@camstack/types 1.2.364 → 1.2.366

package/dist/client.mjs

@@ -558,6 +558,240 @@ z.object({
 	resolution: CamStreamResolutionSchema.optional()
 });
 //#endregion
+//#region src/auth/device-certificate.ts
+/**
+* Device certificates (D855) — the wire contract shared by the hub, the admin
+* UI and the native viewer.
+*
+* A device (a phone) generates its OWN P-256 key pair in hardware (Secure
+* Enclave / Android Keystore / a non-extractable WebCrypto key). The private
+* key never travels. The hub signs the PUBLIC key into an X.509 leaf under a
+* dedicated device CA; the device later proves possession of the key by
+* signing a hub-issued nonce, and the hub answers with the same session a
+* password login opens.
+*
+* Everything on the wire is a small string (a PEM, a base64url signature):
+* D613 is about bulk bytes, and a certificate is ~600 bytes.
+*/
+/** Signature algorithm of every device credential: ECDSA, curve P-256, SHA-256. */
+var DEVICE_CERT_SIGNATURE = "ecdsa-p256-sha256";
+/** First line of every signed message; a change of format bumps the version. */
+var DEVICE_SIGNATURE_MESSAGE_VERSION = "camstack-device-cert-v1";
+z.enum([
+	"login",
+	"renew",
+	"revoke"
+]);
+var DEVICE_CERT_RENEW_WINDOW_DAYS = 30;
+/**
+* The exact bytes a device signs (UTF-8, `\n` separators, no trailing newline):
+*
+*   camstack-device-cert-v1
+*   <login|renew>
+*   <origin>            the hub origin returned by `getDeviceChallenge`
+*   <nonce>
+*
+* The origin is part of the message so a signature collected by a look-alike
+* hub is worthless on the real one; the hub additionally binds the nonce to
+* the origin it issued it for and refuses any other.
+*/
+function buildDeviceSignatureMessage(input) {
+	return [
+		DEVICE_SIGNATURE_MESSAGE_VERSION,
+		input.purpose,
+		input.origin,
+		input.nonce
+	].join("\n");
+}
+/** The deep link a QR carries: `camstack://enroll?hub=<origin>&code=<code>`. */
+function buildDeviceEnrollmentLink(input) {
+	const query = new URLSearchParams();
+	if (input.hub !== void 0) query.set("hub", input.hub);
+	query.set("code", input.code);
+	return `${input.scheme ?? "camstack"}://enroll?${query.toString()}`;
+}
+/** Parse an enrollment deep link; `null` when it is not one. `hub` is absent when the link names none. */
+function parseDeviceEnrollmentLink(raw) {
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		return null;
+	}
+	if (url.protocol !== "camstack:" && url.protocol !== "camstack.dev:") return null;
+	if (url.hostname !== "enroll") return null;
+	const code = url.searchParams.get("code");
+	if (code === null || code === "") return null;
+	const hub = url.searchParams.get("hub");
+	return {
+		hub: hub === null || hub === "" ? null : hub,
+		code
+	};
+}
+var DevicePlatformSchema = z.enum([
+	"ios",
+	"android",
+	"web",
+	"other"
+]);
+var Base64UrlSchema = z.string().min(1).max(4096).regex(/^[A-Za-z0-9_-]+$/);
+var PemSchema = z.string().min(1).max(16384);
+/**
+* Why a device-certificate endpoint said no. Distinct from a transport / 5xx
+* failure: those carry no reason and mean "try again", never "the credential is
+* dead". The viewer switches on this exhaustively.
+*/
+var DeviceRefusalReasonSchema = z.enum([
+	"revoked",
+	"unknown-credential",
+	"expired",
+	"bad-signature",
+	"nonce-invalid",
+	"rate-limited",
+	"invalid-certificate",
+	"superseded",
+	"user-gone",
+	"unavailable",
+	"code-invalid",
+	"self-enrollment-disabled",
+	"step-up-required",
+	"bad-public-key"
+]);
+/** The only answers after which the app may count towards deleting its credential. */
+var DEFINITIVE_DEVICE_REFUSALS = [
+	"revoked",
+	"unknown-credential",
+	"user-gone"
+];
+/** Consecutive DEFINITIVE answers before the app deletes its key and certificate. */
+var DEVICE_DEFINITIVE_REFUSALS_BEFORE_DELETE = 3;
+function isDefinitiveDeviceRefusal(reason) {
+	return DEFINITIVE_DEVICE_REFUSALS.includes(reason);
+}
+var DeviceRefusalSchema = z.object({
+	ok: z.literal(false),
+	reason: DeviceRefusalReasonSchema,
+	definitive: z.boolean(),
+	retryAfterSeconds: z.number().optional()
+});
+/**
+* A credential-bound session that can no longer refresh answers
+* `auth.refreshSession` with UNAUTHORIZED whose message is this prefix + the
+* reason; {@link deviceRefusalFromMessage} reads it back.
+*/
+var DEVICE_REFRESH_REFUSAL_PREFIX = "device-credential:";
+function deviceRefusalFromMessage(message) {
+	if (!message.startsWith("device-credential:")) return null;
+	const parsed = DeviceRefusalReasonSchema.safeParse(message.slice(18));
+	return parsed.success ? parsed.data : null;
+}
+z.object({
+	code: z.string().min(1).max(256),
+	/** SubjectPublicKeyInfo DER of the device's P-256 public key, base64url. */
+	publicKeySpki: Base64UrlSchema,
+	deviceName: z.string().min(1).max(80).optional(),
+	platform: DevicePlatformSchema
+});
+var CompleteEnrollmentOutputSchema = z.object({
+	credentialId: z.string(),
+	certPem: PemSchema,
+	/** The device CA certificate the leaf chains to. */
+	chainPem: PemSchema,
+	notAfter: z.number(),
+	user: z.object({
+		id: z.string(),
+		username: z.string()
+	})
+});
+z.discriminatedUnion("ok", [CompleteEnrollmentOutputSchema.extend({ ok: z.literal(true) }), DeviceRefusalSchema]);
+z.object({
+	/** The single-use step-up proof (`auth.deviceEnrollProofFrom…`). */
+	proof: z.string().min(1).max(512),
+	publicKeySpki: Base64UrlSchema,
+	deviceName: z.string().min(1).max(80),
+	platform: DevicePlatformSchema
+});
+z.object({
+	proof: z.string(),
+	expiresAt: z.number()
+});
+var DeviceChallengeSchema = z.object({
+	nonce: z.string(),
+	/** The origin to put in the signed message. The app compares it to the hub it dialled. */
+	origin: z.string(),
+	expiresAt: z.number(),
+	signature: z.literal(DEVICE_CERT_SIGNATURE)
+});
+z.discriminatedUnion("ok", [DeviceChallengeSchema.extend({ ok: z.literal(true) }), DeviceRefusalSchema]);
+z.object({
+	certPem: PemSchema,
+	nonce: z.string().min(1).max(256),
+	/** ECDSA P-256 SHA-256 over {@link buildDeviceSignatureMessage}; raw r||s or DER, base64url. */
+	signature: Base64UrlSchema
+});
+var RenewDeviceCertificateOutputSchema = z.object({
+	credentialId: z.string(),
+	certPem: PemSchema,
+	chainPem: PemSchema,
+	notAfter: z.number()
+});
+z.discriminatedUnion("ok", [RenewDeviceCertificateOutputSchema.extend({ ok: z.literal(true) }), DeviceRefusalSchema]);
+z.discriminatedUnion("ok", [z.object({
+	ok: z.literal(true),
+	credentialId: z.string(),
+	sessionsEnded: z.number().int()
+}), DeviceRefusalSchema]);
+var DeviceCredentialStatusSchema = z.enum([
+	"active",
+	"expired",
+	"revoked"
+]);
+z.object({
+	id: z.string(),
+	userId: z.string(),
+	username: z.string().nullable(),
+	deviceName: z.string(),
+	platform: DevicePlatformSchema,
+	enrolledVia: z.enum(["qr", "self"]),
+	/** SHA-256 of the leaf certificate DER, colon-hex. */
+	fingerprint: z.string(),
+	issuedAt: z.number(),
+	expiresAt: z.number(),
+	lastUsedAt: z.number().nullable(),
+	lastUsedFrom: z.string().nullable(),
+	revokedAt: z.number().nullable(),
+	/** `admin:<userId>` | `user:<userId>` | `device` | `user-deleted`. */
+	revokedBy: z.string().nullable(),
+	status: DeviceCredentialStatusSchema
+});
+z.object({
+	/** Shown once; only its hash is kept. */
+	code: z.string(),
+	expiresAt: z.number(),
+	/** `camstack://enroll?hub=…&code=…` — what the QR encodes. */
+	enrollUrl: z.string(),
+	/** The hub origin in the link, or `null` when the hub could not name one (the link then has no `hub`). */
+	hubOrigin: z.string().nullable(),
+	/** Every origin the apps may try (role `appConnections`). */
+	hubOrigins: z.array(z.string())
+});
+z.object({
+	kind: z.literal("device-certificate"),
+	id: z.literal("device-certificate"),
+	label: z.string(),
+	stage: z.literal("primary"),
+	/** tRPC paths under the hub's `auth` router, so a client names no literal. */
+	challengePath: z.literal("auth.getDeviceChallenge"),
+	revokePath: z.literal("auth.revokeOwnDeviceCertificate"),
+	enrollSelfPath: z.literal("auth.enrollSelf"),
+	loginPath: z.literal("auth.loginWithDeviceCertificate"),
+	renewPath: z.literal("auth.renewDeviceCertificate"),
+	signature: z.literal(DEVICE_CERT_SIGNATURE),
+	messageVersion: z.literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
+	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
+	clients: z.array(z.enum(["native", "web"]))
+});
+//#endregion
 //#region src/catalogs/sensor-active-state.ts
 /**
 * THE table "which boolean of this device type counts as HIGH", and the
@@ -27411,6 +27645,16 @@ function createSystemProxy(api) {
 			release: (input) => dispatch("deviceAdoption", "release", "mutation", input),
 			resync: (input) => dispatch("deviceAdoption", "resync", "mutation", input)
 		},
+		deviceCredentials: {
+			listDeviceCredentials: (input) => dispatch("deviceCredentials", "listDeviceCredentials", "query", input),
+			startEnrollment: (input) => dispatch("deviceCredentials", "startEnrollment", "mutation", input),
+			revokeDeviceCredential: (input) => dispatch("deviceCredentials", "revokeDeviceCredential", "mutation", input),
+			getDeviceCertificateSettings: (input) => dispatch("deviceCredentials", "getDeviceCertificateSettings", "query", input),
+			setDeviceCertificateSettings: (input) => dispatch("deviceCredentials", "setDeviceCertificateSettings", "mutation", input),
+			deleteDeviceCredential: (input) => dispatch("deviceCredentials", "deleteDeviceCredential", "mutation", input),
+			getDeviceCaStatus: (input) => dispatch("deviceCredentials", "getDeviceCaStatus", "query", input),
+			renameDeviceCredential: (input) => dispatch("deviceCredentials", "renameDeviceCredential", "mutation", input)
+		},
 		deviceExport: {
 			getStatus: (input) => dispatch("deviceExport", "getStatus", "query", input),
 			listSupportedDeviceKinds: (input) => dispatch("deviceExport", "listSupportedDeviceKinds", "query", input),
@@ -30873,4 +31117,4 @@ var TimelapseRuleSchema = TimelapseRuleInputSchema.extend({
 	updatedAt: z.number()
 });
 //#endregion
-export { APPLE_SA_TO_MACRO, AUDIO_MACRO_LABELS, AlarmArmModeSchema, CLIP_BROKER_PACED_RATES, COCO_TO_MACRO, CamProfileSchema, DEFAULT_TIMELAPSE_PREVIEW_TEXT, DeviceType, EVENTFUL_CAP_NAMES, EVENT_KIND_BY_CAP, EVENT_TAXONOMY, ICON_CATEGORIES, ICON_ENTRIES, ICON_KEYS, ICON_VIEWER_MODULES, IconKeySchema, LOCATION_ICON_FALLBACK, MACRO_LABELS, NC_ALARM_DELAY_MAX_SEC, NC_ALARM_SENSORS_MAX, NC_ALARM_SYSTEM_EVENT_KINDS, NC_ALARM_TRIGGERED_MAX_SEC, NC_BATTERY_CONSUMABLE_SYSTEM_EVENT_KINDS, NC_CAMERA_SCOPE_CAP_NAME, NC_CONSUMABLE_LOW_PERCENT_DEFAULT, NC_CONSUMABLE_LOW_PERCENT_MAX, NC_GROUPING_DEFAULT_SEC, NC_GROUPING_MAX_SEC, NC_GROUPING_MIN_SEC, NC_RULE_EDITOR_SECTION_ORDER, NC_RULE_KIND_SPECS, NC_SENSOR_TRANSITION_UNSUPPORTED_REASON, NC_SYSTEM_EVENT_FAMILY_FILTERS, NC_SYSTEM_EVENT_KIND_GROUP_SPECS, NC_SYSTEM_EVENT_SUMMARY_FAMILIES, NC_TEMPLATE_HELD_BACK_SYSTEM_EVENT_KINDS, NC_TEMPLATE_VARS, NcAlarmConfigSchema, NcAlarmSensorsSchema, NcAlarmSettingsPatchSchema, NcHistoryEntrySchema, NcRuleLastRunsSchema, NodeDirectorySchema, RECORDING_EXPORT_MAX_READ_BYTES, RETRAIN_REVIEW_ADJUSTED_IOU, RETRAIN_REVIEW_MATCH_IOU, RETRAIN_REVIEW_STATUSES, RETRAIN_REVISION_CONFLICT, SystemMirror, TIMELAPSE_DENSE_FLOOR_SEC, TimelapseRuleSchema, YAMNET_TO_MACRO, alarmDeviceBlocksArming, alarmDeviceSecureOnArm, alarmPatchLanded, canonicalIconKey, classifyRetrainReview, conditionVisibleForKind, createSystemProxy, droppedConditionsForKind, iconCategoryLabel, iconEntry, iconsInCategory, isHeldBackTemplateVar, isIconKey, isSystemRuleKind, kindsForDiscriminator, knownValues, locationIconKey, nodePickerItems, packagePickerItems, parseRetrainRevisionConflict, pickerForCondition, pickerForRuleClasses, resolveIconKey, resolveModeDelays, retrainBoxIou, retrainRevisionConflictMessage, ruleDeviceCompatCapNames, ruleEditorSectionsForKind, ruleGroupingApplies, ruleKindOf, ruleKindSpec, ruleSeedForSection, searchIcons, sensorTransitionNeverFires, sensorTransitionOffered, stateLabel, summarizeReview, systemEventDeliveryProblems, systemEventFilterAppliesToAnyKind, systemEventKindsOfFamily, systemFamilyOfKind, templateCarriesSummary, templateVarDeliveryApplies, templateVarKindApplies, templateVarSystemEventApplies };
+export { APPLE_SA_TO_MACRO, AUDIO_MACRO_LABELS, AlarmArmModeSchema, CLIP_BROKER_PACED_RATES, COCO_TO_MACRO, CamProfileSchema, DEFAULT_TIMELAPSE_PREVIEW_TEXT, DEFINITIVE_DEVICE_REFUSALS, DEVICE_CERT_RENEW_WINDOW_DAYS, DEVICE_CERT_SIGNATURE, DEVICE_DEFINITIVE_REFUSALS_BEFORE_DELETE, DEVICE_REFRESH_REFUSAL_PREFIX, DEVICE_SIGNATURE_MESSAGE_VERSION, DeviceType, EVENTFUL_CAP_NAMES, EVENT_KIND_BY_CAP, EVENT_TAXONOMY, ICON_CATEGORIES, ICON_ENTRIES, ICON_KEYS, ICON_VIEWER_MODULES, IconKeySchema, LOCATION_ICON_FALLBACK, MACRO_LABELS, NC_ALARM_DELAY_MAX_SEC, NC_ALARM_SENSORS_MAX, NC_ALARM_SYSTEM_EVENT_KINDS, NC_ALARM_TRIGGERED_MAX_SEC, NC_BATTERY_CONSUMABLE_SYSTEM_EVENT_KINDS, NC_CAMERA_SCOPE_CAP_NAME, NC_CONSUMABLE_LOW_PERCENT_DEFAULT, NC_CONSUMABLE_LOW_PERCENT_MAX, NC_GROUPING_DEFAULT_SEC, NC_GROUPING_MAX_SEC, NC_GROUPING_MIN_SEC, NC_RULE_EDITOR_SECTION_ORDER, NC_RULE_KIND_SPECS, NC_SENSOR_TRANSITION_UNSUPPORTED_REASON, NC_SYSTEM_EVENT_FAMILY_FILTERS, NC_SYSTEM_EVENT_KIND_GROUP_SPECS, NC_SYSTEM_EVENT_SUMMARY_FAMILIES, NC_TEMPLATE_HELD_BACK_SYSTEM_EVENT_KINDS, NC_TEMPLATE_VARS, NcAlarmConfigSchema, NcAlarmSensorsSchema, NcAlarmSettingsPatchSchema, NcHistoryEntrySchema, NcRuleLastRunsSchema, NodeDirectorySchema, RECORDING_EXPORT_MAX_READ_BYTES, RETRAIN_REVIEW_ADJUSTED_IOU, RETRAIN_REVIEW_MATCH_IOU, RETRAIN_REVIEW_STATUSES, RETRAIN_REVISION_CONFLICT, SystemMirror, TIMELAPSE_DENSE_FLOOR_SEC, TimelapseRuleSchema, YAMNET_TO_MACRO, alarmDeviceBlocksArming, alarmDeviceSecureOnArm, alarmPatchLanded, buildDeviceEnrollmentLink, buildDeviceSignatureMessage, canonicalIconKey, classifyRetrainReview, conditionVisibleForKind, createSystemProxy, deviceRefusalFromMessage, droppedConditionsForKind, iconCategoryLabel, iconEntry, iconsInCategory, isDefinitiveDeviceRefusal, isHeldBackTemplateVar, isIconKey, isSystemRuleKind, kindsForDiscriminator, knownValues, locationIconKey, nodePickerItems, packagePickerItems, parseDeviceEnrollmentLink, parseRetrainRevisionConflict, pickerForCondition, pickerForRuleClasses, resolveIconKey, resolveModeDelays, retrainBoxIou, retrainRevisionConflictMessage, ruleDeviceCompatCapNames, ruleEditorSectionsForKind, ruleGroupingApplies, ruleKindOf, ruleKindSpec, ruleSeedForSection, searchIcons, sensorTransitionNeverFires, sensorTransitionOffered, stateLabel, summarizeReview, systemEventDeliveryProblems, systemEventFilterAppliesToAnyKind, systemEventKindsOfFamily, systemFamilyOfKind, templateCarriesSummary, templateVarDeliveryApplies, templateVarKindApplies, templateVarSystemEventApplies };