@aphexcms/cms-core 9.3.0 → 9.5.0

package/dist/server/api/routes/organizations.js

@@ -78,7 +78,10 @@ export const organizationsRouter = new Hono()
             parentOrganizationId: auth.organizationId,
             createdBy: auth.user.id
         });
-        await databaseAdapter.seedBuiltinRoles(newOrganization.id);
+        // Seed with the install's full capability set (core + plugin-declared), the
+        // same one the boot reconcile uses — otherwise a brand-new org's owner would
+        // be missing every capability its plugins declare until the next restart.
+        await databaseAdapter.seedBuiltinRoles(newOrganization.id, c.var.aphexCMS.cmsEngine.ownerCapabilities());
         await databaseAdapter.addMember({
             organizationId: newOrganization.id,
             userId: auth.user.id,

package/dist/server/api/routes/plugin-settings.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+export declare const pluginSettingsRouter: Hono<AphexEnv>;
+//# sourceMappingURL=plugin-settings.d.ts.map

package/dist/server/api/routes/plugin-settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-settings.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/plugin-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AA6DzC,eAAO,MAAM,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CA2E7C,CAAC"}

package/dist/server/api/routes/plugin-settings.js

@@ -0,0 +1,108 @@
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { hasCapability } from '../../../types/capabilities.js';
+import { savePluginSettingsRequest } from '../../../api/schemas/plugin-settings.js';
+import { PluginSettingsValidationError } from '../../../services/plugin-settings-service.js';
+/**
+ * Require a session with `plugin.settings.manage`. Returns the narrowed session auth
+ * to proceed, or a 401/403 Response to short-circuit — so callers get a typed org id
+ * without a non-null assertion.
+ */
+function requireManage(c) {
+    const auth = c.var.auth;
+    if (!auth || auth.type !== 'session') {
+        return c.json({ success: false, error: 'Unauthorized', message: 'Session authentication required' }, 401);
+    }
+    if (!hasCapability(auth, 'plugin.settings.manage')) {
+        return c.json({
+            success: false,
+            error: 'Forbidden',
+            message: 'The plugin.settings.manage capability is required'
+        }, 403);
+    }
+    return auth;
+}
+/**
+ * Does this session satisfy a settings section's own `requiredCapabilities`?
+ *
+ * `plugin.settings.manage` is the floor, checked by `requireManage`. A declaration may
+ * additionally name narrower capabilities to gate itself more tightly — the part's
+ * documented contract, and the same convention `hooks.ts` applies to plugin routes and
+ * `resolver.ts` applies to actions and tools. Without this the declared gate was
+ * silently ignored, so anyone who could manage settings could overwrite every plugin's
+ * secrets regardless of what the plugin asked for.
+ */
+function canAccessSettings(auth, required) {
+    if (!required || required.length === 0)
+        return true;
+    return required.every((capability) => hasCapability(auth, capability));
+}
+export const pluginSettingsRouter = new Hono()
+    .get('/', async (c) => {
+    try {
+        const auth = requireManage(c);
+        if (auth instanceof Response)
+            return auth;
+        const { pluginSettingsService, partResolver } = c.var.aphexCMS;
+        // One entry per plugin that declared settings AND that this session is
+        // allowed to see, with the org's effective values. `getMasked` — never
+        // `get` — so secret plaintext never reaches the client (secrets come back
+        // as a mask placeholder).
+        const declarations = partResolver
+            .settingsDeclarations()
+            .filter((decl) => canAccessSettings(auth, decl.requiredCapabilities));
+        const secretsEnabled = pluginSettingsService.secretsEnabled;
+        const data = await Promise.all(declarations.map(async (decl) => ({
+            pluginId: decl.pluginId,
+            title: decl.title,
+            values: await pluginSettingsService.getMasked(auth.organizationId, decl.pluginId)
+        })));
+        return c.json({ success: true, data, secretsEnabled });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to list plugin settings:', error);
+        return c.json({ success: false, error: 'Internal error' }, 500);
+    }
+})
+    .put('/:pluginId', zValidator('json', savePluginSettingsRequest), async (c) => {
+    try {
+        const auth = requireManage(c);
+        if (auth instanceof Response)
+            return auth;
+        const { pluginSettingsService, partResolver } = c.var.aphexCMS;
+        const pluginId = c.req.param('pluginId');
+        // Reject plugins that never declared settings — nothing to write to.
+        const declaration = partResolver.settingsDeclaration(pluginId);
+        if (!declaration) {
+            return c.json({
+                success: false,
+                error: 'Unknown plugin settings',
+                message: `Plugin "${pluginId}" has not declared any settings.`
+            }, 404);
+        }
+        // Honour the declaration's own gate. GET only ever returns masked secrets,
+        // so the exposure this closes is write: without it, anyone holding
+        // `plugin.settings.manage` could overwrite the secrets of a plugin that
+        // asked for a narrower capability.
+        if (!canAccessSettings(auth, declaration.requiredCapabilities)) {
+            return c.json({
+                success: false,
+                error: 'Forbidden',
+                message: `Plugin "${pluginId}" requires: ${declaration.requiredCapabilities?.join(', ')}`
+            }, 403);
+        }
+        const { values } = c.req.valid('json');
+        const saved = await pluginSettingsService.save(auth.organizationId, pluginId, values);
+        return c.json({ success: true, data: { pluginId, values: saved } });
+    }
+    catch (error) {
+        // A value that doesn't match its declared field type is the caller's fault, not
+        // ours — report it as such, with the specific issues, rather than an opaque 500.
+        if (error instanceof PluginSettingsValidationError) {
+            return c.json({ success: false, error: 'Validation failed', issues: error.issues }, 400);
+        }
+        cmsLogger.error('Failed to save plugin settings:', error);
+        return c.json({ success: false, error: 'Internal error' }, 500);
+    }
+});

package/dist/server/api/routes/roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,EAAE,IAAI,CAAC,QAAQ,CAuSpC,CAAC"}
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAwBzC;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,EAAE,IAAI,CAAC,QAAQ,CA+TpC,CAAC"}

package/dist/server/api/routes/roles.js

@@ -3,6 +3,24 @@ import { zValidator } from '@hono/zod-validator';
 import { cmsLogger } from '../../../utils/logger.js';
 import { hasCapability, BUILTIN_ROLE_NAMES } from '../../../types/capabilities.js';
 import { createRoleRequest, updateRoleRequest } from '../../../api/schemas/roles.js';
+/**
+ * Authoritative capability validation against the runtime registry. The zod schema
+ * only guards the id *format*; this rejects ids that don't actually exist in the
+ * catalog (built-in + plugin-declared), so a role can't be granted a phantom
+ * capability. Returns a 400 Response to short-circuit, or null when all are valid.
+ */
+function rejectUnknownCapabilities(c, caps) {
+    const known = new Set(c.var.aphexCMS.partResolver.capabilityCatalog().map((d) => d.id));
+    const unknown = caps.filter((cap) => !known.has(cap));
+    if (unknown.length === 0)
+        return null;
+    return c.json({
+        success: false,
+        error: 'Unknown capability',
+        message: `These capabilities are not registered: ${unknown.join(', ')}`,
+        unknownCapabilities: unknown
+    }, 400);
+}
 /**
  * Roles router. Combines `/roles` (list, create) and `/roles/:name`
  * (update, delete) so the wire URLs are
@@ -63,6 +81,9 @@ export const rolesRouter = new Hono()
             }, 403);
         }
         const body = c.req.valid('json');
+        const badCaps = rejectUnknownCapabilities(c, body.capabilities);
+        if (badCaps)
+            return badCaps;
         if (BUILTIN_ROLE_NAMES.includes(body.name)) {
             return c.json({
                 success: false,
@@ -132,6 +153,22 @@ export const rolesRouter = new Hono()
             }, 400);
         }
         const body = c.req.valid('json');
+        // `owner` is defined as "every capability" and is reconciled back to the
+        // full set on every boot, so accepting an edit here would appear to work
+        // and then silently revert on the next restart. Same reasoning as the
+        // hardcoded block on deleting built-in roles below.
+        if (name === 'owner' && body.capabilities !== undefined) {
+            return c.json({
+                success: false,
+                error: 'Forbidden',
+                message: '"owner" always holds every capability and its permissions cannot be changed. Create a custom role to grant narrower access.'
+            }, 403);
+        }
+        if (body.capabilities) {
+            const badCaps = rejectUnknownCapabilities(c, body.capabilities);
+            if (badCaps)
+                return badCaps;
+        }
         const updated = await databaseAdapter.updateRole(auth.organizationId, name, body);
         if (!updated) {
             return c.json({

package/dist/server/api/routes/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,EAAE,IAAI,CAAC,QAAQ,CA6IpC,CAAC"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,EAAE,IAAI,CAAC,QAAQ,CA2JpC,CAAC"}

package/dist/server/api/routes/user.js

@@ -16,7 +16,7 @@ export const userRouter = new Hono()
         return c.json({
             success: false,
             error: 'Invalid request body',
-            message: 'name is required',
+            message: 'name or image is required',
             issues: result.error.issues
         }, 400);
     }
@@ -37,8 +37,19 @@ export const userRouter = new Hono()
                 error: 'Auth provider not configured'
             }, 500);
         }
-        const { name } = c.req.valid('json');
-        await provider.changeUserName(auth.user.id, name);
+        const { name, image } = c.req.valid('json');
+        if (name !== undefined) {
+            await provider.changeUserName(auth.user.id, name);
+        }
+        if (image !== undefined) {
+            if (!provider.changeUserImage) {
+                return c.json({
+                    success: false,
+                    error: 'Auth provider does not support profile image updates'
+                }, 500);
+            }
+            await provider.changeUserImage(auth.user.id, image);
+        }
         return c.json({ success: true, message: 'User updated successfully' });
     }
     catch (error) {

package/dist/services/asset-service.d.ts

@@ -21,6 +21,7 @@ export interface AssetFilters {
     assetType?: 'image' | 'file';
     mimeType?: string;
     search?: string;
+    includeSystem?: boolean;
     limit?: number;
     offset?: number;
 }

package/dist/services/asset-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"asset-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/asset-service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAI5C,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IAIrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE;QACV,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACnB,CAAC;CACF;AAED,MAAM,WAAW,YAAY;IAC5B,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,qBAAa,YAAY;IAEvB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,QAAQ;gBADR,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,eAAe;IAGlC;;OAEG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC;IAsFhF;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAI9E;;;;;;;;;;OAUG;IACG,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBhF;;;OAGG;IACG,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAmB5D;;OAEG;IACG,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAItF;;;;;OAKG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BvE;;OAEG;IACG,mBAAmB,CACxB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE;QACT,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,GACC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAIxB;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;QACpD,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;KAClB,CAAC;IAeF;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC;QAChC,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,OAAO,CAAC;KAClB,CAAC;CAWF"}
+{"version":3,"file":"asset-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/asset-service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAI5C,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IAIrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE;QACV,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACnB,CAAC;CACF;AAED,MAAM,WAAW,YAAY;IAC5B,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,qBAAa,YAAY;IAEvB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,QAAQ;gBADR,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,eAAe;IAGlC;;OAEG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC;IAsFhF;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAI9E;;;;;;;;;;OAUG;IACG,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBhF;;;OAGG;IACG,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAmB5D;;OAEG;IACG,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAItF;;;;;OAKG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BvE;;OAEG;IACG,mBAAmB,CACxB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE;QACT,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,GACC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAIxB;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;QACpD,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;KAClB,CAAC;IAeF;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC;QAChC,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,OAAO,CAAC;KAClB,CAAC;CAWF"}

package/dist/services/index.d.ts

@@ -3,4 +3,6 @@ export type { AssetUploadData, AssetFilters } from './asset-service.js';
 export { HierarchyService } from './hierarchy-service.js';
 export { RolesService } from './roles-service.js';
 export { VersionService } from './version-service.js';
+export { PluginSettingsService } from './plugin-settings-service.js';
+export type { ResolvedSettings } from './plugin-settings-service.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/services/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/services/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/services/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,YAAY,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/services/index.js

@@ -5,3 +5,4 @@ export { AssetService } from './asset-service.js';
 export { HierarchyService } from './hierarchy-service.js';
 export { RolesService } from './roles-service.js';
 export { VersionService } from './version-service.js';
+export { PluginSettingsService } from './plugin-settings-service.js';

package/dist/services/plugin-settings-service.d.ts

@@ -0,0 +1,76 @@
+import type { DatabaseAdapter } from '../db/index.js';
+import type { PartResolver } from '../plugins/resolver.js';
+import type { SettingsPart } from '../plugins/types.js';
+/** Placeholder shown to the client for a secret that has a stored value. */
+export declare const SECRET_MASK = "\u2022\u2022\u2022\u2022\u2022\u2022";
+/**
+ * The persistence this service needs — the settings slice of `DatabaseAdapter`, which
+ * satisfies it structurally. Declaring the narrow dependency rather than the whole
+ * adapter keeps the service honest about its reach (config values only, never content)
+ * and lets it be constructed against a stub.
+ */
+export type PluginSettingsStore = Pick<DatabaseAdapter, 'getPluginSettings' | 'setPluginSettings'>;
+/** Likewise the resolver slice: this service only ever looks up settings declarations. */
+export type SettingsDeclarationSource = Pick<PartResolver, 'settingsDeclaration'>;
+/** A declared settings section plus whether the plugin registered one at all. */
+export interface ResolvedSettings {
+    /** The plugin's settings declaration, or `null` if it declared none. */
+    declaration: SettingsPart | null;
+    /** Declared defaults merged with the org's stored values (secrets masked). */
+    values: Record<string, unknown>;
+    /** Whether an encryption key is configured — the UI flags secret fields read-only if not. */
+    secretsEnabled: boolean;
+}
+/** Raised when a submitted value doesn't match its declared field type. */
+export declare class PluginSettingsValidationError extends Error {
+    readonly issues: string[];
+    constructor(issues: string[]);
+}
+export declare class PluginSettingsService {
+    /** Narrowed to the two methods this service uses — the full adapter satisfies it. */
+    private db;
+    /** Likewise: settings resolution is the only part of the resolver needed here. */
+    private resolver;
+    /** Key for encrypting `secret` fields; when absent, secrets are disabled (fail safe). */
+    private encryptionKey;
+    constructor(
+    /** Narrowed to the two methods this service uses — the full adapter satisfies it. */
+    db: PluginSettingsStore, 
+    /** Likewise: settings resolution is the only part of the resolver needed here. */
+    resolver: SettingsDeclarationSource, 
+    /** Key for encrypting `secret` fields; when absent, secrets are disabled (fail safe). */
+    encryptionKey?: string | null);
+    /** Whether secret fields can be stored/read (an encryption key is configured). */
+    get secretsEnabled(): boolean;
+    private secretFieldNames;
+    /**
+     * Effective values for injection into plugin **server** code: declared defaults
+     * overlaid with stored values, with secrets **decrypted** to plaintext. Secrets
+     * that can't be decrypted (no key, or a bad envelope) are omitted, never returned
+     * as ciphertext. This is the sensitive read — never send its result to a client.
+     */
+    get(organizationId: string, pluginId: string): Promise<Record<string, unknown>>;
+    /**
+     * Effective values for the **client/API**: same merge, but secrets are **masked** —
+     * a stored secret becomes {@link SECRET_MASK}, an unset one an empty string. Plaintext
+     * secrets never cross this boundary.
+     */
+    getMasked(organizationId: string, pluginId: string): Promise<Record<string, unknown>>;
+    /**
+     * Resolve for the admin surface: the declaration plus masked values plus whether
+     * secrets are enabled. `declaration: null` when the plugin declares no settings.
+     */
+    resolve(organizationId: string, pluginId: string): Promise<ResolvedSettings>;
+    /**
+     * Persist a partial edit. Only declared field names are accepted, and each value is
+     * type-checked against its declaration — an invalid patch is rejected whole, never
+     * applied in part, so a failed save can't leave settings half-written. Secret fields
+     * are encrypted; a blank or still-masked secret submission means "leave unchanged"
+     * (so the client never has to echo the real value back). Returns the new **masked**
+     * values — a save response never leaks a plaintext secret.
+     *
+     * @throws {PluginSettingsValidationError} when a value doesn't match its field type.
+     */
+    save(organizationId: string, pluginId: string, patch: Record<string, unknown>): Promise<Record<string, unknown>>;
+}
+//# sourceMappingURL=plugin-settings-service.d.ts.map

package/dist/services/plugin-settings-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-settings-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/plugin-settings-service.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAMrD,4EAA4E;AAC5E,eAAO,MAAM,WAAW,yCAAW,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,eAAe,EAAE,mBAAmB,GAAG,mBAAmB,CAAC,CAAC;AAEnG,0FAA0F;AAC1F,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;AAElF,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAChC,wEAAwE;IACxE,WAAW,EAAE,YAAY,GAAG,IAAI,CAAC;IACjC,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,6FAA6F;IAC7F,cAAc,EAAE,OAAO,CAAC;CACxB;AAwBD,2EAA2E;AAC3E,qBAAa,6BAA8B,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE;gBAAhB,MAAM,EAAE,MAAM,EAAE;CAIrC;AAkDD,qBAAa,qBAAqB;IAEhC,qFAAqF;IACrF,OAAO,CAAC,EAAE;IACV,kFAAkF;IAClF,OAAO,CAAC,QAAQ;IAChB,yFAAyF;IACzF,OAAO,CAAC,aAAa;;IALrB,qFAAqF;IAC7E,EAAE,EAAE,mBAAmB;IAC/B,kFAAkF;IAC1E,QAAQ,EAAE,yBAAyB;IAC3C,yFAAyF;IACjF,aAAa,GAAE,MAAM,GAAG,IAAW;IAG5C,kFAAkF;IAClF,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED,OAAO,CAAC,gBAAgB;IAIxB;;;;;OAKG;IACG,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IA6BrF;;;;OAIG;IACG,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAc3F;;;OAGG;IACG,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAMlF;;;;;;;;;OASG;IACG,IAAI,CACT,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CA2CnC"}

package/dist/services/plugin-settings-service.js

@@ -0,0 +1,235 @@
+// services/plugin-settings-service.ts
+//
+// Resolves and persists a plugin's per-organization settings — the "config plane"
+// (see references/plugin-settings-and-secrets-scope.md). A plugin declares its
+// settings shape via an `aphex/settings` part; this service merges the declared
+// defaults with the stored per-(org, plugin) values and writes edits back, scoped
+// to the org.
+//
+// Secrets (`type: 'secret'` fields) are handled specially:
+//   - stored AES-256-GCM-encrypted (never plaintext),
+//   - decrypted only for server injection (`get`), never for the client (`getMasked`),
+//   - write-only: a blank/masked submission means "leave unchanged".
+// When no encryption key is configured, secret writes are refused and secret reads
+// return nothing — fail safe, never store or reveal a plaintext secret.
+import { encryptSecret, decryptSecret, isEncryptedSecret } from '../security/secret-crypto.js';
+import { settingsListItems } from '../schema-utils/settings.js';
+import { cmsLogger } from '../utils/logger.js';
+/** Placeholder shown to the client for a secret that has a stored value. */
+export const SECRET_MASK = '••••••';
+const isSecret = (f) => f.type === 'secret';
+/**
+ * Static default for a field — its `initialValue` when that's a plain value (not a
+ * function/thunk). Secrets never carry a default.
+ */
+function fieldDefault(field) {
+    if (isSecret(field))
+        return undefined;
+    const initial = field.initialValue;
+    return typeof initial === 'function' ? undefined : initial;
+}
+/** Build the defaults object from a declaration's fields (skips undefined). */
+function defaultsFor(fields) {
+    const out = {};
+    for (const field of fields) {
+        const value = fieldDefault(field);
+        if (value !== undefined)
+            out[field.name] = value;
+    }
+    return out;
+}
+/** Raised when a submitted value doesn't match its declared field type. */
+export class PluginSettingsValidationError extends Error {
+    issues;
+    constructor(issues) {
+        super(`Invalid plugin settings: ${issues.join('; ')}`);
+        this.issues = issues;
+        this.name = 'PluginSettingsValidationError';
+    }
+}
+/**
+ * Check one submitted value against its declared field type, returning an error
+ * message or `null`.
+ *
+ * The declaration is the contract, so the host enforces it here rather than leaving
+ * every plugin to re-guard values it already described. Without this a `string` field
+ * would happily store an object, and the plugin would find out at request time, deep
+ * in its own code, with no useful trace back to the save that caused it.
+ *
+ * `null` is always allowed — it's how the panel represents "cleared".
+ */
+function checkValue(field, value) {
+    if (value === null)
+        return null;
+    switch (field.type) {
+        case 'string': {
+            if (typeof value !== 'string')
+                return `"${field.name}" must be a string`;
+            // A select-style string field may only hold one of its declared options.
+            const items = settingsListItems(field);
+            if (items.length > 0 && !items.some((item) => item.value === value)) {
+                return `"${field.name}" must be one of: ${items.map((i) => i.value).join(', ')}`;
+            }
+            return null;
+        }
+        case 'text':
+            if (typeof value !== 'string')
+                return `"${field.name}" must be a string`;
+            return null;
+        case 'number':
+            // Reject NaN/Infinity too — they survive JSON as null and corrupt round-trips.
+            if (typeof value !== 'number' || !Number.isFinite(value)) {
+                return `"${field.name}" must be a finite number`;
+            }
+            if (field.min !== undefined && value < field.min) {
+                return `"${field.name}" must be >= ${field.min}`;
+            }
+            if (field.max !== undefined && value > field.max) {
+                return `"${field.name}" must be <= ${field.max}`;
+            }
+            return null;
+        case 'boolean':
+            if (typeof value !== 'boolean')
+                return `"${field.name}" must be a boolean`;
+            return null;
+        case 'secret':
+            // Secrets are write-only strings; blank/mask is handled before this point.
+            if (typeof value !== 'string')
+                return `"${field.name}" must be a string`;
+            return null;
+    }
+}
+export class PluginSettingsService {
+    db;
+    resolver;
+    encryptionKey;
+    constructor(
+    /** Narrowed to the two methods this service uses — the full adapter satisfies it. */
+    db, 
+    /** Likewise: settings resolution is the only part of the resolver needed here. */
+    resolver, 
+    /** Key for encrypting `secret` fields; when absent, secrets are disabled (fail safe). */
+    encryptionKey = null) {
+        this.db = db;
+        this.resolver = resolver;
+        this.encryptionKey = encryptionKey;
+    }
+    /** Whether secret fields can be stored/read (an encryption key is configured). */
+    get secretsEnabled() {
+        return typeof this.encryptionKey === 'string' && this.encryptionKey.length > 0;
+    }
+    secretFieldNames(declaration) {
+        return new Set(declaration.fields.filter(isSecret).map((f) => f.name));
+    }
+    /**
+     * Effective values for injection into plugin **server** code: declared defaults
+     * overlaid with stored values, with secrets **decrypted** to plaintext. Secrets
+     * that can't be decrypted (no key, or a bad envelope) are omitted, never returned
+     * as ciphertext. This is the sensitive read — never send its result to a client.
+     */
+    async get(organizationId, pluginId) {
+        const declaration = this.resolver.settingsDeclaration(pluginId);
+        const stored = (await this.db.getPluginSettings(organizationId, pluginId)) ?? {};
+        const defaults = declaration ? defaultsFor(declaration.fields) : {};
+        const merged = { ...defaults, ...stored };
+        if (!declaration)
+            return merged;
+        const secrets = this.secretFieldNames(declaration);
+        for (const name of secrets) {
+            const value = merged[name];
+            if (!isEncryptedSecret(value)) {
+                // Unset or non-envelope — nothing usable to inject.
+                delete merged[name];
+                continue;
+            }
+            if (!this.secretsEnabled) {
+                delete merged[name];
+                continue;
+            }
+            try {
+                merged[name] = decryptSecret(value, this.encryptionKey);
+            }
+            catch (error) {
+                cmsLogger.error(`Failed to decrypt secret "${pluginId}.${name}":`, error);
+                delete merged[name];
+            }
+        }
+        return merged;
+    }
+    /**
+     * Effective values for the **client/API**: same merge, but secrets are **masked** —
+     * a stored secret becomes {@link SECRET_MASK}, an unset one an empty string. Plaintext
+     * secrets never cross this boundary.
+     */
+    async getMasked(organizationId, pluginId) {
+        const declaration = this.resolver.settingsDeclaration(pluginId);
+        const stored = (await this.db.getPluginSettings(organizationId, pluginId)) ?? {};
+        const defaults = declaration ? defaultsFor(declaration.fields) : {};
+        const merged = { ...defaults, ...stored };
+        if (declaration) {
+            for (const name of this.secretFieldNames(declaration)) {
+                merged[name] = isEncryptedSecret(merged[name]) ? SECRET_MASK : '';
+            }
+        }
+        return merged;
+    }
+    /**
+     * Resolve for the admin surface: the declaration plus masked values plus whether
+     * secrets are enabled. `declaration: null` when the plugin declares no settings.
+     */
+    async resolve(organizationId, pluginId) {
+        const declaration = this.resolver.settingsDeclaration(pluginId) ?? null;
+        const values = await this.getMasked(organizationId, pluginId);
+        return { declaration, values, secretsEnabled: this.secretsEnabled };
+    }
+    /**
+     * Persist a partial edit. Only declared field names are accepted, and each value is
+     * type-checked against its declaration — an invalid patch is rejected whole, never
+     * applied in part, so a failed save can't leave settings half-written. Secret fields
+     * are encrypted; a blank or still-masked secret submission means "leave unchanged"
+     * (so the client never has to echo the real value back). Returns the new **masked**
+     * values — a save response never leaks a plaintext secret.
+     *
+     * @throws {PluginSettingsValidationError} when a value doesn't match its field type.
+     */
+    async save(organizationId, pluginId, patch) {
+        const declaration = this.resolver.settingsDeclaration(pluginId);
+        if (!declaration) {
+            throw new Error(`Plugin "${pluginId}" has not declared any settings.`);
+        }
+        const fieldsByName = new Map(declaration.fields.map((f) => [f.name, f]));
+        const secrets = this.secretFieldNames(declaration);
+        const stored = (await this.db.getPluginSettings(organizationId, pluginId)) ?? {};
+        const next = { ...stored };
+        // Validate the whole patch before writing any of it.
+        const issues = [];
+        const pending = [];
+        for (const [key, value] of Object.entries(patch)) {
+            const field = fieldsByName.get(key);
+            if (!field)
+                continue; // undeclared → dropped
+            if (secrets.has(key)) {
+                // Write-only: blank or the untouched mask means "keep the current value".
+                if (value === '' || value === SECRET_MASK || value == null)
+                    continue;
+                if (!this.secretsEnabled) {
+                    throw new Error(`Cannot store secret "${pluginId}.${key}": no secretEncryptionKey configured.`);
+                }
+            }
+            const issue = checkValue(field, value);
+            if (issue)
+                issues.push(issue);
+            else
+                pending.push([key, value]);
+        }
+        if (issues.length > 0)
+            throw new PluginSettingsValidationError(issues);
+        for (const [key, value] of pending) {
+            next[key] = secrets.has(key)
+                ? encryptSecret(String(value), this.encryptionKey)
+                : value;
+        }
+        await this.db.setPluginSettings(organizationId, pluginId, next);
+        return this.getMasked(organizationId, pluginId);
+    }
+}

package/dist/services/roles-service.d.ts

@@ -1,6 +1,6 @@
 import type { CacheAdapter } from '../cache/index.js';
 import type { DatabaseAdapter } from '../db/index.js';
-import { type Capability, type Role } from '../types/capabilities.js';
+import { type Role } from '../types/capabilities.js';
 /**
  * RolesService — caches per-org role capability lookups.
  *
@@ -23,7 +23,7 @@ export declare class RolesService {
      *   3. Built-in seed if the name matches a built-in.
      *   4. Empty list — unknown role → no capabilities.
      */
-    getCapabilities(organizationId: string, roleName: string): Promise<Capability[]>;
+    getCapabilities(organizationId: string, roleName: string): Promise<string[]>;
     /** List every role defined for an organization. */
     listRoles(organizationId: string): Promise<Role[]>;
     /** Idempotent — safe to call on every request if you want. */

package/dist/services/roles-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/roles-service.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAGN,KAAK,UAAU,EACf,KAAK,IAAI,EACT,MAAM,uBAAuB,CAAC;AAI/B;;;;;GAKG;AACH,qBAAa,YAAY;IAKvB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,GAAG;IANZ,OAAO,CAAC,MAAM,CAAC,WAAW,CAAM;IAChC,OAAO,CAAC,QAAQ,CAA4C;gBAGnD,EAAE,EAAE,eAAe,EACnB,KAAK,GAAE,YAAY,GAAG,IAAW,EACjC,GAAG,GAAE,MAAiC;IAG/C;;;;;;;;OAQG;IACG,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAqBtF,mDAAmD;IAC7C,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAIxD,8DAA8D;IACxD,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3D,uEAAuE;IACjE,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAW5D,aAAa;CA2B3B"}
+{"version":3,"file":"roles-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/roles-service.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAyC,KAAK,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAIzF;;;;;GAKG;AACH,qBAAa,YAAY;IAKvB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,GAAG;IANZ,OAAO,CAAC,MAAM,CAAC,WAAW,CAAM;IAChC,OAAO,CAAC,QAAQ,CAAwC;gBAG/C,EAAE,EAAE,eAAe,EACnB,KAAK,GAAE,YAAY,GAAG,IAAW,EACjC,GAAG,GAAE,MAAiC;IAG/C;;;;;;;;OAQG;IACG,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAqBlF,mDAAmD;IAC7C,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAIxD,8DAA8D;IACxD,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3D,uEAAuE;IACjE,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAW5D,aAAa;CA2B3B"}

package/dist/theme/css.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Emit theme tokens as a scoped `<style>` body.
+ *
+ * Two hard rules, both learned the expensive way:
+ *  1. NEVER emit site tokens at `:root` — they'd bleed into the admin chrome.
+ *     Always scope to the site shell selector.
+ *  2. Theme values are user-authored, so sanitize before interpolating. Any value
+ *     that could break out of the `--var: value;` declaration (contains `;`, `{`,
+ *     `}`, `<`, `>`, or a CSS `url(`/`expression(`) is dropped, and the token's
+ *     CSS fallback in the layout applies instead.
+ */
+/** Return the value if safe to interpolate into a CSS declaration, else null. */
+export declare function sanitizeTokenValue(value: string): string | null;
+/**
+ * Build a sanitized `--var: value; …` declaration list from a `cssVar → value`
+ * map (see deriveThemeVars). Suitable for an inline `style` attribute on the site
+ * shell element — the simplest way to scope tokens to the site subtree while
+ * beating component-CSS specificity, with no `<style>` injection to guard. Returns
+ * `''` when nothing survives sanitization.
+ */
+export declare function emitThemeVars(vars: Record<string, string>): string;
+/**
+ * Build a scoped style *rule* from a `cssVar → value` map, for callers that
+ * prefer injecting a `<style>` block over an inline attribute. Returns `''` when
+ * nothing survives sanitization, so callers can skip rendering an empty `<style>`.
+ *
+ * @param selector CSS selector to scope the custom properties to, e.g. `.blog-shell`.
+ */
+export declare function emitThemeStyle(selector: string, vars: Record<string, string>): string;
+//# sourceMappingURL=css.d.ts.map

package/dist/theme/css.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"css.d.ts","sourceRoot":"","sources":["../../src/lib/theme/css.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK/D;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAWlE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAIrF"}