@betterportal/config-manager 10.0.30 → 10.1.0

package/lib/.bsb/clients/service-betterportal-config-manager.d.ts

@@ -1,7 +1,7 @@
 /**
  * Auto-generated BSB virtual client for service-betterportal-config-manager
  * DO NOT EDIT - Regenerated on every build
- * @version 10.0.30
+ * @version 10.1.0
  */
 import { ServiceClient, BSBService } from "@bsb/base";
 import type { Observable, BSBServiceClientDefinition, EventInputType } from "@bsb/base";

package/lib/.bsb/clients/service-betterportal-config-manager.js

@@ -1,7 +1,7 @@
 /**
  * Auto-generated BSB virtual client for service-betterportal-config-manager
  * DO NOT EDIT - Regenerated on every build
- * @version 10.0.30
+ * @version 10.1.0
  */
 import { ServiceClient, bsb, createBroadcastEvent, createEventSchemas } from "@bsb/base";
 const _platformConfigChangedSchema = bsb.object({

package/lib/plugins/service-betterportal-config-manager/adminApi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adminApi.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-config-manager/adminApi.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EAEjB,mBAAmB,EAEpB,MAAM,yBAAyB,CAAC;AAUjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AA+qBzD,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,gBAAgB,GACxB,IAAI,CA6iCN"}
+{"version":3,"file":"adminApi.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-config-manager/adminApi.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EAEjB,mBAAmB,EAEpB,MAAM,yBAAyB,CAAC;AAUjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAmyBzD,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,gBAAgB,GACxB,IAAI,CAgnCN"}

package/lib/plugins/service-betterportal-config-manager/adminApi.js

@@ -1,6 +1,7 @@
 import { eventHeaders, htmlResponse, jsonResponse, resolveEmbeddedRequestContext, signServiceConfigTicket, uuidv7 } from "@betterportal/framework";
 import { generateApiKey, hashApiKey } from "./storage/index.js";
 import { getManifestCache } from "./syncApi.js";
+import { apiRoutePath, isApiRoute } from "./routeMounts.js";
 const API_BASE = "/.well-known/bp/admin";
 const CONFIG_TICKET_TTL_SECONDS = 5 * 60;
 // Parse-only base for relative request URLs. Never emit this origin.
@@ -14,6 +15,24 @@ async function readFormBody(event) {
         out[k] = v; });
     return out;
 }
+async function readFormBodyWithArrays(event) {
+    const fd = await event.req.formData().catch(() => null);
+    if (!fd)
+        return {};
+    const out = {};
+    fd.forEach((v, k) => {
+        if (typeof v !== "string")
+            return;
+        const existing = out[k];
+        if (Array.isArray(existing))
+            existing.push(v);
+        else if (typeof existing === "string")
+            out[k] = [existing, v];
+        else
+            out[k] = v;
+    });
+    return out;
+}
 function escapeHtml(s) {
     return s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]));
 }
@@ -26,7 +45,7 @@ async function readJsonBody(event) {
 async function readFormOrJsonBody(event) {
     const contentType = event.req.headers.get("content-type") ?? "";
     if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-        return readFormBody(event);
+        return readFormBodyWithArrays(event);
     }
     return readJsonBody(event);
 }
@@ -59,6 +78,12 @@ function routeMethodsFromManifest(methods) {
     const normalized = (methods ?? []).filter((method) => method === "GET" || method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE" || method === "OPTIONS");
     return normalized.length ? normalized : ["GET"];
 }
+function hasPageRenderer(view) {
+    const renderers = view.html?.themeRenderers;
+    if (!renderers)
+        return view.renderable !== false;
+    return Object.values(renderers).some((renderer) => Array.isArray(renderer.renderModes) && renderer.renderModes.includes("page"));
+}
 function appMatchesTenantUrl(app, tenantUrl) {
     let host = "";
     try {
@@ -187,7 +212,9 @@ function parseRouteCreateBody(body) {
         return { error: viewId.error };
     const manifestView = getManifestCache().get(serviceId.value)?.viewIndex[viewId.value];
     const renderable = manifestView?.renderable !== false;
-    const path = renderable ? requiredRouteString(body, "path", "Mount path") : { value: manifestView?.path ?? `/${viewId.value}` };
+    const manifest = getManifestCache().get(serviceId.value);
+    const serviceRoutePath = manifestView?.path ?? `/${viewId.value}`;
+    const path = renderable ? requiredRouteString(body, "path", "Mount path") : { value: apiRoutePath(manifest?.serviceId ?? serviceId.value, serviceRoutePath) };
     if (path.error)
         return { error: path.error };
     if (!path.value.startsWith("/"))
@@ -196,6 +223,7 @@ function parseRouteCreateBody(body) {
     if (title.error)
         return { error: title.error };
     const route = {
+        kind: renderable ? "page" : "api",
         path: path.value,
         serviceId: serviceId.value,
         viewId: viewId.value,
@@ -281,7 +309,8 @@ function addRouteDependencies(appDef, route) {
             continue;
         appDef.routes.push({
             id: uuidv7(),
-            path: dependency.path,
+            kind: "api",
+            path: apiRoutePath(manifest.serviceId, dependency.path),
             serviceId: route.serviceId,
             viewId: dependencyViewId,
             targetPath: dependency.path,
@@ -445,6 +474,53 @@ function collectServiceDeleteBlockers(config, tenantId, serviceId) {
     }
     return blockers;
 }
+function purgeTenantServiceReferences(config, tenantId, serviceId) {
+    const summary = {
+        routesRemoved: 0,
+        menuItemsRemoved: 0,
+        slotsRemoved: 0,
+        fragmentsRemoved: 0,
+        roleGrantsRemoved: 0,
+        shellCleared: 0,
+        authCleared: 0
+    };
+    for (const app of config.apps.filter((candidate) => candidate.tenantId === tenantId)) {
+        if (app.shell?.serviceId === serviceId) {
+            delete app.shell;
+            summary.shellCleared += 1;
+        }
+        if (app.auth?.serviceId === serviceId) {
+            delete app.auth;
+            summary.authCleared += 1;
+        }
+        else if (app.auth?.roles) {
+            for (const role of app.auth.roles) {
+                const before = role.permissions.length;
+                role.permissions = role.permissions.filter((grant) => grant.serviceId !== serviceId);
+                summary.roleGrantsRemoved += before - role.permissions.length;
+            }
+        }
+        const routeIds = new Set(app.routes.filter((route) => route.serviceId === serviceId).map((route) => route.id));
+        const routeCountBefore = app.routes.length;
+        app.routes = app.routes.filter((route) => route.serviceId !== serviceId);
+        summary.routesRemoved += routeCountBefore - app.routes.length;
+        const menuBefore = JSON.stringify(app.menu ?? []);
+        app.menu = removeMenuRoutes(app.menu, routeIds);
+        if (menuBefore !== JSON.stringify(app.menu ?? []))
+            summary.menuItemsRemoved += routeIds.size;
+        const slotsBefore = app.slots.length;
+        app.slots = app.slots.filter((slot) => slot.serviceId !== serviceId);
+        summary.slotsRemoved += slotsBefore - app.slots.length;
+        for (const [location, fragments] of Object.entries(app.fragments)) {
+            const before = fragments.length;
+            app.fragments[location] = fragments.filter((fragment) => fragment.serviceId !== serviceId);
+            summary.fragmentsRemoved += before - app.fragments[location].length;
+            if (app.fragments[location].length === 0)
+                delete app.fragments[location];
+        }
+    }
+    return summary;
+}
 function sharedServiceIdFor(service, requested) {
     return (requested && requested.trim()) || service.serviceId || service.id;
 }
@@ -616,6 +692,23 @@ function migrateTenantServiceToShared(config, tenantId, serviceId, options = {})
 function linkedServiceError(blockers) {
     return `Service is still linked and cannot be deleted. Remove these references first: ${blockers.slice(0, 8).join("; ")}${blockers.length > 8 ? `; and ${blockers.length - 8} more` : ""}`;
 }
+function linkedServiceHtmxError(tenantId, serviceId, blockers) {
+    const items = blockers.slice(0, 8).map((blocker) => `<li>${escapeHtml(blocker)}</li>`).join("");
+    const more = blockers.length > 8 ? `<li>${blockers.length - 8} more references</li>` : "";
+    return htmlResponse(`
+    <div class="alert alert-warning">
+      <div class="fw-semibold mb-2">Service is still linked and cannot be deleted.</div>
+      <ul class="mb-3">${items}${more}</ul>
+      <button
+        class="btn btn-sm btn-danger"
+        hx-post="${API_BASE}/tenants/${encodeURIComponent(tenantId)}/services/${encodeURIComponent(serviceId)}/purge"
+        hx-target="#bp-services-alerts"
+        hx-swap="innerHTML"
+        hx-confirm="Purge all routes, menu entries, fragments, slots, auth links and role grants for this service, then delete it?"
+      >Purge references and delete service</button>
+    </div>
+  `, 409, "text/html; mode=fragment");
+}
 function parseWizardManifest(raw) {
     const parsed = JSON.parse(raw);
     return parsed && typeof parsed === "object" && !Array.isArray(parsed)
@@ -1002,7 +1095,7 @@ export function registerAdminApiRoutes(app, store, cpState) {
         const blockers = collectServiceDeleteBlockers(config, tenantId, serviceId);
         if (blockers.length > 0) {
             const message = linkedServiceError(blockers);
-            return wantsHtmx(event) ? htmxError(message, 409) : jsonResponse({ error: message, blockers }, 409);
+            return wantsHtmx(event) ? linkedServiceHtmxError(tenantId, serviceId, blockers) : jsonResponse({ error: message, blockers }, 409);
         }
         tenant.services = tenant.services.filter((s) => s.id !== serviceId);
         await store.saveConfig(config);
@@ -1014,6 +1107,31 @@ export function registerAdminApiRoutes(app, store, cpState) {
         }
         return jsonResponse({ ok: true });
     });
+    app.post(`${API_BASE}/tenants/:tenantId/services/:serviceId/purge`, async (event) => {
+        const tenantId = getParam(event, "tenantId");
+        const serviceId = getParam(event, "serviceId");
+        if (!tenantId || !serviceId)
+            return jsonResponse({ error: "tenantId and serviceId required" }, 400);
+        const config = await store.loadConfig();
+        const tenant = config.tenants.find((t) => t.id === tenantId);
+        if (!tenant)
+            return wantsHtmx(event) ? htmxError("Tenant not found", 404) : jsonResponse({ error: "Tenant not found" }, 404);
+        const service = tenant.services.find((candidate) => candidate.id === serviceId);
+        if (!service)
+            return wantsHtmx(event) ? htmxError("Service not found", 404) : jsonResponse({ error: "Service not found" }, 404);
+        const summary = purgeTenantServiceReferences(config, tenantId, serviceId);
+        tenant.services = tenant.services.filter((candidate) => candidate.id !== serviceId);
+        await store.saveConfig(config);
+        if (wantsHtmx(event)) {
+            return htmlResponse(`
+        <div class="alert alert-success">
+          Service deleted. Purged ${summary.routesRemoved} route(s), ${summary.slotsRemoved} slot(s), ${summary.fragmentsRemoved} fragment(s), ${summary.roleGrantsRemoved} role grant(s), ${summary.shellCleared} shell binding(s), and ${summary.authCleared} auth binding(s).
+        </div>
+        <div hx-get="/services?tenantId=${encodeURIComponent(tenantId)}" hx-trigger="load" hx-target="#bp-main" hx-swap="innerHTML"></div>
+      `, 200, "text/html; mode=fragment");
+        }
+        return jsonResponse({ ok: true, summary });
+    });
     // Activate/deactivate platform services for tenant
     app.get(`${API_BASE}/tenants/:tenantId/services/:serviceId/migrate-to-shared/preview`, async (event) => {
         const tenantId = getParam(event, "tenantId");
@@ -1335,15 +1453,20 @@ export function registerAdminApiRoutes(app, store, cpState) {
                 return validationError(event, "View is required.");
             route.viewId = viewId;
         }
-        const manifestView = getManifestCache().get(route.serviceId)?.viewIndex[route.viewId];
+        const manifest = getManifestCache().get(route.serviceId);
+        const manifestView = manifest?.viewIndex[route.viewId];
         if (manifestView) {
             route.methods = routeMethodsFromManifest(manifestView.methods);
             route.targetPath = manifestView.path;
             if (manifestView.renderable === false) {
-                route.path = manifestView.path;
+                route.kind = "api";
+                route.path = apiRoutePath(manifest?.serviceId ?? route.serviceId, manifestView.path);
                 route.title = manifestView.viewId;
                 delete route.query;
             }
+            else {
+                route.kind = "page";
+            }
         }
         if (body.targetPath !== undefined) {
             const targetPath = trimmedString(body, "targetPath");
@@ -1354,7 +1477,9 @@ export function registerAdminApiRoutes(app, store, cpState) {
         }
         if (body.query !== undefined) {
             const query = trimmedString(body, "query");
-            if (query)
+            if (isApiRoute(route, manifestView?.renderable))
+                delete route.query;
+            else if (query)
                 route.query = query.replace(/^\?+/, "");
             else
                 delete route.query;
@@ -1363,7 +1488,8 @@ export function registerAdminApiRoutes(app, store, cpState) {
             const title = trimmedString(body, "title");
             if (!title)
                 return validationError(event, "Display title is required.");
-            route.title = title;
+            if (!isApiRoute(route, manifestView?.renderable))
+                route.title = title;
         }
         if (body.enabled !== undefined)
             route.enabled = body.enabled === true || body.enabled === "true" || body.enabled === "on";
@@ -1441,7 +1567,7 @@ export function registerAdminApiRoutes(app, store, cpState) {
     // Browser-mediated: the admin UI fetches the manifest from the service
     // (CM cannot reach services) and POSTs the parsed payload here.
     app.post(`${API_BASE}/wizard/verify`, async (event) => {
-        const adminApiBase = adminApiBaseFromControlPlane(cpState);
+        const adminApiBase = API_BASE;
         const form = await readFormBody(event);
         const tenantId = form.tenantId ?? "";
         const hostname = normalizeHostname(form.hostname);
@@ -1479,17 +1605,22 @@ export function registerAdminApiRoutes(app, store, cpState) {
     });
     // HTMX wizard: register service
     app.post(`${API_BASE}/wizard/register`, async (event) => {
-        const form = await readFormBody(event);
-        const tenantId = form.tenantId ?? "";
-        const hostname = (form.hostname ?? "").replace(/\/+$/, "");
-        const title = form.title || hostname;
+        const body = await readFormOrJsonBody(event);
+        const jsonMode = (event.req.headers.get("accept") ?? "").includes("application/json")
+            || (event.req.headers.get("content-type") ?? "").includes("application/json");
+        const registerError = (message, status = 400) => jsonMode
+            ? jsonResponse({ error: message }, status)
+            : htmlResponse(`<div class="alert alert-danger">${escapeHtml(message)}</div>`, 200, "text/html; mode=fragment");
+        const tenantId = typeof body.tenantId === "string" ? body.tenantId : "";
+        const hostname = (typeof body.hostname === "string" ? body.hostname : "").replace(/\/+$/, "");
+        const title = (typeof body.title === "string" && body.title.trim().length > 0 ? body.title.trim() : hostname);
         if (!tenantId || !hostname) {
-            return htmlResponse(`<div class="alert alert-danger">Missing tenantId or hostname</div>`, 200, "text/html; mode=fragment");
+            return registerError("Missing tenantId or hostname");
         }
         const config = await store.loadConfig();
         const tenant = config.tenants.find((t) => t.id === tenantId);
         if (!tenant) {
-            return htmlResponse(`<div class="alert alert-danger">Tenant not found</div>`, 200, "text/html; mode=fragment");
+            return registerError("Tenant not found", 404);
         }
         // Schema is fetched by the browser from the service (CM cannot reach services)
         // and posted to us as a JSON string in form.schema.
@@ -1497,19 +1628,27 @@ export function registerAdminApiRoutes(app, store, cpState) {
         let capabilities = [];
         let serviceRoutes = [];
         let viewMeta = new Map();
-        if (form.schema) {
+        const schemaText = typeof body.schema === "string" ? body.schema : "";
+        if (schemaText) {
             try {
-                const schema = JSON.parse(form.schema);
+                const schema = JSON.parse(schemaText);
                 serviceId = schema.manifest?.pluginId;
                 capabilities = Array.isArray(schema.manifest?.capabilities) ? schema.manifest.capabilities.filter((value) => typeof value === "string") : [];
                 serviceRoutes = schema.routes ?? [];
-                viewMeta = new Map((schema.manifest?.views ?? []).map((v) => [v.viewId, v.title]));
+                viewMeta = new Map((schema.manifest?.views ?? []).map((v) => [v.viewId, {
+                        title: v.title,
+                        renderable: v.renderable !== false,
+                        pageRenderable: hasPageRenderer(v),
+                        methods: Array.isArray(v.methods)
+                            ? v.methods.filter((value) => typeof value === "string")
+                            : []
+                    }]));
             }
             catch { /* malformed schema - register without routes */ }
         }
         const duplicate = duplicateTenantService(tenant, hostname, serviceId);
         if (duplicate) {
-            return htmlResponse(`<div class="alert alert-warning">${escapeHtml(duplicate)}</div>`, 200, "text/html; mode=fragment");
+            return registerError(duplicate, 409);
         }
         const newServiceId = uuidv7();
         const service = {
@@ -1532,30 +1671,37 @@ export function registerAdminApiRoutes(app, store, cpState) {
                 const groupChildren = [];
                 const existingPaths = new Set(appDef.routes.map((r) => r.path));
                 for (const r of serviceRoutes) {
+                    const meta = viewMeta.get(r.viewId);
+                    const renderable = meta?.renderable ?? r.renderable !== false;
                     // Default mounting path is the service's own path; skip collisions
-                    const mountPath = existingPaths.has(r.path) ? `/${title.toLowerCase().replace(/[^a-z0-9]+/g, "-")}${r.path}` : r.path;
+                    const mountPath = renderable
+                        ? (existingPaths.has(r.path) ? `/${title.toLowerCase().replace(/[^a-z0-9]+/g, "-")}${r.path}` : r.path)
+                        : apiRoutePath(serviceId ?? newServiceId, r.path);
                     if (existingPaths.has(mountPath))
                         continue;
                     const routeId = uuidv7();
-                    const routeTitle = viewMeta.get(r.viewId) ?? r.viewId;
+                    const routeTitle = meta?.title ?? r.viewId;
                     appDef.routes.push({
                         id: routeId,
+                        kind: renderable ? "page" : "api",
                         path: mountPath,
                         serviceId: newServiceId,
                         viewId: r.viewId,
                         targetPath: r.path,
                         title: routeTitle,
                         enabled: true,
-                        methods: ["GET"]
+                        methods: routeMethodsFromManifest(r.methods)
                     });
                     existingPaths.add(mountPath);
-                    groupChildren.push({
-                        id: uuidv7(),
-                        type: "link",
-                        title: routeTitle,
-                        routeId,
-                        enabled: true
-                    });
+                    if (meta?.pageRenderable === true && !isApiRoute({ kind: renderable ? "page" : "api", path: mountPath }, renderable)) {
+                        groupChildren.push({
+                            id: uuidv7(),
+                            type: "link",
+                            title: routeTitle,
+                            routeId,
+                            enabled: true
+                        });
+                    }
                 }
                 if (groupChildren.length > 0) {
                     const menu = (appDef.menu ?? []);
@@ -1571,7 +1717,17 @@ export function registerAdminApiRoutes(app, store, cpState) {
             }
         }
         await store.saveConfig(config);
-        const adminApiBase = adminApiBaseFromControlPlane(cpState);
+        if (jsonMode) {
+            return jsonResponse({
+                ok: true,
+                tenantId,
+                serviceInstanceId: newServiceId,
+                serviceUrl: hostname,
+                title,
+                deploymentMode: service.deploymentMode
+            });
+        }
+        const adminApiBase = API_BASE;
         return htmlResponse(renderWizardStep3({
             apiKey: "",
             deploymentMode: service.deploymentMode,
@@ -1602,7 +1758,7 @@ export function registerAdminApiRoutes(app, store, cpState) {
         const tenantId = url.searchParams.get("tenantId") ?? undefined;
         const hostname = url.searchParams.get("hostname") ?? undefined;
         const config = await store.loadConfig();
-        return htmlResponse(renderWizardStep1(config, undefined, { tenantId, hostname }, adminApiBaseFromControlPlane(cpState)), 200, "text/html; mode=fragment");
+        return htmlResponse(renderWizardStep1(config, undefined, { tenantId, hostname }, API_BASE), 200, "text/html; mode=fragment");
     });
     // HTMX configure: load form
     app.get(`${API_BASE}/configure`, async (event) => {
@@ -1771,7 +1927,7 @@ function renderWizardStep2(d) {
       <div class="form-text">Auto-filled from manifest. Edit if needed.</div>
     </div>
     <div class="d-flex gap-2">
-      <button type="button" class="btn btn-outline-secondary" hx-get="/.well-known/bp/admin/wizard/step1" hx-target="#bp-wizard-step" hx-swap="outerHTML"><- Back</button>
+      <button type="button" class="btn btn-outline-secondary" hx-get="${escapeHtml(d.adminApiBase)}/wizard/step1" hx-target="#bp-wizard-step" hx-swap="outerHTML"><- Back</button>
       <button type="submit" class="btn btn-primary flex-grow-1">Register Service</button>
     </div>
   </form>