@digitalpaws/starr 0.0.1

package/dist/auth/oidc/user-service.js

@@ -0,0 +1,177 @@
+// SPDX-License-Identifier: 0BSD
+// SPDX-FileCopyrightText: 2025 Digi <digitalpaws@proton.me>
+import { randomUUID } from "node:crypto";
+export class UserService {
+    db;
+    logger;
+    constructor(db, logger) {
+        this.db = db;
+        this.logger = logger;
+    }
+    /** Get a user by UUID or the fixed admin id. */
+    get(id) {
+        const row = this.db
+            .prepare("SELECT * FROM users WHERE id = @id")
+            .get({ id });
+        return row ? this.rowToUser(row) : null;
+    }
+    /** Get a user by username. */
+    getByUsername(username) {
+        const row = this.db
+            .prepare("SELECT * FROM users WHERE username = @username")
+            .get({ username });
+        return row ? this.rowToUser(row) : null;
+    }
+    /**
+     * Find a user by OIDC subject and provider.
+     * This is the primary lookup during OIDC callback.
+     */
+    getByOidcSub(oidcSub, oidcProviderId) {
+        const row = this.db
+            .prepare("SELECT * FROM users WHERE oidc_sub = @sub AND oidc_provider_id = @providerId")
+            .get({ sub: oidcSub, providerId: oidcProviderId });
+        return row ? this.rowToUser(row) : null;
+    }
+    /**
+     * Find or create a user from OIDC claims during callback.
+     *
+     * Steps:
+     * 1. Look up by (oidc_sub, oidc_provider_id).
+     * 2. If found, update display_name, avatar_url, username from claims.
+     * 3. If not found, create a new user with provider='oidc'.
+     *
+     * Returns the user and a boolean indicating whether it was newly created.
+     */
+    findOrCreateFromOidc(claims, oidcProviderId, defaultRole) {
+        // 1. Look up existing user by OIDC identity
+        let user = this.getByOidcSub(claims.sub, oidcProviderId);
+        if (user) {
+            // 2. Update claims (username/display name/avatar may have changed at the IdP)
+            const displayName = claims.name ?? claims.preferred_username ?? claims.sub;
+            const avatarUrl = claims.picture ?? null;
+            const username = claims.preferred_username ?? claims.sub;
+            this.db.prepare(`
+        UPDATE users SET
+          username = @username,
+          display_name = @displayName,
+          avatar_url = @avatarUrl,
+          updated_at = datetime('now')
+        WHERE id = @id
+      `).run({
+                id: user.id,
+                username,
+                displayName,
+                avatarUrl,
+            });
+            user = this.get(user.id);
+            return { user, created: false };
+        }
+        // 3. Create new user
+        const id = randomUUID();
+        const displayName = claims.name ?? claims.preferred_username ?? claims.sub;
+        const avatarUrl = claims.picture ?? null;
+        const username = claims.preferred_username ?? claims.sub;
+        // If the preferred_username is already taken, append a suffix
+        let finalUsername = username;
+        let suffix = 1;
+        while (this.getByUsername(finalUsername)) {
+            finalUsername = `${username}_${suffix}`;
+            suffix++;
+        }
+        this.db.prepare(`
+      INSERT INTO users (id, username, display_name, avatar_url, role, provider,
+        oidc_sub, oidc_provider_id)
+      VALUES (@id, @username, @displayName, @avatarUrl, @role, 'oidc',
+        @oidcSub, @oidcProviderId)
+    `).run({
+            id,
+            username: finalUsername,
+            displayName,
+            avatarUrl,
+            role: defaultRole,
+            oidcSub: claims.sub,
+            oidcProviderId,
+        });
+        user = this.get(id);
+        this.logger.info("OIDC user auto-created", {
+            userId: user.id,
+            username: user.username,
+            providerId: oidcProviderId,
+        });
+        return { user, created: true };
+    }
+    /** List all users (admin only). */
+    list() {
+        const rows = this.db
+            .prepare("SELECT * FROM users ORDER BY created_at ASC")
+            .all();
+        return rows.map(this.rowToUser);
+    }
+    /** Count how many admin users exist. */
+    countAdmins() {
+        const row = this.db
+            .prepare("SELECT COUNT(*) AS count FROM users WHERE role = 'admin'")
+            .get();
+        return row.count;
+    }
+    /** Change a user's role. Returns the updated user or null if not found. */
+    setRole(id, role) {
+        const user = this.get(id);
+        if (!user)
+            return null;
+        // Prevent demoting the built-in local admin account
+        if (id === "admin" && role === "user") {
+            throw new Error("Cannot demote the built-in admin account");
+        }
+        // Prevent demoting the last admin
+        if (user.role === "admin" && role === "user") {
+            const adminCount = this.countAdmins();
+            if (adminCount <= 1) {
+                throw new Error("Cannot demote the last admin user");
+            }
+        }
+        this.db.prepare(`
+      UPDATE users SET role = @role, updated_at = datetime('now') WHERE id = @id
+    `).run({ id, role });
+        this.logger.info("user role changed", {
+            targetUserId: id,
+            newRole: role,
+        });
+        return this.get(id);
+    }
+    /** Check if there is at least one admin user. */
+    hasAdmin() {
+        const row = this.db
+            .prepare("SELECT 1 FROM users WHERE role = 'admin' LIMIT 1")
+            .get();
+        return row !== undefined;
+    }
+    /**
+     * Resolve a user identifier (UUID or "admin") to a user.
+     * Used when validating sessions that may have either format in user_id.
+     */
+    resolveUser(userId) {
+        // Try direct lookup by id first
+        const user = this.get(userId);
+        if (user)
+            return user;
+        // Fallback: try as username (for backward compat with old sessions)
+        return this.getByUsername(userId);
+    }
+    // ── Private helpers ──
+    rowToUser(row) {
+        return {
+            id: row.id,
+            username: row.username,
+            displayName: row.display_name,
+            avatarUrl: row.avatar_url,
+            role: row.role,
+            provider: row.provider,
+            oidcSub: row.oidc_sub,
+            oidcProviderId: row.oidc_provider_id,
+            createdAt: row.created_at,
+            updatedAt: row.updated_at,
+        };
+    }
+}
+//# sourceMappingURL=user-service.js.map

package/dist/auth/oidc/user-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-service.js","sourceRoot":"","sources":["../../../src/auth/oidc/user-service.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,4DAA4D;AAE5D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAsBzC,MAAM,OAAO,WAAW;IAEZ;IACA;IAFV,YACU,EAAqB,EACrB,MAAc;QADd,OAAE,GAAF,EAAE,CAAmB;QACrB,WAAM,GAAN,MAAM,CAAQ;IACrB,CAAC;IAEJ,gDAAgD;IAChD,GAAG,CAAC,EAAU;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,oCAAoC,CAAC;aAC7C,GAAG,CAAC,EAAE,EAAE,EAAE,CAAQ,CAAC;QACtB,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAED,8BAA8B;IAC9B,aAAa,CAAC,QAAgB;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,gDAAgD,CAAC;aACzD,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAQ,CAAC;QAC5B,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,OAAe,EAAE,cAAsB;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CACN,8EAA8E,CAC/E;aACA,GAAG,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,CAAQ,CAAC;QAC5D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAED;;;;;;;;;OASG;IACH,oBAAoB,CAClB,MAMC,EACD,cAAsB,EACtB,WAA6B;QAE7B,4CAA4C;QAC5C,IAAI,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACzD,IAAI,IAAI,EAAE,CAAC;YACT,8EAA8E;YAC9E,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,GAAG,CAAC;YAC3E,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,GAAG,CAAC;YAEzD,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;;;OAOf,CAAC,CAAC,GAAG,CAAC;gBACL,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,QAAQ;gBACR,WAAW;gBACX,SAAS;aACV,CAAC,CAAC;YAEH,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAClC,CAAC;QAED,qBAAqB;QACrB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,GAAG,CAAC;QAC3E,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,GAAG,CAAC;QAEzD,8DAA8D;QAC9D,IAAI,aAAa,GAAG,QAAQ,CAAC;QAC7B,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;YACzC,aAAa,GAAG,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;YACxC,MAAM,EAAE,CAAC;QACX,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;KAKf,CAAC,CAAC,GAAG,CAAC;YACL,EAAE;YACF,QAAQ,EAAE,aAAa;YACvB,WAAW;YACX,SAAS;YACT,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,cAAc;SACf,CAAC,CAAC;QAEH,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACzC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,cAAc;SAC3B,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;IAED,mCAAmC;IACnC,IAAI;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,6CAA6C,CAAC;aACtD,GAAG,EAAW,CAAC;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,wCAAwC;IACxC,WAAW;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,0DAA0D,CAAC;aACnE,GAAG,EAAuB,CAAC;QAC9B,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC;IAED,2EAA2E;IAC3E,OAAO,CAAC,EAAU,EAAE,IAAsB;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,oDAAoD;QACpD,IAAI,EAAE,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,kCAAkC;QAClC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;KAEf,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAErB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE;YACpC,YAAY,EAAE,EAAE;YAChB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;IAED,iDAAiD;IACjD,QAAQ;QACN,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,kDAAkD,CAAC;aAC3D,GAAG,EAAE,CAAC;QACT,OAAO,GAAG,KAAK,SAAS,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,MAAc;QACxB,gCAAgC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QACtB,oEAAoE;QACpE,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,wBAAwB;IAEhB,SAAS,CAAC,GAAQ;QACxB,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,cAAc,EAAE,GAAG,CAAC,gBAAgB;YACpC,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAU;SAC1B,CAAC;IACJ,CAAC;CACF"}

package/dist/auth/rate-limiter.d.ts

@@ -0,0 +1,31 @@
+import type { FastifyRequest, FastifyReply } from "fastify";
+export declare class RateLimiter {
+    private map;
+    private maxAttempts;
+    private windowMs;
+    constructor(maxAttempts?: number, windowMinutes?: number);
+    /**
+     * Record a failed attempt for the given key (typically IP).
+     * Returns true if the attempt is allowed, false if rate-limited.
+     */
+    check(key: string): boolean;
+    /**
+     * Reset the rate limit for a key (called on successful login).
+     */
+    reset(key: string): void;
+    /**
+     * How many seconds until the window resets for a key.
+     * Used to inform the client.
+     */
+    retryAfterSeconds(key: string): number;
+}
+/**
+ * Return a Fastify preHandler hook that rate-limits by IP.
+ * Usage:
+ *   server.post("/api/auth/login", { preHandler: rateLimit(5, 60) }, handler)
+ *
+ * @param maxAttempts  Maximum attempts allowed in the window.
+ * @param windowMinutes  Time window in minutes.
+ */
+export declare function rateLimit(maxAttempts: number, windowMinutes: number): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/auth/rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../src/auth/rate-limiter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAO5D,qBAAa,WAAW;IACtB,OAAO,CAAC,GAAG,CAAqC;IAChD,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,QAAQ,CAAS;gBAEb,WAAW,SAAI,EAAE,aAAa,SAAK;IAK/C;;;OAGG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAiB3B;;OAEG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAIxB;;;OAGG;IACH,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;CAMvC;AAID;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,IAGpD,SAAS,cAAc,EAAE,OAAO,YAAY,mBAW3D"}

package/dist/auth/rate-limiter.js

@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: 0BSD
+// SPDX-FileCopyrightText: 2025 Digi <digitalpaws@proton.me>
+export class RateLimiter {
+    map = new Map();
+    maxAttempts;
+    windowMs;
+    constructor(maxAttempts = 4, windowMinutes = 15) {
+        this.maxAttempts = maxAttempts;
+        this.windowMs = windowMinutes * 60_000;
+    }
+    /**
+     * Record a failed attempt for the given key (typically IP).
+     * Returns true if the attempt is allowed, false if rate-limited.
+     */
+    check(key) {
+        const now = Date.now();
+        const entry = this.map.get(key);
+        if (!entry || now - entry.windowStart > this.windowMs) {
+            // New window
+            this.map.set(key, { count: 1, windowStart: now });
+            return true;
+        }
+        entry.count++;
+        if (entry.count > this.maxAttempts) {
+            return false; // rate-limited
+        }
+        return true;
+    }
+    /**
+     * Reset the rate limit for a key (called on successful login).
+     */
+    reset(key) {
+        this.map.delete(key);
+    }
+    /**
+     * How many seconds until the window resets for a key.
+     * Used to inform the client.
+     */
+    retryAfterSeconds(key) {
+        const entry = this.map.get(key);
+        if (!entry)
+            return 0;
+        const elapsed = Date.now() - entry.windowStart;
+        return Math.max(0, Math.ceil((this.windowMs - elapsed) / 1000));
+    }
+}
+// ── Fastify preHandler wrapper ────────────────────────────────
+/**
+ * Return a Fastify preHandler hook that rate-limits by IP.
+ * Usage:
+ *   server.post("/api/auth/login", { preHandler: rateLimit(5, 60) }, handler)
+ *
+ * @param maxAttempts  Maximum attempts allowed in the window.
+ * @param windowMinutes  Time window in minutes.
+ */
+export function rateLimit(maxAttempts, windowMinutes) {
+    const limiter = new RateLimiter(maxAttempts, windowMinutes);
+    return async (request, reply) => {
+        const key = request.ip;
+        const allowed = limiter.check(key);
+        if (!allowed) {
+            reply
+                .status(429)
+                .header("Retry-After", String(limiter.retryAfterSeconds(key)))
+                .send({ error: "Too many requests. Please try again later." });
+            return;
+        }
+    };
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/auth/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../src/auth/rate-limiter.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,4DAA4D;AAS5D,MAAM,OAAO,WAAW;IACd,GAAG,GAAG,IAAI,GAAG,EAA0B,CAAC;IACxC,WAAW,CAAS;IACpB,QAAQ,CAAS;IAEzB,YAAY,WAAW,GAAG,CAAC,EAAE,aAAa,GAAG,EAAE;QAC7C,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,aAAa,GAAG,MAAM,CAAC;IACzC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAW;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEhC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtD,aAAa;YACb,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,CAAC,eAAe;QAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAW;QACf,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,GAAW;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC;QAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;CACF;AAED,iEAAiE;AAEjE;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,WAAmB,EAAE,aAAqB;IAClE,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAE5D,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,KAAK;iBACF,MAAM,CAAC,GAAG,CAAC;iBACX,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;iBAC7D,IAAI,CAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/config/config-service.d.ts

@@ -0,0 +1,83 @@
+import type Database from "better-sqlite3";
+import type { ConfigSchema, Logger } from "../types/plugin.js";
+import { type ValidationResult } from "./validate.js";
+/**
+ * Sentinel value used to mask secret fields in UI-exported data.
+ * When update() receives this value for a secret field, it preserves
+ * the existing encrypted value rather than overwriting it.
+ */
+export declare const SECRET_UNCHANGED_SENTINEL = "__STARR_SECRET_UNCHANGED__";
+export interface PluginConfigEntry {
+    schema: ConfigSchema<any>;
+    values: Record<string, unknown>;
+    needsConfiguration: boolean;
+    updatedAt: string;
+}
+export interface PluginConfigSummary {
+    pluginId: string;
+    instanceId?: string;
+    needsConfiguration: boolean;
+    updatedAt: string;
+    /** The connected library ID, if any (for downloader instances). */
+    libraryId?: string;
+}
+export declare class ConfigService {
+    private db;
+    private logger;
+    private onReload?;
+    private getStmt;
+    private getByInstanceStmt;
+    private upsertStmt;
+    private listStmt;
+    private listInstancesStmt;
+    private deleteInstanceStmt;
+    constructor(db: Database.Database, logger: Logger, onReload?: (pluginId: string) => void);
+    /**
+     * Called by the plugin context during register.
+     * Returns read-only validated values.
+     */
+    register<T>(pluginId: string, schema: ConfigSchema<T>, instanceId?: string): Readonly<T>;
+    /**
+     * Called by the admin settings API when saving config.
+     * Updates values, persists, and triggers reload.
+     */
+    update(pluginId: string, schema: ConfigSchema<any>, input: Record<string, unknown>, instanceId?: string): ValidationResult;
+    /**
+     * Called by the admin UI to get render data.
+     * Returns schema + values (with secrets masked) + needsConfiguration flag.
+     */
+    get(pluginId: string, instanceId?: string): PluginConfigEntry | undefined;
+    /**
+     * Called by the admin UI to list all plugins with config status.
+     */
+    list(): PluginConfigSummary[];
+    /**
+     * List all instances for a given plugin.
+     */
+    listInstances(pluginId: string): PluginConfigSummary[];
+    /**
+     * Create a new plugin instance with the given instanceId and config values.
+     * Validates and persists.
+     */
+    createInstance<T>(pluginId: string, instanceId: string, schema: ConfigSchema<T>, values: Record<string, unknown>): ValidationResult;
+    /**
+     * Delete a plugin instance and its config.
+     */
+    deleteInstance(pluginId: string, instanceId: string): void;
+    /**
+     * Return decrypted stored values for a plugin, or undefined if no row exists.
+     * Used by the test-connection endpoint to resolve secret sentinels.
+     */
+    getDecryptedValues(pluginId: string, instanceId?: string): Record<string, unknown> | undefined;
+    /**
+     * Check whether a plugin needs configuration (required fields missing).
+     * Used by context.ts for the debug log.
+     */
+    needsConfiguration(pluginId: string, instanceId?: string): boolean;
+    private buildDefaults;
+    private computeNeedsConfiguration;
+    private encryptValues;
+    private decryptValues;
+    private maskSecretValues;
+}
+//# sourceMappingURL=config-service.d.ts.map

package/dist/config/config-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-service.d.ts","sourceRoot":"","sources":["../../src/config/config-service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGtE;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,+BAA+B,CAAC;AAEtE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,EAAE,CAAoB;IAC9B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAC,CAA6B;IAG9C,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,iBAAiB,CAAqB;IAC9C,OAAO,CAAC,UAAU,CAAqB;IACvC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,iBAAiB,CAAqB;IAC9C,OAAO,CAAC,kBAAkB,CAAqB;gBAG7C,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI;IA+BvC;;;OAGG;IACH,QAAQ,CAAC,CAAC,EACR,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,EACvB,UAAU,SAAY,GACrB,QAAQ,CAAC,CAAC,CAAC;IAyDd;;;OAGG;IACH,MAAM,CACJ,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,EACzB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,UAAU,SAAY,GACrB,gBAAgB;IA0CnB;;;OAGG;IACH,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,SAAY,GAAG,iBAAiB,GAAG,SAAS;IA0B5E;;OAEG;IACH,IAAI,IAAI,mBAAmB,EAAE;IA2B7B;;OAEG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,mBAAmB,EAAE;IA2BtD;;;OAGG;IACH,cAAc,CAAC,CAAC,EACd,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,EACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,gBAAgB;IAkBnB;;OAEG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAO1D;;;OAGG;IACH,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,SAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAYjG;;;OAGG;IACH,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,SAAY,GAAG,OAAO;IAcrE,OAAO,CAAC,aAAa;IAWrB,OAAO,CAAC,yBAAyB;IAkBjC,OAAO,CAAC,aAAa;IAerB,OAAO,CAAC,aAAa;IAmBrB,OAAO,CAAC,gBAAgB;CAezB"}