@velora-cms/server 0.11.0

package/dist/routes/plugin-management.js

@@ -0,0 +1,525 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { ApiErrorSchema, BundleUninstallConfirmationRequiredSchema, BundleUninstallSucceededSchema, LicenseRecheckResponseSchema, ManagedPluginListQuerySchema, ManagedPluginListResponseSchema, MarketplaceStatusResponseSchema, PluginIdParamsSchema, RestoreBodySchema, RestoreConfirmationRequiredSchema, RestoreSucceededSchema, SnapshotGroupListQuerySchema, SnapshotGroupListResponseSchema, UninstallBlockedByDocumentTypesSchema, UninstallConfirmationRequiredSchema, UninstallPluginBodySchema, UninstallSucceededSchema, } from "@velora-cms/api-schemas";
+import { DocumentTypeInUseError } from "@velora-cms/content-service";
+import { requireAdmin } from "../auth/require-auth.js";
+import { getMarketplaceBaseUrl } from "../config/marketplace.js";
+import { prisma } from "../db/prisma.js";
+import { revalidateLicense } from "../marketplace/revalidate-license.js";
+import { removePluginPackages } from "../plugins/plugin-package-store.js";
+import { PluginDocumentTypesInUseError, PluginNotLoadedError, StructuredDataCleanupRequiresConfirmationError, } from "../plugins/plugin-registry-service.js";
+import { listSnapshotGroups } from "../plugins/snapshot-groups.js";
+import { BundleMemberBlockedError, BundleUninstallRequiresConfirmationError, uninstallBundle, } from "../plugins/uninstall-bundle.js";
+// The ADMIN management surface (S135). Deliberately NOT under
+// /api/plugins/... — the S89 dispatcher owns /api/plugins/:pluginId/*
+// wildcards for plugin-contributed routes, and management routes there
+// would shadow them.
+//
+// 204 responses declare `204: z.null()` and call reply.code(204).send(null).
+// No existing route in this codebase returns 204 today (checked:
+// document-types.ts/media.ts/api-keys.ts all return 200 with a body), so
+// there's no precedent to match — this is fastify-type-provider-zod's own
+// convention (createJsonSchemaTransform special-cases a `type: "null"`
+// JSON schema for OpenAPI) plus the only shape that keeps the typed
+// `reply.code(204)` callable at all: fastify-type-provider-zod's Reply
+// type only accepts status codes present in the route's declared response
+// map, so an UNDECLARED 204 fails to typecheck (`Argument of type '204'
+// is not assignable...`). Sending a literal `null` is safe despite
+// z.null() serializing it to the 4-byte string "null": Fastify's
+// onSendEnd (reply.js) special-cases `statusCode === 204` unconditionally
+// — it strips content-type/content-length and returns before the
+// payload is ever written to the socket, regardless of what the
+// serializer produced. Verified by reading node_modules/fastify's
+// reply.js directly rather than assuming.
+// S161 (S154 rider): closes the requestRestorePlan -> confirmRestore
+// TOCTOU. The 409 hands the operator a plan and a hash of it; the confirm
+// must carry that hash back, and we re-plan and re-hash before doing
+// anything. If a snapshot landed in between, the plan the operator saw is
+// no longer the plan we would execute, so we refuse and show the new one.
+// The plan is sorted before hashing so an incidental ordering difference
+// between two identical plans (planRestore already returns a
+// tableName-sorted array, but nothing here should depend on that staying
+// true) cannot read as a change. Hashed on tableName + snapshotGroupId
+// only — those two fields are exactly what determines which snapshot rows
+// restorePluginData reads for each table; groupTakenAt is display
+// metadata derived from the group's own rows and carries no additional
+// identity, so including it would make two plans that restore identically
+// hash differently for no reason (e.g. if a group's takenAt were ever
+// recomputed).  Uses node:crypto's createHash directly — this is server
+// code, not a Module-Federation-bundled plugin file, so the
+// globalThis.crypto rule doesn't apply here.
+function hashRestorePlan(plan) {
+    const canonical = plan
+        .map((entry) => `${entry.tableName}:${entry.snapshotGroupId}`)
+        .sort()
+        .join("|");
+    return createHash("sha256").update(canonical).digest("hex").slice(0, 32);
+}
+export const pluginManagementRoutes = async (app, opts) => {
+    const { adapter, structuredSnapshotService } = opts;
+    // S180: whether this instance has a marketplace to browse at all — the
+    // admin's Marketplace browse/detail screens gate on this once (at the
+    // section level) rather than inferring it from a load failure, which
+    // would conflate "no marketplace configured" with "marketplace
+    // configured but unreachable." Always registered (like every route in
+    // this file), even when the marketplace proxy routes themselves are
+    // structurally absent (app.ts) — this is the one endpoint an admin
+    // whose instance opted out via VELORA_MARKETPLACE_URL=off can still
+    // reach to learn that honestly.
+    app.get("/api/plugin-management/marketplace-status", {
+        onRequest: requireAdmin,
+        schema: {
+            response: {
+                200: MarketplaceStatusResponseSchema,
+                401: ApiErrorSchema,
+                403: ApiErrorSchema,
+            },
+        },
+    }, async () => {
+        return { configured: getMarketplaceBaseUrl() !== undefined };
+    });
+    app.get("/api/plugin-management/plugins", {
+        onRequest: requireAdmin,
+        schema: {
+            querystring: ManagedPluginListQuerySchema,
+            response: {
+                200: ManagedPluginListResponseSchema,
+                401: ApiErrorSchema,
+                403: ApiErrorSchema,
+            },
+        },
+    }, async (request) => {
+        const { cursor, limit } = request.query;
+        const rows = await prisma.pluginRegistry.findMany({
+            orderBy: { id: "asc" },
+            take: limit,
+            ...(cursor ? { cursor: { id: cursor }, skip: 1 } : {}),
+        });
+        // One extra query, not N+1: a single findMany keyed on the page's
+        // pluginIds, then map by pluginId below. No @relation exists between
+        // PluginRegistry and PluginLicense (same reasoning as
+        // PluginMigrationRecord/PluginDocumentType — tracked by pluginId,
+        // not a foreign key), so this can't be a Prisma `include`.
+        const licenses = await prisma.pluginLicense.findMany({
+            where: { pluginId: { in: rows.map((row) => row.pluginId) } },
+            // Never select `key` here — it's the plaintext license key
+            // (kept plaintext for S139's re-validation ping, see schema.prisma).
+            // This list endpoint needs the status plus the three fields the
+            // admin's license cell (S139 Task 5) reads to render an honest
+            // state without a second per-row request — still no `key`.
+            select: {
+                pluginId: true,
+                status: true,
+                lastReason: true,
+                lastValidatedAt: true,
+                lastAttemptError: true,
+                boundDomain: true,
+            },
+        });
+        const licenseByPluginId = new Map(licenses.map((license) => [license.pluginId, license]));
+        const items = rows.map((row) => {
+            const license = licenseByPluginId.get(row.pluginId);
+            return {
+                pluginId: row.pluginId,
+                name: row.name,
+                type: row.type,
+                version: row.version,
+                trustTier: row.trustTier,
+                // The manifest contract (plugin-sdk's databaseCompatibility) only
+                // ever produces "simple" | "structured" — there is no "none".
+                storageType: row.storageType,
+                enabled: row.enabled,
+                licenseStatus: license?.status ?? null,
+                licenseReason: license?.lastReason ?? null,
+                licenseLastValidatedAt: license?.lastValidatedAt?.toISOString() ?? null,
+                licenseLastAttemptError: license?.lastAttemptError ?? null,
+                boundDomain: license?.boundDomain ?? null,
+            };
+        });
+        const nextCursor = items.length === limit ? (rows[rows.length - 1]?.id ?? null) : null;
+        return { items, nextCursor };
+    });
+    app.post("/api/plugin-management/plugins/:pluginId/activate", {
+        onRequest: requireAdmin,
+        schema: {
+            params: PluginIdParamsSchema,
+            response: {
+                204: z.null(),
+                401: ApiErrorSchema,
+                403: ApiErrorSchema,
+                404: ApiErrorSchema,
+                409: ApiErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const { pluginId } = request.params;
+        const row = await prisma.pluginRegistry.findUnique({ where: { pluginId } });
+        if (!row)
+            return reply.code(404).send({ message: `plugin "${pluginId}" is not installed` });
+        // A hard-revoked plugin must not be toggleable back on. domain_mismatch
+        // and an unreachable license server both fall through to activation
+        // (S139: warn, don't block; fail open). That fail-open promise has to
+        // hold even when the license CHECK ITSELF blows up (a Prisma pool
+        // exhaustion, a lock timeout, anything revalidateLicense() doesn't
+        // already catch internally) — an ordinary database hiccup here must
+        // never read as "revoked" and block an admin from enabling a plugin.
+        // Same log-and-continue shape as license-revalidation-job.ts's sweep.
+        const marketplaceBaseUrl = getMarketplaceBaseUrl();
+        if (marketplaceBaseUrl) {
+            try {
+                const outcome = await revalidateLicense({ prisma, registry: app.pluginRegistry, marketplaceBaseUrl }, pluginId);
+                if (outcome.checked && outcome.status === "revoked") {
+                    return reply.code(403).send({ message: `license check failed: ${outcome.reason}` });
+                }
+            }
+            catch (error) {
+                console.error(`[license] revalidation threw for ${pluginId} during activation — failing open`, error);
+            }
+        }
+        try {
+            await app.pluginRegistry.activate(pluginId);
+        }
+        catch (error) {
+            if (error instanceof PluginNotLoadedError) {
+                return reply.code(409).send({ message: error.message });
+            }
+            throw error;
+        }
+        // S153 recovery symmetry: re-licensing a revoked bundle must bring
+        // the SET back, not just the functionless bundle row. Best-effort
+        // per member — one member's failing onActivate never blocks the
+        // others or the 204 (the bundle itself did activate).
+        if (row.type === "bundle") {
+            const members = await prisma.pluginBundleMember.findMany({
+                where: { bundlePluginId: pluginId },
+                orderBy: { position: "asc" },
+            });
+            for (const member of members) {
+                try {
+                    await app.pluginRegistry.activate(member.memberPluginId);
+                }
+                catch (error) {
+                    request.log.warn({ err: error }, `bundle member ${member.memberPluginId} could not be re-activated`);
+                }
+            }
+        }
+        return reply.code(204).send(null);
+    });
+    app.post("/api/plugin-management/plugins/:pluginId/license/recheck", {
+        onRequest: requireAdmin,
+        schema: {
+            params: PluginIdParamsSchema,
+            response: {
+                200: LicenseRecheckResponseSchema,
+                401: ApiErrorSchema,
+                403: ApiErrorSchema,
+                404: ApiErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const { pluginId } = request.params;
+        const row = await prisma.pluginRegistry.findUnique({ where: { pluginId } });
+        if (!row)
+            return reply.code(404).send({ message: `plugin "${pluginId}" is not installed` });
+        const marketplaceBaseUrl = getMarketplaceBaseUrl();
+        if (!marketplaceBaseUrl) {
+            // revalidateLicense() requires a marketplaceBaseUrl to call, so this
+            // can't distinguish "no license" from "license, but unchecked" the
+            // way the branch below does — it can still tell whether there's
+            // anything on record worth reporting on at all.
+            const license = await prisma.pluginLicense.findUnique({ where: { pluginId } });
+            if (!license)
+                return reply.code(404).send({ message: `plugin "${pluginId}" has no license on record` });
+            return {
+                pluginId,
+                checked: false,
+                status: null,
+                reason: "the marketplace is not configured (VELORA_MARKETPLACE_URL is unset or \"off\") — skipping the license check",
+                // L1: this branch never actually checked anything, so — same as
+                // the fail-open catch branch below and the outcome.checked===false
+                // branch further down — the row's own lastValidatedAt must ride
+                // along unchanged. A hardcoded null here previously made a
+                // perfectly healthy license flip to "unreachable" in the admin
+                // UI (isLicenseStale treats a null lastValidatedAt as stale) the
+                // moment someone clicked Re-check with no marketplace configured.
+                lastValidatedAt: license.lastValidatedAt?.toISOString() ?? null,
+            };
+        }
+        // Same fail-open contract as the activate handler above: a Prisma
+        // failure inside revalidateLicense() (not the upstream-unreachable
+        // case it already catches itself) must report as an unchecked result,
+        // not a 500 — this is a diagnostic endpoint, and "the check itself
+        // errored" is exactly what checked:false already means to callers.
+        let outcome;
+        try {
+            outcome = await revalidateLicense({ prisma, registry: app.pluginRegistry, marketplaceBaseUrl }, pluginId);
+        }
+        catch (error) {
+            console.error(`[license] revalidation threw for ${pluginId} during a manual recheck`, error);
+            const license = await prisma.pluginLicense.findUnique({ where: { pluginId } });
+            if (!license)
+                return reply.code(404).send({ message: `plugin "${pluginId}" has no license on record` });
+            return {
+                pluginId,
+                checked: false,
+                status: null,
+                reason: `the license check itself failed: ${error instanceof Error ? error.message : String(error)}`,
+                lastValidatedAt: license.lastValidatedAt?.toISOString() ?? null,
+            };
+        }
+        if (!outcome.checked && "missingLicense" in outcome && outcome.missingLicense) {
+            return reply.code(404).send({ message: `plugin "${pluginId}" has no license on record` });
+        }
+        const license = await prisma.pluginLicense.findUnique({ where: { pluginId } });
+        return {
+            pluginId,
+            checked: outcome.checked,
+            status: outcome.checked ? outcome.status : null,
+            reason: outcome.checked ? (outcome.status === "valid" ? null : outcome.reason) : outcome.reason,
+            lastValidatedAt: license?.lastValidatedAt?.toISOString() ?? null,
+        };
+    });
+    app.post("/api/plugin-management/plugins/:pluginId/deactivate", {
+        onRequest: requireAdmin,
+        schema: {
+            params: PluginIdParamsSchema,
+            response: {
+                204: z.null(),
+                401: ApiErrorSchema,
+                403: ApiErrorSchema,
+                404: ApiErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const { pluginId } = request.params;
+        const row = await prisma.pluginRegistry.findUnique({ where: { pluginId } });
+        if (!row)
+            return reply.code(404).send({ message: `plugin "${pluginId}" is not installed` });
+        await app.pluginRegistry.deactivate(pluginId);
+        // S153: manual bundle deactivation cascades like revocation does —
+        // reverse install order, best-effort per member.
+        if (row.type === "bundle") {
+            const members = await prisma.pluginBundleMember.findMany({
+                where: { bundlePluginId: pluginId },
+                orderBy: { position: "desc" },
+            });
+            for (const member of members) {
+                try {
+                    await app.pluginRegistry.deactivate(member.memberPluginId);
+                }
+                catch (error) {
+                    request.log.warn({ err: error }, `bundle member ${member.memberPluginId} could not be deactivated`);
+                }
+            }
+        }
+        return reply.code(204).send(null);
+    });
+    app.delete("/api/plugin-management/plugins/:pluginId", {
+        onRequest: requireAdmin,
+        schema: {
+            params: PluginIdParamsSchema,
+            body: UninstallPluginBodySchema,
+            response: {
+                200: UninstallSucceededSchema.or(BundleUninstallSucceededSchema),
+                401: ApiErrorSchema,
+                403: ApiErrorSchema,
+                404: ApiErrorSchema,
+                409: UninstallConfirmationRequiredSchema.or(BundleUninstallConfirmationRequiredSchema)
+                    .or(UninstallBlockedByDocumentTypesSchema)
+                    .or(ApiErrorSchema),
+            },
+        },
+    }, async (request, reply) => {
+        const { pluginId } = request.params;
+        const row = await prisma.pluginRegistry.findUnique({ where: { pluginId } });
+        if (!row)
+            return reply.code(404).send({ message: `plugin "${pluginId}" is not installed` });
+        if (row.type === "bundle") {
+            // S152: bundle uninstall cascades to the members THIS bundle
+            // installed (skip-don't-claim members were never recorded and are
+            // untouched). uninstallBundle preflights the whole set before
+            // removing anything and does the per-plugin route-level cleanup
+            // itself, so this branch returns without the single-plugin cleanup
+            // lines below.
+            let memberSnapshots;
+            try {
+                ({ memberSnapshots } = await uninstallBundle({ prisma, registry: app.pluginRegistry, adapter }, pluginId, { confirmStructuredDataCleanup: request.body?.confirmStructuredDataCleanup === true }));
+            }
+            catch (error) {
+                if (error instanceof BundleUninstallRequiresConfirmationError) {
+                    return reply.code(409).send({
+                        requiresConfirmation: true,
+                        memberSnapshots: error.memberSnapshots,
+                        message: error.message,
+                    });
+                }
+                // F1 QA fix wave: uninstallBundle()'s own preflight 1 (above,
+                // same file) still throws the bare per-id DocumentTypeInUseError
+                // directly from DocumentTypeService — that's what normally
+                // surfaces here. PluginDocumentTypesInUseError is the cascade's
+                // OWN per-member registry.uninstall() call re-checking the same
+                // guard and (TOCTOU: content added after preflight 1 passed)
+                // finding it blocked after all — falling back to the plain
+                // message, same as the single-plugin path did before this fix
+                // wave, rather than an uncaught 500.
+                if (error instanceof BundleMemberBlockedError ||
+                    error instanceof DocumentTypeInUseError ||
+                    error instanceof PluginDocumentTypesInUseError) {
+                    return reply.code(409).send({ message: error.message });
+                }
+                throw error;
+            }
+            return reply.code(200).send({ memberSnapshots });
+        }
+        let snapshotGroupId;
+        try {
+            ({ snapshotGroupId } = await app.pluginRegistry.uninstall(pluginId, {
+                confirmStructuredDataCleanup: request.body?.confirmStructuredDataCleanup === true,
+            }));
+        }
+        catch (error) {
+            if (error instanceof StructuredDataCleanupRequiresConfirmationError) {
+                // The snapshot is ALREADY taken (S87's ordering) — retrying
+                // with confirmation is always safe.
+                return reply.code(409).send({
+                    requiresConfirmation: true,
+                    snapshotGroupId: error.snapshotGroupId,
+                    message: error.message,
+                });
+            }
+            // F1 QA fix wave: uninstall()'s document-type guard now aggregates
+            // every blocked tracked document type into PluginDocumentTypesInUseError
+            // (named, with a content count where the guard already has one) —
+            // checked before the plain DocumentTypeInUseError below, which
+            // stays as a fallback only content-service's own single-id error
+            // (not reachable from this call site anymore, but kept for safety
+            // should that ever change) would hit. Re-throw only unknown shapes.
+            if (error instanceof PluginDocumentTypesInUseError) {
+                return reply.code(409).send({
+                    message: error.message,
+                    blockedBy: error.blockers.map((blocker) => ({
+                        documentType: blocker.documentType,
+                        contentCount: blocker.contentCount,
+                    })),
+                });
+            }
+            if (error instanceof DocumentTypeInUseError) {
+                return reply.code(409).send({ message: error.message });
+            }
+            throw error;
+        }
+        // Success: the route (not the service) orchestrates cleanup — the
+        // S122 flag wired at last, plus in-process detach so the plugin's
+        // contributed routes stop answering without a restart. M3 (S138
+        // hardening review): PluginRegistryService.uninstall() never touched
+        // PluginLicense — without this, a plaintext license key survived
+        // uninstalling the very plugin it licensed, quietly turning "one
+        // license per installed plugin" into "per plugin ever installed."
+        // deleteMany (not delete): most plugins were never licensed at all,
+        // and deleteMany is a correct no-op for that case rather than a
+        // P2025 "record not found" this route would then have to catch.
+        removePluginPackages(pluginId);
+        app.pluginRegistry.detachManifest(pluginId);
+        await prisma.pluginLicense.deleteMany({ where: { pluginId } });
+        return reply.code(200).send({ snapshotGroupId });
+    });
+    // S154 Task 4: a plugin's structured-data snapshot GROUPS (derived, see
+    // snapshot-groups.ts). Deliberately keyed off SNAPSHOT rows, not the
+    // registry row: uninstall deletes the PluginRegistry row but never the
+    // PluginStructuredSnapshot rows, so an uninstalled plugin's groups must
+    // still list — that's exactly when a snapshot history matters most. The
+    // 404 below therefore fires ONLY when there is neither a registry row
+    // NOR any snapshot rows at all — a plugin this site has never heard of.
+    app.get("/api/plugin-management/plugins/:pluginId/snapshot-groups", {
+        onRequest: requireAdmin,
+        schema: {
+            params: PluginIdParamsSchema,
+            querystring: SnapshotGroupListQuerySchema,
+            response: {
+                200: SnapshotGroupListResponseSchema,
+                401: ApiErrorSchema,
+                403: ApiErrorSchema,
+                404: ApiErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const { pluginId } = request.params;
+        const { cursor, limit } = request.query;
+        const registryRow = await prisma.pluginRegistry.findUnique({ where: { pluginId } });
+        if (!registryRow) {
+            const anySnapshot = await prisma.pluginStructuredSnapshot.findFirst({
+                where: { pluginId },
+                select: { id: true },
+            });
+            if (!anySnapshot) {
+                return reply.code(404).send({ message: `plugin "${pluginId}" is not installed and has no snapshot history` });
+            }
+        }
+        const { items, nextCursor } = await listSnapshotGroups(prisma, pluginId, { cursor, limit });
+        return { pluginId, items, nextCursor };
+    });
+    // S154 Task 5: the UNION restore — the mockup's "restore" action.
+    // Unlike restoreSnapshot(groupId) (S87, untouched, still keyed to one
+    // specific group), this drives StructuredSnapshotService.restorePluginData,
+    // which replaces each of the plugin's tables with the newest available
+    // snapshot copy of that table across ALL of its groups. 404 fires only
+    // when the plugin has no snapshot rows at all — unlike the GET route
+    // above, a live PluginRegistry row is neither required nor consulted:
+    // restore only ever needs the snapshot history, and the collision case
+    // this exists for (restoring onto a reinstalled plugin) has a registry
+    // row throughout.
+    app.post("/api/plugin-management/plugins/:pluginId/snapshot-groups/restore", {
+        onRequest: requireAdmin,
+        schema: {
+            params: PluginIdParamsSchema,
+            body: RestoreBodySchema,
+            response: {
+                200: RestoreSucceededSchema,
+                401: ApiErrorSchema,
+                403: ApiErrorSchema,
+                404: ApiErrorSchema,
+                409: RestoreConfirmationRequiredSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const { pluginId } = request.params;
+        const anySnapshot = await prisma.pluginStructuredSnapshot.findFirst({
+            where: { pluginId },
+            select: { id: true },
+        });
+        if (!anySnapshot) {
+            return reply.code(404).send({ message: `plugin "${pluginId}" has no snapshot history to restore from` });
+        }
+        // Unconfirmed: return the plan (plus a hash of it), touch nothing.
+        // request.body is `null` for a genuinely absent payload (Fastify's
+        // validator substitution, same as UninstallPluginBodySchema above),
+        // so this optional-chain read tolerates both null and undefined.
+        if (request.body?.confirmRestore !== true) {
+            const plan = await structuredSnapshotService.planRestore(pluginId);
+            return reply.code(409).send({
+                requiresConfirmation: true,
+                plan,
+                planHash: hashRestorePlan(plan),
+                message: `restoring "${pluginId}" will replace ${plan.length} table(s) with the newest available snapshot of each — confirm to proceed`,
+            });
+        }
+        // Confirmed: re-plan and re-hash before touching anything. request.body
+        // is guaranteed non-null here (confirmRestore === true just matched),
+        // but request.body.planHash is still only optional at the schema
+        // level (see RestoreBodySchema) — a confirm sent without one simply
+        // can never match the freshly computed hash below, so it takes the
+        // same refusal path as a genuinely stale one.
+        const freshPlan = await structuredSnapshotService.planRestore(pluginId);
+        const freshHash = hashRestorePlan(freshPlan);
+        if (request.body.planHash !== freshHash) {
+            return reply.code(409).send({
+                requiresConfirmation: true,
+                plan: freshPlan,
+                planHash: freshHash,
+                message: `the restore plan for "${pluginId}" has changed since it was last reviewed — check the refreshed plan below and confirm again`,
+            });
+        }
+        const { preRestoreSnapshotGroupId, restoredTables } = await structuredSnapshotService.restorePluginData(pluginId);
+        return { preRestoreSnapshotGroupId, restoredTables };
+    });
+};

package/dist/routes/plugin-storage.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyPluginAsyncZod } from "fastify-type-provider-zod";
+import type { DatabaseAdapter } from "@velora-cms/db-adapter";
+import type { SimpleStorageAPI } from "../plugins/simple-storage-api.js";
+export interface PluginStorageRouteOptions {
+    adapter: DatabaseAdapter;
+    simpleStorageAPI: SimpleStorageAPI;
+}
+export declare const pluginStorageRoutes: FastifyPluginAsyncZod<PluginStorageRouteOptions>;

package/dist/routes/plugin-storage.js

@@ -0,0 +1,104 @@
+import { ApiErrorSchema, PluginFieldValueResponseSchema, PluginStorageParamsSchema, SetPluginFieldValueRequestSchema, } from "@velora-cms/api-schemas";
+import { requireAuth } from "../auth/require-auth.js";
+import { PluginNotActiveError, PluginNotInstalledError } from "../plugins/plugin-registry-service.js";
+// SimpleStorageAPI's HTTP surface (Session 68) — the callable-from-the-
+// browser layer Session 70's usePluginValue() wires the SDK to.
+// /api/plugins/:pluginId/... namespacing matches api-design.md's
+// plugin-route convention (avoids two plugins colliding on a path).
+//
+// S163 closes the S110 flag: BOTH verbs now require auth. The previous
+// comment here claimed the public GET matched "every other route in this
+// codebase (data-types.ts, content.ts)" — that was false, and is the reason
+// this comment was rewritten once already. State only what is true and
+// verifiable, with a file:line for any claim about another file, so it
+// goes stale visibly instead of silently:
+//   - content.ts requires auth on EVERY route, including reads
+//     (apps/server/src/routes/content.ts:67,90,141,162,193,215).
+//   - data-types.ts does NOT: its two GETs
+//     (apps/server/src/routes/data-types.ts:50-51 list, :68-69 by id) carry
+//     no `onRequest` and there is no route-family-wide auth hook — only its
+//     POST/PATCH mutations require auth. The previous comment's citation of
+//     data-types.ts was itself wrong.
+//   - This was NOT the CMS's only unauthenticated read of internal content
+//     data — GET /api/media and GET /api/media/:id
+//     (apps/server/src/routes/media.ts:65-66, 84-85) are unauthenticated
+//     and return media items each carrying a fresh presigned downloadUrl,
+//     and GET /api/document-types (apps/server/src/routes/document-types.ts:146-147),
+//     GET /api/templates (apps/server/src/routes/templates.ts:40-41),
+//     GET /api/themes (apps/server/src/routes/themes.ts:15-16), and
+//     GET /api/plugins (apps/server/src/routes/plugins.ts:10-11) are also
+//     open. None of that is fixed here — it's a separate surface with its
+//     own consumers, recorded as a pre-deploy backlog item rather than
+//     closed unexamined.
+// getContentNode does not filter by publish state, so anyone holding a
+// content UUID could read plugin field values on DRAFT content — that part
+// of the original rationale for closing this flag was accurate. Nothing
+// real broke by closing it: the only caller is the SDK's
+// SimpleStorageValueProvider, which fetches through usePluginApi() —
+// admin-ui's authFetch — and already sends a session.
+export const pluginStorageRoutes = async (app, opts) => {
+    const { adapter, simpleStorageAPI } = opts;
+    app.get("/api/plugins/:pluginId/storage/:contentId/:fieldId", {
+        onRequest: requireAuth,
+        schema: {
+            params: PluginStorageParamsSchema,
+            response: {
+                200: PluginFieldValueResponseSchema,
+                401: ApiErrorSchema,
+                403: ApiErrorSchema,
+                404: ApiErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const { pluginId, contentId, fieldId } = request.params;
+        const node = await adapter.getContentNode(contentId);
+        if (!node) {
+            return reply.code(404).send({ message: `No content node found with id ${contentId}` });
+        }
+        try {
+            const value = await simpleStorageAPI.get(contentId, fieldId, pluginId);
+            return { value };
+        }
+        catch (err) {
+            if (err instanceof PluginNotInstalledError) {
+                return reply.code(404).send({ message: err.message });
+            }
+            if (err instanceof PluginNotActiveError) {
+                return reply.code(403).send({ message: err.message });
+            }
+            throw err;
+        }
+    });
+    app.put("/api/plugins/:pluginId/storage/:contentId/:fieldId", {
+        onRequest: requireAuth,
+        schema: {
+            params: PluginStorageParamsSchema,
+            body: SetPluginFieldValueRequestSchema,
+            response: {
+                200: PluginFieldValueResponseSchema,
+                401: ApiErrorSchema,
+                403: ApiErrorSchema,
+                404: ApiErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const { pluginId, contentId, fieldId } = request.params;
+        const node = await adapter.getContentNode(contentId);
+        if (!node) {
+            return reply.code(404).send({ message: `No content node found with id ${contentId}` });
+        }
+        try {
+            await simpleStorageAPI.set(contentId, fieldId, pluginId, request.body.value);
+            return { value: request.body.value };
+        }
+        catch (err) {
+            if (err instanceof PluginNotInstalledError) {
+                return reply.code(404).send({ message: err.message });
+            }
+            if (err instanceof PluginNotActiveError) {
+                return reply.code(403).send({ message: err.message });
+            }
+            throw err;
+        }
+    });
+};

package/dist/routes/plugins.d.ts

@@ -0,0 +1,2 @@
+import type { FastifyPluginAsyncZod } from "fastify-type-provider-zod";
+export declare const pluginRoutes: FastifyPluginAsyncZod;