camstack 1.2.33 → 1.2.34

package/dist/cli.js

@@ -38,7 +38,7 @@ async function runServe(args) {
     ...typeof values.data === "string" ? { data: values.data } : {}
   };
   Object.assign(process.env, buildServeEnv(opts));
-  await import("./launcher-LXP37XH2.js");
+  await import("./launcher-CSBOA3IK.js");
 }
 
 // src/commands/agent.ts
@@ -83,7 +83,7 @@ async function runAgent(args) {
     ...typeof values.port === "string" ? { port: values.port } : {}
   };
   Object.assign(process.env, buildAgentEnv(opts));
-  await import("./launcher-LXP37XH2.js");
+  await import("./launcher-CSBOA3IK.js");
 }
 
 // src/commands/setup.ts

package/dist/{launcher-LXP37XH2.js → launcher-CSBOA3IK.js}

@@ -396909,7 +396909,7 @@ var require_trpc_context = __commonJS({
       }
       return null;
     }
-    async function resolveUser(token2, authService, addonRegistry, shareTokens = null) {
+    async function resolveUser(token2, authService, addonRegistry, shareTokens = null, logger = null) {
       if (!token2)
         return null;
       if (token2.startsWith(share_token_service_js_1.SHARE_TOKEN_PREFIX)) {
@@ -396971,8 +396971,14 @@ var require_trpc_context = __commonJS({
         if (typeof payload.isAdmin !== "boolean") {
           return null;
         }
-        const credential = (0, trpc_error_principal_js_1.readCredentialIdentity)(payload);
         const principal = (0, types_1.classifyBearerPrincipal)(payload);
+        if (principal.kind === "not-a-credential") {
+          logger?.warn("trpc: refused a bearer that is not an API credential", {
+            meta: { reason: principal.reason, userId: payload.userId ?? payload.keyId ?? "unknown" }
+          });
+          return null;
+        }
+        const credential = (0, trpc_error_principal_js_1.readCredentialIdentity)(payload);
         return {
           id: payload.userId ?? payload.keyId ?? "unknown",
           username: payload.username ?? "unknown",
@@ -397035,19 +397041,19 @@ var require_trpc_context = __commonJS({
       };
       return { user };
     }
-    async function createTrpcContext(req, authService, addonRegistry, shareTokens = null) {
+    async function createTrpcContext(req, authService, addonRegistry, shareTokens = null, logger = null) {
       const token2 = extractTokenFromRequest(req);
       return {
-        user: await resolveUser(token2, authService, addonRegistry, shareTokens),
+        user: await resolveUser(token2, authService, addonRegistry, shareTokens, logger),
         req,
         deviceScopeLookup: makeDeviceScopeLookup(addonRegistry),
         deviceFleet: () => addonRegistry.getPersistedDeviceList()
       };
     }
-    async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens = null) {
+    async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens = null, logger = null) {
       const paramToken = opts.info.connectionParams?.["token"];
       const token2 = (typeof paramToken === "string" ? paramToken : null) ?? extractTokenFromRequest(opts.req);
-      const user = await resolveUser(token2, authService, addonRegistry, shareTokens);
+      const user = await resolveUser(token2, authService, addonRegistry, shareTokens, logger);
       return {
         user,
         req: opts.req,
@@ -408917,7 +408923,16 @@ var require_main4 = __commonJS({
           prefix: "/trpc",
           trpcOptions: {
             router: appRouter,
-            createContext: ({ req }) => (0, trpc_context_1.createTrpcContext)(req, authService, addonRegistry, shareTokenService),
+            createContext: ({ req }) => (0, trpc_context_1.createTrpcContext)(
+              req,
+              authService,
+              addonRegistry,
+              shareTokenService,
+              // A bearer refused for NOT being an API credential never reaches a
+              // procedure, so `onError` below never sees it — the refusal would
+              // be silent without this. Same reason `gateAddonJwt` logs (D103).
+              app.get(logging_service_1.LoggingService).createLogger("tRPC")
+            ),
             onError: ({ path: trpcPath, error, ctx }) => {
               const trpcLogger = app.get(logging_service_1.LoggingService).createLogger("tRPC");
               trpcLogger.warn("tRPC error", {
@@ -409311,7 +409326,7 @@ var require_main4 = __commonJS({
         (0, ws_1.applyWSSHandler)({
           wss,
           router: appRouter,
-          createContext: (opts) => (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, shareTokenService),
+          createContext: (opts) => (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, shareTokenService, app.get(logging_service_1.LoggingService).createLogger("tRPC:ws")),
           onError: ({ path: trpcPath, error, ctx }) => {
             const trpcLogger = app.get(logging_service_1.LoggingService).createLogger("tRPC:ws");
             trpcLogger.warn("tRPC error", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "camstack",
-  "version": "1.2.33",
+  "version": "1.2.34",
   "description": "CLI tool for managing and running CamStack server",
   "keywords": [
     "camstack",