@coffer-org/server 1.2.4 → 1.3.0

package/dist/auth-api.d.ts

@@ -0,0 +1,11 @@
+import type { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
+import { type AuthUser } from './auth-store.ts';
+declare module 'fastify' {
+    interface FastifyRequest {
+        user?: AuthUser;
+    }
+}
+export declare const PUBLIC_API_PATHS: string[];
+export declare function resolveRequestUser(req: FastifyRequest): Promise<AuthUser | null>;
+export declare function requireAdmin(req: FastifyRequest, reply: FastifyReply): boolean;
+export declare function registerAuthApi(app: FastifyInstance): Promise<void>;

package/dist/auth-api.js

@@ -0,0 +1,184 @@
+import { field } from '@coffer-org/sdk/fields';
+import { countUsers, createUser, findUserByLogin, findUserById, getPasswordHash, listUsers, updateUser, deleteUser, countAdmins, createSession, resolveSession, deleteSession, createApiToken, resolveApiToken, listApiTokens, revokeApiToken, } from "./auth-store.js";
+import { verifyPassword } from "./auth-crypto.js";
+import { maskSecrets, preserveSecrets } from "./secrets.js";
+import { rowMatch } from "./records-api.js";
+import { tokenize } from '@coffer-org/core/search';
+import { USERS_MODULE } from '@coffer-org/sdk/users-module';
+const PASSWORD_FIELDS = [field.password({ key: 'password' })];
+const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+const COOKIE_NAME = 'sid';
+export const PUBLIC_API_PATHS = ['/api/auth/status', '/api/auth/login', '/api/auth/setup'];
+function readCookie(req, name) {
+    const header = req.headers.cookie;
+    if (!header)
+        return undefined;
+    for (const part of header.split(';')) {
+        const [k, ...rest] = part.trim().split('=');
+        if (k === name)
+            return rest.join('=');
+    }
+    return undefined;
+}
+function setCookie(reply, value, maxAgeSec) {
+    const secure = process.env['NODE_ENV'] === 'production' ? '; Secure' : '';
+    reply.header('set-cookie', `${COOKIE_NAME}=${value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAgeSec}${secure}`);
+}
+export async function resolveRequestUser(req) {
+    const auth = req.headers.authorization;
+    if (auth?.startsWith('Bearer ')) {
+        return resolveApiToken(auth.slice('Bearer '.length));
+    }
+    const sid = readCookie(req, COOKIE_NAME);
+    if (!sid)
+        return null;
+    return resolveSession(sid);
+}
+export function requireAdmin(req, reply) {
+    if (req.user?.role !== 'admin') {
+        reply.code(403).send({ error: 'forbidden' });
+        return false;
+    }
+    return true;
+}
+function publicUser(u) {
+    return { id: u.id, login: u.login, displayName: u.displayName, role: u.role, disabled: u.disabled };
+}
+function withMaskedPassword(u) {
+    return maskSecrets(PASSWORD_FIELDS, { ...publicUser(u), password: 'x' });
+}
+async function resolvePasswordPatch(userId, rawPassword) {
+    const existingHash = await getPasswordHash(userId);
+    const preserved = preserveSecrets(PASSWORD_FIELDS, { password: rawPassword }, { password: existingHash ?? undefined });
+    const val = preserved['password'];
+    if (!val || val === existingHash)
+        return undefined;
+    return val;
+}
+export async function registerAuthApi(app) {
+    app.get('/api/auth/status', async () => ({ needsSetup: (await countUsers()) === 0 }));
+    app.post('/api/auth/setup', async (req, reply) => {
+        if ((await countUsers()) > 0)
+            return reply.code(409).send({ error: 'already_setup' });
+        const body = (req.body ?? {});
+        if (!body.login || !body.password || !body.displayName) {
+            return reply.code(422).send({ issues: [{ field: !body.login ? 'login' : !body.password ? 'password' : 'displayName', code: 'required' }] });
+        }
+        const user = await createUser({ login: body.login, password: body.password, displayName: body.displayName, role: 'admin' });
+        const { raw } = await createSession(user.id, SESSION_TTL_MS);
+        setCookie(reply, raw, SESSION_TTL_MS / 1000);
+        return publicUser(user);
+    });
+    app.post('/api/auth/login', async (req, reply) => {
+        const body = (req.body ?? {});
+        if (!body.login || !body.password)
+            return reply.code(422).send({ issues: [{ field: 'login', code: 'required' }] });
+        const row = await findUserByLogin(body.login);
+        if (!row || row.disabled || !(await verifyPassword(body.password, row.passwordHash))) {
+            return reply.code(401).send({ error: 'invalid_credentials' });
+        }
+        const { raw } = await createSession(row.id, SESSION_TTL_MS);
+        setCookie(reply, raw, SESSION_TTL_MS / 1000);
+        return publicUser(row);
+    });
+    app.post('/api/auth/logout', async (req, reply) => {
+        const sid = readCookie(req, COOKIE_NAME);
+        if (sid)
+            await deleteSession(sid);
+        setCookie(reply, '', 0);
+        return { ok: true };
+    });
+    app.get('/api/auth/me', async (req, reply) => {
+        if (!req.user)
+            return reply.code(401).send({ error: 'unauthorized' });
+        return withMaskedPassword(req.user);
+    });
+    app.patch('/api/auth/me', async (req, reply) => {
+        if (!req.user)
+            return reply.code(401).send({ error: 'unauthorized' });
+        const body = (req.body ?? {});
+        const password = await resolvePasswordPatch(req.user.id, body.password);
+        const updated = await updateUser(req.user.id, { displayName: body.displayName, password });
+        return withMaskedPassword(updated);
+    });
+    app.get('/api/auth/users', async (req, reply) => {
+        if (!requireAdmin(req, reply))
+            return;
+        const { q } = req.query;
+        const tokens = q ? tokenize(q) : [];
+        let users = await listUsers();
+        if (tokens.length > 0) {
+            users = users.filter((u) => rowMatch(USERS_MODULE, u, tokens) !== null);
+        }
+        return users.map(withMaskedPassword);
+    });
+    app.post('/api/auth/users', async (req, reply) => {
+        if (!requireAdmin(req, reply))
+            return;
+        const body = (req.body ?? {});
+        if (!body.login || !body.password || !body.displayName || (body.role !== 'admin' && body.role !== 'member')) {
+            return reply.code(422).send({ issues: [{ field: 'login', code: 'required' }] });
+        }
+        const user = await createUser({ login: body.login, password: body.password, displayName: body.displayName, role: body.role });
+        return publicUser(user);
+    });
+    app.patch('/api/auth/users/:id', async (req, reply) => {
+        if (!requireAdmin(req, reply))
+            return;
+        const id = Number(req.params.id);
+        const body = (req.body ?? {});
+        const wantsDisabled = body.disabled === undefined ? undefined : Boolean(body.disabled);
+        const demotingOrDisabling = (body.role === 'member' || wantsDisabled === true) && (await isLastAdmin(id));
+        if (demotingOrDisabling)
+            return reply.code(409).send({ error: 'last_admin' });
+        const password = await resolvePasswordPatch(id, body.password);
+        const updated = await updateUser(id, {
+            displayName: body.displayName,
+            role: body.role === 'admin' || body.role === 'member' ? body.role : undefined,
+            disabled: wantsDisabled,
+            password,
+        });
+        if (!updated)
+            return reply.code(404).send({ error: 'not_found' });
+        return withMaskedPassword(updated);
+    });
+    app.delete('/api/auth/users/:id', async (req, reply) => {
+        if (!requireAdmin(req, reply))
+            return;
+        const id = Number(req.params.id);
+        if (await isLastAdmin(id))
+            return reply.code(409).send({ error: 'last_admin' });
+        const ok = await deleteUser(id);
+        if (!ok)
+            return reply.code(404).send({ error: 'not_found' });
+        return { ok: true };
+    });
+    async function isLastAdmin(id) {
+        const user = await findUserById(id);
+        return user?.role === 'admin' && (await countAdmins(id)) === 0;
+    }
+    app.get('/api/auth/tokens', async (req, reply) => {
+        if (!req.user)
+            return reply.code(401).send({ error: 'unauthorized' });
+        return listApiTokens(req.user.id);
+    });
+    app.post('/api/auth/tokens', async (req, reply) => {
+        if (!req.user)
+            return reply.code(401).send({ error: 'unauthorized' });
+        const body = (req.body ?? {});
+        if (!body.name || !body.token) {
+            return reply.code(422).send({ issues: [{ field: !body.name ? 'name' : 'token', code: 'required' }] });
+        }
+        const { id, createdAt } = await createApiToken(req.user.id, body.name, body.token);
+        return { id, createdAt };
+    });
+    app.delete('/api/auth/tokens/:id', async (req, reply) => {
+        if (!req.user)
+            return reply.code(401).send({ error: 'unauthorized' });
+        const id = Number(req.params.id);
+        const ok = await revokeApiToken(id, req.user.id);
+        if (!ok)
+            return reply.code(404).send({ error: 'not_found' });
+        return { ok: true };
+    });
+}

package/dist/auth-crypto.d.ts

@@ -0,0 +1,4 @@
+export declare function hashPassword(password: string): Promise<string>;
+export declare function verifyPassword(password: string, stored: string): Promise<boolean>;
+export declare function generateToken(): string;
+export declare function hashToken(raw: string): string;

package/dist/auth-crypto.js

@@ -0,0 +1,24 @@
+import { randomBytes, scrypt as scryptCb, timingSafeEqual, createHash } from 'node:crypto';
+import { promisify } from 'node:util';
+const scrypt = promisify(scryptCb);
+const KEYLEN = 64;
+export async function hashPassword(password) {
+    const salt = randomBytes(16);
+    const derived = await scrypt(password, salt, KEYLEN);
+    return `${salt.toString('hex')}:${derived.toString('hex')}`;
+}
+export async function verifyPassword(password, stored) {
+    const [saltHex, hashHex] = stored.split(':');
+    if (!saltHex || !hashHex)
+        return false;
+    const salt = Buffer.from(saltHex, 'hex');
+    const expected = Buffer.from(hashHex, 'hex');
+    const derived = await scrypt(password, salt, expected.length);
+    return derived.length === expected.length && timingSafeEqual(derived, expected);
+}
+export function generateToken() {
+    return randomBytes(32).toString('base64url');
+}
+export function hashToken(raw) {
+    return createHash('sha256').update(raw).digest('hex');
+}

package/dist/auth-store.d.ts

@@ -0,0 +1,46 @@
+export interface AuthUser {
+    id: number;
+    login: string;
+    displayName: string;
+    role: 'admin' | 'member';
+    disabled: boolean;
+}
+export declare function countUsers(): Promise<number>;
+export declare function createUser(input: {
+    login: string;
+    password: string;
+    displayName: string;
+    role: 'admin' | 'member';
+}): Promise<AuthUser>;
+export declare function findUserByLogin(login: string): Promise<(AuthUser & {
+    passwordHash: string;
+}) | null>;
+export declare function findUserById(id: number): Promise<AuthUser | null>;
+export declare function getPasswordHash(id: number): Promise<string | null>;
+export declare function listUsers(): Promise<AuthUser[]>;
+export declare function updateUser(id: number, patch: {
+    displayName?: string;
+    role?: 'admin' | 'member';
+    disabled?: boolean;
+    password?: string;
+}): Promise<AuthUser | null>;
+export declare function deleteUser(id: number): Promise<boolean>;
+export declare function countAdmins(excluding?: number): Promise<number>;
+export declare function createSession(userId: number, ttlMs: number): Promise<{
+    raw: string;
+    expiresAt: string;
+}>;
+export declare function resolveSession(raw: string): Promise<AuthUser | null>;
+export declare function deleteSession(raw: string): Promise<void>;
+export declare function createApiToken(userId: number, name: string, rawToken: string): Promise<{
+    id: number;
+    createdAt: string;
+}>;
+export declare function resolveApiToken(raw: string): Promise<AuthUser | null>;
+export declare function listApiTokens(userId: number): Promise<{
+    id: number;
+    name: string;
+    createdAt: string;
+    lastUsedAt: string | null;
+}[]>;
+export declare function revokeApiToken(id: number, userId: number): Promise<boolean>;

package/dist/auth-store.js

@@ -0,0 +1,145 @@
+import { getEm } from "./db.js";
+import { hashPassword, generateToken, hashToken } from "./auth-crypto.js";
+function toAuthUser(row) {
+    return { id: row.id, login: row.login, displayName: row.display_name, role: row.role, disabled: Boolean(row.disabled) };
+}
+export async function countUsers() {
+    const em = getEm().fork();
+    return em.count('_User', {});
+}
+export async function createUser(input) {
+    const em = getEm().fork();
+    const row = em.create('_User', {
+        login: input.login,
+        password_hash: await hashPassword(input.password),
+        display_name: input.displayName,
+        role: input.role,
+        disabled: 0,
+        created_at: new Date().toISOString(),
+    });
+    await em.flush();
+    return toAuthUser(row);
+}
+export async function findUserByLogin(login) {
+    const em = getEm().fork();
+    const row = (await em.findOne('_User', { login }));
+    return row ? { ...toAuthUser(row), passwordHash: row.password_hash } : null;
+}
+export async function findUserById(id) {
+    const em = getEm().fork();
+    const row = (await em.findOne('_User', { id }));
+    return row ? toAuthUser(row) : null;
+}
+export async function getPasswordHash(id) {
+    const em = getEm().fork();
+    const row = (await em.findOne('_User', { id }));
+    return row ? row.password_hash : null;
+}
+export async function listUsers() {
+    const em = getEm().fork();
+    const rows = (await em.find('_User', {}));
+    return rows.map(toAuthUser);
+}
+export async function updateUser(id, patch) {
+    const em = getEm().fork();
+    const row = (await em.findOne('_User', { id }));
+    if (!row)
+        return null;
+    const changes = {};
+    if (patch.displayName !== undefined)
+        changes['display_name'] = patch.displayName;
+    if (patch.role !== undefined)
+        changes['role'] = patch.role;
+    if (patch.disabled !== undefined)
+        changes['disabled'] = patch.disabled ? 1 : 0;
+    if (patch.password)
+        changes['password_hash'] = await hashPassword(patch.password);
+    em.assign(row, changes);
+    await em.flush();
+    return toAuthUser(row);
+}
+export async function deleteUser(id) {
+    const em = getEm().fork();
+    const row = await em.findOne('_User', { id });
+    if (!row)
+        return false;
+    em.remove(row);
+    await em.flush();
+    return true;
+}
+export async function countAdmins(excluding) {
+    const em = getEm().fork();
+    const rows = (await em.find('_User', { role: 'admin', disabled: 0 }));
+    return rows.filter((r) => r.id !== excluding).length;
+}
+export async function createSession(userId, ttlMs) {
+    const em = getEm().fork();
+    const raw = generateToken();
+    const expiresAt = new Date(Date.now() + ttlMs).toISOString();
+    em.create('_Session', {
+        token_hash: hashToken(raw),
+        user_id: userId,
+        expires_at: expiresAt,
+        created_at: new Date().toISOString(),
+    });
+    await em.flush();
+    return { raw, expiresAt };
+}
+export async function resolveSession(raw) {
+    const em = getEm().fork();
+    const session = (await em.findOne('_Session', { token_hash: hashToken(raw) }));
+    if (!session)
+        return null;
+    if (new Date(session.expires_at).getTime() < Date.now())
+        return null;
+    const user = await findUserById(session.user_id);
+    return user && !user.disabled ? user : null;
+}
+export async function deleteSession(raw) {
+    const em = getEm().fork();
+    const session = await em.findOne('_Session', { token_hash: hashToken(raw) });
+    if (session) {
+        em.remove(session);
+        await em.flush();
+    }
+}
+export async function createApiToken(userId, name, rawToken) {
+    const em = getEm().fork();
+    const createdAt = new Date().toISOString();
+    const row = em.create('_ApiToken', {
+        user_id: userId,
+        name,
+        token_hash: hashToken(rawToken),
+        created_at: createdAt,
+        last_used_at: null,
+        revoked: 0,
+    });
+    await em.flush();
+    return { id: row.id, createdAt };
+}
+export async function resolveApiToken(raw) {
+    const em = getEm().fork();
+    const token = (await em.findOne('_ApiToken', { token_hash: hashToken(raw), revoked: 0 }));
+    if (!token)
+        return null;
+    const user = await findUserById(token.user_id);
+    if (!user || user.disabled)
+        return null;
+    em.assign(token, { last_used_at: new Date().toISOString() });
+    await em.flush();
+    return user;
+}
+export async function listApiTokens(userId) {
+    const em = getEm().fork();
+    const rows = (await em.find('_ApiToken', { user_id: userId, revoked: 0 }));
+    return rows.map((r) => ({ id: r.id, name: r.name, createdAt: r.created_at, lastUsedAt: r.last_used_at }));
+}
+export async function revokeApiToken(id, userId) {
+    const em = getEm().fork();
+    const row = await em.findOne('_ApiToken', { id, user_id: userId });
+    if (!row)
+        return false;
+    em.assign(row, { revoked: 1 });
+    await em.flush();
+    return true;
+}

package/dist/collection-io.js

@@ -114,10 +114,9 @@ export function flattenEmbeddedAt(fields, input) {
         const nested = out[key];
         delete out[key];
         if (nested && typeof nested === 'object') {
-            for (const f of g.fields) {
-                if ('key' in f)
-                    out[`${key}__${f.key}`] = nested[f.key];
-            }
+            const flatChild = flattenEmbeddedAt(g.fields, nested);
+            for (const [sub, val] of Object.entries(flatChild))
+                out[`${key}__${sub}`] = val;
         }
     }
     for (const [key, subs] of columnsTargets(fields)) {
@@ -146,20 +145,18 @@ export function nestEmbeddedAt(fields, row) {
             out[key] = nested;
     }
     for (const [key, g] of embeddedGroups(fields)) {
-        const nested = {};
+        const inner = {};
         let any = false;
-        for (const f of g.fields) {
-            if (!('key' in f))
+        const prefix = `${key}__`;
+        for (const col of Object.keys(out)) {
+            if (!col.startsWith(prefix))
                 continue;
-            const col = `${key}__${f.key}`;
-            if (col in out) {
-                nested[f.key] = out[col];
-                delete out[col];
-                any = true;
-            }
+            inner[col.slice(prefix.length)] = out[col];
+            delete out[col];
+            any = true;
         }
         if (any)
-            out[key] = nested;
+            out[key] = nestEmbeddedAt(g.fields, inner);
     }
     return out;
 }

package/dist/entity-schema.d.ts

@@ -18,4 +18,7 @@ export declare const EmbeddingSchema: EntitySchema<any, never, import("@mikro-or
 export declare const PluginStateSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
 export declare function buildPluginEntities(plugins: PluginManifest[]): EntitySchema[];
 export declare const MsgLogSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
+export declare const UserSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
+export declare const SessionSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
+export declare const ApiTokenSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
 export declare const systemEntities: EntitySchema[];

package/dist/entity-schema.js

@@ -176,7 +176,44 @@ export const MsgLogSchema = new EntitySchema({
         ms: { type: 'integer', nullable: true },
     },
 });
+export const UserSchema = new EntitySchema({
+    name: '_User',
+    tableName: '_users',
+    properties: {
+        id: { type: 'integer', primary: true, autoincrement: true },
+        login: { type: 'text', unique: true },
+        password_hash: { type: 'text' },
+        display_name: { type: 'text' },
+        role: { type: 'text' },
+        disabled: { type: 'integer' },
+        created_at: { type: 'text' },
+    },
+});
+export const SessionSchema = new EntitySchema({
+    name: '_Session',
+    tableName: '_sessions',
+    properties: {
+        token_hash: { type: 'text', primary: true },
+        user_id: { type: 'integer' },
+        expires_at: { type: 'text' },
+        created_at: { type: 'text' },
+    },
+});
+export const ApiTokenSchema = new EntitySchema({
+    name: '_ApiToken',
+    tableName: '_api_tokens',
+    properties: {
+        id: { type: 'integer', primary: true, autoincrement: true },
+        user_id: { type: 'integer' },
+        name: { type: 'text' },
+        token_hash: { type: 'text', unique: true },
+        created_at: { type: 'text' },
+        last_used_at: { type: 'text', nullable: true },
+        revoked: { type: 'integer' },
+    },
+});
 export const systemEntities = [
     EventSchema, PluginRowSchema, MigrationRowSchema, SeedRowSchema,
     EmbeddingSchema, PluginStateSchema, MsgLogSchema,
+    UserSchema, SessionSchema, ApiTokenSchema,
 ];

package/dist/index.js

@@ -26,6 +26,9 @@ import { resolveEmbed } from "./embed.js";
 import { resolveWithinHome, filterSort, listDir } from "./fs-list.js";
 import { initPlugins, teardownPlugins, readDisabled, purgePluginData, getPluginSettings, getPlugins, } from "./plugin-runtime.js";
 import { registerPluginsApi } from "./plugins-api.js";
+import { registerAuthApi, resolveRequestUser, requireAdmin, PUBLIC_API_PATHS } from "./auth-api.js";
+import { discoverPluginAssets } from "./plugin-discovery.js";
+import { checkLatestVersion, resolveUpdateTarget, runNpmInstall } from "./plugin-updates.js";
 import { buildClientSchema } from "./schema-api.js";
 import { recordList, recordGet, recordCreate, recordUpdate, recordDelete, rowMatch, UnknownTypeError } from "./records-api.js";
 import { maskTree, preserveTree } from "./secrets.js";
@@ -54,6 +57,17 @@ app.addHook('onSend', async (req, reply, payload) => {
     }
     return payload;
 });
+app.addHook('onRequest', async (req, reply) => {
+    const gated = req.url.startsWith('/api/') || req.url.startsWith('/uploads/');
+    if (!gated)
+        return;
+    if (PUBLIC_API_PATHS.some((p) => req.url.startsWith(p)))
+        return;
+    const user = await resolveRequestUser(req);
+    if (!user)
+        return reply.code(401).send({ error: 'unauthorized' });
+    req.user = user;
+});
 app.post('/api/upload', async (req, reply) => {
     const data = await req.file();
     if (!data)
@@ -144,6 +158,8 @@ app.get('/api/search', async (req) => {
     return scored.slice(0, lim).map((s) => s.result);
 });
 app.patch('/api/plugins/:id', async (req, reply) => {
+    if (!requireAdmin(req, reply))
+        return;
     const { id } = req.params;
     const { enabled } = (req.body ?? {});
     const plugins = await getPlugins();
@@ -176,6 +192,8 @@ app.patch('/api/plugins/:id', async (req, reply) => {
     return { ok: true, restartRequired: true };
 });
 app.delete('/api/plugins/:id/data', async (req, reply) => {
+    if (!requireAdmin(req, reply))
+        return;
     const { id } = req.params;
     const plugins = await getPlugins();
     const p = plugins.find((x) => x.id === id);
@@ -191,7 +209,27 @@ app.delete('/api/plugins/:id/data', async (req, reply) => {
     await purgePluginData(p, 'gui');
     return { ok: true, restartRequired: true };
 });
+app.post('/api/plugins/:id/update', async (req, reply) => {
+    if (!requireAdmin(req, reply))
+        return;
+    const { id } = req.params;
+    const assets = await discoverPluginAssets();
+    const rec = assets.find((a) => a.id === id);
+    const latest = rec ? await checkLatestVersion(rec.packageName) : null;
+    const target = resolveUpdateTarget(assets, id, latest);
+    if (!target.ok) {
+        return reply.code(target.error === 'unknown_plugin' ? 404 : 400).send({ error: target.error });
+    }
+    const result = await runNpmInstall(target.packageName, target.version, process.cwd());
+    if (!result.ok) {
+        return reply.code(500).send({ error: 'install_failed', stderr: result.stderr });
+    }
+    reply.send({ ok: true });
+    setTimeout(() => process.exit(0), 500);
+});
 app.get('/api/plugins/:id/settings', async (req, reply) => {
+    if (!requireAdmin(req, reply))
+        return;
     const { id } = req.params;
     const plugins = await getPlugins();
     const p = plugins.find((x) => x.id === id);
@@ -201,33 +239,39 @@ app.get('/api/plugins/:id/settings', async (req, reply) => {
     const row = await getPluginSettings(id);
     return maskTree(p.settings.fields, row);
 });
-app.put('/api/plugins/:id/settings', (req, reply) => guard(reply, async () => {
-    const { id } = req.params;
-    const plugins = await getPlugins();
-    const p = plugins.find((x) => x.id === id);
-    if (!p || !p.settings || p.settings.fields.length === 0) {
-        return reply.code(404).send({ error: 'no_settings' });
-    }
-    const syntheticMod = {
-        vault: '_settings',
-        module: id,
-        label: `${id}.plugin.label`,
-        fields: p.settings.fields,
-    };
-    const existing = await getPluginSettings(id);
-    const body = preserveTree(p.settings.fields, (req.body ?? {}), existing);
-    const parsed = buildZodObject(syntheticMod).safeParse(body);
-    if (!parsed.success) {
-        throw new ValidationError(parsed.error.issues.map(toIssue));
-    }
-    const entityName = `_settings__${id}`;
-    const row = { plugin_id: id, ...parsed.data };
-    await getEm()
-        .fork()
-        .upsert(entityName, row);
-    return { ok: true, row: maskTree(p.settings.fields, row) };
-}));
-app.post('/api/plugins/nextcloud/test', async (_req, reply) => {
+app.put('/api/plugins/:id/settings', (req, reply) => {
+    if (!requireAdmin(req, reply))
+        return;
+    return guard(reply, async () => {
+        const { id } = req.params;
+        const plugins = await getPlugins();
+        const p = plugins.find((x) => x.id === id);
+        if (!p || !p.settings || p.settings.fields.length === 0) {
+            return reply.code(404).send({ error: 'no_settings' });
+        }
+        const syntheticMod = {
+            vault: '_settings',
+            module: id,
+            label: `${id}.plugin.label`,
+            fields: p.settings.fields,
+        };
+        const existing = await getPluginSettings(id);
+        const body = preserveTree(p.settings.fields, (req.body ?? {}), existing);
+        const parsed = buildZodObject(syntheticMod).safeParse(body);
+        if (!parsed.success) {
+            throw new ValidationError(parsed.error.issues.map(toIssue));
+        }
+        const entityName = `_settings__${id}`;
+        const row = { plugin_id: id, ...parsed.data };
+        await getEm()
+            .fork()
+            .upsert(entityName, row);
+        return { ok: true, row: maskTree(p.settings.fields, row) };
+    });
+});
+app.post('/api/plugins/nextcloud/test', async (req, reply) => {
+    if (!requireAdmin(req, reply))
+        return;
     const settings = await getPluginSettings('nextcloud');
     const url = settings['nextcloud_url'];
     const login = settings['login'];
@@ -242,7 +286,9 @@ app.post('/api/plugins/nextcloud/test', async (_req, reply) => {
         return { ok: true };
     return reply.code(400).send({ error: result.error });
 });
-app.post('/api/plugins/finance/test', async (_req, reply) => {
+app.post('/api/plugins/finance/test', async (req, reply) => {
+    if (!requireAdmin(req, reply))
+        return;
     const settings = await getPluginSettings('finance');
     const url = settings['firefly_url'];
     const token = settings['token'];
@@ -256,7 +302,9 @@ app.post('/api/plugins/finance/test', async (_req, reply) => {
         return { ok: true };
     return reply.code(400).send({ error: result.error });
 });
-app.post('/api/plugins/finance/sync', async (_req, reply) => {
+app.post('/api/plugins/finance/sync', async (req, reply) => {
+    if (!requireAdmin(req, reply))
+        return;
     const finRuntime = '@coffer-org/plugin-finance/runtime';
     const { runSync } = (await import(__rewriteRelativeImportExtension(finRuntime)));
     try {
@@ -267,7 +315,9 @@ app.post('/api/plugins/finance/sync', async (_req, reply) => {
         return reply.code(400).send({ error: e.message });
     }
 });
-app.post('/api/plugins/finance/import-wise', async (_req, reply) => {
+app.post('/api/plugins/finance/import-wise', async (req, reply) => {
+    if (!requireAdmin(req, reply))
+        return;
     const finRuntime = '@coffer-org/plugin-finance/runtime';
     const { importWise } = (await import(__rewriteRelativeImportExtension(finRuntime)));
     try {
@@ -277,7 +327,9 @@ app.post('/api/plugins/finance/import-wise', async (_req, reply) => {
         return reply.code(400).send({ error: e.message });
     }
 });
-app.post('/api/plugins/devices/scan', async (_req, reply) => {
+app.post('/api/plugins/devices/scan', async (req, reply) => {
+    if (!requireAdmin(req, reply))
+        return;
     const devRuntime = '@coffer-org/plugin-devices/runtime';
     const { runScan } = (await import(__rewriteRelativeImportExtension(devRuntime)));
     try {
@@ -292,7 +344,9 @@ app.post('/api/plugins/devices/scan', async (_req, reply) => {
         return reply.code(409).send({ error: e.message });
     }
 });
-app.post('/api/plugins/media/test', async (_req, reply) => {
+app.post('/api/plugins/media/test', async (req, reply) => {
+    if (!requireAdmin(req, reply))
+        return;
     const settings = await getPluginSettings('media');
     const url = settings['jellyfin_url'];
     const token = settings['jellyfin_token'];
@@ -306,7 +360,9 @@ app.post('/api/plugins/media/test', async (_req, reply) => {
         return { ok: true };
     return reply.code(400).send({ error: result.error });
 });
-app.post('/api/plugins/media/sync', async (_req, reply) => {
+app.post('/api/plugins/media/sync', async (req, reply) => {
+    if (!requireAdmin(req, reply))
+        return;
     const mediaRuntime = '@coffer-org/plugin-media/runtime';
     const { runJellyfinSync } = (await import(__rewriteRelativeImportExtension(mediaRuntime)));
     try {
@@ -318,6 +374,8 @@ app.post('/api/plugins/media/sync', async (_req, reply) => {
     }
 });
 app.post('/api/plugins/media/add', async (req, reply) => {
+    if (!requireAdmin(req, reply))
+        return;
     const { query, tmdb_id, kind } = (req.body ?? {});
     const mediaRuntime = '@coffer-org/plugin-media/runtime';
     const { addTitle } = (await import(__rewriteRelativeImportExtension(mediaRuntime)));
@@ -457,6 +515,7 @@ app.delete('/api/:vault/:type/:id', (req, reply) => guard(reply, async () => {
         throw e;
     }
 }));
+await registerAuthApi(app);
 await registerPluginsApi(app);
 const WEB_DIST = process.env.WEB_DIST;
 if (WEB_DIST && existsSync(join(WEB_DIST, 'index.html'))) {

package/dist/plugin-updates.d.ts

@@ -0,0 +1,15 @@
+import type { PluginAssetRecord } from './plugin-discovery.ts';
+export declare function checkLatestVersion(pkgName: string): Promise<string | null>;
+export type UpdateTarget = {
+    ok: true;
+    packageName: string;
+    version: string;
+} | {
+    ok: false;
+    error: 'unknown_plugin' | 'no_update_available';
+};
+export declare function resolveUpdateTarget(assets: PluginAssetRecord[], id: string, latestVersion: string | null): UpdateTarget;
+export declare function runNpmInstall(packageName: string, version: string, cwd: string): Promise<{
+    ok: boolean;
+    stderr: string;
+}>;

package/dist/plugin-updates.js

@@ -0,0 +1,52 @@
+import { execFile } from 'node:child_process';
+import { getPluginState, setPluginState } from "./plugin-state.js";
+const TTL_MS = 60 * 60 * 1000;
+const STATE_PLUGIN = 'core';
+const stateKey = (pkgName) => `update-check:${pkgName}`;
+function readCache(raw) {
+    if (!raw)
+        return null;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+export async function checkLatestVersion(pkgName) {
+    const key = stateKey(pkgName);
+    let cached = null;
+    try {
+        cached = readCache(await getPluginState(STATE_PLUGIN, key));
+        if (cached && Date.now() - cached.checkedAt < TTL_MS)
+            return cached.latestVersion;
+        const res = await fetch(`https://registry.npmjs.org/${pkgName}/latest`, { signal: AbortSignal.timeout(5000) });
+        if (!res.ok)
+            return cached?.latestVersion ?? null;
+        const data = (await res.json());
+        if (!data.version)
+            return cached?.latestVersion ?? null;
+        await setPluginState(STATE_PLUGIN, key, JSON.stringify({ latestVersion: data.version, checkedAt: Date.now() }));
+        return data.version;
+    }
+    catch {
+        return cached?.latestVersion ?? null;
+    }
+}
+export function resolveUpdateTarget(assets, id, latestVersion) {
+    const rec = assets.find((a) => a.id === id);
+    if (!rec)
+        return { ok: false, error: 'unknown_plugin' };
+    if (!latestVersion || latestVersion === rec.version)
+        return { ok: false, error: 'no_update_available' };
+    return { ok: true, packageName: rec.packageName, version: latestVersion };
+}
+export function runNpmInstall(packageName, version, cwd) {
+    return new Promise((resolve) => {
+        execFile('npm', ['install', `${packageName}@${version}`], { cwd, timeout: 120_000, encoding: 'utf8' }, (err, _stdout, stderr) => {
+            if (err)
+                return resolve({ ok: false, stderr: (stderr || err.message || '').trim() });
+            resolve({ ok: true, stderr: '' });
+        });
+    });
+}

package/dist/plugins-api.d.ts

@@ -1,2 +1,19 @@
 import type { FastifyInstance } from 'fastify';
+import type { PluginManifest } from '@coffer-org/sdk/plugin';
+import type { PluginAssetRecord } from './plugin-discovery.ts';
+export interface PluginListEntry {
+    id: string;
+    installedVersion: string;
+    latestVersion: string | null;
+    packageName: string | null;
+    dependsOn: string[];
+    enabled: boolean;
+    vaults: string[];
+    extends: string[];
+    hasSettings: boolean;
+    schema?: string;
+    web?: string;
+    css?: string;
+}
+export declare function buildPluginListResponse(plugins: PluginManifest[], assets: PluginAssetRecord[], disabled: Set<string>): Promise<PluginListEntry[]>;
 export declare function registerPluginsApi(app: FastifyInstance): Promise<void>;

package/dist/plugins-api.js

@@ -2,27 +2,33 @@ import { join } from 'node:path';
 import { createReadStream, existsSync, readFileSync } from 'node:fs';
 import { discoverPluginAssets } from "./plugin-discovery.js";
 import { getPlugins, readDisabled } from "./plugin-runtime.js";
+import { checkLatestVersion } from "./plugin-updates.js";
 const nmRoot = () => join(process.cwd(), 'node_modules');
 const ASSET_KEY = { 'schema.js': 'schema', 'web.js': 'web', 'web.css': 'css' };
+export async function buildPluginListResponse(plugins, assets, disabled) {
+    const assetById = new Map(assets.map((a) => [a.id, a]));
+    return Promise.all(plugins.map(async (p) => {
+        const a = assetById.get(p.id);
+        return {
+            id: p.id,
+            installedVersion: a?.version ?? p.version,
+            latestVersion: a ? await checkLatestVersion(a.packageName) : null,
+            packageName: a?.packageName ?? null,
+            dependsOn: p.dependsOn,
+            enabled: !disabled.has(p.id),
+            vaults: (p.vaults ?? []).map((v) => v.meta.id),
+            extends: (p.extends_ ?? []).map((e) => e.id),
+            hasSettings: Boolean(p.settings && p.settings.fields.length > 0),
+            schema: a?.schema,
+            web: a?.web,
+            css: a?.css,
+        };
+    }));
+}
 export async function registerPluginsApi(app) {
     app.get('/api/plugins', async () => {
         const [plugins, assets, disabled] = await Promise.all([getPlugins(), discoverPluginAssets(), readDisabled()]);
-        const assetById = new Map(assets.map((a) => [a.id, a]));
-        return plugins.map((p) => {
-            const a = assetById.get(p.id);
-            return {
-                id: p.id,
-                version: p.version,
-                dependsOn: p.dependsOn,
-                enabled: !disabled.has(p.id),
-                vaults: (p.vaults ?? []).map((v) => v.meta.id),
-                extends: (p.extends_ ?? []).map((e) => e.id),
-                hasSettings: Boolean(p.settings && p.settings.fields.length > 0),
-                schema: a?.schema,
-                web: a?.web,
-                css: a?.css,
-            };
-        });
+        return buildPluginListResponse(plugins, assets, disabled);
     });
     app.get('/plugins/:id/:file', async (req, reply) => {
         const { id, file } = req.params;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffer-org/server",
-  "version": "1.2.4",
+  "version": "1.3.0",
   "type": "module",
   "engines": {
     "node": ">=24"
@@ -24,8 +24,8 @@
     "postpack": "node ../../scripts/swap-exports.mjs src"
   },
   "dependencies": {
-    "@coffer-org/core": "^1.2.4",
-    "@coffer-org/sdk": "^1.2.4",
+    "@coffer-org/core": "^1.3.0",
+    "@coffer-org/sdk": "^1.3.0",
     "@extractus/oembed-extractor": "^4.1.0",
     "@fastify/cors": "^11.2.0",
     "@fastify/multipart": "^10.0.0",