emdash 0.0.0-b → 0.0.2

package/src/api/handlers/oauth-clients.ts

@@ -0,0 +1,349 @@
+/**
+ * OAuth client management handlers.
+ *
+ * CRUD operations for registered OAuth clients. Each client has a set
+ * of pre-registered redirect URIs. The authorization endpoint rejects
+ * any redirect_uri not in the client's registered set.
+ */
+
+import type { Kysely } from "kysely";
+
+import type { Database } from "../../database/types.js";
+import type { ApiResult } from "../types.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+/** Parse a JSON string column into a typed value. */
+function parseJsonColumn<T>(value: string): T {
+	// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- JSON.parse returns unknown, callers provide the expected shape
+	return JSON.parse(value) as T;
+}
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+export interface OAuthClientInfo {
+	id: string;
+	name: string;
+	redirectUris: string[];
+	scopes: string[] | null;
+	createdAt: string;
+	updatedAt: string;
+}
+
+// ---------------------------------------------------------------------------
+// Handlers
+// ---------------------------------------------------------------------------
+
+/**
+ * Create a new OAuth client.
+ */
+export async function handleOAuthClientCreate(
+	db: Kysely<Database>,
+	input: {
+		id: string;
+		name: string;
+		redirectUris: string[];
+		scopes?: string[] | null;
+	},
+): Promise<ApiResult<OAuthClientInfo>> {
+	try {
+		if (input.redirectUris.length === 0) {
+			return {
+				success: false,
+				error: {
+					code: "VALIDATION_ERROR",
+					message: "At least one redirect URI is required",
+				},
+			};
+		}
+
+		// Check for duplicate client ID
+		const existing = await db
+			.selectFrom("_emdash_oauth_clients")
+			.select("id")
+			.where("id", "=", input.id)
+			.executeTakeFirst();
+
+		if (existing) {
+			return {
+				success: false,
+				error: { code: "CONFLICT", message: "OAuth client with this ID already exists" },
+			};
+		}
+
+		const now = new Date().toISOString();
+
+		await db
+			.insertInto("_emdash_oauth_clients")
+			.values({
+				id: input.id,
+				name: input.name,
+				redirect_uris: JSON.stringify(input.redirectUris),
+				scopes: input.scopes ? JSON.stringify(input.scopes) : null,
+			})
+			.execute();
+
+		return {
+			success: true,
+			data: {
+				id: input.id,
+				name: input.name,
+				redirectUris: input.redirectUris,
+				scopes: input.scopes ?? null,
+				createdAt: now,
+				updatedAt: now,
+			},
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "CLIENT_CREATE_ERROR",
+				message: "Failed to create OAuth client",
+			},
+		};
+	}
+}
+
+/**
+ * List all registered OAuth clients.
+ */
+export async function handleOAuthClientList(
+	db: Kysely<Database>,
+): Promise<ApiResult<{ items: OAuthClientInfo[] }>> {
+	try {
+		const rows = await db
+			.selectFrom("_emdash_oauth_clients")
+			.selectAll()
+			.orderBy("created_at", "desc")
+			.execute();
+
+		const items: OAuthClientInfo[] = rows.map((row) => ({
+			id: row.id,
+			name: row.name,
+			redirectUris: parseJsonColumn<string[]>(row.redirect_uris),
+			scopes: row.scopes ? parseJsonColumn<string[]>(row.scopes) : null,
+			createdAt: row.created_at,
+			updatedAt: row.updated_at,
+		}));
+
+		return { success: true, data: { items } };
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "CLIENT_LIST_ERROR",
+				message: "Failed to list OAuth clients",
+			},
+		};
+	}
+}
+
+/**
+ * Get a single OAuth client by ID.
+ */
+export async function handleOAuthClientGet(
+	db: Kysely<Database>,
+	clientId: string,
+): Promise<ApiResult<OAuthClientInfo>> {
+	try {
+		const row = await db
+			.selectFrom("_emdash_oauth_clients")
+			.selectAll()
+			.where("id", "=", clientId)
+			.executeTakeFirst();
+
+		if (!row) {
+			return {
+				success: false,
+				error: { code: "NOT_FOUND", message: "OAuth client not found" },
+			};
+		}
+
+		return {
+			success: true,
+			data: {
+				id: row.id,
+				name: row.name,
+				redirectUris: parseJsonColumn<string[]>(row.redirect_uris),
+				scopes: row.scopes ? parseJsonColumn<string[]>(row.scopes) : null,
+				createdAt: row.created_at,
+				updatedAt: row.updated_at,
+			},
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "CLIENT_GET_ERROR",
+				message: "Failed to get OAuth client",
+			},
+		};
+	}
+}
+
+/**
+ * Update an OAuth client.
+ */
+export async function handleOAuthClientUpdate(
+	db: Kysely<Database>,
+	clientId: string,
+	input: {
+		name?: string;
+		redirectUris?: string[];
+		scopes?: string[] | null;
+	},
+): Promise<ApiResult<OAuthClientInfo>> {
+	try {
+		const existing = await db
+			.selectFrom("_emdash_oauth_clients")
+			.selectAll()
+			.where("id", "=", clientId)
+			.executeTakeFirst();
+
+		if (!existing) {
+			return {
+				success: false,
+				error: { code: "NOT_FOUND", message: "OAuth client not found" },
+			};
+		}
+
+		if (input.redirectUris !== undefined && input.redirectUris.length === 0) {
+			return {
+				success: false,
+				error: {
+					code: "VALIDATION_ERROR",
+					message: "At least one redirect URI is required",
+				},
+			};
+		}
+
+		const updates: Record<string, string> = {
+			updated_at: new Date().toISOString(),
+		};
+
+		if (input.name !== undefined) {
+			updates.name = input.name;
+		}
+		if (input.redirectUris !== undefined) {
+			updates.redirect_uris = JSON.stringify(input.redirectUris);
+		}
+		if (input.scopes !== undefined) {
+			updates.scopes = input.scopes ? JSON.stringify(input.scopes) : "";
+		}
+
+		await db.updateTable("_emdash_oauth_clients").set(updates).where("id", "=", clientId).execute();
+
+		// Fetch the updated row
+		const updated = await db
+			.selectFrom("_emdash_oauth_clients")
+			.selectAll()
+			.where("id", "=", clientId)
+			.executeTakeFirst();
+
+		if (!updated) {
+			return {
+				success: false,
+				error: { code: "NOT_FOUND", message: "OAuth client not found after update" },
+			};
+		}
+
+		return {
+			success: true,
+			data: {
+				id: updated.id,
+				name: updated.name,
+				redirectUris: parseJsonColumn<string[]>(updated.redirect_uris),
+				scopes: updated.scopes ? parseJsonColumn<string[]>(updated.scopes) : null,
+				createdAt: updated.created_at,
+				updatedAt: updated.updated_at,
+			},
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "CLIENT_UPDATE_ERROR",
+				message: "Failed to update OAuth client",
+			},
+		};
+	}
+}
+
+/**
+ * Delete an OAuth client.
+ */
+export async function handleOAuthClientDelete(
+	db: Kysely<Database>,
+	clientId: string,
+): Promise<ApiResult<{ deleted: true }>> {
+	try {
+		const result = await db
+			.deleteFrom("_emdash_oauth_clients")
+			.where("id", "=", clientId)
+			.executeTakeFirst();
+
+		if (result.numDeletedRows === 0n) {
+			return {
+				success: false,
+				error: { code: "NOT_FOUND", message: "OAuth client not found" },
+			};
+		}
+
+		return { success: true, data: { deleted: true } };
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "CLIENT_DELETE_ERROR",
+				message: "Failed to delete OAuth client",
+			},
+		};
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Lookup helpers (used by authorization handler)
+// ---------------------------------------------------------------------------
+
+/**
+ * Look up a registered OAuth client by ID.
+ * Returns the client's redirect URIs or null if the client is not registered.
+ */
+export async function lookupOAuthClient(
+	db: Kysely<Database>,
+	clientId: string,
+): Promise<{ redirectUris: string[]; scopes: string[] | null } | null> {
+	const row = await db
+		.selectFrom("_emdash_oauth_clients")
+		.select(["redirect_uris", "scopes"])
+		.where("id", "=", clientId)
+		.executeTakeFirst();
+
+	if (!row) return null;
+
+	return {
+		redirectUris: parseJsonColumn<string[]>(row.redirect_uris),
+		scopes: row.scopes ? parseJsonColumn<string[]>(row.scopes) : null,
+	};
+}
+
+/**
+ * Validate that a redirect URI is in the client's registered set.
+ *
+ * Comparison is exact string match (per RFC 6749 §3.1.2.3).
+ * Returns null if valid, or an error message if not.
+ */
+export function validateClientRedirectUri(
+	redirectUri: string,
+	allowedUris: string[],
+): string | null {
+	if (allowedUris.includes(redirectUri)) {
+		return null; // OK
+	}
+	return "redirect_uri is not registered for this client";
+}

package/src/api/handlers/oauth-user-lookup.ts

@@ -0,0 +1,39 @@
+/**
+ * Shared user lookup for OAuth token operations.
+ *
+ * Extracts user role and disabled status from the database. Used by
+ * handleTokenRefresh() to revalidate scopes against the user's current
+ * role and reject disabled users.
+ */
+
+import { toRoleLevel, type RoleLevel } from "@emdash-cms/auth";
+import type { Kysely } from "kysely";
+
+import type { Database } from "../../database/types.js";
+
+export interface UserRoleAndStatus {
+	role: RoleLevel;
+	disabled: boolean;
+}
+
+/**
+ * Look up a user's current role and disabled status.
+ * Returns null if the user doesn't exist.
+ */
+export async function lookupUserRoleAndStatus(
+	db: Kysely<Database>,
+	userId: string,
+): Promise<UserRoleAndStatus | null> {
+	const row = await db
+		.selectFrom("users")
+		.select(["role", "disabled"])
+		.where("id", "=", userId)
+		.executeTakeFirst();
+
+	if (!row) return null;
+
+	return {
+		role: toRoleLevel(row.role),
+		disabled: row.disabled === 1,
+	};
+}

package/src/api/handlers/plugins.ts

@@ -0,0 +1,254 @@
+/**
+ * Plugin management handlers
+ */
+
+import type { Kysely } from "kysely";
+
+import type { Database } from "../../database/types.js";
+import { PluginStateRepository, type PluginState, type PluginStatus } from "../../plugins/state.js";
+import type { ResolvedPlugin } from "../../plugins/types.js";
+import type { ApiResult } from "../types.js";
+
+export interface PluginInfo {
+	id: string;
+	name: string;
+	version: string;
+	package?: string;
+	enabled: boolean;
+	status: PluginStatus;
+	source?: "config" | "marketplace";
+	marketplaceVersion?: string;
+	capabilities: string[];
+	hasAdminPages: boolean;
+	hasDashboardWidgets: boolean;
+	hasHooks: boolean;
+	installedAt?: string;
+	activatedAt?: string;
+	deactivatedAt?: string;
+	/** Description of what the plugin does */
+	description?: string;
+	/** URL to the plugin icon on the marketplace */
+	iconUrl?: string;
+}
+
+export interface PluginListResponse {
+	items: PluginInfo[];
+}
+
+export interface PluginResponse {
+	item: PluginInfo;
+}
+
+function marketplaceIconUrl(marketplaceUrl: string, pluginId: string): string {
+	return `${marketplaceUrl}/api/v1/plugins/${encodeURIComponent(pluginId)}/icon`;
+}
+
+/**
+ * Get plugin info from configured plugin and database state
+ */
+function buildPluginInfo(
+	plugin: ResolvedPlugin,
+	state: PluginState | null,
+	marketplaceUrl?: string,
+): PluginInfo {
+	// If no state exists, plugin is considered active (default on first run)
+	const status = state?.status ?? "active";
+	const enabled = status === "active";
+	const isMarketplace = (state?.source ?? "config") === "marketplace";
+
+	return {
+		id: plugin.id,
+		name: state?.displayName || plugin.id,
+		version: plugin.version,
+		package: undefined, // v2 doesn't have package field
+		enabled,
+		status,
+		source: state?.source ?? "config",
+		marketplaceVersion: state?.marketplaceVersion ?? undefined,
+		capabilities: plugin.capabilities,
+		hasAdminPages: (plugin.admin.pages?.length ?? 0) > 0,
+		hasDashboardWidgets: (plugin.admin.widgets?.length ?? 0) > 0,
+		hasHooks: Object.keys(plugin.hooks ?? {}).length > 0,
+		installedAt: state?.installedAt?.toISOString(),
+		activatedAt: state?.activatedAt?.toISOString() ?? undefined,
+		deactivatedAt: state?.deactivatedAt?.toISOString() ?? undefined,
+		description: state?.description ?? undefined,
+		iconUrl:
+			isMarketplace && marketplaceUrl ? marketplaceIconUrl(marketplaceUrl, plugin.id) : undefined,
+	};
+}
+
+/**
+ * List all configured plugins with their state
+ */
+export async function handlePluginList(
+	db: Kysely<Database>,
+	configuredPlugins: ResolvedPlugin[],
+	marketplaceUrl?: string,
+): Promise<ApiResult<PluginListResponse>> {
+	try {
+		const stateRepo = new PluginStateRepository(db);
+		const allStates = await stateRepo.getAll();
+		const stateMap = new Map(allStates.map((s) => [s.pluginId, s]));
+
+		const configuredIds = new Set(configuredPlugins.map((p) => p.id));
+
+		const items = configuredPlugins.map((plugin) => {
+			const state = stateMap.get(plugin.id) ?? null;
+			return buildPluginInfo(plugin, state, marketplaceUrl);
+		});
+
+		// Include marketplace-installed plugins that aren't in the configured plugins list
+		for (const state of allStates) {
+			if (state.source !== "marketplace") continue;
+			if (configuredIds.has(state.pluginId)) continue;
+
+			items.push({
+				id: state.pluginId,
+				name: state.displayName || state.pluginId,
+				version: state.marketplaceVersion ?? state.version,
+				enabled: state.status === "active",
+				status: state.status,
+				source: "marketplace",
+				marketplaceVersion: state.marketplaceVersion ?? undefined,
+				capabilities: [],
+				hasAdminPages: false,
+				hasDashboardWidgets: false,
+				hasHooks: false,
+				installedAt: state.installedAt?.toISOString(),
+				activatedAt: state.activatedAt?.toISOString() ?? undefined,
+				deactivatedAt: state.deactivatedAt?.toISOString() ?? undefined,
+				description: state.description ?? undefined,
+				iconUrl: marketplaceUrl ? marketplaceIconUrl(marketplaceUrl, state.pluginId) : undefined,
+			});
+		}
+
+		return {
+			success: true,
+			data: { items },
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "PLUGIN_LIST_ERROR",
+				message: "Failed to list plugins",
+			},
+		};
+	}
+}
+
+/**
+ * Get a single plugin's info
+ */
+export async function handlePluginGet(
+	db: Kysely<Database>,
+	configuredPlugins: ResolvedPlugin[],
+	pluginId: string,
+	marketplaceUrl?: string,
+): Promise<ApiResult<PluginResponse>> {
+	try {
+		const plugin = configuredPlugins.find((p) => p.id === pluginId);
+		if (!plugin) {
+			return {
+				success: false,
+				error: {
+					code: "NOT_FOUND",
+					message: `Plugin not found: ${pluginId}`,
+				},
+			};
+		}
+
+		const stateRepo = new PluginStateRepository(db);
+		const state = await stateRepo.get(pluginId);
+
+		return {
+			success: true,
+			data: { item: buildPluginInfo(plugin, state, marketplaceUrl) },
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "PLUGIN_GET_ERROR",
+				message: "Failed to get plugin",
+			},
+		};
+	}
+}
+
+/**
+ * Enable a plugin
+ */
+export async function handlePluginEnable(
+	db: Kysely<Database>,
+	configuredPlugins: ResolvedPlugin[],
+	pluginId: string,
+): Promise<ApiResult<PluginResponse>> {
+	try {
+		const plugin = configuredPlugins.find((p) => p.id === pluginId);
+		if (!plugin) {
+			return {
+				success: false,
+				error: {
+					code: "NOT_FOUND",
+					message: `Plugin not found: ${pluginId}`,
+				},
+			};
+		}
+
+		const stateRepo = new PluginStateRepository(db);
+		const state = await stateRepo.enable(pluginId, plugin.version);
+
+		return {
+			success: true,
+			data: { item: buildPluginInfo(plugin, state) },
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "PLUGIN_ENABLE_ERROR",
+				message: "Failed to enable plugin",
+			},
+		};
+	}
+}
+
+/**
+ * Disable a plugin
+ */
+export async function handlePluginDisable(
+	db: Kysely<Database>,
+	configuredPlugins: ResolvedPlugin[],
+	pluginId: string,
+): Promise<ApiResult<PluginResponse>> {
+	try {
+		const plugin = configuredPlugins.find((p) => p.id === pluginId);
+		if (!plugin) {
+			return {
+				success: false,
+				error: {
+					code: "NOT_FOUND",
+					message: `Plugin not found: ${pluginId}`,
+				},
+			};
+		}
+
+		const stateRepo = new PluginStateRepository(db);
+		const state = await stateRepo.disable(pluginId, plugin.version);
+
+		return {
+			success: true,
+			data: { item: buildPluginInfo(plugin, state) },
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "PLUGIN_DISABLE_ERROR",
+				message: "Failed to disable plugin",
+			},
+		};
+	}
+}