@camstack/system 1.2.357 → 1.2.359

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,11 +3,16 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CFVOy8VT.js");
+const require_dist = require("../../dist-W_X44h-s.js");
+let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");
 crypto$1 = require_chunk.__toESM(crypto$1, 1);
+let node_path = require("node:path");
+node_path = require_chunk.__toESM(node_path);
+let node_fs = require("node:fs");
+node_fs = require_chunk.__toESM(node_fs);
 //#region src/auth/parse-record.ts
 function parseRecord(kind, schema, data) {
 	try {
@@ -6708,15 +6713,44 @@ var UserManager = class {
 			}
 		});
 	}
-	async ensureAdminExists() {
+	/**
+	* Seed the configured admin (`auth.adminUsername` / `auth.adminPassword`,
+	* i.e. `CAMSTACK_ADMIN_USER` / `CAMSTACK_ADMIN_PASS`) — on FIRST boot only.
+	*
+	* The configured password is a seed, never an authority. Once any admin
+	* exists, this never writes a password: the operator's own change in the
+	* admin UI is the truth from then on. This method used to compare the stored
+	* hash with the configured password on every boot and rewrite it when they
+	* differed, so a password changed in the UI went back to the configured one
+	* (`changeme` on a Mac hub and on any container without `CAMSTACK_ADMIN_PASS`)
+	* at the next restart.
+	*
+	* `resetPassword: true` is the one explicit exception — the operator's
+	* one-shot recovery request (see `admin-password-reset.ts`): the configured
+	* admin's password is set back to the configured one.
+	*/
+	async ensureAdminExists(options = {}) {
 		const adminUsername = this.config.get("auth.adminUsername");
 		const adminPassword = this.config.get("auth.adminPassword");
-		if (!adminUsername || !adminPassword) return;
+		if (!adminUsername || !adminPassword) return { kind: "not-configured" };
 		const existing = await this.findByUsername(adminUsername);
 		if (existing) {
-			if (!await this.auth.comparePassword(adminPassword, existing.passwordHash)) await this.resetPassword(existing.id, adminPassword);
-			return;
+			if (options.resetPassword === true) {
+				await this.resetPassword(existing.id, adminPassword);
+				return {
+					kind: "reset",
+					username: adminUsername
+				};
+			}
+			return {
+				kind: "exists",
+				username: adminUsername
+			};
 		}
+		if ((await this.listAll()).some((u) => u.isAdmin)) return {
+			kind: "other-admin-exists",
+			username: adminUsername
+		};
 		await this.create({
 			username: adminUsername,
 			password: adminPassword,
@@ -6724,6 +6758,19 @@ var UserManager = class {
 			allowedProviders: "*",
 			allowedDevices: {}
 		});
+		return {
+			kind: "seeded",
+			username: adminUsername
+		};
+	}
+	/**
+	* Does `username` still sign in with `password`? A hash comparison — the
+	* password is never logged or stored. `false` when the user does not exist.
+	*/
+	async hasPassword(username, password) {
+		const user = await this.findByUsername(username);
+		if (!user) return false;
+		return this.auth.comparePassword(password, user.passwordHash);
 	}
 }, i$2 = class extends Error {
 	constructor(e, t) {
@@ -9031,6 +9078,204 @@ var TotpManager = class {
 	}
 };
 //#endregion
+//#region src/kernel/config-schema.ts
+/** Default data directory — used when CAMSTACK_DATA env var is not set */
+var DEFAULT_DATA_PATH = "camstack-data";
+/**
+* A list of browser origins from config.yaml (a YAML list) or from the
+* `CAMSTACK_CORS_ORIGINS` env var (one comma-separated string — env carries
+* only strings). Validation of each entry is the CORS policy's job
+* (`server/backend/src/api/cors/cors-policy.ts`), which logs what it rejects;
+* the schema only fixes the SHAPE so a typo cannot stop the hub from booting.
+*/
+var originListSchema = zod.z.preprocess((value) => typeof value === "string" ? value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0) : value, zod.z.array(zod.z.string()));
+var serverSchema = zod.z.object({
+	port: zod.z.number().default(4443),
+	host: zod.z.string().default("0.0.0.0"),
+	dataPath: zod.z.string().default(DEFAULT_DATA_PATH),
+	/**
+	* EXTRA browser origins allowed to call this hub cross-origin (D707), on
+	* top of the built-ins: the hub's own origin, the hosted viewer PWA and the
+	* native app's opaque `null` origin. Bootstrap-owned on purpose — widening
+	* who may read hub responses in a browser is a security decision, and the
+	* policy is live from the first request, before the settings store exists.
+	*/
+	corsOrigins: originListSchema.default([])
+});
+var authSchema = zod.z.object({
+	jwtSecret: zod.z.string().nullable().default(null),
+	adminUsername: zod.z.string().default("admin"),
+	adminPassword: zod.z.string().default("changeme")
+});
+var hubSchema = zod.z.object({
+	url: zod.z.string().default("ws://localhost:4443/agent"),
+	token: zod.z.string().default("")
+});
+var agentSchema = zod.z.object({
+	name: zod.z.string().default(""),
+	/** Port for the agent status page (minimal HTML) */
+	statusPort: zod.z.number().default(4444)
+});
+var tlsSchema = zod.z.object({ 
+/**
+* Enable HTTPS (default: true). The certificate itself is never configured
+* here: the admin UI (Network → Local access) generates or uploads it
+* (D726), and boot serves whatever `tls/mode` says.
+*/
+enabled: zod.z.boolean().default(true) });
+/**
+* Bootstrap-time addon configuration — read PURELY from YAML, before the
+* kernel can talk to the settings-store. This breaks the chicken-and-egg
+* where the settings store itself is implemented by an addon: the kernel
+* needs to know WHICH addon to load first to provide the store, and that
+* decision can't itself live in the store.
+*
+* Backward-compatible: every field is optional + defaults reproduce the
+* current hard-coded behavior. Existing config.yaml files keep working.
+*/
+var bootstrapAddonsSchema = zod.z.object({
+	/**
+	* Addon implementing the `settings-store` capability. Loaded FIRST,
+	* before any other addon is enabled — every other addon's enable
+	* state, settings, and ordering lives in the store it provides.
+	*
+	* Default: '@camstack/addon-sqlite-storage' (the workspace's
+	* default SQLite-backed store). Future alternatives could swap this
+	* for postgres/redis without touching kernel code.
+	*/
+	settingsStoreAddon: zod.z.string().default("@camstack/addon-sqlite-storage"),
+	/**
+	* How the launcher provisions REQUIRED_PACKAGES into `data/addons/`
+	* on startup.
+	*
+	*   - `'npm'`     — pull from the npm registry (production default).
+	*   - `'local'`   — copy `packages/<X>/` from the workspace into
+	*                   `data/addons/<X>/`. Use for the Electron-
+	*                   packaged bundle and the e2e harness.
+	*   - `'symlink'` — point `data/addons/<X>` at the workspace source
+	*                   dir via a directory symlink. Dev-only: a
+	*                   workspace rebuild (`npm run build -w <X>`) is
+	*                   immediately reflected at the next addon load,
+	*                   no copy step. Falls back to `'local'` on
+	*                   platforms that reject symlink creation (Windows
+	*                   without developer-mode).
+	*
+	* The `CAMSTACK_INSTALL_SOURCE` env var, when set, wins over this
+	* field. Leave undefined to keep the launcher's default behaviour
+	* (npm when no workspace, local when a bundled addons dir is
+	* present, …).
+	*/
+	installSource: zod.z.enum([
+		"npm",
+		"local",
+		"symlink"
+	]).optional(),
+	/**
+	* Override the kernel's hard-coded `AddonInstaller.REQUIRED_PACKAGES`.
+	* Passing an array here REPLACES the default list entirely — useful
+	* for stripped-down deployments (only the bundle of addons the
+	* operator actually wants) and for forcing a different storage
+	* backend at first boot.
+	*
+	* Leave undefined to use the kernel-shipped defaults.
+	*/
+	requiredAddons: zod.z.array(zod.z.string()).optional(),
+	/**
+	* Disable list applied AFTER the settings-store reports the enabled
+	* set. Operator escape hatch — boot without a known-broken addon
+	* without having to mutate the store.
+	*/
+	forceDisable: zod.z.array(zod.z.string()).default([])
+});
+/** Bootstrap config -- loaded from config.yaml ONLY at startup.
+*  All other settings live in SQL (system_settings table). */
+var bootstrapSchema = zod.z.object({
+	/** Server mode: 'hub' (full server) or 'agent' (worker node) */
+	mode: zod.z.enum(["hub", "agent"]).default("hub"),
+	server: serverSchema.default(serverSchema.parse({})),
+	auth: authSchema.default(authSchema.parse({})),
+	/** Hub connection config — only used when mode='agent' */
+	hub: hubSchema.default(hubSchema.parse({})),
+	/** Agent-specific config — only used when mode='agent' */
+	agent: agentSchema.default(agentSchema.parse({})),
+	/** TLS configuration */
+	tls: tlsSchema.default(tlsSchema.parse({})),
+	/**
+	* Addon bootstrap directives — minimum addon set needed before the
+	* kernel can reach the settings-store. See bootstrapAddonsSchema.
+	* Spec: docs/superpowers/specs/2026-05-15-yaml-bootstrap-expansion.md
+	*/
+	bootstrap: bootstrapAddonsSchema.default(bootstrapAddonsSchema.parse({}))
+});
+//#endregion
+//#region src/builtins/local-auth/admin-account-boot.ts
+/**
+* The admin account at boot: seed it once, reset it only on the operator's
+* explicit one-shot request, and say so when it still has the default password.
+*
+* ## Why a trigger FILE, not a variable
+*
+* The configured password (`CAMSTACK_ADMIN_PASS` / `auth.adminPassword`) seeds
+* the admin on first boot and is never applied again — a password the operator
+* changes in the admin UI survives every restart. Recovering a forgotten
+* password therefore needs an explicit request, and that request must be
+* ONE-SHOT: an environment flag stays set in a container template until someone
+* remembers to remove it, and while it is set it reverts the password on every
+* boot — the very defect this replaced. A file the hub DELETES after acting on
+* it cannot be left armed: create `RESET_ADMIN_PASSWORD` in the node's data
+* directory (`/data` in the container), restart, and the configured admin's
+* password is set back to the configured one, once.
+*/
+/** The trigger's name, at the root of the node's data directory. */
+var ADMIN_PASSWORD_RESET_TRIGGER = "RESET_ADMIN_PASSWORD";
+async function reconcileAdminAccountAtBoot(input) {
+	const { users, fs, logger } = input;
+	const triggerPath = node_path.join(input.dataDir, ADMIN_PASSWORD_RESET_TRIGGER);
+	const resetRequested = fs.exists(triggerPath);
+	const outcome = await users.ensureAdminExists({ resetPassword: resetRequested });
+	logOutcome(outcome, logger);
+	if (resetRequested) consumeTrigger(triggerPath, outcome, input);
+	const username = "username" in outcome ? outcome.username : null;
+	const usesDefaultPassword = username !== null && await users.hasPassword(username, "changeme");
+	if (usesDefaultPassword && username !== null) logger.warn("The admin account still uses the default password — change it in the admin UI (the first sign-in with it asks for a new one)", { meta: { username } });
+	return {
+		outcome,
+		usesDefaultPassword
+	};
+}
+function logOutcome(outcome, logger) {
+	switch (outcome.kind) {
+		case "seeded":
+			logger.info("Admin account seeded from the configured credentials (first boot)", { meta: { username: outcome.username } });
+			return;
+		case "reset":
+			logger.warn("Admin password reset to the configured password, as requested", { meta: { username: outcome.username } });
+			return;
+		case "other-admin-exists":
+			logger.info("Configured admin username not seeded: another admin account already exists", { meta: { username: outcome.username } });
+			return;
+		case "not-configured":
+			logger.warn("No admin username/password configured — no admin account seeded");
+			return;
+		case "exists": return;
+	}
+}
+/** Delete the trigger after acting on it — a reset must never repeat by itself. */
+function consumeTrigger(triggerPath, outcome, input) {
+	if (outcome.kind !== "reset") input.logger.warn("Admin password reset requested, but no configured admin account to reset", { meta: {
+		trigger: triggerPath,
+		outcome: outcome.kind
+	} });
+	try {
+		input.fs.remove(triggerPath);
+	} catch (err) {
+		input.logger.error("Could not delete the admin password reset trigger — delete it by hand, or every restart resets the admin password again", { meta: {
+			trigger: triggerPath,
+			error: err instanceof Error ? err.message : String(err)
+		} });
+	}
+}
+//#endregion
 //#region src/builtins/local-auth/auth-config-reader.ts
 /**
 * Every config path this reader can answer. Anything else resolves to
@@ -9066,8 +9311,9 @@ function narrow(value) {
 //#region src/builtins/local-auth/auth-schema.ts
 /**
 * @durable class=config owner=local-auth
-*   write="an operator creates a user, or `ensureAdminExists` seeds/re-syncs the
-*     configured admin at boot; updated on scope, isAdmin and password edits"
+*   write="an operator creates a user, or `ensureAdminExists` seeds the configured
+*     admin on first boot (or resets its password on the operator's one-shot
+*     RESET_ADMIN_PASSWORD trigger); updated on scope, isAdmin and password edits"
 *   retention="none — a row goes only when an operator deletes the user. A
 *     `declareCollection` that adds a PK/UNIQUE/NOT-NULL-without-default column
 *     REBUILDS the table: every account is wiped and only the configured admin
@@ -9675,6 +9921,23 @@ var OauthSessionManager = class {
 };
 //#endregion
 //#region src/builtins/local-auth/local-auth.addon.ts
+/**
+* Local Auth Addon — owns user accounts, API keys, scoped tokens,
+* and local password authentication.
+*
+* Capabilities registered:
+*   - `auth-provider` (collection) — local password authentication
+*   - `user-management` (singleton) — user CRUD, API keys, scoped tokens
+*
+* This addon owns the OAuth grant MACHINERY (codes, sessions, refresh) but
+* declares no `oauth-integration` client of its own, and must not start: which
+* clients exist is integration-specific knowledge and belongs to the addon that
+* owns the integration (D101). `homeassistant` moved to `homeassistant-export`;
+* `export-alexa` was always there.
+*
+* Extension: an OIDC addon can register another `auth-provider` entry.
+* The server's login flow iterates the `auth-provider` collection.
+*/
 /** How often the auth tables are swept for dead rows. */
 var AUTH_REAP_INTERVAL_MS = 24 * 36e5;
 /**
@@ -9732,7 +9995,15 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 			this.oauthSessionManager = new OauthSessionManager(store);
 			this.totpManager = new TotpManager(store);
 			try {
-				await this.userManager.ensureAdminExists();
+				await reconcileAdminAccountAtBoot({
+					users: this.userManager,
+					dataDir: this.ctx.nodeDataDir,
+					fs: {
+						exists: (filePath) => node_fs.existsSync(filePath),
+						remove: (filePath) => node_fs.rmSync(filePath, { force: true })
+					},
+					logger: this.ctx.logger
+				});
 				const liveUsers = await this.userManager.listAll();
 				const liveIds = new Set(liveUsers.map((u) => u.id));
 				const removed = await this.scopedTokenManager.cleanupOrphans(liveIds);
@@ -9986,11 +10257,13 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 //#endregion
 exports.ApiKeyManager = ApiKeyManager;
 exports.AuthManager = AuthManager;
+exports.DEFAULT_DATA_PATH = DEFAULT_DATA_PATH;
 exports.LocalAuthAddon = LocalAuthAddon;
 exports.default = LocalAuthAddon;
 exports.ScopedTokenManager = ScopedTokenManager;
 exports.SettingsReadUnavailableError = SettingsReadUnavailableError;
 exports.UserManager = UserManager;
+exports.bootstrapSchema = bootstrapSchema;
 exports.isSettingsReadUnavailable = isSettingsReadUnavailable;
 Object.defineProperty(exports, "require_ms", {
 	enumerable: true,