@3sln/trove 0.0.5 → 0.0.7

package/README.md

@@ -163,6 +163,12 @@ TROVE_S3_ACCESS_KEY_ID=…            # or AWS_ACCESS_KEY_ID
 TROVE_S3_SECRET_ACCESS_KEY=…        # or AWS_SECRET_ACCESS_KEY
 TROVE_S3_PATH_STYLE=true            # MinIO / custom endpoints
 
+# Which store types a COLLECTION may be created on. Defaults to everything this
+# runtime registered; naming a subset takes the rest off the collection form and
+# refuses them. Worth setting on Workers, where `memory` is offered because it is
+# portable but produces a collection that loses its uploads on isolate recycle.
+TROVE_STORAGE_DRIVERS=s3            # subset of: memory | filesystem | s3
+
 # Metadata (file tree + facets)
 TROVE_METADATA=sqlite               # memory | sqlite
 TROVE_DB_PATH=./data/trove.db

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@3sln/trove",
-  "version": "0.0.5",
+  "version": "0.0.7",
   "type": "module",
   "description": "Trove — a self-hostable, plugin-extensible Google Drive. Semantic search, pluggable storage (S3 / filesystem / NAS), and a VS Code-style contribution system with sandboxed plugins.",
   "repository": {

package/packages/core/src/storage/drivers.js

@@ -49,9 +49,19 @@ export function portableDrivers() {
           help: 'MinIO and most self-hosted endpoints need this.',
         },
       ],
-      // S3Storage takes the config flat; the old switch passed `cfg.s3`, which meant a
-      // collection record had to nest its own settings one level deeper than every
-      // other driver for no reason a user could see.
+      // Two config shapes reach here and both have to work.
+      //
+      // Flat — `{ driver: 's3', bucket: … }` — is what `fields` above describes and what
+      // the collection form posts. Nested under `s3` is what `configFromEnv` produces and
+      // what every collection record written before this driver existed holds, because the
+      // switch this replaced read `cfg.s3` and nothing else.
+      //
+      // Normalising rather than only handling it in `create` is the point: validation runs
+      // against the normalised shape, so a nested config is no longer refused for a missing
+      // top-level `bucket` that was about to be spread in anyway. That refusal broke every
+      // environment-configured S3 deployment at startup, which is as loud as a bug gets and
+      // still took a local run to see, because no test used the env shape.
+      normalize: (cfg) => ({ ...cfg, ...(cfg.s3 || {}) }),
       create: (cfg) => new S3Storage({
         bucket: cfg.bucket,
         region: cfg.region || 'auto',
@@ -60,7 +70,6 @@ export function portableDrivers() {
         secretAccessKey: cfg.secretAccessKey,
         sessionToken: cfg.sessionToken,
         forcePathStyle: cfg.forcePathStyle === true || cfg.forcePathStyle === 'true',
-        ...(cfg.s3 || {}),
       }),
     },
     {

package/packages/core/src/storage/registry.js

@@ -56,6 +56,9 @@ export class StorageDriverRegistry {
    * @param {string} driver.label         for a form
    * @param {string} [driver.description] one line about what it is
    * @param {DriverField[]} [driver.fields]
+   * @param {(config: object) => object} [driver.normalize] accept an older or alternative
+   *   config shape, returning the one `fields` describes. Runs before validation, so the
+   *   shape checked is the shape built from.
    * @param {(config: object) => StorageBackend} driver.create
    */
   register(driver) {
@@ -82,6 +85,7 @@ export class StorageDriverRegistry {
         placeholder: f.placeholder || '',
         help: f.help || '',
       })),
+      normalize: driver.normalize || null,
       create: driver.create,
     });
     return this;
@@ -95,9 +99,30 @@ export class StorageDriverRegistry {
     return [...this._drivers.keys()];
   }
 
-  /** What a client needs to render a form. No `create`, because that is not data. */
+  /**
+   * One registered driver, `create` included — unlike `describe()`, which deliberately
+   * strips it because it answers a client.
+   *
+   * For copying a driver into another registry, which is how a deployment narrows the set
+   * it offers: a registry has no `unregister`, so narrowing rebuilds from what survived
+   * rather than removing from what did not. Keeping removal out of this class is the point
+   * — a driver disappearing from a live registry is a store that stops being buildable
+   * while collections still reference it.
+   */
+  driver(key) {
+    return this._drivers.get(key);
+  }
+
+  /**
+   * What a client needs to render a form.
+   *
+   * Neither `create` nor `normalize`: both are behaviour, not data. JSON.stringify would
+   * drop them anyway, which is exactly why they are removed here instead — a describe()
+   * whose result is only serialisable by accident is one that leaks the next function
+   * somebody adds into every in-process consumer.
+   */
   describe() {
-    return [...this._drivers.values()].map(({ create, ...rest }) => rest);
+    return [...this._drivers.values()].map(({ create, normalize, ...rest }) => rest);
   }
 
   /**
@@ -105,6 +130,13 @@ export class StorageDriverRegistry {
    *
    * An unknown driver throws, and says what IS available. This is the arm that used to
    * return an in-memory store.
+   *
+   * `normalize` runs FIRST, so a driver that accepts more than one config shape validates
+   * the shape it will actually build from. Without it, required-field checks are performed
+   * against a config the driver was about to rewrite — which is precisely how S3 broke:
+   * `configFromEnv` nests its settings under `s3`, `create` spread that back out, and the
+   * check in between looked for a top-level `bucket` that was never going to be there and
+   * refused every environment-configured S3 deployment at startup.
    */
   build(config) {
     const key = config?.driver;
@@ -115,12 +147,13 @@ export class StorageDriverRegistry {
         `Unknown storage driver "${key}" — this deployment has: ${this.keys().join(', ') || 'none'}`,
       );
     }
+    const cfg = driver.normalize ? driver.normalize(config) : config;
     for (const f of driver.fields) {
-      if (f.required && (config[f.name] == null || config[f.name] === '')) {
+      if (f.required && (cfg[f.name] == null || cfg[f.name] === '')) {
         throw TroveError.invalid(`Storage driver "${key}" requires "${f.name}"`);
       }
     }
-    const backend = driver.create(config);
+    const backend = driver.create(cfg);
     if (!(backend instanceof StorageBackend)) {
       throw TroveError.invalid(`Storage driver "${key}" did not return a StorageBackend`);
     }

package/packages/server/src/engine/providers/core.js

@@ -58,13 +58,41 @@ const resolve = (value, BaseClass, build) =>
  * portable ones — so a deployment adds Filesystem (Node/Bun), or a driver written
  * entirely outside this package, by naming it at the entry point. What is not registered
  * is not offered and cannot be built.
+ *
+ * `config.allowedStorageDrivers` (TROVE_STORAGE_DRIVERS) narrows the result to an explicit
+ * set. Adding drivers is a code decision made by an entry point, which knows what the
+ * runtime can run; REMOVING them is an operator decision about one deployment, and needs
+ * to be reachable from configuration alone. A drive on Workers is the case in point: memory
+ * is portable, so it is offered, and choosing it there produces a collection that accepts
+ * uploads and loses them when the isolate is recycled. `TROVE_STORAGE_DRIVERS=s3` takes it
+ * off the menu without a fork of the entry point.
+ *
+ * A name that matches nothing throws rather than narrowing to nothing — a typo that left a
+ * drive with no way to make a collection would be a puzzle, not a message.
  */
 export function storageRegistry(config = {}) {
   if (config.storageRegistry instanceof StorageDriverRegistry) return config.storageRegistry;
   if (config.storageDrivers instanceof StorageDriverRegistry) return config.storageDrivers;
   const registry = new StorageDriverRegistry(portableDrivers());
   for (const d of config.storageDrivers || []) registry.register(d);
-  return registry;
+
+  const allowed = config.allowedStorageDrivers;
+  if (!allowed?.length) return registry;
+  const unknown = allowed.filter((k) => !registry.has(k));
+  if (unknown.length) {
+    throw TroveError.invalid(
+      `TROVE_STORAGE_DRIVERS names ${unknown.map((k) => `"${k}"`).join(', ')}, which `
+      + `${unknown.length === 1 ? 'is not a driver' : 'are not drivers'} this deployment has: `
+      + `${registry.keys().join(', ')}`,
+    );
+  }
+  // Rebuilt from the descriptors that survived rather than mutated, so a registry never
+  // has to support removal — and the drivers keep their registration order.
+  const narrowed = new StorageDriverRegistry();
+  for (const key of registry.keys()) {
+    if (allowed.includes(key)) narrowed.register(registry.driver(key));
+  }
+  return narrowed;
 }
 
 /**

package/packages/server/src/index.js

@@ -624,6 +624,14 @@ export function configFromEnv(env = (typeof process !== 'undefined' ? process.en
   if (config.storage.driver === 'filesystem') config.storage.root = env.TROVE_FS_ROOT || './data/objects';
   if (config.storage.driver === 's3') config.storage.s3 = s3FromEnv(env, 'TROVE_');
 
+  // Which store types a COLLECTION may be created on, if not all of the ones this entry
+  // point registered. `TROVE_STORAGE` picks the drive's own primary store; this restricts
+  // the menu the collection form offers and what `build` will accept — see
+  // engine/providers/core.js for why removal is configuration and addition is code.
+  if (env.TROVE_STORAGE_DRIVERS) {
+    config.allowedStorageDrivers = env.TROVE_STORAGE_DRIVERS.split(',').map((s) => s.trim()).filter(Boolean);
+  }
+
   config.metadata.driver = env.TROVE_METADATA || (config.storage.driver === 'memory' ? 'memory' : 'sqlite');
   config.metadata.path = env.TROVE_DB_PATH || './data/trove.db';