@crowi/api 2.0.0-alpha.0

package/dist/routes/ts-rest/admin/auth.js

@@ -0,0 +1,95 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("@ts-rest/express");
+const api_contract_1 = require("@crowi/api-contract");
+const express_2 = require("express");
+const admin_config_1 = require("../../../util/admin-config");
+const ts_rest_helpers_1 = require("../../../util/ts-rest-helpers");
+const debug_1 = __importDefault(require("debug"));
+const debug = (0, debug_1.default)('crowi:routes:ts-rest:admin:auth');
+const KEY_REQUIRE_THIRD_PARTY_AUTH = 'auth:requireThirdPartyAuth';
+const KEY_DISABLE_PASSWORD_AUTH = 'auth:disablePasswordAuth';
+const readAuthSettings = (crowi) => {
+    const ns = (0, admin_config_1.getCrowiConfigNamespace)(crowi);
+    return {
+        requireThirdPartyAuth: (0, admin_config_1.coerceBoolean)(ns[KEY_REQUIRE_THIRD_PARTY_AUTH]),
+        disablePasswordAuth: (0, admin_config_1.coerceBoolean)(ns[KEY_DISABLE_PASSWORD_AUTH]),
+    };
+};
+exports.default = (crowi, _app) => {
+    const s = (0, express_1.initServer)();
+    const router = (0, express_2.Router)();
+    const authRouter = s.router(api_contract_1.apiContract.admin.auth, {
+        /**
+         * GET /api/v2/admin/auth
+         * Returns the two `auth:*` config values currently in effect.
+         * Authorization (jwt + admin) is handled by the surrounding adminRouter
+         * middleware; missing/forbidden auth never reaches this handler.
+         */
+        getAuthSettings: async () => {
+            try {
+                const settings = readAuthSettings(crowi);
+                return { status: 200, body: settings };
+            }
+            catch (err) {
+                const error = err;
+                debug('Error reading auth settings:', error.message);
+                return ts_rest_helpers_1.internalServerErrorResponse;
+            }
+        },
+        /**
+         * PUT /api/v2/admin/auth
+         * Persists the two `auth:*` keys via configService.saveConfig('crowi', ...).
+         *
+         * Self-lockout guard: if the requester sets `disablePasswordAuth: true`
+         * but their own account is not connected to a valid third-party identity
+         * (Google / GitHub), reject with 422. Mirrors the legacy guard in
+         * controllers/admin.ts:postSettings — it intentionally checks only the
+         * acting admin, not other admins, matching the previous behaviour.
+         *
+         * - We only write the two auth keys we own; saveConfig merges into the
+         *   existing 'crowi' namespace so unrelated keys (app:*, security:*,
+         *   mail:*) are untouched.
+         * - Returns the post-save settings so the UI doesn't need a follow-up GET.
+         */
+        updateAuthSettings: async ({ body, req }) => {
+            // jwtAdminRequired guarantees req.user is populated; the augmentation
+            // declares it optional so we re-narrow here.
+            const user = req.user;
+            if (body.disablePasswordAuth && !user.hasValidThirdPartyId()) {
+                return {
+                    status: 422,
+                    body: {
+                        error: {
+                            code: 'PASSWORD_AUTH_REQUIRES_THIRDPARTY',
+                            // Wire-level fallback; UIs key off `code` and render the
+                            // localised message via paraglide. Kept non-empty so legacy
+                            // / scripted callers see a hint without grepping for the code.
+                            message: 'Disabling password auth requires the acting admin to be connected to a valid third-party identity.',
+                        },
+                    },
+                };
+            }
+            try {
+                await crowi.getConfigService().saveConfig('crowi', {
+                    [KEY_REQUIRE_THIRD_PARTY_AUTH]: body.requireThirdPartyAuth,
+                    [KEY_DISABLE_PASSWORD_AUTH]: body.disablePasswordAuth,
+                });
+            }
+            catch (err) {
+                const error = err;
+                debug('Error saving auth settings:', error.message);
+                return ts_rest_helpers_1.internalServerErrorResponse;
+            }
+            // Re-read from the in-memory cache (saveConfig updates it) so the
+            // response reflects the new values without a Mongo round-trip.
+            return { status: 200, body: readAuthSettings(crowi) };
+        },
+    });
+    (0, express_1.createExpressEndpoints)(api_contract_1.apiContract.admin.auth, authRouter, router);
+    return router;
+};
+//# sourceMappingURL=auth.js.map

package/dist/routes/ts-rest/admin/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../../src/routes/ts-rest/admin/auth.ts"],"names":[],"mappings":";;;;;AAAA,8CAAsE;AACtE,sDAAqE;AAErE,qCAA0C;AAE1C,wDAA+E;AAC/E,8DAAuE;AACvE,kDAA0B;AAE1B,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,iCAAiC,CAAC,CAAC;AAEvD,MAAM,4BAA4B,GAAG,4BAA4B,CAAC;AAClE,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAE7D,MAAM,gBAAgB,GAAG,CAAC,KAAY,EAAgB,EAAE;IACtD,MAAM,EAAE,GAAG,IAAA,sCAAuB,EAAC,KAAK,CAAC,CAAC;IAC1C,OAAO;QACL,qBAAqB,EAAE,IAAA,4BAAa,EAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC;QACtE,mBAAmB,EAAE,IAAA,4BAAa,EAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC;KAClE,CAAC;AACJ,CAAC,CAAC;AAEF,kBAAe,CAAC,KAAY,EAAE,IAAa,EAAE,EAAE;IAC7C,MAAM,CAAC,GAAG,IAAA,oBAAU,GAAE,CAAC;IACvB,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,0BAAW,CAAC,KAAK,CAAC,IAAI,EAAE;QAClD;;;;;WAKG;QACH,eAAe,EAAE,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACzC,OAAO,EAAE,MAAM,EAAE,GAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAClD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAY,CAAC;gBAC3B,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBACrD,OAAO,6CAA2B,CAAC;YACrC,CAAC;QACH,CAAC;QAED;;;;;;;;;;;;;;WAcG;QACH,kBAAkB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;YAC1C,sEAAsE;YACtE,6CAA6C;YAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAoB,CAAC;YAEtC,IAAI,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;gBAC7D,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE;wBACJ,KAAK,EAAE;4BACL,IAAI,EAAE,mCAA4C;4BAClD,yDAAyD;4BACzD,4DAA4D;4BAC5D,+DAA+D;4BAC/D,OAAO,EAAE,oGAAoG;yBAC9G;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,gBAAgB,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE;oBACjD,CAAC,4BAA4B,CAAC,EAAE,IAAI,CAAC,qBAAqB;oBAC1D,CAAC,yBAAyB,CAAC,EAAE,IAAI,CAAC,mBAAmB;iBACtD,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAY,CAAC;gBAC3B,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBACpD,OAAO,6CAA2B,CAAC;YACrC,CAAC;YAED,kEAAkE;YAClE,+DAA+D;YAC/D,OAAO,EAAE,MAAM,EAAE,GAAY,EAAE,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,CAAC;KACF,CAAC,CAAC;IAEH,IAAA,gCAAsB,EAAC,0BAAW,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAEnE,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/routes/ts-rest/admin/index.d.ts

@@ -0,0 +1,10 @@
+import Crowi from '../../../crowi';
+import { Express } from 'express';
+/**
+ * Aggregate router for all admin-only ts-rest endpoints. Mounted under the
+ * adminRouter in `routes/ts-rest/index.ts` which already applies
+ * `jwtAdminRequired` (JWT + admin permission). Individual sub-routers should
+ * therefore not re-implement authorization.
+ */
+declare const _default: (crowi: Crowi, app: Express) => import("express-serve-static-core").Router;
+export default _default;

package/dist/routes/ts-rest/admin/index.js

@@ -0,0 +1,35 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
+const app_1 = __importDefault(require("./app"));
+const auth_1 = __importDefault(require("./auth"));
+const mail_1 = __importDefault(require("./mail"));
+const plugins_1 = __importDefault(require("./plugins"));
+const search_1 = __importDefault(require("./search"));
+const security_1 = __importDefault(require("./security"));
+const share_1 = __importDefault(require("./share"));
+const storage_1 = __importDefault(require("./storage"));
+const users_1 = __importDefault(require("./users"));
+/**
+ * Aggregate router for all admin-only ts-rest endpoints. Mounted under the
+ * adminRouter in `routes/ts-rest/index.ts` which already applies
+ * `jwtAdminRequired` (JWT + admin permission). Individual sub-routers should
+ * therefore not re-implement authorization.
+ */
+exports.default = (crowi, app) => {
+    const router = (0, express_1.Router)();
+    router.use((0, app_1.default)(crowi, app));
+    router.use((0, auth_1.default)(crowi, app));
+    router.use((0, security_1.default)(crowi, app));
+    router.use((0, mail_1.default)(crowi, app));
+    router.use((0, share_1.default)(crowi, app));
+    router.use((0, storage_1.default)(crowi, app));
+    router.use((0, search_1.default)(crowi, app));
+    router.use((0, users_1.default)(crowi, app));
+    router.use((0, plugins_1.default)(crowi, app));
+    return router;
+};
+//# sourceMappingURL=index.js.map

package/dist/routes/ts-rest/admin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/routes/ts-rest/admin/index.ts"],"names":[],"mappings":";;;;;AACA,qCAA0C;AAC1C,gDAA8B;AAC9B,kDAAgC;AAChC,kDAAgC;AAChC,wDAAsC;AACtC,sDAAoC;AACpC,0DAAwC;AACxC,oDAAkC;AAClC,wDAAsC;AACtC,oDAAkC;AAElC;;;;;GAKG;AACH,kBAAe,CAAC,KAAY,EAAE,GAAY,EAAE,EAAE;IAC5C,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB,MAAM,CAAC,GAAG,CAAC,IAAA,aAAS,EAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,CAAC,IAAA,cAAU,EAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,CAAC,IAAA,kBAAc,EAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,CAAC,IAAA,cAAU,EAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,CAAC,IAAA,eAAW,EAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,CAAC,IAAA,iBAAa,EAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,IAAA,gBAAY,EAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,IAAA,eAAW,EAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,CAAC,IAAA,iBAAa,EAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAEtC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/routes/ts-rest/admin/mail.d.ts

@@ -0,0 +1,4 @@
+import { Express } from 'express';
+import Crowi from '../../../crowi';
+declare const _default: (crowi: Crowi, _app: Express) => import("express-serve-static-core").Router;
+export default _default;

package/dist/routes/ts-rest/admin/mail.js

@@ -0,0 +1,156 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("@ts-rest/express");
+const api_contract_1 = require("@crowi/api-contract");
+const express_2 = require("express");
+const admin_config_1 = require("../../../util/admin-config");
+const debug_1 = __importDefault(require("debug"));
+const debug = (0, debug_1.default)('crowi:routes:ts-rest:admin:mail');
+const KEY_FROM = 'mail:from';
+const KEY_SMTP_HOST = 'mail:smtpHost';
+const KEY_SMTP_PORT = 'mail:smtpPort';
+const KEY_SMTP_USER = 'mail:smtpUser';
+const KEY_SMTP_PASSWORD = 'mail:smtpPassword';
+const KEY_AWS_REGION = 'mail:aws:region';
+const KEY_AWS_ACCESS_KEY = 'mail:aws:accessKeyId';
+const KEY_AWS_SECRET = 'mail:aws:secretAccessKey';
+exports.default = (crowi, _app) => {
+    const s = (0, express_1.initServer)();
+    const router = (0, express_2.Router)();
+    const router_ = s.router(api_contract_1.apiContract.admin.mail, {
+        getMailSettings: async () => {
+            const ns = (0, admin_config_1.getCrowiConfigNamespace)(crowi);
+            const smtpPassword = (0, admin_config_1.coerceString)(ns[KEY_SMTP_PASSWORD]);
+            const awsSecret = (0, admin_config_1.coerceString)(ns[KEY_AWS_SECRET]);
+            return {
+                status: 200,
+                body: {
+                    from: (0, admin_config_1.coerceString)(ns[KEY_FROM]),
+                    smtpHost: (0, admin_config_1.coerceString)(ns[KEY_SMTP_HOST]),
+                    smtpPort: (0, admin_config_1.coerceNumber)(ns[KEY_SMTP_PORT]),
+                    smtpUser: (0, admin_config_1.coerceString)(ns[KEY_SMTP_USER]),
+                    smtpPassword: { hasValue: smtpPassword.length > 0 },
+                    aws: {
+                        region: (0, admin_config_1.coerceString)(ns[KEY_AWS_REGION]),
+                        accessKeyId: (0, admin_config_1.coerceString)(ns[KEY_AWS_ACCESS_KEY]),
+                        secretAccessKey: { hasValue: awsSecret.length > 0 },
+                    },
+                },
+            };
+        },
+        /**
+         * Partial update. `smtpPassword` and `aws.secretAccessKey` follow the same
+         * three-state semantics admin/app uses:
+         * - omitted   → not added to the payload, value stays untouched.
+         * - empty ''  → forwarded as '' to clear the row.
+         * - non-empty → forwarded; auto-encryption kicks in via `isSensitiveConfig`.
+         *
+         * After persisting we re-run `crowi.setupMailer()` so the in-memory mailer
+         * reflects the new values without a server restart.
+         */
+        updateMailSettings: async ({ body }) => {
+            const updates = {};
+            if (body.from !== undefined)
+                updates[KEY_FROM] = body.from;
+            if (body.smtpHost !== undefined)
+                updates[KEY_SMTP_HOST] = body.smtpHost;
+            if (body.smtpPort !== undefined)
+                updates[KEY_SMTP_PORT] = body.smtpPort;
+            if (body.smtpUser !== undefined)
+                updates[KEY_SMTP_USER] = body.smtpUser;
+            if (body.smtpPassword !== undefined)
+                updates[KEY_SMTP_PASSWORD] = body.smtpPassword;
+            if (body.aws) {
+                const { region, accessKeyId, secretAccessKey } = body.aws;
+                if (region !== undefined)
+                    updates[KEY_AWS_REGION] = region;
+                if (accessKeyId !== undefined)
+                    updates[KEY_AWS_ACCESS_KEY] = accessKeyId;
+                if (secretAccessKey !== undefined)
+                    updates[KEY_AWS_SECRET] = secretAccessKey;
+            }
+            if (Object.keys(updates).length > 0) {
+                debug('updateMailSettings keys=%o', Object.keys(updates));
+                await crowi.getConfigService().saveConfig('crowi', updates);
+                crowi.setupMailer();
+            }
+            return { status: 200, body: { ok: true } };
+        },
+        /**
+         * Send a test mail to the calling admin's email. Mirrors the legacy
+         * `validateMailSetting` controller: builds an SMTP transport from the
+         * supplied option (or current saved values) and dispatches a fixed-text
+         * mail. Network errors surface as 502.
+         */
+        sendTestMail: async ({ body, req }) => {
+            const user = req.user;
+            if (!user || !user.email) {
+                return {
+                    status: 502,
+                    body: { error: { code: 'MAIL_TEST_FAILED', message: 'No email address on the calling user' } },
+                };
+            }
+            const ns = (0, admin_config_1.getCrowiConfigNamespace)(crowi);
+            const host = body?.smtpHost ?? (0, admin_config_1.coerceString)(ns[KEY_SMTP_HOST]);
+            const port = body?.smtpPort ?? (0, admin_config_1.coerceNumber)(ns[KEY_SMTP_PORT]);
+            const smtpUser = body?.smtpUser ?? (0, admin_config_1.coerceString)(ns[KEY_SMTP_USER]);
+            const smtpPassword = body?.smtpPassword ?? (0, admin_config_1.coerceString)(ns[KEY_SMTP_PASSWORD]);
+            if (!host || !port) {
+                return {
+                    status: 502,
+                    body: { error: { code: 'MAIL_TEST_FAILED', message: 'SMTP host / port is not configured' } },
+                };
+            }
+            const option = {
+                host,
+                port,
+            };
+            if (smtpUser && smtpPassword) {
+                option.auth = { user: smtpUser, pass: smtpPassword };
+            }
+            if (port === 465) {
+                option.secure = true;
+            }
+            const mailer = crowi.mailer;
+            if (!mailer || typeof mailer.createSMTPClient !== 'function') {
+                return {
+                    status: 502,
+                    body: { error: { code: 'MAIL_TEST_FAILED', message: 'Mailer is not initialized' } },
+                };
+            }
+            const smtpClient = mailer.createSMTPClient(option);
+            try {
+                await new Promise((resolve, reject) => {
+                    smtpClient.sendMail({
+                        to: user.email,
+                        // ASCII-only: this is an SMTP smoke test that has to land
+                        // in the recipient's inbox even when the configured
+                        // transport's character-encoding settings are wrong.
+                        subject: 'Crowi: SMTP test mail',
+                        text: 'This is a test message dispatched from the Crowi admin SMTP settings page.',
+                    }, (err) => {
+                        if (err)
+                            reject(err);
+                        else
+                            resolve();
+                    });
+                });
+            }
+            catch (err) {
+                const error = err;
+                debug('sendTestMail failed: %s', error.message);
+                return {
+                    status: 502,
+                    body: { error: { code: 'MAIL_TEST_FAILED', message: error.message } },
+                };
+            }
+            return { status: 200, body: { ok: true, to: user.email } };
+        },
+    });
+    (0, express_1.createExpressEndpoints)(api_contract_1.apiContract.admin.mail, router_, router);
+    return router;
+};
+//# sourceMappingURL=mail.js.map

package/dist/routes/ts-rest/admin/mail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail.js","sourceRoot":"","sources":["../../../../src/routes/ts-rest/admin/mail.ts"],"names":[],"mappings":";;;;;AAAA,8CAAsE;AACtE,sDAAkD;AAClD,qCAA0C;AAG1C,wDAA4F;AAC5F,kDAA0B;AAE1B,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,iCAAiC,CAAC,CAAC;AAEvD,MAAM,QAAQ,GAAG,WAAW,CAAC;AAC7B,MAAM,aAAa,GAAG,eAAe,CAAC;AACtC,MAAM,aAAa,GAAG,eAAe,CAAC;AACtC,MAAM,aAAa,GAAG,eAAe,CAAC;AACtC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAC9C,MAAM,cAAc,GAAG,iBAAiB,CAAC;AACzC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAClD,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAElD,kBAAe,CAAC,KAAY,EAAE,IAAa,EAAE,EAAE;IAC7C,MAAM,CAAC,GAAG,IAAA,oBAAU,GAAE,CAAC;IACvB,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,0BAAW,CAAC,KAAK,CAAC,IAAI,EAAE;QAC/C,eAAe,EAAE,KAAK,IAAI,EAAE;YAC1B,MAAM,EAAE,GAAG,IAAA,sCAAuB,EAAC,KAAK,CAAC,CAAC;YAE1C,MAAM,YAAY,GAAG,IAAA,2BAAY,EAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,IAAA,2BAAY,EAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;YAEnD,OAAO;gBACL,MAAM,EAAE,GAAY;gBACpB,IAAI,EAAE;oBACJ,IAAI,EAAE,IAAA,2BAAY,EAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;oBAChC,QAAQ,EAAE,IAAA,2BAAY,EAAC,EAAE,CAAC,aAAa,CAAC,CAAC;oBACzC,QAAQ,EAAE,IAAA,2BAAY,EAAC,EAAE,CAAC,aAAa,CAAC,CAAC;oBACzC,QAAQ,EAAE,IAAA,2BAAY,EAAC,EAAE,CAAC,aAAa,CAAC,CAAC;oBACzC,YAAY,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE;oBACnD,GAAG,EAAE;wBACH,MAAM,EAAE,IAAA,2BAAY,EAAC,EAAE,CAAC,cAAc,CAAC,CAAC;wBACxC,WAAW,EAAE,IAAA,2BAAY,EAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;wBACjD,eAAe,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE;qBACpD;iBACF;aACF,CAAC;QACJ,CAAC;QAED;;;;;;;;;WASG;QACH,kBAAkB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YACrC,MAAM,OAAO,GAA4B,EAAE,CAAC;YAE5C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;YAC3D,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;gBAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;YACxE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;gBAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;YACxE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;gBAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;YACxE,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;gBAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;YAEpF,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;gBAC1D,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC;gBAC3D,IAAI,WAAW,KAAK,SAAS;oBAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,WAAW,CAAC;gBACzE,IAAI,eAAe,KAAK,SAAS;oBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,eAAe,CAAC;YAC/E,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,KAAK,CAAC,4BAA4B,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC1D,MAAM,KAAK,CAAC,gBAAgB,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC5D,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,GAAY,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAa,EAAE,EAAE,CAAC;QAC/D,CAAC;QAED;;;;;WAKG;QACH,YAAY,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;YACpC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAgC,CAAC;YAClD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACzB,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAA2B,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE;iBACxG,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,GAAG,IAAA,sCAAuB,EAAC,KAAK,CAAC,CAAC;YAE1C,MAAM,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAI,IAAA,2BAAY,EAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAI,IAAA,2BAAY,EAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,IAAA,2BAAY,EAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;YACnE,MAAM,YAAY,GAAG,IAAI,EAAE,YAAY,IAAI,IAAA,2BAAY,EAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAE/E,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACnB,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAA2B,EAAE,OAAO,EAAE,oCAAoC,EAAE,EAAE;iBACtG,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAA4F;gBACtG,IAAI;gBACJ,IAAI;aACL,CAAC;YACF,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;YACvD,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;YACvB,CAAC;YAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC5B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;gBAC7D,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAA2B,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE;iBAC7F,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAEnD,IAAI,CAAC;gBACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;oBAC1C,UAAU,CAAC,QAAQ,CACjB;wBACE,EAAE,EAAE,IAAI,CAAC,KAAK;wBACd,0DAA0D;wBAC1D,oDAAoD;wBACpD,qDAAqD;wBACrD,OAAO,EAAE,uBAAuB;wBAChC,IAAI,EAAE,4EAA4E;qBACnF,EACD,CAAC,GAAiB,EAAE,EAAE;wBACpB,IAAI,GAAG;4BAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;4BAChB,OAAO,EAAE,CAAC;oBACjB,CAAC,CACF,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAY,CAAC;gBAC3B,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBAChD,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAA2B,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE;iBAC/E,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,GAAY,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAa,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QAC/E,CAAC;KACF,CAAC,CAAC;IAEH,IAAA,gCAAsB,EAAC,0BAAW,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/routes/ts-rest/admin/plugins.d.ts

@@ -0,0 +1,4 @@
+import { Express } from 'express';
+import Crowi from '../../../crowi';
+declare const _default: (crowi: Crowi, _app: Express) => import("express-serve-static-core").Router;
+export default _default;

package/dist/routes/ts-rest/admin/plugins.js

@@ -0,0 +1,317 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("@ts-rest/express");
+const express_2 = require("express");
+const api_contract_1 = require("@crowi/api-contract");
+const schema_serializer_1 = require("../../../plugin/schema-serializer");
+const ts_rest_helpers_1 = require("../../../util/ts-rest-helpers");
+const debug_1 = __importDefault(require("debug"));
+const debug = (0, debug_1.default)('crowi:routes:ts-rest:admin:plugins');
+exports.default = (crowi, _app) => {
+    const s = (0, express_1.initServer)();
+    const router = (0, express_2.Router)();
+    const pluginsRouter = s.router(api_contract_1.apiContract.admin.plugins, {
+        /**
+         * GET /api/v2/admin/plugins
+         *
+         * Lists every plugin currently loaded by the PluginManager along
+         * with its declared registry slots. The admin "Plugins" page
+         * renders this as a table.
+         */
+        listPlugins: async () => {
+            const manager = crowi.pluginManager;
+            if (!manager) {
+                return { status: 200, body: { plugins: [] } };
+            }
+            const all = manager.getLoadedPlugins();
+            const plugins = all.map((p) => toPluginInfo(p, all));
+            return { status: 200, body: { plugins } };
+        },
+        /**
+         * GET /api/v2/admin/plugins/:name/config
+         *
+         * Get the form schema + current values for a single plugin.
+         * Sensitive fields are masked to `{ hasValue: boolean }` before
+         * returning so plaintext secrets never reach the browser.
+         */
+        getPluginConfig: async ({ query }) => {
+            const manager = crowi.pluginManager;
+            const plugin = manager?.getLoadedPlugin(query.name);
+            if (!plugin) {
+                return pluginNotFound(query.name);
+            }
+            if (!plugin.configSchema) {
+                // Plugin has no configurable values; return an empty form.
+                return {
+                    status: 200,
+                    body: { name: plugin.name, fields: [], values: {} },
+                };
+            }
+            const fields = (0, schema_serializer_1.serializeConfigSchema)(plugin.configSchema);
+            const ns = readPluginNamespace(crowi, plugin.name);
+            const values = {};
+            for (const field of fields) {
+                if (field.kind === 'secret') {
+                    const raw = ns[field.name];
+                    values[field.name] = { hasValue: typeof raw === 'string' && raw.length > 0 };
+                }
+                else {
+                    values[field.name] = ns[field.name] ?? field.defaultValue ?? null;
+                }
+            }
+            return {
+                status: 200,
+                body: { name: plugin.name, fields, values },
+            };
+        },
+        /**
+         * PUT /api/v2/admin/plugins/:name/config
+         *
+         * Validate the request body through the plugin's Zod schema and
+         * persist each field into `plugin:<name>:*` config rows. Sensitive
+         * fields follow the three-state convention used by /admin/app and
+         * /admin/mail:
+         *   - undefined / missing → leave value untouched
+         *   - empty string         → clear the saved value
+         *   - non-empty string     → replace and re-encrypt
+         */
+        updatePluginConfig: async ({ query, body }) => {
+            const manager = crowi.pluginManager;
+            const plugin = manager?.getLoadedPlugin(query.name);
+            if (!plugin) {
+                return pluginNotFound(query.name);
+            }
+            if (!plugin.configSchema) {
+                return {
+                    status: 422,
+                    body: {
+                        error: {
+                            code: 'PLUGIN_CONFIG_VALIDATION_FAILED',
+                            message: 'Plugin does not declare any configurable values',
+                            issues: [],
+                        },
+                    },
+                };
+            }
+            const fields = (0, schema_serializer_1.serializeConfigSchema)(plugin.configSchema);
+            const fieldsByName = new Map(fields.map((f) => [f.name, f]));
+            // Build a candidate object using new values + existing values
+            // for fields the operator did not touch (so secret-untouched
+            // doesn't overwrite the saved secret).
+            const existing = readPluginNamespace(crowi, plugin.name);
+            const merged = { ...existing };
+            const toWrite = {};
+            for (const [key, value] of Object.entries(body.values)) {
+                const field = fieldsByName.get(key);
+                if (!field) {
+                    // Ignore unknown keys. The Zod parse below would also catch
+                    // them via `.strict()`, but we strip first so users get
+                    // friendlier per-field errors instead of a global one.
+                    continue;
+                }
+                if (field.kind === 'secret' && value === undefined) {
+                    // explicitly leave untouched
+                    continue;
+                }
+                merged[key] = value;
+                toWrite[key] = value;
+            }
+            const parsed = plugin.configSchema.safeParse(merged);
+            if (!parsed.success) {
+                return {
+                    status: 422,
+                    body: {
+                        error: {
+                            code: 'PLUGIN_CONFIG_VALIDATION_FAILED',
+                            message: 'Plugin config failed validation',
+                            issues: parsed.error.issues.map((i) => ({
+                                path: i.path.map((p) => (typeof p === 'symbol' ? String(p) : p)),
+                                message: i.message,
+                            })),
+                        },
+                    },
+                };
+            }
+            const configService = crowi.getConfigService();
+            const writes = {};
+            for (const [key, value] of Object.entries(toWrite)) {
+                writes[`plugin:${plugin.name}:${key}`] = value;
+            }
+            try {
+                if (Object.keys(writes).length > 0) {
+                    await configService.saveConfig('crowi', writes);
+                }
+            }
+            catch (err) {
+                const error = err;
+                debug('Error saving plugin config:', error.message);
+                return ts_rest_helpers_1.internalServerErrorResponse;
+            }
+            let hotReloaded = false;
+            let reconfigureFailed = false;
+            const pluginManager = crowi.pluginManager;
+            if (pluginManager && Object.keys(writes).length > 0) {
+                const result = await pluginManager.reconfigureAffected([`plugin:${plugin.name}`]);
+                hotReloaded = result.attempted > 0 && result.succeeded === result.attempted;
+                reconfigureFailed = result.attempted > result.succeeded;
+            }
+            return { status: 200, body: { ok: true, hotReloaded, reconfigureFailed } };
+        },
+        /**
+         * POST /api/v2/admin/plugins/render-cache/clear-all
+         *
+         * Drops every PluginRenderCache document. Surfaced by the
+         * "Clear all render cache" button in the admin UI. The next
+         * render of any embed-bearing page repopulates the cache.
+         */
+        clearRenderCacheAll: async () => {
+            const renderer = crowi.renderer;
+            if (!renderer) {
+                return ts_rest_helpers_1.internalServerErrorResponse;
+            }
+            try {
+                const removedCount = await renderer.cache.invalidateAll();
+                return {
+                    status: 200,
+                    body: {
+                        ok: true,
+                        clearedAt: new Date().toISOString(),
+                        removedCount,
+                    },
+                };
+            }
+            catch (err) {
+                debug('clearRenderCacheAll failed:', err.message);
+                return ts_rest_helpers_1.internalServerErrorResponse;
+            }
+        },
+        /**
+         * POST /api/v2/admin/plugins/render-cache/clear-plugin?name=…
+         *
+         * Drops PluginRenderCache documents whose `pluginName` matches.
+         * Returns 404 when the named plugin is not loaded; that prevents
+         * typos from silently succeeding ("nothing matched, but ok").
+         */
+        clearRenderCachePlugin: async ({ query }) => {
+            const renderer = crowi.renderer;
+            const manager = crowi.pluginManager;
+            if (!renderer) {
+                return ts_rest_helpers_1.internalServerErrorResponse;
+            }
+            if (manager && !manager.getLoadedPlugin(query.name)) {
+                return pluginNotFound(query.name);
+            }
+            try {
+                const removedCount = await renderer.cache.invalidatePlugin(query.name);
+                return {
+                    status: 200,
+                    body: {
+                        ok: true,
+                        clearedAt: new Date().toISOString(),
+                        removedCount,
+                    },
+                };
+            }
+            catch (err) {
+                debug('clearRenderCachePlugin failed:', err.message);
+                return ts_rest_helpers_1.internalServerErrorResponse;
+            }
+        },
+    });
+    (0, express_1.createExpressEndpoints)(api_contract_1.apiContract.admin.plugins, pluginsRouter, router);
+    return router;
+};
+const toPluginInfo = (plugin, all) => ({
+    name: plugin.name,
+    version: plugin.version,
+    requires: plugin.requires,
+    hasConfig: !!plugin.configSchema,
+    registers: collectRegistrySlots(plugin),
+    adminPlacement: resolvePlacement(plugin),
+    supportsHotReload: hasReconfigureOrDependent(plugin, all),
+});
+/**
+ * A plugin "supports hot reload" if changing its config can be applied
+ * live. That is true when the plugin itself implements `reconfigure`
+ * OR when a plugin that requires it does — config-only base plugins
+ * (e.g. `@crowi/plugin-aws`) flow through this transitively because
+ * the dependents fan-out fires their reconfigure.
+ */
+function hasReconfigureOrDependent(plugin, all) {
+    if (plugin.reconfigure)
+        return true;
+    for (const other of all) {
+        if (other.requires?.includes(plugin.name) && other.reconfigure)
+            return true;
+    }
+    return false;
+}
+function collectRegistrySlots(plugin) {
+    const slots = [];
+    if (plugin.registerStorage)
+        slots.push('storage');
+    if (plugin.registerSearch)
+        slots.push('search');
+    if (plugin.registerAuth)
+        slots.push('auth');
+    if (plugin.registerNotifier)
+        slots.push('notifier');
+    return slots;
+}
+/**
+ * Compute the effective sidebar placement for a plugin. The plugin's
+ * own `adminPlacement` wins where it sets a field; missing fields
+ * fall back to derived defaults:
+ *   - section: derived from register* hooks (storage / search / auth /
+ *     notification → matching section). Plugins with no register*
+ *     hook need to declare `section: 'shared'` themselves to appear
+ *     under the "shared services" section; if they didn't declare it
+ *     either, fall through to `'settings'`.
+ *   - label: defaults to the plugin's npm name.
+ *   - icon: optional, no default.
+ */
+function resolvePlacement(plugin) {
+    const declared = plugin.adminPlacement;
+    const derivedSection = deriveSectionFromHooks(plugin);
+    return {
+        section: declared?.section ?? derivedSection ?? 'settings',
+        label: declared?.label ?? plugin.name,
+        icon: declared?.icon,
+    };
+}
+function deriveSectionFromHooks(plugin) {
+    if (plugin.registerStorage)
+        return 'storage';
+    if (plugin.registerAuth)
+        return 'auth';
+    if (plugin.registerNotifier)
+        return 'notification';
+    // search has no top-level section in the to-be sidebar; surface
+    // search-only plugins under "settings" by default.
+    return undefined;
+}
+function readPluginNamespace(crowi, pluginName) {
+    const all = crowi.getConfig();
+    const crowiNs = (all && typeof all === 'object' ? all.crowi : undefined) ?? {};
+    const prefix = `plugin:${pluginName}:`;
+    const out = {};
+    for (const [key, value] of Object.entries(crowiNs)) {
+        if (key.startsWith(prefix)) {
+            out[key.slice(prefix.length)] = value;
+        }
+    }
+    return out;
+}
+const pluginNotFound = (name) => ({
+    status: 404,
+    body: {
+        error: {
+            code: 'PLUGIN_NOT_FOUND',
+            message: `Plugin '${name}' is not loaded`,
+        },
+    },
+});
+//# sourceMappingURL=plugins.js.map