? `${joined.slice(0, MAX_ECHOED_INTEGRATION_LEN)}…`
+        : joined;
+}
+/**
+ * Resolve the `integration` parameter to a single id.
+ *
+ * A repeat carrying ONE distinct value is collapsed rather than refused:
+ * every layer that parses the query — proxy, framework, app — necessarily
+ * agrees on the value, so there is no parameter-pollution ambiguity to
+ * protect against, and refusing would strand a client whose request is
+ * merely redundant. A repeat whose values DISAGREE is exactly that
+ * ambiguity, and is refused.
+ */
+function resolveIntegrationParam(raw) {
+    if (raw === undefined)
+        return { ok: false, reason: 'missing' };
+    if (typeof raw === 'string') {
+        return raw === '' ? { ok: false, reason: 'missing' } : { ok: true, value: raw };
+    }
+    const distinct = [...new Set(raw.filter((v) => v !== ''))];
+    const [first] = distinct;
+    if (first === undefined)
+        return { ok: false, reason: 'missing' };
+    if (distinct.length > 1)
+        return { ok: false, reason: 'conflicting-repeat' };
+    return { ok: true, value: first };
+}
 /** Validate the inbound authorize query. `client_id` is intentionally
  *  NOT checked — that pair is verified only at the Lambda boundary, and a
  *  PUBLIC client (`requiresPkce`) has no secret to check it against at all;
@@ -14,9 +51,24 @@ const private_host_js_1 = require("./private-host.js");
 function validateAuthorizeQuery(q, knownIntegrations) {
     if (q.response_type !== 'code')
         return { ok: false, status: 400, error: 'unsupported_response_type' };
-    const policy = q.integration ? knownIntegrations.get(q.integration) : undefined;
-    if (!q.integration || !policy)
-        return { ok: false, status: 400, error: 'invalid_request — unknown integration' };
+    // Three distinct client faults used to collapse into one opaque string.
+    // Alexa linking was down for a day because the message named neither what
+    // arrived nor what would have been accepted.
+    const detail = {
+        received: describeReceivedIntegration(q.integration),
+        known_integrations: [...knownIntegrations.keys()],
+    };
+    const param = resolveIntegrationParam(q.integration);
+    if (!param.ok) {
+        const error = param.reason === 'missing'
+            ? 'invalid_request — integration parameter missing'
+            : 'invalid_request — integration parameter repeated with conflicting values';
+        return { ok: false, status: 400, error, detail };
+    }
+    const policy = knownIntegrations.get(param.value);
+    if (!policy) {
+        return { ok: false, status: 400, error: 'invalid_request — unknown integration', detail };
+    }
     if (!q.redirect_uri)
         return { ok: false, status: 400, error: 'invalid_request — redirect_uri required' };
     if (!q.state)
@@ -32,7 +84,7 @@ function validateAuthorizeQuery(q, knownIntegrations) {
     }
     return {
         ok: true,
-        integration: q.integration,
+        integration: param.value,
         redirectUri: q.redirect_uri,
         state: q.state,
         codeChallenge: challenge,
@@ -76,6 +128,20 @@ function summariseScopes(scopes) {
     }
     return scopes.map((s) => s.type).join(', ') || 'no permissions';
 }
+/** A refused `/authorize`. Logged at `warn` and echoed to the caller: both
+ *  halves name the value that ARRIVED and the ids that would have worked, so
+ *  neither the operator nor the log reader has to guess which of them is
+ *  wrong. */
+function refuseAuthorize(reply, logger, method, refusal) {
+    logger.warn(`oauth2 authorize refused: ${refusal.error}`, {
+        meta: {
+            method,
+            received: refusal.detail?.received ?? null,
+            knownIntegrations: refusal.detail?.known_integrations ?? [],
+        },
+    });
+    return reply.status(refusal.status).send({ error: refusal.error, ...refusal.detail });
+}
 /** Build a map of integrationId → descriptor from all registered oauth-integration providers. */
 async function buildIntegrationMap(registry) {
     const entries = registry.getCollectionEntries('oauth-integration');
@@ -137,10 +203,19 @@ function registerOauth2Routes(fastify, deps) {
         const query = request.query;
         const v = validateAuthorizeQuery(query, descriptorMap);
         if (!v.ok) {
-            return reply.status(v.status).send({ error: v.error });
+            return refuseAuthorize(reply, deps.logger, 'GET', v);
         }
         const descriptor = descriptorMap.get(v.integration);
         if (!isRedirectUriAllowed(v.redirectUri, descriptor.allowedRedirectPrefixes, descriptor.allowedPrivateHostPaths ?? [])) {
+            deps.logger.warn('oauth2 authorize refused: redirect_uri not allowed', {
+                meta: {
+                    method: 'GET',
+                    integration: v.integration,
+                    redirectUri: v.redirectUri,
+                    allowedPrefixes: descriptor.allowedRedirectPrefixes,
+                    allowedPrivateHostPaths: descriptor.allowedPrivateHostPaths ?? [],
+                },
+            });
             return reply
                 .status(400)
                 .send({ error: 'invalid_request — redirect_uri not allowed for this integration' });
@@ -223,10 +298,19 @@ function registerOauth2Routes(fastify, deps) {
         // and every one of them is attacker-editable.
         const v = validateAuthorizeQuery(formQuery, descriptorMap);
         if (!v.ok) {
-            return reply.status(v.status).send({ error: v.error });
+            return refuseAuthorize(reply, deps.logger, 'POST', v);
         }
         const descriptor = descriptorMap.get(v.integration);
         if (!isRedirectUriAllowed(v.redirectUri, descriptor.allowedRedirectPrefixes, descriptor.allowedPrivateHostPaths ?? [])) {
+            deps.logger.warn('oauth2 authorize refused: redirect_uri not allowed', {
+                meta: {
+                    method: 'POST',
+                    integration: v.integration,
+                    redirectUri: v.redirectUri,
+                    allowedPrefixes: descriptor.allowedRedirectPrefixes,
+                    allowedPrivateHostPaths: descriptor.allowedPrivateHostPaths ?? [],
+                },
+            });
             return reply
                 .status(400)
                 .send({ error: 'invalid_request — redirect_uri not allowed for this integration' });

package/dist/api/trpc/generated-cap-routers.js

@@ -7794,6 +7794,15 @@ function createCapRouter_snapshot(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.getSnapshotOverview(methodInput);
         }),
+        getSnapshotLinks: trpc_middleware_js_1.protectedProcedure
+            .input(types_98.snapshotCapability.methods.getSnapshotLinks.input.loose())
+            .output(types_98.snapshotCapability.methods.getSnapshotLinks.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('snapshot', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.getSnapshotLinks(methodInput);
+        }),
     });
 }
 function createCapRouter_ssoBridge(getProvider, createRemoteProxy) {

package/dist/main.js

@@ -958,6 +958,10 @@ async function bootstrap() {
             getRegistry: () => capabilityRegistry,
             verifyToken: (t) => authService.verifyToken(t),
             publicHubUrl: () => process.env.CAMSTACK_PUBLIC_ORIGIN ?? `https://localhost:${port}`,
+            // Every /authorize refusal is a dropped account-linking attempt. Without
+            // this scope the drop is invisible in Loki and the only signal left is an
+            // operator noticing that linking stopped working.
+            logger: app.get(logging_service_1.LoggingService).createLogger('oauth2'),
         });
         console.log('[bootstrap] OAuth2 routes registered at /api/oauth2/*');
         // Attach tRPC WebSocket handler using noServer mode to avoid

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.80",
+  "version": "1.2.81",
   "private": false,
   "files": [
     "dist",
@@ -40,12 +40,12 @@
     "@camstack/addon-notifiers": "1.2.13",
     "@camstack/addon-pipeline": "1.2.52",
     "@camstack/addon-pipeline-orchestrator": "1.2.33",
-    "@camstack/addon-post-analysis": "1.2.55",
+    "@camstack/addon-post-analysis": "1.2.56",
     "@camstack/sdk": "1.2.10",
     "@camstack/shm-ring": "1.1.9",
-    "@camstack/system": "1.2.67",
-    "@camstack/types": "1.2.51",
-    "@camstack/ui-library": "1.2.36",
+    "@camstack/system": "1.2.68",
+    "@camstack/types": "1.2.52",
+    "@camstack/ui-library": "1.2.37",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",