@betterportal/config-manager 10.1.52 → 10.1.54

package/lib/plugins/service-betterportal-config-manager/adminApi.js

@@ -90,6 +90,76 @@ function requiredRouteString(body, key, label) {
         return { error: `${label} is required.` };
     return { value };
 }
+function routeParamNames(path) {
+    return [...new Set(path.split("/").flatMap((segment) => {
+            const match = segment.match(/^:([A-Za-z_][A-Za-z0-9_]*)$/);
+            return match ? [match[1]] : [];
+        }))];
+}
+function validateCanonicalRoutePath(path, label) {
+    if (!path.startsWith("/"))
+        return `${label} must start with /.`;
+    if (/\{[^}]+\}/.test(path))
+        return `${label} must use :param syntax; {param} is no longer supported.`;
+    for (const segment of path.split("/")) {
+        if (segment.startsWith(":") && !/^:[A-Za-z_][A-Za-z0-9_]*$/.test(segment)) {
+            return `${label} contains an invalid parameter segment: ${segment}.`;
+        }
+    }
+    return undefined;
+}
+function fixedParamsFromBody(body) {
+    const fixed = {};
+    for (const [key, value] of Object.entries(body)) {
+        if (!key.startsWith("fixedParam."))
+            continue;
+        const name = key.slice("fixedParam.".length);
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) || typeof value !== "string")
+            continue;
+        const normalized = value.trim();
+        if (normalized)
+            fixed[name] = normalized;
+    }
+    return fixed;
+}
+function validateFixedParamValue(name, value, paramsSchema) {
+    const properties = paramsSchema?.properties;
+    const schema = properties && typeof properties === "object" && !Array.isArray(properties)
+        ? properties[name]
+        : undefined;
+    const rule = schema && typeof schema === "object" && !Array.isArray(schema)
+        ? schema
+        : {};
+    const minLength = typeof rule.minLength === "number" ? rule.minLength : 1;
+    const maxLength = Math.min(typeof rule.maxLength === "number" ? rule.maxLength : 100, 100);
+    if (value.length < minLength || value.length > maxLength) {
+        return `${name} must be between ${minLength} and ${maxLength} characters.`;
+    }
+    if (typeof rule.pattern === "string") {
+        try {
+            if (!new RegExp(rule.pattern).test(value))
+                return `${name} does not match its service validation pattern.`;
+        }
+        catch {
+            return `${name} has an invalid validation pattern in the service manifest.`;
+        }
+    }
+    return undefined;
+}
+function validateRouteParamMapping(appPath, servicePath, fixedParams, paramsSchema) {
+    const appParams = new Set(routeParamNames(appPath));
+    for (const name of routeParamNames(servicePath)) {
+        if (appParams.has(name))
+            continue;
+        const value = fixedParams[name];
+        if (!value)
+            return `Service parameter :${name} must appear in the app path or have a fixed value.`;
+        const valueError = validateFixedParamValue(name, value, paramsSchema);
+        if (valueError)
+            return valueError;
+    }
+    return undefined;
+}
 function routeMethodsFromManifest(methods) {
     const normalized = (methods ?? []).filter((method) => method === "GET" || method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE" || method === "OPTIONS");
     return normalized.length ? normalized : ["GET"];
@@ -266,12 +336,24 @@ function parseRouteCreateBody(body) {
     const manifestView = getManifestCache().get(serviceId.value)?.viewIndex[viewId.value];
     const renderable = manifestView?.renderable !== false;
     const manifest = getManifestCache().get(serviceId.value);
-    const serviceRoutePath = manifestView?.path ?? `/${viewId.value}`;
+    const servicePathVariant = trimmedString(body, "servicePathVariant") ?? manifestView?.path ?? `/${viewId.value}`;
+    if (manifestView && ![manifestView.path, ...manifestView.pathVariants].includes(servicePathVariant)) {
+        return { error: "Selected service path is not available for this view." };
+    }
+    const serviceRoutePath = servicePathVariant;
     const path = renderable ? requiredRouteString(body, "path", "Mount path") : { value: apiRoutePath(manifest?.serviceId ?? serviceId.value, serviceRoutePath) };
     if (path.error)
         return { error: path.error };
-    if (!path.value.startsWith("/"))
-        return { error: "Mount path must start with /." };
+    const pathError = validateCanonicalRoutePath(path.value, "Mount path");
+    if (pathError)
+        return { error: pathError };
+    const servicePathError = validateCanonicalRoutePath(serviceRoutePath, "Service path");
+    if (servicePathError)
+        return { error: servicePathError };
+    const fixedParams = fixedParamsFromBody(body);
+    const mappingError = validateRouteParamMapping(path.value, serviceRoutePath, fixedParams, manifestView?.paramsSchema);
+    if (mappingError)
+        return { error: mappingError };
     const title = renderable ? requiredRouteString(body, "title", "Display title") : { value: manifestView?.viewId ?? viewId.value };
     if (title.error)
         return { error: title.error };
@@ -280,12 +362,14 @@ function parseRouteCreateBody(body) {
         path: path.value,
         serviceId: serviceId.value,
         viewId: viewId.value,
+        ...(manifestView && servicePathVariant !== manifestView.path ? { servicePathVariant } : {}),
+        ...(Object.keys(fixedParams).length > 0 ? { fixedParams } : {}),
         title: title.value,
         enabled: true,
         methods: routeMethodsFromManifest(manifestView?.methods)
     };
     if (manifestView?.path)
-        route.targetPath = manifestView.path;
+        route.targetPath = serviceRoutePath;
     const query = trimmedString(body, "query");
     if (query && renderable)
         route.query = query.replace(/^\?+/, "");
@@ -1845,8 +1929,9 @@ export function registerAdminApiRoutes(app, store, cpState) {
             const path = trimmedString(body, "path");
             if (!path)
                 return validationError(event, "Mount path is required.");
-            if (!path.startsWith("/"))
-                return validationError(event, "Mount path must start with /.");
+            const pathError = validateCanonicalRoutePath(path, "Mount path");
+            if (pathError)
+                return validationError(event, pathError);
             if (appDef.routes.some((candidate) => candidate.id !== route.id && appRoutePatternKey(candidate.path) === appRoutePatternKey(path))) {
                 return validationError(event, `A route already exists at ${path}.`);
             }
@@ -1870,11 +1955,38 @@ export function registerAdminApiRoutes(app, store, cpState) {
         const manifest = getManifestCache().get(route.serviceId);
         const manifestView = manifest?.viewIndex[route.viewId];
         if (manifestView) {
+            const routeIdentityChanged = body.serviceId !== undefined || body.viewId !== undefined;
+            const requestedServicePath = trimmedString(body, "servicePathVariant")
+                ?? (routeIdentityChanged ? undefined : route.servicePathVariant)
+                ?? manifestView.path;
+            if (![manifestView.path, ...manifestView.pathVariants].includes(requestedServicePath)) {
+                return validationError(event, "Selected service path is not available for this view.");
+            }
+            const servicePathError = validateCanonicalRoutePath(requestedServicePath, "Service path");
+            if (servicePathError)
+                return validationError(event, servicePathError);
+            const submittedFixed = fixedParamsFromBody(body);
+            const mappedAppPath = manifestView.renderable === false
+                ? apiRoutePath(manifest?.serviceId ?? route.serviceId, requestedServicePath)
+                : route.path;
+            const appParams = new Set(routeParamNames(mappedAppPath));
+            const fixedParams = Object.fromEntries(Object.entries(submittedFixed).filter(([name]) => routeParamNames(requestedServicePath).includes(name) && !appParams.has(name)));
+            const mappingError = validateRouteParamMapping(mappedAppPath, requestedServicePath, fixedParams, manifestView.paramsSchema);
+            if (mappingError)
+                return validationError(event, mappingError);
+            if (requestedServicePath === manifestView.path)
+                delete route.servicePathVariant;
+            else
+                route.servicePathVariant = requestedServicePath;
+            if (Object.keys(fixedParams).length > 0)
+                route.fixedParams = fixedParams;
+            else
+                delete route.fixedParams;
             route.methods = routeMethodsFromManifest(manifestView.methods);
-            route.targetPath = manifestView.path;
+            route.targetPath = requestedServicePath;
             if (manifestView.renderable === false) {
                 route.kind = "api";
-                route.path = apiRoutePath(manifest?.serviceId ?? route.serviceId, manifestView.path);
+                route.path = apiRoutePath(manifest?.serviceId ?? route.serviceId, requestedServicePath);
                 route.title = manifestView.viewId;
                 delete route.query;
             }
@@ -2552,7 +2664,7 @@ function renderConfigControl(field, value, placeholder, disabled) {
     const inputType = ["number", "color", "date", "time", "datetime-local", "url", "email", "password"].includes(control) ? control : "text";
     return `<input class="form-control" type="${inputType}" name="${name}" value="${escapeHtml(value)}" placeholder="${placeholderAttr}" ${attrs}${disabledAttr} />`;
 }
-function renderConfigClientShell(d) {
+export function renderConfigClientShell(d) {
     const payload = JSON.stringify({
         hostname: d.hostname,
         tenantId: d.tenantId,
@@ -2631,6 +2743,26 @@ function renderConfigClientShell(d) {
     if (!response.ok) throw new Error(data.error || data.message || "config HTTP " + response.status);
     return data.values || {};
   };
+  const writeValues = async (token, appId, values, clearKeys = []) => {
+    const headers = {
+      "Content-Type": "application/json",
+      Accept: "application/json",
+      Authorization: "Bearer " + token,
+      "x-bp-tenant-id": cfg.tenantId
+    };
+    if (appId) headers["x-bp-app-id"] = appId;
+    const payload = { tenantId: cfg.tenantId, values };
+    if (appId) payload.appId = appId;
+    if (clearKeys.length > 0) payload.clearKeys = clearKeys;
+    const response = await fetch(serviceBase() + "/.well-known/bp/config", {
+      method: "POST",
+      headers,
+      body: JSON.stringify(payload)
+    });
+    const data = await readJson(response, "config write");
+    if (!response.ok) throw new Error(data.error || data.message || "config HTTP " + response.status);
+    return data;
+  };
   const hasOwn = (obj, key) => Object.prototype.hasOwnProperty.call(obj || {}, key);
   const compareOrder = (left, right) => {
     const leftOrder = typeof left.order === "number" ? left.order : 0;
@@ -2730,13 +2862,16 @@ function renderConfigClientShell(d) {
     const layout = schemaLayout(schema);
     const fields = layout.fields;
     const scope = selectedScope === "app" ? "app" : "tenant";
-    const selectedAppId = scope === "app" ? appId : "";
+    const apps = cfg.tenantApps || [];
+    const selectedAppId = scope === "app"
+      ? (apps.some((app) => app.id === appId) ? appId : apps[0]?.id || "")
+      : "";
     const tenantValues = await loadValues(token, "");
     const appValues = selectedAppId ? await loadValues(token, selectedAppId) : {};
     const scopeSelector = '<div class="row g-2 mb-3"><div class="col-5"><label class="form-label">Scope</label>' +
       '<select class="form-select" data-bp-config-scope><option value="tenant"' + (scope === "tenant" ? " selected" : "") + '>Tenant defaults</option><option value="app"' + (scope === "app" ? " selected" : "") + '>App override</option></select></div>' +
       '<div class="col-7"><label class="form-label">App</label><select class="form-select" data-bp-config-app ' + (scope === "app" ? "" : "disabled") + '><option value="">Select app...</option>' +
-      (cfg.tenantApps || []).map((app) => '<option value="' + escapeHtml(app.id) + '"' + (app.id === selectedAppId ? " selected" : "") + '>' + escapeHtml(app.title) + '</option>').join("") +
+      apps.map((app) => '<option value="' + escapeHtml(app.id) + '"' + (app.id === selectedAppId ? " selected" : "") + '>' + escapeHtml(app.title) + '</option>').join("") +
       '</select></div></div>';
     if (scope === "app" && !selectedAppId) {
       body.innerHTML = scopeSelector + '<div class="alert alert-info">Select an app to edit overrides.</div>';
@@ -2779,8 +2914,88 @@ function renderConfigClientShell(d) {
       const content = sectionFields.map(renderField).join("");
       return '<div class="border rounded p-3 mb-3" data-bp-config-section="' + escapeHtml(section.id) + '">' + header + content + '</div>';
     }).join("");
-    body.innerHTML = scopeSelector + '<form data-bp-config-form>' + sectionsHtml + '<div data-bp-save-status></div><button type="submit" class="btn btn-primary w-100">Save Configuration</button></form>';
+    const transferActions = '<div class="d-flex justify-content-end gap-2 mb-3">' +
+      '<button type="button" class="btn btn-sm btn-link text-decoration-none p-0" data-bp-config-export>Export</button>' +
+      '<button type="button" class="btn btn-sm btn-link text-decoration-none p-0" data-bp-config-import>Import</button>' +
+      '<input type="file" accept="application/json,.json" hidden data-bp-config-import-file />' +
+      '</div>';
+    body.innerHTML = scopeSelector + transferActions + '<form data-bp-config-form>' + sectionsHtml + '<div data-bp-save-status></div><button type="submit" class="btn btn-primary w-100">Save Configuration</button></form>';
     wireScopeControls(schema, token);
+    const currentValues = scope === "app" ? appValues : tenantValues;
+    const importFile = root.querySelector("[data-bp-config-import-file]");
+    root.querySelector("[data-bp-config-export]")?.addEventListener("click", () => {
+      const values = {};
+      let omittedSecrets = 0;
+      for (const field of fields) {
+        if (!hasOwn(currentValues, field.key)) continue;
+        if (field.visibility === "secret" && currentValues[field.key] === "__redacted__") {
+          omittedSecrets += 1;
+          continue;
+        }
+        values[field.key] = currentValues[field.key];
+      }
+      const exported = {
+        format: "betterportal.service-config",
+        version: 1,
+        serviceId: cfg.serviceId,
+        tenantId: cfg.tenantId,
+        scope,
+        ...(selectedAppId ? { appId: selectedAppId } : {}),
+        values
+      };
+      const blobUrl = URL.createObjectURL(new Blob([JSON.stringify(exported, null, 2) + "\\n"], { type: "application/json" }));
+      const link = document.createElement("a");
+      link.href = blobUrl;
+      link.download = String(cfg.serviceId || "service").replace(/[^a-z0-9._-]+/gi, "-") + "-" + scope + ".json";
+      document.body.appendChild(link);
+      link.click();
+      link.remove();
+      URL.revokeObjectURL(blobUrl);
+      setStatus("ok", "Configuration exported." + (omittedSecrets ? " Stored secrets were omitted." : ""));
+    });
+    root.querySelector("[data-bp-config-import]")?.addEventListener("click", () => importFile?.click());
+    importFile?.addEventListener("change", async () => {
+      const file = importFile.files?.[0];
+      importFile.value = "";
+      if (!file) return;
+      setStatus("info", "Importing configuration...");
+      try {
+        const imported = JSON.parse(await file.text());
+        if (!imported || typeof imported !== "object" || Array.isArray(imported)) throw new Error("Import must be a JSON object.");
+        if (imported.format !== "betterportal.service-config" || imported.version !== 1) throw new Error("Unsupported config export format.");
+        if (imported.serviceId !== cfg.serviceId) throw new Error("This export belongs to a different service.");
+        if (!["tenant", "app"].includes(imported.scope)) throw new Error("Import scope must be tenant or app.");
+        if (imported.scope !== scope) throw new Error("Select the " + imported.scope + " scope before importing this file.");
+        if (!imported.values || typeof imported.values !== "object" || Array.isArray(imported.values)) throw new Error("Import values must be a JSON object.");
+        const fieldsByKey = new Map(fields.map((field) => [field.key, field]));
+        const unknownKeys = Object.keys(imported.values).filter((key) => !fieldsByKey.has(key));
+        if (unknownKeys.length > 0) throw new Error("Unknown config fields: " + unknownKeys.join(", "));
+        const values = {};
+        const clearKeys = [];
+        for (const field of fields) {
+          if (hasOwn(imported.values, field.key)) {
+            if (field.visibility !== "secret" || imported.values[field.key] !== "__redacted__") {
+              values[field.key] = imported.values[field.key];
+            }
+          } else if (field.visibility !== "secret") {
+            clearKeys.push(field.key);
+          }
+        }
+        const scopeLabel = selectedAppId
+          ? "the selected app override"
+          : "the tenant defaults";
+        if (!window.confirm("Replace " + scopeLabel + " with this import? Existing stored secrets are preserved unless the file supplies replacements.")) {
+          setStatus("info", "Import cancelled.");
+          return;
+        }
+        await writeValues(token, selectedAppId, values, clearKeys);
+        document.body.dispatchEvent(new CustomEvent("bp:config-saved"));
+        await renderForm(schema, token, scope, selectedAppId);
+        setStatus("ok", "Configuration imported.");
+      } catch (error) {
+        setStatus("error", error instanceof Error ? error.message : String(error));
+      }
+    });
     root.querySelectorAll("[data-bp-override-key]").forEach((checkbox) => {
       checkbox.addEventListener("change", () => {
         const field = checkbox.closest("[data-bp-field]");
@@ -2803,24 +3018,14 @@ function renderConfigClientShell(d) {
         if (!key) return;
         button.disabled = true;
         setStatus("info", "Resetting " + key + "...");
-        const response = await fetch(serviceBase() + "/.well-known/bp/config", {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            Accept: "application/json",
-            Authorization: "Bearer " + token,
-            "x-bp-tenant-id": cfg.tenantId
-          },
-          body: JSON.stringify({ tenantId: cfg.tenantId, values: {}, clearKeys: [key] })
-        });
-        if (!response.ok) {
-          const error = await readJson(response, "reset").catch((err) => ({ error: err.message || "HTTP " + response.status }));
-          setStatus("error", error.error || "Reset failed.");
+        try {
+          await writeValues(token, "", {}, [key]);
+          document.body.dispatchEvent(new CustomEvent("bp:config-saved"));
+          await renderForm(schema, token, "tenant", "");
+        } catch (error) {
+          setStatus("error", error instanceof Error ? error.message : String(error));
           button.disabled = false;
-          return;
         }
-        document.body.dispatchEvent(new CustomEvent("bp:config-saved"));
-        await renderForm(schema, token, "tenant", "");
       });
     });
     root.querySelector("[data-bp-config-form]")?.addEventListener("submit", async (event) => {
@@ -2849,31 +3054,17 @@ function renderConfigClientShell(d) {
           if (value !== undefined && value !== "(unchanged)") valuesToSave[field.key] = value;
         }
       }
-      const payload = { tenantId: cfg.tenantId, values: valuesToSave };
-      if (selectedAppId) payload.appId = selectedAppId;
-      if (clearKeys.length > 0) payload.clearKeys = clearKeys;
-      const headers = {
-        "Content-Type": "application/json",
-        Accept: "application/json",
-        Authorization: "Bearer " + token,
-        "x-bp-tenant-id": cfg.tenantId
-      };
-      if (selectedAppId) headers["x-bp-app-id"] = selectedAppId;
-      const response = await fetch(serviceBase() + "/.well-known/bp/config", {
-        method: "POST",
-        headers,
-        body: JSON.stringify(payload)
-      });
-      if (!response.ok) {
-        const error = await readJson(response, "save").catch((err) => ({ error: err.message || "HTTP " + response.status }));
-        if (saveStatus) saveStatus.innerHTML = '<div class="alert alert-danger">' + escapeHtml(error.error || "Save failed") + '</div>';
-        setStatus("error", error.error || "Save failed.");
+      try {
+        await writeValues(token, selectedAppId, valuesToSave, clearKeys);
+        document.body.dispatchEvent(new CustomEvent("bp:config-saved"));
+        await renderForm(schema, token, scope, selectedAppId);
+        setStatus("ok", "Configuration saved.");
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (saveStatus) saveStatus.innerHTML = '<div class="alert alert-danger">' + escapeHtml(message) + '</div>';
+        setStatus("error", message);
         if (submitButton) submitButton.disabled = false;
-        return;
       }
-      document.body.dispatchEvent(new CustomEvent("bp:config-saved"));
-      await renderForm(schema, token, scope, selectedAppId);
-      setStatus("ok", "Configuration saved.");
     });
     setStatus("ok", "Configuration loaded.");
   };