@betterportal/config-manager 10.0.31 → 10.1.1

package/lib/.bsb/clients/service-betterportal-config-manager.d.ts

@@ -1,7 +1,7 @@
 /**
  * Auto-generated BSB virtual client for service-betterportal-config-manager
  * DO NOT EDIT - Regenerated on every build
- * @version 10.0.31
+ * @version 10.1.1
  */
 import { ServiceClient, BSBService } from "@bsb/base";
 import type { Observable, BSBServiceClientDefinition, EventInputType } from "@bsb/base";

package/lib/.bsb/clients/service-betterportal-config-manager.js

@@ -1,7 +1,7 @@
 /**
  * Auto-generated BSB virtual client for service-betterportal-config-manager
  * DO NOT EDIT - Regenerated on every build
- * @version 10.0.31
+ * @version 10.1.1
  */
 import { ServiceClient, bsb, createBroadcastEvent, createEventSchemas } from "@bsb/base";
 const _platformConfigChangedSchema = bsb.object({

package/lib/plugins/service-betterportal-config-manager/adminApi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adminApi.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-config-manager/adminApi.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EAEjB,mBAAmB,EAEpB,MAAM,yBAAyB,CAAC;AAUjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AA4vBzD,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,gBAAgB,GACxB,IAAI,CAwkCN"}
+{"version":3,"file":"adminApi.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-config-manager/adminApi.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EAEjB,mBAAmB,EAEpB,MAAM,yBAAyB,CAAC;AAUjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AA8yBzD,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,gBAAgB,GACxB,IAAI,CAqnCN"}

package/lib/plugins/service-betterportal-config-manager/adminApi.js

@@ -1,10 +1,13 @@
 import { eventHeaders, htmlResponse, jsonResponse, resolveEmbeddedRequestContext, signServiceConfigTicket, uuidv7 } from "@betterportal/framework";
 import { generateApiKey, hashApiKey } from "./storage/index.js";
 import { getManifestCache } from "./syncApi.js";
+import { apiRoutePath, isApiRoute } from "./routeMounts.js";
 const API_BASE = "/.well-known/bp/admin";
 const CONFIG_TICKET_TTL_SECONDS = 5 * 60;
 // Parse-only base for relative request URLs. Never emit this origin.
 const RELATIVE_URL_PARSE_BASE = "http://betterportal.invalid";
+const ROLE_ID_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,63}$/;
+const RESERVED_ROLE_IDS = new Set(["*", "root"]);
 async function readFormBody(event) {
     const fd = await event.req.formData().catch(() => null);
     if (!fd)
@@ -14,6 +17,24 @@ async function readFormBody(event) {
         out[k] = v; });
     return out;
 }
+async function readFormBodyWithArrays(event) {
+    const fd = await event.req.formData().catch(() => null);
+    if (!fd)
+        return {};
+    const out = {};
+    fd.forEach((v, k) => {
+        if (typeof v !== "string")
+            return;
+        const existing = out[k];
+        if (Array.isArray(existing))
+            existing.push(v);
+        else if (typeof existing === "string")
+            out[k] = [existing, v];
+        else
+            out[k] = v;
+    });
+    return out;
+}
 function escapeHtml(s) {
     return s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]));
 }
@@ -26,7 +47,7 @@ async function readJsonBody(event) {
 async function readFormOrJsonBody(event) {
     const contentType = event.req.headers.get("content-type") ?? "";
     if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-        return readFormBody(event);
+        return readFormBodyWithArrays(event);
     }
     return readJsonBody(event);
 }
@@ -45,6 +66,18 @@ function htmxError(message, status = 400) {
 function validationError(event, message) {
     return wantsHtmx(event) ? htmxError(message, 400) : jsonResponse({ error: message }, 400);
 }
+function validateRoleId(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const roleId = value.trim();
+    if (!roleId)
+        return undefined;
+    if (!ROLE_ID_PATTERN.test(roleId))
+        return undefined;
+    if (RESERVED_ROLE_IDS.has(roleId.toLowerCase()))
+        return undefined;
+    return roleId;
+}
 function trimmedString(body, key) {
     const value = body[key];
     return typeof value === "string" ? value.trim() : undefined;
@@ -59,6 +92,12 @@ function routeMethodsFromManifest(methods) {
     const normalized = (methods ?? []).filter((method) => method === "GET" || method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE" || method === "OPTIONS");
     return normalized.length ? normalized : ["GET"];
 }
+function hasPageRenderer(view) {
+    const renderers = view.html?.themeRenderers;
+    if (!renderers)
+        return view.renderable !== false;
+    return Object.values(renderers).some((renderer) => Array.isArray(renderer.renderModes) && renderer.renderModes.includes("page"));
+}
 function appMatchesTenantUrl(app, tenantUrl) {
     let host = "";
     try {
@@ -187,7 +226,9 @@ function parseRouteCreateBody(body) {
         return { error: viewId.error };
     const manifestView = getManifestCache().get(serviceId.value)?.viewIndex[viewId.value];
     const renderable = manifestView?.renderable !== false;
-    const path = renderable ? requiredRouteString(body, "path", "Mount path") : { value: manifestView?.path ?? `/${viewId.value}` };
+    const manifest = getManifestCache().get(serviceId.value);
+    const serviceRoutePath = manifestView?.path ?? `/${viewId.value}`;
+    const path = renderable ? requiredRouteString(body, "path", "Mount path") : { value: apiRoutePath(manifest?.serviceId ?? serviceId.value, serviceRoutePath) };
     if (path.error)
         return { error: path.error };
     if (!path.value.startsWith("/"))
@@ -196,6 +237,7 @@ function parseRouteCreateBody(body) {
     if (title.error)
         return { error: title.error };
     const route = {
+        kind: renderable ? "page" : "api",
         path: path.value,
         serviceId: serviceId.value,
         viewId: viewId.value,
@@ -281,7 +323,8 @@ function addRouteDependencies(appDef, route) {
             continue;
         appDef.routes.push({
             id: uuidv7(),
-            path: dependency.path,
+            kind: "api",
+            path: apiRoutePath(manifest.serviceId, dependency.path),
             serviceId: route.serviceId,
             viewId: dependencyViewId,
             targetPath: dependency.path,
@@ -1269,6 +1312,11 @@ export function registerAdminApiRoutes(app, store, cpState) {
         const title = body.title;
         if (!title)
             return wantsHtmx(event) ? htmxError("title required") : jsonResponse({ error: "title required" }, 400);
+        const roleId = validateRoleId(body.id);
+        if (!roleId) {
+            const message = "role id must start with a letter or number, may contain letters, numbers, dot, underscore, colon, or dash, and cannot be reserved";
+            return wantsHtmx(event) ? htmxError(message) : jsonResponse({ error: message }, 400);
+        }
         const { config, appDef } = await getAppOr404(appId);
         if (!appDef)
             return wantsHtmx(event) ? htmxError("App not found", 404) : jsonResponse({ error: "App not found" }, 404);
@@ -1277,7 +1325,7 @@ export function registerAdminApiRoutes(app, store, cpState) {
             return authResult.response;
         const auth = authResult.auth;
         const role = {
-            id: body.id || uuidv7(),
+            id: roleId,
             title,
             description: body.description,
             permissions: Array.isArray(body.permissions) ? body.permissions : []
@@ -1424,15 +1472,20 @@ export function registerAdminApiRoutes(app, store, cpState) {
                 return validationError(event, "View is required.");
             route.viewId = viewId;
         }
-        const manifestView = getManifestCache().get(route.serviceId)?.viewIndex[route.viewId];
+        const manifest = getManifestCache().get(route.serviceId);
+        const manifestView = manifest?.viewIndex[route.viewId];
         if (manifestView) {
             route.methods = routeMethodsFromManifest(manifestView.methods);
             route.targetPath = manifestView.path;
             if (manifestView.renderable === false) {
-                route.path = manifestView.path;
+                route.kind = "api";
+                route.path = apiRoutePath(manifest?.serviceId ?? route.serviceId, manifestView.path);
                 route.title = manifestView.viewId;
                 delete route.query;
             }
+            else {
+                route.kind = "page";
+            }
         }
         if (body.targetPath !== undefined) {
             const targetPath = trimmedString(body, "targetPath");
@@ -1443,7 +1496,9 @@ export function registerAdminApiRoutes(app, store, cpState) {
         }
         if (body.query !== undefined) {
             const query = trimmedString(body, "query");
-            if (query)
+            if (isApiRoute(route, manifestView?.renderable))
+                delete route.query;
+            else if (query)
                 route.query = query.replace(/^\?+/, "");
             else
                 delete route.query;
@@ -1452,7 +1507,8 @@ export function registerAdminApiRoutes(app, store, cpState) {
             const title = trimmedString(body, "title");
             if (!title)
                 return validationError(event, "Display title is required.");
-            route.title = title;
+            if (!isApiRoute(route, manifestView?.renderable))
+                route.title = title;
         }
         if (body.enabled !== undefined)
             route.enabled = body.enabled === true || body.enabled === "true" || body.enabled === "on";
@@ -1530,7 +1586,7 @@ export function registerAdminApiRoutes(app, store, cpState) {
     // Browser-mediated: the admin UI fetches the manifest from the service
     // (CM cannot reach services) and POSTs the parsed payload here.
     app.post(`${API_BASE}/wizard/verify`, async (event) => {
-        const adminApiBase = adminApiBaseFromControlPlane(cpState);
+        const adminApiBase = API_BASE;
         const form = await readFormBody(event);
         const tenantId = form.tenantId ?? "";
         const hostname = normalizeHostname(form.hostname);
@@ -1568,17 +1624,22 @@ export function registerAdminApiRoutes(app, store, cpState) {
     });
     // HTMX wizard: register service
     app.post(`${API_BASE}/wizard/register`, async (event) => {
-        const form = await readFormBody(event);
-        const tenantId = form.tenantId ?? "";
-        const hostname = (form.hostname ?? "").replace(/\/+$/, "");
-        const title = form.title || hostname;
+        const body = await readFormOrJsonBody(event);
+        const jsonMode = (event.req.headers.get("accept") ?? "").includes("application/json")
+            || (event.req.headers.get("content-type") ?? "").includes("application/json");
+        const registerError = (message, status = 400) => jsonMode
+            ? jsonResponse({ error: message }, status)
+            : htmlResponse(`<div class="alert alert-danger">${escapeHtml(message)}</div>`, 200, "text/html; mode=fragment");
+        const tenantId = typeof body.tenantId === "string" ? body.tenantId : "";
+        const hostname = (typeof body.hostname === "string" ? body.hostname : "").replace(/\/+$/, "");
+        const title = (typeof body.title === "string" && body.title.trim().length > 0 ? body.title.trim() : hostname);
         if (!tenantId || !hostname) {
-            return htmlResponse(`<div class="alert alert-danger">Missing tenantId or hostname</div>`, 200, "text/html; mode=fragment");
+            return registerError("Missing tenantId or hostname");
         }
         const config = await store.loadConfig();
         const tenant = config.tenants.find((t) => t.id === tenantId);
         if (!tenant) {
-            return htmlResponse(`<div class="alert alert-danger">Tenant not found</div>`, 200, "text/html; mode=fragment");
+            return registerError("Tenant not found", 404);
         }
         // Schema is fetched by the browser from the service (CM cannot reach services)
         // and posted to us as a JSON string in form.schema.
@@ -1586,19 +1647,27 @@ export function registerAdminApiRoutes(app, store, cpState) {
         let capabilities = [];
         let serviceRoutes = [];
         let viewMeta = new Map();
-        if (form.schema) {
+        const schemaText = typeof body.schema === "string" ? body.schema : "";
+        if (schemaText) {
             try {
-                const schema = JSON.parse(form.schema);
+                const schema = JSON.parse(schemaText);
                 serviceId = schema.manifest?.pluginId;
                 capabilities = Array.isArray(schema.manifest?.capabilities) ? schema.manifest.capabilities.filter((value) => typeof value === "string") : [];
                 serviceRoutes = schema.routes ?? [];
-                viewMeta = new Map((schema.manifest?.views ?? []).map((v) => [v.viewId, v.title]));
+                viewMeta = new Map((schema.manifest?.views ?? []).map((v) => [v.viewId, {
+                        title: v.title,
+                        renderable: v.renderable !== false,
+                        pageRenderable: hasPageRenderer(v),
+                        methods: Array.isArray(v.methods)
+                            ? v.methods.filter((value) => typeof value === "string")
+                            : []
+                    }]));
             }
             catch { /* malformed schema - register without routes */ }
         }
         const duplicate = duplicateTenantService(tenant, hostname, serviceId);
         if (duplicate) {
-            return htmlResponse(`<div class="alert alert-warning">${escapeHtml(duplicate)}</div>`, 200, "text/html; mode=fragment");
+            return registerError(duplicate, 409);
         }
         const newServiceId = uuidv7();
         const service = {
@@ -1621,30 +1690,37 @@ export function registerAdminApiRoutes(app, store, cpState) {
                 const groupChildren = [];
                 const existingPaths = new Set(appDef.routes.map((r) => r.path));
                 for (const r of serviceRoutes) {
+                    const meta = viewMeta.get(r.viewId);
+                    const renderable = meta?.renderable ?? r.renderable !== false;
                     // Default mounting path is the service's own path; skip collisions
-                    const mountPath = existingPaths.has(r.path) ? `/${title.toLowerCase().replace(/[^a-z0-9]+/g, "-")}${r.path}` : r.path;
+                    const mountPath = renderable
+                        ? (existingPaths.has(r.path) ? `/${title.toLowerCase().replace(/[^a-z0-9]+/g, "-")}${r.path}` : r.path)
+                        : apiRoutePath(serviceId ?? newServiceId, r.path);
                     if (existingPaths.has(mountPath))
                         continue;
                     const routeId = uuidv7();
-                    const routeTitle = viewMeta.get(r.viewId) ?? r.viewId;
+                    const routeTitle = meta?.title ?? r.viewId;
                     appDef.routes.push({
                         id: routeId,
+                        kind: renderable ? "page" : "api",
                         path: mountPath,
                         serviceId: newServiceId,
                         viewId: r.viewId,
                         targetPath: r.path,
                         title: routeTitle,
                         enabled: true,
-                        methods: ["GET"]
+                        methods: routeMethodsFromManifest(r.methods)
                     });
                     existingPaths.add(mountPath);
-                    groupChildren.push({
-                        id: uuidv7(),
-                        type: "link",
-                        title: routeTitle,
-                        routeId,
-                        enabled: true
-                    });
+                    if (meta?.pageRenderable === true && !isApiRoute({ kind: renderable ? "page" : "api", path: mountPath }, renderable)) {
+                        groupChildren.push({
+                            id: uuidv7(),
+                            type: "link",
+                            title: routeTitle,
+                            routeId,
+                            enabled: true
+                        });
+                    }
                 }
                 if (groupChildren.length > 0) {
                     const menu = (appDef.menu ?? []);
@@ -1660,7 +1736,17 @@ export function registerAdminApiRoutes(app, store, cpState) {
             }
         }
         await store.saveConfig(config);
-        const adminApiBase = adminApiBaseFromControlPlane(cpState);
+        if (jsonMode) {
+            return jsonResponse({
+                ok: true,
+                tenantId,
+                serviceInstanceId: newServiceId,
+                serviceUrl: hostname,
+                title,
+                deploymentMode: service.deploymentMode
+            });
+        }
+        const adminApiBase = API_BASE;
         return htmlResponse(renderWizardStep3({
             apiKey: "",
             deploymentMode: service.deploymentMode,
@@ -1691,7 +1777,7 @@ export function registerAdminApiRoutes(app, store, cpState) {
         const tenantId = url.searchParams.get("tenantId") ?? undefined;
         const hostname = url.searchParams.get("hostname") ?? undefined;
         const config = await store.loadConfig();
-        return htmlResponse(renderWizardStep1(config, undefined, { tenantId, hostname }, adminApiBaseFromControlPlane(cpState)), 200, "text/html; mode=fragment");
+        return htmlResponse(renderWizardStep1(config, undefined, { tenantId, hostname }, API_BASE), 200, "text/html; mode=fragment");
     });
     // HTMX configure: load form
     app.get(`${API_BASE}/configure`, async (event) => {