@deadair/plugin-sdk 0.53.0 → 0.55.0

package/README.md

@@ -1533,6 +1533,40 @@ the whole row stays fillable until they say what kind of thing it is. A `secret`
 cell that stops applying keeps whatever is stored; nothing here deletes a
 credential.
 
+### A credential that goes to an address the operator types
+
+A secret is write-only, and a save that leaves one out keeps what is stored. That
+is what lets an operator change one setting without retyping every key, and it is
+also what would let anybody allowed to save the form point the address at a server
+of their own and collect the key the station sends there. So a secret names the
+address it is sent to:
+
+```ts
+{ key: 'baseUrl', label: 'Server address', type: 'url', required: true },
+{ key: 'apiKey', label: 'API key', type: 'secret', sentTo: 'baseUrl' },
+```
+
+and a column does the same inside its list:
+
+```ts
+{ key: 'baseUrl', label: 'Address', type: 'url' },
+{ key: 'apiKey', label: 'API key', type: 'secret', sentTo: 'baseUrl' },
+```
+
+With it declared, the host refuses a save that keeps the stored secret while
+moving that address to another origin (scheme, host or port), and the operator is
+asked to type the secret again. A changed path on the same server is not a move, a
+secret typed or cleared in the same save is never refused, and on a row the
+address is compared with the same row as it was stored. An empty field counts as
+its `default`.
+
+Declare it on every secret that goes to an address the operator supplies. Leave it
+off one that goes to a fixed vendor whatever the form says (a token for a public
+API whose host is in your manifest): there is no address to move. `sentTo` must
+name a `url` or `string` field, or a column in the same list; the manifest schema
+refuses one that names anything else, because a declaration pointing at nothing
+would be a protection that is silently off.
+
 ### Rows to start from
 
 Where most rows describe one of a few well-known things, `presets` offers them:

package/dist/index.js

@@ -1074,6 +1074,23 @@ function parseRows(raw) {
   }
 }
 __name(parseRows, "parseRows");
+function sentToProblems(fields) {
+  const isAddress = /* @__PURE__ */ __name((type) => type === "url" || type === "string", "isAddress");
+  const problems = [];
+  for (const field of fields) {
+    if (field.sentTo !== void 0 && !isAddress(fields.find((candidate) => candidate.key === field.sentTo)?.type)) {
+      problems.push(`"${field.key}" is sent to "${field.sentTo}", which is not a url or string field in this form`);
+    }
+    const columns = field.columns ?? [];
+    for (const column of columns) {
+      if (column.sentTo !== void 0 && !isAddress(columns.find((candidate) => candidate.key === column.sentTo)?.type)) {
+        problems.push(`"${field.key}.${column.key}" is sent to "${column.sentTo}", which is not a url or string column in this list`);
+      }
+    }
+  }
+  return problems;
+}
+__name(sentToProblems, "sentToProblems");
 var configFieldOptionSchema = z.object({
   value: z.string(),
   label: z.string()
@@ -1135,7 +1152,8 @@ var configFieldColumnSchema = z.object({
   // one, and a schema that refuses what the contract accepts is the drift the generated-output
   // rule exists to prevent; values without a target are documented as ignored instead.
   dependsOn: z.string().min(1).optional(),
-  dependsOnValues: z.array(z.string().min(1)).optional()
+  dependsOnValues: z.array(z.string().min(1)).optional(),
+  sentTo: z.string().min(1).optional()
 });
 var configFieldPresetSchema = z.object({
   label: z.string().min(1),
@@ -1163,7 +1181,10 @@ var configFieldSchema = z.object({
   columns: z.array(configFieldColumnSchema).optional(),
   presets: z.array(configFieldPresetSchema).optional(),
   dependsOn: z.string().optional(),
-  rangeWith: z.string().optional()
+  rangeWith: z.string().optional(),
+  // Named here for the reason `dependsOn` is named on a column: the loader keeps the zod OUTPUT,
+  // and a declaration stripped at load is a protection that is silently not there.
+  sentTo: z.string().min(1).optional()
 });
 
 // src/plugin.config.read.ts
@@ -1341,7 +1362,13 @@ var pluginManifestSchema = z3.object({
   homepage: z3.string().optional(),
   icon: z3.string().optional(),
   permissions: pluginPermissionsSchema,
-  configFields: z3.array(configFieldSchema),
+  // A `sentTo` naming nothing is refused here rather than ignored: see `sentToProblems`.
+  configFields: z3.array(configFieldSchema).superRefine((fields, ctx) => {
+    for (const message of sentToProblems(fields)) ctx.addIssue({
+      code: "custom",
+      message
+    });
+  }),
   configSchema: z3.custom(isZodSchema, {
     message: "configSchema must be a zod schema"
   })
@@ -1431,6 +1458,7 @@ export {
   readRowSecret,
   retryAfterMs,
   rowSecretKey,
+  sentToProblems,
   sentencesOf,
   sentencesWithin,
   toPluginError,