@marinoscar/platform-web 0.1.0-next.3 → 0.1.0-next.4

package/dist/storage/ui/S3FamilyDriverPanel.js

@@ -0,0 +1,195 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+/**
+ * The bespoke form of the three built-in drivers (`s3`, `r2`, `s3compatible`)
+ * on the admin storage page (issue #376; a registered panel since PP-14.7,
+ * #925).
+ *
+ * This is the markup the page has always drawn between the provider radios and
+ * the save bar, moved here verbatim so the built-ins register through the same
+ * `registerStorageDriverPanel` an app uses and their DOM does not move: the
+ * bucket and region grid, the block that belongs to the selected flavour, the
+ * credentials, and the three-option path-style control. Its header comments
+ * stay with the code they explain.
+ *
+ * =============================================================================
+ * THE SECRET ACCESS KEY IS WRITE-ONLY, AND BLANK PRESERVES
+ * =============================================================================
+ *
+ * The page holds it OUTSIDE the settings (`secrets`), because it is not a value
+ * this page ever read — it is a write-only instruction. The field renders empty
+ * because the stored key is encrypted and unreadable, never because nothing is
+ * stored, so `config.secretStatus` — the only non-secret thing the API says
+ * about it — writes the helper text rather than a fixed placeholder guessing at
+ * it.
+ *
+ * =============================================================================
+ * `forcePathStyle` IS THREE-STATE, AND A SWITCH CANNOT SAY IT
+ * =============================================================================
+ *
+ * `boolean | null`, where `null` is "use this vendor's convention" — path style
+ * for `s3compatible`, virtual-host style for `s3` and `r2`. That is NOT the
+ * same as `false`, and #374 shipped the bug that proves it: a `false` nobody
+ * chose reached the driver as an operator's explicit answer, suppressed the
+ * vendor default and broke MinIO. A two-position `Switch` has no way to render
+ * "unset", so the control is a three-option radio group, and `null` is a
+ * first-class, selectable answer.
+ */
+import { Button, Divider, FormControl, FormControlLabel, FormHelperText, FormLabel, Grid, Radio, RadioGroup, TextField, Typography, } from '@mui/material';
+/** Mirrors `deriveR2Endpoint` / `R2_ENDPOINT_HOST_SUFFIX` in `@marinoscar/platform-api/storage` (`drivers/s3/s3-config.ts`). */
+const R2_ENDPOINT_HOST_SUFFIX = 'r2.cloudflarestorage.com';
+function deriveR2Endpoint(accountId) {
+    return `https://${accountId.trim()}.${R2_ENDPOINT_HOST_SUFFIX}`;
+}
+/** The API's own ceilings (the built-in drivers' settings schemas), so the obvious typo does not round-trip. */
+const MAX_FIELD_LENGTH = 255;
+const MAX_ENDPOINT_LENGTH = 512;
+/**
+ * The three answers `forcePathStyle` can hold, as radio values.
+ *
+ * The mapping is the whole point of this table: `'vendor'` is `null`, and it is
+ * a REAL saved value meaning "I have not overridden this", not the absence of
+ * an answer. See the file header for why a `Switch` cannot express it.
+ */
+const FORCE_PATH_STYLE_CHOICES = {
+    vendor: null,
+    on: true,
+    off: false,
+};
+function forcePathStyleChoice(value) {
+    if (value === null)
+        return 'vendor';
+    return value ? 'on' : 'off';
+}
+/**
+ * What the vendor convention actually IS for the selected provider, named in
+ * prose next to the control.
+ *
+ * "Use this vendor's convention" is meaningless on its own — an operator
+ * choosing it deserves to know what they just chose. The two answers come from
+ * `buildS3ClientConfig` on the API side, which is the only place that knows
+ * them; this sentence reports that table rather than duplicating the decision.
+ */
+function vendorConventionFor(provider) {
+    return provider === 's3compatible'
+        ? 'path-style addressing (https://host/bucket/key)'
+        : 'virtual-host addressing (https://bucket.host/key)';
+}
+/** A string setting, `''` when absent. */
+function text(value, name) {
+    const raw = value[name];
+    return typeof raw === 'string' ? raw : '';
+}
+/** `forcePathStyle` as the tri-state it is: anything but a boolean is "vendor convention". */
+function triState(value) {
+    return typeof value.forcePathStyle === 'boolean' ? value.forcePathStyle : null;
+}
+/**
+ * What to say about the stored secret access key.
+ *
+ * `hint` is the credential store's own mask, derived on write by the code that
+ * held the plaintext. It beats a fixed placeholder outright: an admin who has
+ * just rotated a key can see WHICH one is live, not merely that one exists. It
+ * can still be null — for a secret too short to mask safely, or a row written
+ * outside `CredentialsService` — so the sentence is assembled to read correctly
+ * without it rather than assuming it is there. Mirrors
+ * `smtpPasswordHelperText` in `EmailSettingsPage`.
+ */
+function secretHelperText(status) {
+    if (!status.configured) {
+        return 'No secret access key is stored yet. Storage cannot work without one.';
+    }
+    const which = status.hint ? ` (${status.hint})` : '';
+    const when = status.updatedAt
+        ? `, last changed ${new Date(status.updatedAt).toLocaleDateString()}`
+        : '';
+    return `A secret access key is saved${which}${when}. Leave this blank to keep it, or type a new one to replace it.`;
+}
+/**
+ * Field-level validation of the S3 family's settings, client-side only and
+ * deliberately thin.
+ *
+ * The API validates for real — it must, since this page is not the only
+ * possible caller — and this exists to stop the obvious typo round-tripping.
+ * NOTE WHAT IS NOT REQUIRED: an empty `bucket` is how a deployment is
+ * un-configured, so blanking the form is a legitimate save rather than an
+ * error. What IS checked is anything that would produce a confusing failure
+ * several layers down: an endpoint that is not a URL (the S3 client rejects it
+ * at construction, far from this form), and an R2 account id missing while a
+ * bucket is named (the endpoint would be derived from an empty string and the
+ * request would go to a host that cannot exist).
+ *
+ * @param provider - `s3`, `r2` or `s3compatible`.
+ * @param value - that driver's settings as edited.
+ * @returns the error text by setting name; empty when there is nothing to fix.
+ */
+export function validateS3FamilySettings(provider, value) {
+    const errors = {};
+    const bucket = text(value, 'bucket').trim();
+    const region = text(value, 'region').trim();
+    const accessKeyId = text(value, 'accessKeyId').trim();
+    if (bucket.length > MAX_FIELD_LENGTH) {
+        errors.bucket = `Keep the bucket name to ${MAX_FIELD_LENGTH} characters or fewer.`;
+    }
+    if (region.length > MAX_FIELD_LENGTH) {
+        errors.region = `Keep the region to ${MAX_FIELD_LENGTH} characters or fewer.`;
+    }
+    if (accessKeyId.length > MAX_FIELD_LENGTH) {
+        errors.accessKeyId = `Keep the access key id to ${MAX_FIELD_LENGTH} characters or fewer.`;
+    }
+    const endpoint = text(value, 'endpoint').trim();
+    if (endpoint) {
+        if (endpoint.length > MAX_ENDPOINT_LENGTH) {
+            errors.endpoint = `Keep the endpoint to ${MAX_ENDPOINT_LENGTH} characters or fewer.`;
+        }
+        else if (!/^https?:\/\/\S+$/i.test(endpoint)) {
+            errors.endpoint = 'Must be a full URL, e.g. https://minio.example.com:9000.';
+        }
+    }
+    if (provider === 's3compatible' && bucket && !endpoint) {
+        errors.endpoint = 'An S3-compatible provider needs an endpoint — there is no default host.';
+    }
+    if (provider === 'r2') {
+        const accountId = text(value, 'accountId').trim();
+        if (!accountId && bucket && !endpoint) {
+            errors.accountId = 'R2 needs an account id — the endpoint is derived from it.';
+        }
+        if (accountId.length > MAX_FIELD_LENGTH) {
+            errors.accountId = `Keep the account id to ${MAX_FIELD_LENGTH} characters or fewer.`;
+        }
+    }
+    if (provider === 's3' && bucket && !region) {
+        errors.region = 'Amazon S3 needs a region, e.g. us-east-1.';
+    }
+    return errors;
+}
+/**
+ * The form of the three built-in S3-family drivers: what the admin storage page
+ * has always drawn for them, registered as their panel.
+ *
+ * @param props - see {@link StorageDriverPanelProps}.
+ * @returns the form fields (a fragment, so the markup around it is the page's).
+ *
+ * @extensionPoint component
+ * @stability experimental
+ */
+export function S3FamilyDriverPanel({ provider, descriptor, config, value, onChange, secrets, onSecretChange, errors, canWrite, }) {
+    const endpoint = text(value, 'endpoint');
+    const accountId = text(value, 'accountId');
+    const forcePathStyle = triState(value);
+    const secretAccessKey = secrets.secretAccessKey ?? '';
+    const effectiveEndpointPreview = provider === 'r2' ? endpoint.trim() || (accountId.trim() ? deriveR2Endpoint(accountId) : '') : '';
+    return (_jsxs(_Fragment, { children: [_jsxs(Grid, { container: true, spacing: 2, sx: { mt: 1 }, children: [_jsx(Grid, { size: { xs: 12, sm: 6 }, children: _jsx(TextField, { fullWidth: true, label: "Bucket", value: text(value, 'bucket'), onChange: (e) => onChange('bucket', e.target.value), disabled: !canWrite, error: !!errors.bucket, helperText: errors.bucket ?? 'Clearing this un-configures storage for the whole deployment.' }) }), _jsx(Grid, { size: { xs: 12, sm: 6 }, children: _jsx(TextField, { fullWidth: true, label: "Region", value: text(value, 'region'), onChange: (e) => onChange('region', e.target.value), disabled: !canWrite, error: !!errors.region, helperText: errors.region ??
+                                (provider === 'r2'
+                                    ? 'Leave blank for R2 — it signs with "auto". Set one only for a jurisdiction-restricted bucket (eu, fedramp).'
+                                    : provider === 's3compatible'
+                                        ? 'Leave blank to sign with us-east-1, which most S3-compatible servers ignore.'
+                                        : 'The region holding the bucket, e.g. us-east-1.') }) })] }), provider === 'r2' && (_jsxs(_Fragment, { children: [_jsx(Divider, { sx: { my: 3 } }), _jsx(Typography, { variant: "h6", gutterBottom: true, children: "Cloudflare R2" }), _jsxs(Grid, { container: true, spacing: 2, children: [_jsx(Grid, { size: { xs: 12, sm: 6 }, children: _jsx(TextField, { fullWidth: true, label: "Account ID", value: accountId, onChange: (e) => onChange('accountId', e.target.value), disabled: !canWrite, error: !!errors.accountId, helperText: errors.accountId ?? 'Your Cloudflare account id. The endpoint is built from it.' }) }), _jsxs(Grid, { size: { xs: 12, sm: 6 }, children: [_jsx(TextField, { fullWidth: true, label: "Endpoint (derived)", value: effectiveEndpointPreview, disabled: true, slotProps: { htmlInput: { readOnly: true, 'data-testid': 'r2-derived-endpoint' } }, placeholder: `https://<account id>.${R2_ENDPOINT_HOST_SUFFIX}`, helperText: endpoint.trim()
+                                            ? 'A stored endpoint override is in force and takes precedence over the derived host.'
+                                            : 'Built from the account id — there is nothing to type here.' }), endpoint.trim() && (_jsx(Button, { size: "small", sx: { mt: 1 }, disabled: !canWrite, onClick: () => onChange('endpoint', ''), children: "Clear the override and use the derived endpoint" }))] })] })] })), provider === 's3compatible' && (_jsxs(_Fragment, { children: [_jsx(Divider, { sx: { my: 3 } }), _jsx(Typography, { variant: "h6", gutterBottom: true, children: "S3-compatible endpoint" }), _jsx(Grid, { container: true, spacing: 2, children: _jsx(Grid, { size: { xs: 12 }, children: _jsx(TextField, { fullWidth: true, label: "Endpoint", value: endpoint, onChange: (e) => onChange('endpoint', e.target.value), disabled: !canWrite, error: !!errors.endpoint, helperText: errors.endpoint ??
+                                    'The full URL of the server, e.g. https://minio.example.com:9000.' }) }) })] })), provider === 's3' && (_jsxs(_Fragment, { children: [_jsx(Divider, { sx: { my: 3 } }), _jsx(Typography, { variant: "h6", gutterBottom: true, children: "Amazon S3" }), _jsx(Typography, { variant: "body2", color: "text.secondary", children: "No endpoint is needed \u2014 the AWS SDK builds one from the region and the bucket." })] })), _jsx(Divider, { sx: { my: 3 } }), _jsx(Typography, { variant: "h6", gutterBottom: true, children: "Credentials" }), _jsxs(Grid, { container: true, spacing: 2, children: [_jsx(Grid, { size: { xs: 12, sm: 6 }, children: _jsx(TextField, { fullWidth: true, label: "Access key ID", value: text(value, 'accessKeyId'), onChange: (e) => onChange('accessKeyId', e.target.value), disabled: !canWrite, autoComplete: "off", error: !!errors.accessKeyId, helperText: errors.accessKeyId ??
+                                'Shown in full on purpose: it travels in the clear in every signed request, and it is what tells a rotated key from a mistyped one.' }) }), _jsx(Grid, { size: { xs: 12, sm: 6 }, children: _jsx(TextField, { fullWidth: true, type: "password", label: "Secret access key", value: secretAccessKey, onChange: (e) => onSecretChange('secretAccessKey', e.target.value), disabled: !canWrite, 
+                            // A password manager filling this box would silently
+                            // re-send a credential the admin never typed.
+                            autoComplete: "new-password", placeholder: config.secretStatus.configured ? (config.secretStatus.hint ?? '••••••••') : '', helperText: secretHelperText(config.secretStatus) }) })] }), _jsx(Divider, { sx: { my: 3 } }), _jsxs(FormControl, { children: [_jsx(FormLabel, { id: "storage-force-path-style-label", children: "Path-style addressing" }), _jsxs(RadioGroup, { "aria-labelledby": "storage-force-path-style-label", value: forcePathStyleChoice(forcePathStyle), onChange: (e) => onChange('forcePathStyle', FORCE_PATH_STYLE_CHOICES[e.target.value]), sx: { flexDirection: { xs: 'column', sm: 'row' }, columnGap: 3 }, children: [_jsx(FormControlLabel, { value: "vendor", control: _jsx(Radio, {}), label: "Use this provider's convention", disabled: !canWrite }), _jsx(FormControlLabel, { value: "on", control: _jsx(Radio, {}), label: "Force path-style on", disabled: !canWrite }), _jsx(FormControlLabel, { value: "off", control: _jsx(Radio, {}), label: "Force path-style off", disabled: !canWrite })] }), _jsxs(FormHelperText, { children: [descriptor.label, " uses ", vendorConventionFor(provider), " unless you override it. Leaving this on the provider's convention is not the same as forcing it off \u2014 an explicit \"off\" suppresses the default and is what breaks a MinIO deployment."] })] })] }));
+}
+//# sourceMappingURL=S3FamilyDriverPanel.js.map

package/dist/storage/ui/S3FamilyDriverPanel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"S3FamilyDriverPanel.js","sourceRoot":"","sources":["../../../src/storage/ui/S3FamilyDriverPanel.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EACL,MAAM,EACN,OAAO,EACP,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,SAAS,EACT,IAAI,EACJ,KAAK,EACL,UAAU,EACV,SAAS,EACT,UAAU,GACX,MAAM,eAAe,CAAC;AAKvB,gIAAgI;AAChI,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAE3D,SAAS,gBAAgB,CAAC,SAAiB;IACzC,OAAO,WAAW,SAAS,CAAC,IAAI,EAAE,IAAI,uBAAuB,EAAE,CAAC;AAClE,CAAC;AAED,gHAAgH;AAChH,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC;;;;;;GAMG;AACH,MAAM,wBAAwB,GAAG;IAC/B,MAAM,EAAE,IAAI;IACZ,EAAE,EAAE,IAAI;IACR,GAAG,EAAE,KAAK;CACF,CAAC;AAIX,SAAS,oBAAoB,CAAC,KAAqB;IACjD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACpC,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,OAAO,QAAQ,KAAK,cAAc;QAChC,CAAC,CAAC,iDAAiD;QACnD,CAAC,CAAC,mDAAmD,CAAC;AAC1D,CAAC;AAED,0CAA0C;AAC1C,SAAS,IAAI,CAAC,KAAwC,EAAE,IAAY;IAClE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,8FAA8F;AAC9F,SAAS,QAAQ,CAAC,KAAwC;IACxD,OAAO,OAAO,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;AACjF,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB,CAAC,MAA2B;IACnD,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO,sEAAsE,CAAC;IAChF,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS;QAC3B,CAAC,CAAC,kBAAkB,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,kBAAkB,EAAE,EAAE;QACrE,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,+BAA+B,KAAK,GAAG,IAAI,iEAAiE,CAAC;AACtH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,KAAwC;IAExC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC;IAEtD,IAAI,MAAM,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACrC,MAAM,CAAC,MAAM,GAAG,2BAA2B,gBAAgB,uBAAuB,CAAC;IACrF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACrC,MAAM,CAAC,MAAM,GAAG,sBAAsB,gBAAgB,uBAAuB,CAAC;IAChF,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC1C,MAAM,CAAC,WAAW,GAAG,6BAA6B,gBAAgB,uBAAuB,CAAC;IAC5F,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YAC1C,MAAM,CAAC,QAAQ,GAAG,wBAAwB,mBAAmB,uBAAuB,CAAC;QACvF,CAAC;aAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,QAAQ,GAAG,0DAA0D,CAAC;QAC/E,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,cAAc,IAAI,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvD,MAAM,CAAC,QAAQ,GAAG,yEAAyE,CAAC;IAC9F,CAAC;IAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,CAAC,SAAS,GAAG,2DAA2D,CAAC;QACjF,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACxC,MAAM,CAAC,SAAS,GAAG,0BAA0B,gBAAgB,uBAAuB,CAAC;QACvF,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,CAAC,MAAM,GAAG,2CAA2C,CAAC;IAC9D,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,QAAQ,EACR,UAAU,EACV,MAAM,EACN,KAAK,EACL,QAAQ,EACR,OAAO,EACP,cAAc,EACd,MAAM,EACN,QAAQ,GACgB;IACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IAEtD,MAAM,wBAAwB,GAC5B,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpG,OAAO,CACL,8BACE,MAAC,IAAI,IAAC,SAAS,QAAC,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,aACvC,KAAC,IAAI,IAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,YAC3B,KAAC,SAAS,IACR,SAAS,QACT,KAAK,EAAC,QAAQ,EACd,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EAC5B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACnD,QAAQ,EAAE,CAAC,QAAQ,EACnB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EACtB,UAAU,EACR,MAAM,CAAC,MAAM,IAAI,+DAA+D,GAElF,GACG,EACP,KAAC,IAAI,IAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,YAC3B,KAAC,SAAS,IACR,SAAS,QACT,KAAK,EAAC,QAAQ,EACd,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EAC5B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACnD,QAAQ,EAAE,CAAC,QAAQ,EACnB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EACtB,UAAU,EACR,MAAM,CAAC,MAAM;gCACb,CAAC,QAAQ,KAAK,IAAI;oCAChB,CAAC,CAAC,6GAA6G;oCAC/G,CAAC,CAAC,QAAQ,KAAK,cAAc;wCAC3B,CAAC,CAAC,8EAA8E;wCAChF,CAAC,CAAC,gDAAgD,CAAC,GAEzD,GACG,IACF,EAWN,QAAQ,KAAK,IAAI,IAAI,CACpB,8BACE,KAAC,OAAO,IAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,GAAI,EAC1B,KAAC,UAAU,IAAC,OAAO,EAAC,IAAI,EAAC,YAAY,oCAExB,EACb,MAAC,IAAI,IAAC,SAAS,QAAC,OAAO,EAAE,CAAC,aACxB,KAAC,IAAI,IAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,YAC3B,KAAC,SAAS,IACR,SAAS,QACT,KAAK,EAAC,YAAY,EAClB,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtD,QAAQ,EAAE,CAAC,QAAQ,EACnB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,EACzB,UAAU,EACR,MAAM,CAAC,SAAS,IAAI,4DAA4D,GAElF,GACG,EACP,MAAC,IAAI,IAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,aAO3B,KAAC,SAAS,IACR,SAAS,QACT,KAAK,EAAC,oBAAoB,EAC1B,KAAK,EAAE,wBAAwB,EAC/B,QAAQ,QACR,SAAS,EAAE,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,qBAAqB,EAAE,EAAE,EAClF,WAAW,EAAE,wBAAwB,uBAAuB,EAAE,EAC9D,UAAU,EACR,QAAQ,CAAC,IAAI,EAAE;4CACb,CAAC,CAAC,oFAAoF;4CACtF,CAAC,CAAC,4DAA4D,GAElE,EAID,QAAQ,CAAC,IAAI,EAAE,IAAI,CAClB,KAAC,MAAM,IACL,IAAI,EAAC,OAAO,EACZ,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EACb,QAAQ,EAAE,CAAC,QAAQ,EACnB,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,gEAGhC,CACV,IACI,IACF,IACN,CACJ,EAEA,QAAQ,KAAK,cAAc,IAAI,CAC9B,8BACE,KAAC,OAAO,IAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,GAAI,EAC1B,KAAC,UAAU,IAAC,OAAO,EAAC,IAAI,EAAC,YAAY,6CAExB,EACb,KAAC,IAAI,IAAC,SAAS,QAAC,OAAO,EAAE,CAAC,YACxB,KAAC,IAAI,IAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,YACpB,KAAC,SAAS,IACR,SAAS,QACT,KAAK,EAAC,UAAU,EAChB,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACrD,QAAQ,EAAE,CAAC,QAAQ,EACnB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EACxB,UAAU,EACR,MAAM,CAAC,QAAQ;oCACf,kEAAkE,GAEpE,GACG,GACF,IACN,CACJ,EAEA,QAAQ,KAAK,IAAI,IAAI,CACpB,8BACE,KAAC,OAAO,IAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,GAAI,EAC1B,KAAC,UAAU,IAAC,OAAO,EAAC,IAAI,EAAC,YAAY,gCAExB,EACb,KAAC,UAAU,IAAC,OAAO,EAAC,OAAO,EAAC,KAAK,EAAC,gBAAgB,oGAErC,IACZ,CACJ,EAED,KAAC,OAAO,IAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,GAAI,EAC1B,KAAC,UAAU,IAAC,OAAO,EAAC,IAAI,EAAC,YAAY,kCAExB,EACb,MAAC,IAAI,IAAC,SAAS,QAAC,OAAO,EAAE,CAAC,aACxB,KAAC,IAAI,IAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,YAC3B,KAAC,SAAS,IACR,SAAS,QACT,KAAK,EAAC,eAAe,EACrB,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,EACjC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACxD,QAAQ,EAAE,CAAC,QAAQ,EACnB,YAAY,EAAC,KAAK,EAClB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,EAC3B,UAAU,EACR,MAAM,CAAC,WAAW;gCAClB,oIAAoI,GAEtI,GACG,EACP,KAAC,IAAI,IAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,YAQ3B,KAAC,SAAS,IACR,SAAS,QACT,IAAI,EAAC,UAAU,EACf,KAAK,EAAC,mBAAmB,EACzB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAClE,QAAQ,EAAE,CAAC,QAAQ;4BACnB,qDAAqD;4BACrD,8CAA8C;4BAC9C,YAAY,EAAC,cAAc,EAC3B,WAAW,EACT,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,EAEhF,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,GACjD,GACG,IACF,EAEP,KAAC,OAAO,IAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,GAAI,EAK1B,MAAC,WAAW,eACV,KAAC,SAAS,IAAC,EAAE,EAAC,gCAAgC,sCAAkC,EAChF,MAAC,UAAU,uBACO,gCAAgC,EAChD,KAAK,EAAE,oBAAoB,CAAC,cAAc,CAAC,EAC3C,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,QAAQ,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC,CAAC,MAAM,CAAC,KAA6B,CAAC,CAAC,EAE9F,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,aAEhE,KAAC,gBAAgB,IACf,KAAK,EAAC,QAAQ,EACd,OAAO,EAAE,KAAC,KAAK,KAAG,EAClB,KAAK,EAAC,gCAAgC,EACtC,QAAQ,EAAE,CAAC,QAAQ,GACnB,EACF,KAAC,gBAAgB,IACf,KAAK,EAAC,IAAI,EACV,OAAO,EAAE,KAAC,KAAK,KAAG,EAClB,KAAK,EAAC,qBAAqB,EAC3B,QAAQ,EAAE,CAAC,QAAQ,GACnB,EACF,KAAC,gBAAgB,IACf,KAAK,EAAC,KAAK,EACX,OAAO,EAAE,KAAC,KAAK,KAAG,EAClB,KAAK,EAAC,sBAAsB,EAC5B,QAAQ,EAAE,CAAC,QAAQ,GACnB,IACS,EACb,MAAC,cAAc,eACZ,UAAU,CAAC,KAAK,YAAQ,mBAAmB,CAAC,QAAQ,CAAC,qMAGvC,IACL,IACb,CACJ,CAAC;AACJ,CAAC"}

package/dist/storage/ui/StorageConfigPage.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Admin → Settings → Storage (`/admin/settings/storage`).
+ *
+ * Issue #376, epic #372. A STANDALONE PAGE, exactly like `EmailSettingsPage`
+ * and `PushConfigPage` and for the same reason: it hits its own controller
+ * (`/api/admin/storage-config`) with its own document and its own permission
+ * pair, not the generic `system_settings` blob the `SettingsHub` pages share.
+ * One entry in `ADMIN_SECTIONS` (`config/adminSections.tsx`), one route in
+ * `App.tsx` gated on the same `storage_config:read` string, no tab anywhere —
+ * `CLAUDE.md`'s "MANDATORY: Settings UI Pattern" rules 1–3.
+ *
+ * =============================================================================
+ * SNACKBAR vs. ALERT, AND THE RULE THAT DECIDES
+ * =============================================================================
+ *
+ * `EmailSettingsPage`'s header argues this explicitly and it holds here twice
+ * over. A SAVE is the ordinary, expected outcome and says nothing an admin has
+ * to read twice — `Snackbar`. Anything they must actually READ is a persistent,
+ * dismissible `Alert`: a failed check, the provider's verbatim error string,
+ * and above all the `guided` command block, which is a multi-line shell
+ * snippet nobody can copy out of a toast that slides away in five seconds.
+ *
+ * =============================================================================
+ * THE PAGE OWNS THE STATE AND THE SAVE; A PANEL DRAWS ONE DRIVER (PP-14.7, #925)
+ * =============================================================================
+ *
+ * Which object store this deployment talks to is no longer a closed list: the
+ * radios are the drivers the API describes (`descriptors`), and the form below
+ * them is the selected driver's PANEL, chosen by `getStorageDriverPanel(id)`.
+ * The built-in S3, R2 and S3-compatible drivers register their bespoke form
+ * (`S3FamilyDriverPanel`: the markup this page always drew, including the
+ * write-only secret access key and the three-state path-style control); any
+ * other driver is drawn by `StorageGenericDriverPanel` from its descriptor. The
+ * page keeps one settings object per driver and one set of typed secrets, and
+ * saves `{ provider, drivers: { <id>: settings }, secrets: { <id>: { ... } } }`.
+ *
+ * ⚠ A SECRET IS WRITE-ONLY, AND BLANK PRESERVES. Typed secrets live OUTSIDE the
+ * settings, in their own state, because they are not values this page ever
+ * read — they are write-only instructions. A secret nobody retyped is omitted
+ * from the body entirely, so the intent reaches the API as an absence rather
+ * than as a value it has to interpret.
+ *
+ * ⚠ A CLEARED TEXT FIELD IS SENT AS `''`. The API merges `drivers.<id>` over the
+ * stored settings, so an absent key would silently keep the old value.
+ *
+ * =============================================================================
+ * THE TWO PROBES RUN AGAINST WHAT IS ON SCREEN, NOT WHAT IS SAVED
+ * =============================================================================
+ *
+ * The opposite of `EmailSettingsPage`, deliberately, and it is the API's
+ * contract rather than a UI preference: `POST /test` and `POST /bucket` both
+ * take the configuration in the REQUEST BODY, so a new bucket can be proved
+ * before the deployment is committed to it. There is therefore no "save first"
+ * gate on the test button — gating it on a clean form would remove the one
+ * workflow these endpoints were built for.
+ */
+import type { PageSlotsBase } from '../../core/index.js';
+/**
+ * The slots of {@link StorageConfigPage}: the page-slot contract. `Sections` is
+ * where an app adds a section of its own (retention notes, a lifecycle-rule
+ * checklist) at either end of the page; the storage driver panels themselves
+ * come from `registerStorageDriverPanel`.
+ *
+ * @example
+ * ```tsx
+ * <StorageConfigPage slots={{ AfterContent: () => <LifecycleRuleChecklist /> }} />
+ * ```
+ *
+ * @extensionPoint slot
+ * @stability experimental
+ */
+export type StorageConfigPageSlots = PageSlotsBase;
+/**
+ * The props of {@link StorageConfigPage}.
+ *
+ * @stability experimental
+ */
+export interface StorageConfigPageProps {
+    /** Optional extension slots; omitted, the page renders exactly as it always did. */
+    slots?: StorageConfigPageSlots;
+}
+/**
+ * The `/admin/settings/storage` page: the deployment's object-storage
+ * configuration (`storage_config:read` to view, `storage_config:write` for
+ * every control), the connection test, bucket provisioning and the typed
+ * `SWITCH` confirmation. Reads the viewer's permissions from the
+ * `PlatformHostProvider`.
+ *
+ * @returns the page.
+ *
+ * @extensionPoint component
+ * @stability experimental
+ */
+export default function StorageConfigPage(props?: StorageConfigPageProps): import("react").JSX.Element;
+//# sourceMappingURL=StorageConfigPage.d.ts.map

package/dist/storage/ui/StorageConfigPage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StorageConfigPage.d.ts","sourceRoot":"","sources":["../../../src/storage/ui/StorageConfigPage.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAmCH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAwPzD;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAEnD;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,oFAAoF;IACpF,KAAK,CAAC,EAAE,sBAAsB,CAAC;CAChC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,OAAO,UAAU,iBAAiB,CAAC,KAAK,GAAE,sBAA2B,+BAwiB3E"}