npm - @coffer-org/server - Versions diffs - 1.7.1 → 1.9.0 - Mend

@coffer-org/server 1.7.1 → 1.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (61) hide show

package/dist/auth-api.d.ts +1 -0
package/dist/auth-api.js +20 -10
package/dist/background-scheduler.d.ts +22 -0
package/dist/background-scheduler.js +101 -0
package/dist/collection-io.d.ts +7 -7
package/dist/collection-io.js +2 -2
package/dist/connector-identity.d.ts +5 -0
package/dist/connector-identity.js +32 -0
package/dist/embed-openai.d.ts +10 -0
package/dist/embed-openai.js +28 -0
package/dist/entity-schema.d.ts +9 -5
package/dist/entity-schema.js +64 -10
package/dist/extend-io.d.ts +5 -3
package/dist/extend-io.js +17 -10
package/dist/extend-table.d.ts +4 -3
package/dist/extend-table.js +10 -18
package/dist/field-masking.d.ts +7 -0
package/dist/field-masking.js +60 -0
package/dist/index-signal.d.ts +3 -0
package/dist/index-signal.js +14 -0
package/dist/index.js +68 -160
package/dist/local-api.d.ts +3 -3
package/dist/local-api.js +6 -6
package/dist/mcp-http.d.ts +5 -0
package/dist/mcp-http.js +37 -0
package/dist/mcp-http.test-helpers.d.ts +17 -0
package/dist/mcp-http.test-helpers.js +117 -0
package/dist/mcp-local.d.ts +10 -0
package/dist/mcp-local.js +57 -0
package/dist/mcp-tools.d.ts +61 -0
package/dist/mcp-tools.js +225 -0
package/dist/msg-log.d.ts +0 -1
package/dist/msg-log.js +2 -2
package/dist/mutate.d.ts +7 -5
package/dist/mutate.js +20 -8
package/dist/oauth-api.d.ts +2 -0
package/dist/oauth-api.js +281 -0
package/dist/oauth-store.d.ts +56 -0
package/dist/oauth-store.js +159 -0
package/dist/plugin-hooks.d.ts +10 -0
package/dist/plugin-hooks.js +8 -0
package/dist/plugin-runtime.d.ts +1 -0
package/dist/plugin-runtime.js +30 -6
package/dist/plugins-api.d.ts +1 -1
package/dist/plugins-api.js +21 -11
package/dist/public-url.d.ts +4 -0
package/dist/public-url.js +35 -0
package/dist/records-api.d.ts +8 -8
package/dist/records-api.js +35 -32
package/dist/registry-context.d.ts +1 -1
package/dist/registry-context.js +2 -2
package/dist/schema-api.js +5 -5
package/dist/settings-write.d.ts +19 -0
package/dist/settings-write.js +63 -0
package/dist/temporal.d.ts +3 -3
package/dist/temporal.js +1 -1
package/dist/thread-store.d.ts +20 -0
package/dist/thread-store.js +27 -0
package/dist/uploads.d.ts +1 -0
package/dist/uploads.js +4 -0
package/package.json +6 -6

package/dist/oauth-api.js ADDED Viewed

@@ -0,0 +1,281 @@
+import { createCode, findClient, issueTokens, listGrants, redeemCode, registerClient, revokeGrant, rotateRefresh, } from "./oauth-store.js";
+import { resolveRequestUser, startPasswordSession } from "./auth-api.js";
+import { baseUrl, mcpResource } from "./public-url.js";
+import { getLogger } from "./log.js";
+const log = getLogger('oauth');
+const DEFAULT_REDIRECT_ALLOW = [
+    'https://claude.ai/api/mcp/auth_callback',
+    'https://claude.com/api/mcp/auth_callback',
+];
+function redirectAllowlist() {
+    const extra = (process.env['OAUTH_REDIRECT_ALLOW'] ?? '')
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+    return [...DEFAULT_REDIRECT_ALLOW, ...extra];
+}
+function allowInsecure() {
+    return process.env['OAUTH_ALLOW_INSECURE'] === '1';
+}
+const hits = new Map();
+const RATE_WINDOW_MS = 60_000;
+function rateLimited(key, max) {
+    const now = Date.now();
+    const cur = hits.get(key);
+    if (!cur || cur.resetAt < now) {
+        hits.set(key, { count: 1, resetAt: now + RATE_WINDOW_MS });
+        return false;
+    }
+    cur.count += 1;
+    return cur.count > max;
+}
+function esc(s) {
+    return s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
+}
+function page(title, body) {
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${esc(title)}</title>
+<style>
+ body{font:16px/1.5 system-ui,sans-serif;background:#f6f6f5;color:#1a1a19;margin:0;
+      display:flex;min-height:100vh;align-items:center;justify-content:center}
+ .card{background:#fff;border:1px solid #e3e3e0;border-radius:12px;padding:28px;max-width:26rem;width:calc(100% - 2rem)}
+ h1{font-size:1.15rem;margin:0 0 .75rem}
+ p{margin:.5rem 0;color:#57564f}
+ label{display:block;margin:.75rem 0 .25rem;font-size:.85rem;color:#57564f}
+ input{width:100%;box-sizing:border-box;padding:.55rem .65rem;border:1px solid #d5d4cf;border-radius:8px;font:inherit}
+ button{margin-top:1.25rem;width:100%;padding:.6rem;border:0;border-radius:8px;background:#1a1a19;color:#fff;font:inherit;cursor:pointer}
+ .muted{font-size:.85rem}
+ .err{color:#b42318}
+ @media(prefers-color-scheme:dark){body{background:#1a1a19;color:#f6f6f5}.card{background:#232320;border-color:#3a3a36}
+  p,label{color:#a8a79f}input{background:#1a1a19;color:#f6f6f5;border-color:#3a3a36}button{background:#f6f6f5;color:#1a1a19}}
+</style></head><body><div class="card">${body}</div></body></html>`;
+}
+function hidden(params) {
+    return Object.entries(params)
+        .map(([k, v]) => `<input type="hidden" name="${esc(k)}" value="${esc(v)}">`)
+        .join('');
+}
+function readAuthzParams(src) {
+    const s = (k) => (typeof src[k] === 'string' ? src[k] : '');
+    return {
+        client_id: s('client_id'),
+        redirect_uri: s('redirect_uri'),
+        state: s('state'),
+        code_challenge: s('code_challenge'),
+        resource: s('resource'),
+    };
+}
+function loginForm(p, clientName, error) {
+    return page('Sign in to Coffer', `<h1>Sign in to Coffer</h1>
+     <p><b>${esc(clientName)}</b> wants access to your data. Sign in to continue.</p>
+     ${error ? `<p class="err">${esc(error)}</p>` : ''}
+     <form method="post" action="/oauth/authorize">
+       ${hidden({ ...p, action: 'login' })}
+       <label for="login">Login</label><input id="login" name="login" autocomplete="username" autofocus>
+       <label for="password">Password</label><input id="password" name="password" type="password" autocomplete="current-password">
+       <button type="submit">Sign in</button>
+     </form>`);
+}
+function consentForm(p, clientName, user) {
+    const roleLine = user.role === 'admin'
+        ? 'Your account is an <b>administrator</b> — the app will also get the admin-only tools of installed plugins, including settings.'
+        : 'Your account is a <b>member</b> — the app gets read/write access to your records, but no admin tools.';
+    return page('Authorize access', `<h1>Authorize ${esc(clientName)}</h1>
+     <p>It will be able to read, create, update and delete records in your Coffer as <b>${esc(user.login)}</b>.</p>
+     <p class="muted">${roleLine}</p>
+     <form method="post" action="/oauth/authorize">
+       ${hidden({ ...p, action: 'approve' })}
+       <button type="submit">Authorize</button>
+     </form>
+     <p class="muted">You can revoke this at any time in Settings → Connected apps.</p>`);
+}
+function redirectWithError(reply, p, error) {
+    const url = new URL(p.redirect_uri);
+    url.searchParams.set('error', error);
+    if (p.state)
+        url.searchParams.set('state', p.state);
+    return reply.redirect(url.toString(), 302);
+}
+export function registerOAuthApi(app) {
+    app.addContentTypeParser('application/x-www-form-urlencoded', { parseAs: 'string' }, (_req, body, done) => {
+        try {
+            done(null, Object.fromEntries(new URLSearchParams(body)));
+        }
+        catch (e) {
+            done(e, undefined);
+        }
+    });
+    app.get('/.well-known/oauth-protected-resource', async (req) => ({
+        resource: await mcpResource(req),
+        authorization_servers: [await baseUrl(req)],
+        bearer_methods_supported: ['header'],
+    }));
+    app.get('/.well-known/oauth-protected-resource/mcp', async (req) => ({
+        resource: await mcpResource(req),
+        authorization_servers: [await baseUrl(req)],
+        bearer_methods_supported: ['header'],
+    }));
+    const asMetadata = async (req) => {
+        const base = await baseUrl(req);
+        return {
+            issuer: base,
+            authorization_endpoint: `${base}/oauth/authorize`,
+            token_endpoint: `${base}/oauth/token`,
+            registration_endpoint: `${base}/oauth/register`,
+            response_types_supported: ['code'],
+            grant_types_supported: ['authorization_code', 'refresh_token'],
+            code_challenge_methods_supported: ['S256'],
+            token_endpoint_auth_methods_supported: ['none'],
+        };
+    };
+    app.get('/.well-known/oauth-authorization-server', async (req) => asMetadata(req));
+    app.get('/.well-known/oauth-authorization-server/mcp', async (req) => asMetadata(req));
+    app.post('/oauth/register', async (req, reply) => {
+        if (rateLimited(`reg:${req.ip}`, 10))
+            return reply.code(429).send({ error: 'rate_limited' });
+        const body = (req.body ?? {});
+        const uris = Array.isArray(body.redirect_uris) ? body.redirect_uris.filter((u) => typeof u === 'string') : [];
+        if (uris.length === 0) {
+            return reply.code(400).send({ error: 'invalid_redirect_uri', error_description: 'redirect_uris is required' });
+        }
+        const allow = redirectAllowlist();
+        const bad = uris.find((u) => !allow.includes(u));
+        if (bad) {
+            log.warn(`registration rejected: redirect_uri not allowlisted (${bad})`);
+            return reply
+                .code(400)
+                .send({ error: 'invalid_redirect_uri', error_description: `redirect_uri not allowed: ${bad}` });
+        }
+        const client = await registerClient({ clientName: body.client_name?.slice(0, 200) || 'MCP client', redirectUris: uris });
+        log.info(`registered client ${client.clientId} (${client.clientName})`);
+        return reply.code(201).send({
+            client_id: client.clientId,
+            client_name: client.clientName,
+            redirect_uris: client.redirectUris,
+            token_endpoint_auth_method: 'none',
+            grant_types: ['authorization_code', 'refresh_token'],
+            response_types: ['code'],
+        });
+    });
+    async function validateAuthz(p) {
+        if (!p.client_id || !p.redirect_uri) {
+            return { ok: false, html: page('Invalid request', '<h1>Invalid request</h1><p>Missing client_id or redirect_uri.</p>') };
+        }
+        const client = await findClient(p.client_id);
+        if (!client) {
+            return { ok: false, html: page('Unknown client', '<h1>Unknown client</h1><p>This application is not registered.</p>') };
+        }
+        if (!client.redirectUris.includes(p.redirect_uri)) {
+            return { ok: false, html: page('Invalid redirect', '<h1>Invalid redirect</h1><p>redirect_uri does not match this client.</p>') };
+        }
+        return { ok: true, clientName: client.clientName };
+    }
+    app.get('/oauth/authorize', async (req, reply) => {
+        const p = readAuthzParams((req.query ?? {}));
+        const check = await validateAuthz(p);
+        if (!check.ok)
+            return reply.code(400).type('text/html').send(check.html);
+        const q = (req.query ?? {});
+        if (q['response_type'] !== 'code')
+            return redirectWithError(reply, p, 'unsupported_response_type');
+        if (q['code_challenge_method'] !== 'S256' || !p.code_challenge) {
+            return redirectWithError(reply, p, 'invalid_request');
+        }
+        const user = await resolveRequestUser(req);
+        const html = user ? consentForm(p, check.clientName, user) : loginForm(p, check.clientName);
+        return reply.type('text/html').send(html);
+    });
+    app.post('/oauth/authorize', async (req, reply) => {
+        const body = (req.body ?? {});
+        const p = readAuthzParams(body);
+        const check = await validateAuthz(p);
+        if (!check.ok)
+            return reply.code(400).type('text/html').send(check.html);
+        if (body['action'] === 'login') {
+            if (rateLimited(`login:${req.ip}`, 20))
+                return reply.code(429).type('text/html').send(page('Slow down', '<h1>Too many attempts</h1>'));
+            const user = await startPasswordSession(reply, String(body['login'] ?? ''), String(body['password'] ?? ''));
+            if (!user)
+                return reply.code(401).type('text/html').send(loginForm(p, check.clientName, 'Wrong login or password.'));
+            return reply.type('text/html').send(consentForm(p, check.clientName, user));
+        }
+        const user = await resolveRequestUser(req);
+        if (!user)
+            return reply.code(401).type('text/html').send(loginForm(p, check.clientName, 'Your session expired. Sign in again.'));
+        if (body['action'] !== 'approve')
+            return redirectWithError(reply, p, 'access_denied');
+        if (!p.code_challenge)
+            return redirectWithError(reply, p, 'invalid_request');
+        const code = await createCode({
+            clientId: p.client_id,
+            userId: user.id,
+            redirectUri: p.redirect_uri,
+            codeChallenge: p.code_challenge,
+            resource: p.resource || (await mcpResource(req)),
+        });
+        const url = new URL(p.redirect_uri);
+        url.searchParams.set('code', code);
+        if (p.state)
+            url.searchParams.set('state', p.state);
+        log.info(`authorized client ${p.client_id} for user ${user.login}`);
+        return reply.redirect(url.toString(), 302);
+    });
+    app.get('/api/oauth/grants', async (req, reply) => {
+        if (!req.user)
+            return reply.code(401).send({ error: 'unauthorized' });
+        return listGrants(req.user.id);
+    });
+    app.delete('/api/oauth/grants/:clientId', async (req, reply) => {
+        if (!req.user)
+            return reply.code(401).send({ error: 'unauthorized' });
+        const { clientId } = req.params;
+        const revoked = await revokeGrant(req.user.id, clientId);
+        if (revoked === 0)
+            return reply.code(404).send({ error: 'not_found' });
+        log.info(`revoked ${revoked} token(s) of client ${clientId} for user ${req.user.login}`);
+        return { ok: true };
+    });
+    app.post('/oauth/token', async (req, reply) => {
+        reply.header('cache-control', 'no-store');
+        if (rateLimited(`token:${req.ip}`, 60))
+            return reply.code(429).send({ error: 'slow_down' });
+        if (!(await baseUrl(req)).startsWith('https://') && !allowInsecure()) {
+            log.error('refusing to issue tokens over plain HTTP (set PUBLIC_URL to the https origin, or OAUTH_ALLOW_INSECURE=1 for local testing)');
+            return reply.code(400).send({ error: 'invalid_request', error_description: 'https required' });
+        }
+        const body = (req.body ?? {});
+        const s = (k) => (typeof body[k] === 'string' ? body[k] : '');
+        const grant = s('grant_type');
+        if (grant === 'refresh_token') {
+            const tokens = await rotateRefresh(s('refresh_token'), s('client_id'));
+            if (!tokens)
+                return reply.code(400).send({ error: 'invalid_grant' });
+            return reply.send({
+                access_token: tokens.accessToken,
+                refresh_token: tokens.refreshToken,
+                token_type: 'Bearer',
+                expires_in: tokens.expiresIn,
+            });
+        }
+        if (grant !== 'authorization_code') {
+            return reply.code(400).send({ error: 'unsupported_grant_type' });
+        }
+        const result = await redeemCode({
+            code: s('code'),
+            clientId: s('client_id'),
+            redirectUri: s('redirect_uri'),
+            codeVerifier: s('code_verifier'),
+        });
+        if (!result.ok)
+            return reply.code(400).send({ error: result.error });
+        const tokens = await issueTokens({ clientId: s('client_id'), userId: result.user.id, resource: result.resource });
+        return reply.send({
+            access_token: tokens.accessToken,
+            refresh_token: tokens.refreshToken,
+            token_type: 'Bearer',
+            expires_in: tokens.expiresIn,
+            scope: result.user.role,
+        });
+    });
+}

package/dist/oauth-store.d.ts ADDED Viewed

@@ -0,0 +1,56 @@
+import { type AuthUser } from './auth-store.ts';
+export declare const CODE_TTL_MS = 60000;
+export declare const ACCESS_TTL_MS: number;
+export declare const REFRESH_TTL_MS: number;
+export interface OAuthClient {
+    clientId: string;
+    clientName: string;
+    redirectUris: string[];
+    createdAt: string;
+}
+export declare function registerClient(input: {
+    clientName: string;
+    redirectUris: string[];
+}): Promise<OAuthClient>;
+export declare function findClient(clientId: string): Promise<OAuthClient | null>;
+export declare function createCode(input: {
+    clientId: string;
+    userId: number;
+    redirectUri: string;
+    codeChallenge: string;
+    resource: string;
+}): Promise<string>;
+export type CodeRedemption = {
+    ok: true;
+    user: AuthUser;
+    resource: string;
+} | {
+    ok: false;
+    error: 'invalid_grant';
+};
+export declare function redeemCode(input: {
+    code: string;
+    clientId: string;
+    redirectUri: string;
+    codeVerifier: string;
+}): Promise<CodeRedemption>;
+export interface IssuedTokens {
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}
+export declare function issueTokens(input: {
+    clientId: string;
+    userId: number;
+    resource: string;
+}): Promise<IssuedTokens>;
+export declare function resolveAccessToken(raw: string, expectedResource: string): Promise<AuthUser | null>;
+export declare function rotateRefresh(raw: string, clientId: string): Promise<IssuedTokens | null>;
+export interface Grant {
+    clientId: string;
+    clientName: string;
+    createdAt: string;
+    lastUsedAt: string | null;
+}
+export declare function listGrants(userId: number): Promise<Grant[]>;
+export declare function revokeGrant(userId: number, clientId: string): Promise<number>;

package/dist/oauth-store.js ADDED Viewed

@@ -0,0 +1,159 @@
+import { createHash, randomUUID, timingSafeEqual } from 'node:crypto';
+import { getEm } from "./db.js";
+import { generateToken, hashToken } from "./auth-crypto.js";
+import { findUserById } from "./auth-store.js";
+export const CODE_TTL_MS = 60_000;
+export const ACCESS_TTL_MS = 60 * 60_000;
+export const REFRESH_TTL_MS = 30 * 24 * 60 * 60_000;
+function toClient(row) {
+    return {
+        clientId: row.client_id,
+        clientName: row.client_name,
+        redirectUris: JSON.parse(row.redirect_uris),
+        createdAt: row.created_at,
+    };
+}
+export async function registerClient(input) {
+    const em = getEm().fork();
+    const row = {
+        client_id: randomUUID(),
+        client_name: input.clientName,
+        redirect_uris: JSON.stringify(input.redirectUris),
+        created_at: new Date().toISOString(),
+    };
+    em.create('_OAuthClient', row);
+    await em.flush();
+    return toClient(row);
+}
+export async function findClient(clientId) {
+    const em = getEm().fork();
+    const row = (await em.findOne('_OAuthClient', { client_id: clientId }));
+    return row ? toClient(row) : null;
+}
+export async function createCode(input) {
+    const em = getEm().fork();
+    const raw = generateToken();
+    em.create('_OAuthCode', {
+        code_hash: hashToken(raw),
+        client_id: input.clientId,
+        user_id: input.userId,
+        redirect_uri: input.redirectUri,
+        code_challenge: input.codeChallenge,
+        resource: input.resource,
+        expires_at: new Date(Date.now() + CODE_TTL_MS).toISOString(),
+        created_at: new Date().toISOString(),
+    });
+    await em.flush();
+    return raw;
+}
+function verifyPkce(verifier, challenge) {
+    const computed = createHash('sha256').update(verifier).digest('base64url');
+    const a = Buffer.from(computed);
+    const b = Buffer.from(challenge);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+export async function redeemCode(input) {
+    const em = getEm().fork();
+    const row = (await em.findOne('_OAuthCode', { code_hash: hashToken(input.code) }));
+    if (!row)
+        return { ok: false, error: 'invalid_grant' };
+    em.remove(row);
+    await em.flush();
+    if (row.client_id !== input.clientId)
+        return { ok: false, error: 'invalid_grant' };
+    if (row.redirect_uri !== input.redirectUri)
+        return { ok: false, error: 'invalid_grant' };
+    if (new Date(row.expires_at).getTime() < Date.now())
+        return { ok: false, error: 'invalid_grant' };
+    if (!verifyPkce(input.codeVerifier, row.code_challenge))
+        return { ok: false, error: 'invalid_grant' };
+    const user = await findUserById(row.user_id);
+    if (!user || user.disabled)
+        return { ok: false, error: 'invalid_grant' };
+    return { ok: true, user, resource: row.resource };
+}
+export async function issueTokens(input) {
+    const em = getEm().fork();
+    const now = new Date().toISOString();
+    const accessToken = generateToken();
+    const refreshToken = generateToken();
+    for (const [raw, kind, ttl] of [
+        [accessToken, 'access', ACCESS_TTL_MS],
+        [refreshToken, 'refresh', REFRESH_TTL_MS],
+    ]) {
+        em.create('_OAuthToken', {
+            token_hash: hashToken(raw),
+            kind,
+            client_id: input.clientId,
+            user_id: input.userId,
+            resource: input.resource,
+            expires_at: new Date(Date.now() + ttl).toISOString(),
+            created_at: now,
+            last_used_at: null,
+            revoked: 0,
+        });
+    }
+    await em.flush();
+    return { accessToken, refreshToken, expiresIn: Math.floor(ACCESS_TTL_MS / 1000) };
+}
+async function findLiveToken(raw, kind) {
+    const em = getEm().fork();
+    const row = (await em.findOne('_OAuthToken', { token_hash: hashToken(raw), kind, revoked: 0 }));
+    if (!row)
+        return null;
+    if (new Date(row.expires_at).getTime() < Date.now())
+        return null;
+    return row;
+}
+export async function resolveAccessToken(raw, expectedResource) {
+    const row = await findLiveToken(raw, 'access');
+    if (!row)
+        return null;
+    if (row.resource !== expectedResource)
+        return null;
+    const user = await findUserById(row.user_id);
+    if (!user || user.disabled)
+        return null;
+    await getEm()
+        .fork()
+        .nativeUpdate('_OAuthToken', { token_hash: row.token_hash }, { last_used_at: new Date().toISOString() });
+    return user;
+}
+export async function rotateRefresh(raw, clientId) {
+    const row = await findLiveToken(raw, 'refresh');
+    if (!row || row.client_id !== clientId)
+        return null;
+    const user = await findUserById(row.user_id);
+    if (!user || user.disabled)
+        return null;
+    await getEm()
+        .fork()
+        .nativeUpdate('_OAuthToken', { token_hash: row.token_hash }, { revoked: 1 });
+    return issueTokens({ clientId, userId: row.user_id, resource: row.resource });
+}
+export async function listGrants(userId) {
+    const em = getEm().fork();
+    const rows = (await em.find('_OAuthToken', { user_id: userId, revoked: 0 }));
+    const byClient = new Map();
+    for (const r of rows) {
+        const prev = byClient.get(r.client_id);
+        const lastUsed = [prev?.lastUsedAt, r.last_used_at].filter(Boolean).sort().pop() ?? null;
+        byClient.set(r.client_id, {
+            clientId: r.client_id,
+            clientName: prev?.clientName ?? r.client_id,
+            createdAt: prev && prev.createdAt < r.created_at ? prev.createdAt : r.created_at,
+            lastUsedAt: lastUsed,
+        });
+    }
+    for (const [clientId, grant] of byClient) {
+        const client = await findClient(clientId);
+        if (client)
+            grant.clientName = client.clientName;
+    }
+    return [...byClient.values()];
+}
+export async function revokeGrant(userId, clientId) {
+    return getEm()
+        .fork()
+        .nativeUpdate('_OAuthToken', { user_id: userId, client_id: clientId, revoked: 0 }, { revoked: 1 });
+}

package/dist/plugin-hooks.d.ts CHANGED Viewed

@@ -2,6 +2,7 @@ import type { EntityManager } from '@mikro-orm/core';
 import type { z } from 'zod';
 import type { ColumnType } from '@coffer-org/sdk/fields';
 import { type Logger } from '@coffer-org/sdk/logger';
+export type { BackgroundTask } from './background-scheduler.ts';
 export interface TableOps {
     renameColumn(from: string, to: string): Promise<void>;
     fill(column: string, value: string | number | boolean | null, opts?: {
@@ -28,21 +29,30 @@ export interface Seed {
     name: string;
     run(ctx: PluginCtx): Promise<void> | void;
 }
+export type AuthRole = 'admin' | 'member';
 export interface AgentTool {
     name: string;
     description: string;
     inputSchema: z.ZodRawShape;
     handler: (args: Record<string, unknown>, ctx: PluginCtx) => Promise<unknown> | unknown;
+    role?: AuthRole;
 }
 export interface AgentContribution {
     instructions?: string | ((ctx: PluginCtx) => string | Promise<string>);
     tools?: AgentTool[];
 }
+export type PluginAction = (body: Record<string, unknown>) => Promise<unknown>;
+export declare class HttpError extends Error {
+    status: number;
+    constructor(status: number, message: string);
+}
 export interface PluginHooks {
     migrations?: Migration[];
     seed?: Seed[];
     init?(ctx: PluginCtx): Promise<void> | void;
     teardown?(ctx: PluginCtx): Promise<void> | void;
     agent?: AgentContribution;
+    backgroundTasks?: import('./background-scheduler.ts').BackgroundTask[];
+    actions?: Record<string, PluginAction>;
 }
 export declare const pluginHooks: Record<string, PluginHooks>;

package/dist/plugin-hooks.js CHANGED Viewed

@@ -2,4 +2,12 @@ import { getLogger } from '@coffer-org/sdk/logger';
 export function pluginCtx(id, em) {
     return { em, log: getLogger(id) };
 }
+export class HttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = 'HttpError';
+    }
+}
 export const pluginHooks = {};

package/dist/plugin-runtime.d.ts CHANGED Viewed

@@ -3,6 +3,7 @@ import type { PluginManifest } from '@coffer-org/sdk/plugin';
 export declare function getPlugins(): Promise<PluginManifest[]>;
 export declare function readDisabled(): Promise<Set<string>>;
 export declare function getPluginSettings(pluginId: string): Promise<Record<string, unknown>>;
+export declare function requireSettings<K extends string>(pluginId: string, keys: readonly K[]): Promise<Record<K, string>>;
 export declare function initStorage(): Promise<Set<string>>;
 export declare function initPlugins(): Promise<Registry>;
 export declare function teardownPlugins(): Promise<void>;

package/dist/plugin-runtime.js CHANGED Viewed

@@ -3,13 +3,14 @@ import { composeRegistry } from '@coffer-org/core/compose';
 import { getLogger } from '@coffer-org/sdk/logger';
 import { initDb, getOrm, getEm } from "./db.js";
 import { syncSchema } from "./schema-sync.js";
-import { systemEntities, buildPluginEntities, moduleTableName } from "./entity-schema.js";
-import { pluginHooks, pluginCtx } from "./plugin-hooks.js";
+import { systemEntities, buildPluginEntities, shelfTableName } from "./entity-schema.js";
+import { pluginHooks, pluginCtx, HttpError } from "./plugin-hooks.js";
 import { discoverPlugins, loadServerHooks } from "./plugin-discovery.js";
 import { runMigrations, assertSafeRequired } from "./migrations.js";
 import { runSeeds } from "./seeds.js";
 import { setActiveRegistry } from "./registry-context.js";
 import { migrateEmbeddingVectorsToBlob } from "./embeddings.js";
+import { startScheduler, stopScheduler } from "./background-scheduler.js";
 const log = getLogger('plugins');
 let _plugins = null;
 export async function getPlugins() {
@@ -36,6 +37,22 @@ export async function getPluginSettings(pluginId) {
         return {};
     }
 }
+export async function requireSettings(pluginId, keys) {
+    const s = await getPluginSettings(pluginId);
+    const out = {};
+    const missing = [];
+    for (const k of keys) {
+        const v = s[k];
+        if (v == null || v === '')
+            missing.push(k);
+        else
+            out[k] = String(v);
+    }
+    if (missing.length) {
+        throw new HttpError(400, `${pluginId} settings not configured: ${missing.join(', ')}. Save them first.`);
+    }
+    return out;
+}
 async function seedPluginRows() {
     const fork = getEm().fork();
     const existing = new Set((await fork.find('_Plugin', {})).map((r) => r.id));
@@ -74,6 +91,7 @@ export async function initPlugins() {
     setActiveRegistry(reg);
     Object.assign(pluginHooks, await loadServerHooks());
     await runSeeds({ em: getEm().fork(), plugins: reg.order, hooks: pluginHooks });
+    const bgTasks = [];
     for (const p of reg.order) {
         const h = pluginHooks[p.id];
         try {
@@ -81,17 +99,23 @@ export async function initPlugins() {
                 await h.init(pluginCtx(p.id, getEm().fork()));
                 log.debug(`${p.id}: init ✓`);
             }
+            for (const task of h?.backgroundTasks ?? [])
+                bgTasks.push(task);
         }
         catch (err) {
             log.error(`${p.id}: initialization failure`, err);
             throw err;
         }
     }
+    startScheduler(bgTasks);
+    if (bgTasks.length)
+        log.debug(`scheduler: ${bgTasks.length} background task(s): ${bgTasks.map((t) => t.name).join(' ')}`);
     log.info(`active: ${reg.order.map((p) => p.id).join(' ')}` +
         (disabled.size ? ` | disabled: ${[...disabled].join(' ')}` : ''));
     return reg;
 }
 export async function teardownPlugins() {
+    stopScheduler();
     Object.assign(pluginHooks, await loadServerHooks());
     const disabled = await readDisabled();
     const reg = composeRegistry(await getPlugins(), { disabled });
@@ -115,15 +139,15 @@ export async function teardownPlugin(id) {
         log.debug(`${id}: teardown ✓`);
     }
 }
-function pluginModules(p) {
+function pluginShelves(p) {
     return [
-        ...(p.vaults ?? []).flatMap((v) => v.modules.map((m) => ({ vault: m.vault, module: m.module }))),
-        ...(p.vaultModules ?? []).map((m) => ({ vault: m.vault, module: m.module })),
+        ...(p.libraries ?? []).flatMap((v) => v.shelves.map((m) => ({ library: m.library, shelf: m.shelf }))),
+        ...(p.libraryShelves ?? []).map((m) => ({ library: m.library, shelf: m.shelf })),
     ];
 }
 function pluginTables(p) {
     return [
-        ...pluginModules(p).map(({ vault, module }) => moduleTableName(vault, module)),
+        ...pluginShelves(p).map(({ library, shelf }) => shelfTableName(library, shelf)),
         ...(p.extends_ ?? []).map((e) => `extend__${e.id}`),
         ...(p.settings && p.settings.fields.length > 0 ? [`_settings__${p.id}`] : []),
     ];

package/dist/plugins-api.d.ts CHANGED Viewed

@@ -8,7 +8,7 @@ export interface PluginListEntry {
     packageName: string | null;
     dependsOn: string[];
     enabled: boolean;
-    vaults: string[];
+    libraries: string[];
     extends: string[];
     hasSettings: boolean;
     schema?: string;