emdash 0.37.0 → 0.39.0

package/src/api/handlers/plugin-settings.ts

@@ -9,10 +9,12 @@
 
 import type { Kysely } from "kysely";
 
+import { EmDashSecretsError } from "../../config/secrets.js";
 import { OptionsRepository } from "../../database/repositories/options.js";
 import { withTransaction } from "../../database/transaction.js";
 import type { Database } from "../../database/types.js";
 import type { SandboxedPluginEntry } from "../../emdash-runtime.js";
+import { PluginSettingEncryptionError, encodePluginSettingValue } from "../../plugins/settings.js";
 import type { ResolvedPlugin, SettingField } from "../../plugins/types.js";
 import { ErrorCode } from "../errors.js";
 import type { ApiResult } from "../types.js";
@@ -114,7 +116,7 @@ async function buildSettingsResponse(
 		const storedValue = stored.get(settingsKey(pluginId, key));
 
 		if (field.type === "secret") {
-			secretsSet[key] = typeof storedValue === "string" && storedValue.length > 0;
+			secretsSet[key] = storedValue !== undefined && storedValue !== null && storedValue !== "";
 			continue;
 		}
 
@@ -189,24 +191,54 @@ export async function handlePluginSettingsUpdate(
 			}
 		}
 
+		const encodedUpdates = new Map<string, unknown>();
+		for (const [key, value] of Object.entries(updates)) {
+			encodedUpdates.set(
+				key,
+				value === null ? null : await encodePluginSettingValue(pluginId, key, value, schema),
+			);
+		}
+
 		// Wrap the writes + read-back in a transaction so a partial failure
 		// can't leave some settings updated and others not. On D1
 		// withTransaction degrades to running the callback directly — D1 is
 		// single-writer, so per-statement atomicity still holds.
 		const data = await withTransaction(db, async (trx) => {
 			const txRepo = new OptionsRepository(trx);
-			for (const [key, value] of Object.entries(updates)) {
+			for (const [key, value] of encodedUpdates) {
 				if (value === null) {
 					await txRepo.delete(settingsKey(pluginId, key));
 				} else {
 					await txRepo.set(settingsKey(pluginId, key), value);
 				}
+				await trx
+					.deleteFrom("_plugin_storage")
+					.where("plugin_id", "=", pluginId)
+					.where("collection", "=", "__kv")
+					.where("id", "=", `settings:${key}`)
+					.execute();
 			}
 			return buildSettingsResponse(txRepo, pluginId, schema);
 		});
 
 		return { success: true, data };
-	} catch {
+	} catch (error) {
+		if (error instanceof PluginSettingEncryptionError) {
+			return {
+				success: false,
+				error: { code: error.code, message: error.message },
+			};
+		}
+		if (error instanceof EmDashSecretsError) {
+			return {
+				success: false,
+				error: {
+					code: ErrorCode.PLUGIN_SETTING_ENCRYPTION_KEY_INVALID,
+					message:
+						"EMDASH_ENCRYPTION_KEY is malformed. Restore or correct the configured key from its secret backup. Generate a new key only if no stored plugin setting depends on the lost key.",
+				},
+			};
+		}
 		return {
 			success: false,
 			error: {

package/src/api/handlers/redirects.ts

@@ -7,6 +7,8 @@ import type { Kysely } from "kysely";
 import { OptionsRepository } from "../../database/repositories/options.js";
 import {
 	RedirectRepository,
+	RedirectWriteBusyError,
+	type RedirectWriteFence,
 	type Redirect,
 	type NotFoundEntry,
 	type NotFoundSummary,
@@ -14,11 +16,29 @@ import {
 import { InvalidCursorError } from "../../database/repositories/types.js";
 import type { FindManyResult } from "../../database/repositories/types.js";
 import type { Database } from "../../database/types.js";
+import { invalidateRedirectCache } from "../../redirects/cache.js";
 import { wouldCreateLoop, detectLoops, type RedirectEdge } from "../../redirects/loops.js";
 import { validatePattern, validateDestinationParams, isPattern } from "../../redirects/patterns.js";
 import { isTerminalStatus } from "../../redirects/status.js";
 import type { ApiResult } from "../types.js";
 
+async function withRedirectWriteLock<T>(
+	repo: RedirectRepository,
+	action: (fence: RedirectWriteFence, repository: RedirectRepository) => Promise<ApiResult<T>>,
+): Promise<ApiResult<T>> {
+	try {
+		return await repo.withWriteLock(action);
+	} catch (error) {
+		if (error instanceof RedirectWriteBusyError) {
+			return {
+				success: false,
+				error: { code: "REDIRECT_BUSY", message: "Another redirect change is in progress" },
+			};
+		}
+		throw error;
+	}
+}
+
 // ---------------------------------------------------------------------------
 // Redirects
 // ---------------------------------------------------------------------------
@@ -78,79 +98,84 @@ export async function handleRedirectCreate(
 	},
 ): Promise<ApiResult<Redirect>> {
 	try {
-		const repo = new RedirectRepository(db);
-
-		const type = input.type ?? 301;
-		// Terminal statuses (410 Gone / 451) are served directly and have no
-		// destination — skip the destination/loop checks for them.
-		const terminal = isTerminalStatus(type);
-		const destination = terminal ? "" : (input.destination ?? "");
-
-		// Source and destination must differ
-		if (!terminal && input.source === destination) {
-			return {
-				success: false,
-				error: {
-					code: "VALIDATION_ERROR",
-					message: "Source and destination must be different",
-				},
-			};
-		}
-
-		// If source looks like a pattern, validate it
-		const sourceIsPattern = isPattern(input.source);
-		if (sourceIsPattern) {
-			const patternError = validatePattern(input.source);
-			if (patternError) {
+		const lockRepo = new RedirectRepository(db);
+		const result = await withRedirectWriteLock(lockRepo, async (fence, repo) => {
+			const type = input.type ?? 301;
+			// Terminal statuses (410 Gone / 451) are served directly and have no
+			// destination — skip the destination/loop checks for them.
+			const terminal = isTerminalStatus(type);
+			const destination = terminal ? "" : (input.destination ?? "");
+
+			// Source and destination must differ
+			if (!terminal && input.source === destination) {
 				return {
 					success: false,
-					error: { code: "VALIDATION_ERROR", message: `Invalid source pattern: ${patternError}` },
+					error: {
+						code: "VALIDATION_ERROR",
+						message: "Source and destination must be different",
+					},
 				};
 			}
 
-			// Validate destination params reference valid source params
-			// (terminal rules have no destination to interpolate)
-			if (!terminal) {
-				const destError = validateDestinationParams(input.source, destination);
-				if (destError) {
+			// If source looks like a pattern, validate it
+			const sourceIsPattern = isPattern(input.source);
+			if (sourceIsPattern) {
+				const patternError = validatePattern(input.source);
+				if (patternError) {
 					return {
 						success: false,
-						error: { code: "VALIDATION_ERROR", message: destError },
+						error: { code: "VALIDATION_ERROR", message: `Invalid source pattern: ${patternError}` },
 					};
 				}
+
+				// Validate destination params reference valid source params
+				// (terminal rules have no destination to interpolate)
+				if (!terminal) {
+					const destError = validateDestinationParams(input.source, destination);
+					if (destError) {
+						return {
+							success: false,
+							error: { code: "VALIDATION_ERROR", message: destError },
+						};
+					}
+				}
 			}
-		}
 
-		// Check for duplicate source (exact match only for non-patterns)
-		const existing = await repo.findBySource(input.source);
-		if (existing) {
-			return {
-				success: false,
-				error: {
-					code: "CONFLICT",
-					message: `A redirect from "${input.source}" already exists`,
-				},
-			};
-		}
+			// Check for duplicate source (exact match only for non-patterns)
+			const existing = await repo.findBySource(input.source);
+			if (existing) {
+				return {
+					success: false,
+					error: {
+						code: "CONFLICT",
+						message: `A redirect from "${input.source}" already exists`,
+					},
+				};
+			}
 
-		// Check for redirect loops (skip if creating as disabled, or terminal —
-		// a Gone rule has no destination, so it can't form a loop)
-		if (!terminal && input.enabled !== false) {
-			const edges = toEdges(await repo.findAllEnabled());
-			const loopPath = wouldCreateLoop(input.source, destination, edges);
-			if (loopPath) return loopError(loopPath);
-		}
+			// Check for redirect loops (skip if creating as disabled, or terminal —
+			// a Gone rule has no destination, so it can't form a loop)
+			if (!terminal && input.enabled !== false) {
+				const edges = toEdges(await repo.findAllEnabled());
+				const loopPath = wouldCreateLoop(input.source, destination, edges);
+				if (loopPath) return loopError(loopPath);
+			}
 
-		const redirect = await repo.create({
-			source: input.source,
-			destination,
-			type,
-			isPattern: sourceIsPattern,
-			enabled: input.enabled ?? true,
-			groupName: input.groupName ?? null,
+			const redirect = await repo.create(
+				{
+					source: input.source,
+					destination,
+					type,
+					isPattern: sourceIsPattern,
+					enabled: input.enabled ?? true,
+					groupName: input.groupName ?? null,
+				},
+				fence,
+			);
+			return { success: true, data: redirect };
 		});
-
-		return { success: true, data: redirect };
+		if (result.success) invalidateRedirectCache();
+		return result;
 	} catch {
 		return {
 			success: false,
@@ -199,99 +224,135 @@ export async function handleRedirectUpdate(
 		enabled?: boolean;
 		groupName?: string | null;
 	},
+	options?: { expectedRevision?: string },
 ): Promise<ApiResult<Redirect>> {
 	try {
-		const repo = new RedirectRepository(db);
-
-		const existing = await repo.findById(id);
-		if (!existing) {
-			return {
-				success: false,
-				error: { code: "NOT_FOUND", message: `Redirect "${id}" not found` },
-			};
-		}
-
-		const newSource = input.source ?? existing.source;
-		const newDest = input.destination ?? existing.destination;
-
-		// Source and destination must differ
-		if (newSource === newDest) {
-			return {
-				success: false,
-				error: {
-					code: "VALIDATION_ERROR",
-					message: "Source and destination must be different",
-				},
-			};
-		}
+		const lockRepo = new RedirectRepository(db);
+		const result = await withRedirectWriteLock(lockRepo, async (fence, repo) => {
+			const existing = await repo.findById(id);
+			if (!existing) {
+				return {
+					success: false,
+					error: { code: "NOT_FOUND", message: `Redirect "${id}" not found` },
+				};
+			}
 
-		// If source is changing, validate patterns
-		if (input.source !== undefined) {
-			const sourceIsPattern = isPattern(input.source);
-			if (sourceIsPattern) {
-				const patternError = validatePattern(input.source);
-				if (patternError) {
+			if (options?.expectedRevision !== undefined) {
+				const currentRevision = await repo.findConfigRevision(id);
+				if (currentRevision !== options.expectedRevision) {
 					return {
 						success: false,
-						error: {
-							code: "VALIDATION_ERROR",
-							message: `Invalid source pattern: ${patternError}`,
-						},
+						error: { code: "CONFLICT", message: "Redirect changed since it was read" },
 					};
 				}
 			}
 
-			// Check for duplicate source (exclude self)
-			const dup = await repo.findBySource(input.source);
-			if (dup && dup.id !== id) {
+			const newSource = input.source ?? existing.source;
+			const newType = input.type ?? existing.type;
+			const terminal = isTerminalStatus(newType);
+			const newDest = terminal ? "" : (input.destination ?? existing.destination);
+			if (!terminal && !newDest) {
 				return {
 					success: false,
 					error: {
-						code: "CONFLICT",
-						message: `A redirect from "${input.source}" already exists`,
+						code: "VALIDATION_ERROR",
+						message: "destination is required for redirect types (301, 302, 307, 308)",
 					},
 				};
 			}
-		}
 
-		// Validate destination params against the (possibly updated) source
-		const newSourceIsPattern = isPattern(newSource);
-		if (newSourceIsPattern) {
-			const destError = validateDestinationParams(newSource, newDest);
-			if (destError) {
+			// Source and destination must differ
+			if (!terminal && newSource === newDest) {
 				return {
 					success: false,
-					error: { code: "VALIDATION_ERROR", message: destError },
+					error: {
+						code: "VALIDATION_ERROR",
+						message: "Source and destination must be different",
+					},
 				};
 			}
-		}
 
-		// Check for redirect loops if source or destination changed
-		if (input.source !== undefined || input.destination !== undefined) {
-			const edges = toEdges(await repo.findAllEnabled());
-			const loopPath = wouldCreateLoop(newSource, newDest, edges, id);
-			if (loopPath) return loopError(loopPath);
-		}
+			// If source is changing, validate patterns
+			if (input.source !== undefined) {
+				const sourceIsPattern = isPattern(input.source);
+				if (sourceIsPattern) {
+					const patternError = validatePattern(input.source);
+					if (patternError) {
+						return {
+							success: false,
+							error: {
+								code: "VALIDATION_ERROR",
+								message: `Invalid source pattern: ${patternError}`,
+							},
+						};
+					}
+				}
 
-		const updated = await repo.update(id, {
-			source: input.source,
-			destination: input.destination,
-			type: input.type,
-			enabled: input.enabled,
-			groupName: input.groupName,
-		});
+				// Check for duplicate source (exclude self)
+				const dup = await repo.findBySource(input.source);
+				if (dup && dup.id !== id) {
+					return {
+						success: false,
+						error: {
+							code: "CONFLICT",
+							message: `A redirect from "${input.source}" already exists`,
+						},
+					};
+				}
+			}
 
-		if (!updated) {
-			return {
-				success: false,
-				error: { code: "REDIRECT_UPDATE_ERROR", message: "Failed to update redirect" },
-			};
-		}
+			// Validate destination params against the (possibly updated) source
+			const newSourceIsPattern = isPattern(newSource);
+			if (newSourceIsPattern && !terminal) {
+				const destError = validateDestinationParams(newSource, newDest);
+				if (destError) {
+					return {
+						success: false,
+						error: { code: "VALIDATION_ERROR", message: destError },
+					};
+				}
+			}
 
-		// Recompute cache — redirect was modified, so re-fetch
-		await updateLoopCache(db);
+			// Check for redirect loops if source or destination changed
+			const willBeEnabled = input.enabled ?? existing.enabled;
+			if (
+				!terminal &&
+				willBeEnabled &&
+				(input.source !== undefined || input.destination !== undefined)
+			) {
+				const edges = toEdges(await repo.findAllEnabled());
+				const loopPath = wouldCreateLoop(newSource, newDest, edges, id);
+				if (loopPath) return loopError(loopPath);
+			}
+
+			const updated = await repo.update(
+				id,
+				{
+					source: input.source,
+					destination: terminal ? "" : input.destination,
+					type: input.type,
+					enabled: input.enabled,
+					groupName: input.groupName,
+				},
+				options?.expectedRevision,
+				fence,
+			);
+
+			if (!updated) {
+				return {
+					success: false,
+					error: options?.expectedRevision
+						? { code: "CONFLICT", message: "Redirect changed since it was read" }
+						: { code: "REDIRECT_UPDATE_ERROR", message: "Failed to update redirect" },
+				};
+			}
 
-		return { success: true, data: updated };
+			// Recompute cache — redirect was modified, so re-fetch
+			await updateLoopCache(repo.db);
+			return { success: true, data: updated };
+		});
+		if (result.success) invalidateRedirectCache();
+		return result;
 	} catch {
 		return {
 			success: false,
@@ -306,21 +367,43 @@ export async function handleRedirectUpdate(
 export async function handleRedirectDelete(
 	db: Kysely<Database>,
 	id: string,
+	options?: { expectedRevision?: string },
 ): Promise<ApiResult<{ deleted: true }>> {
 	try {
-		const repo = new RedirectRepository(db);
-		const deleted = await repo.delete(id);
-
-		if (!deleted) {
-			return {
-				success: false,
-				error: { code: "NOT_FOUND", message: `Redirect "${id}" not found` },
-			};
-		}
+		const lockRepo = new RedirectRepository(db);
+		const result = await withRedirectWriteLock<{ deleted: true }>(lockRepo, async (fence, repo) => {
+			if (options?.expectedRevision !== undefined) {
+				const existing = await repo.findById(id);
+				if (!existing) {
+					return {
+						success: false,
+						error: { code: "NOT_FOUND", message: `Redirect "${id}" not found` },
+					};
+				}
+				const currentRevision = await repo.findConfigRevision(id);
+				if (currentRevision !== options.expectedRevision) {
+					return {
+						success: false,
+						error: { code: "CONFLICT", message: "Redirect changed since it was read" },
+					};
+				}
+			}
+			const deleted = await repo.delete(id, options?.expectedRevision, fence);
 
-		await updateLoopCache(db);
+			if (!deleted) {
+				return {
+					success: false,
+					error: options?.expectedRevision
+						? { code: "CONFLICT", message: "Redirect changed since it was read" }
+						: { code: "NOT_FOUND", message: `Redirect "${id}" not found` },
+				};
+			}
 
-		return { success: true, data: { deleted: true } };
+			await updateLoopCache(repo.db);
+			return { success: true, data: { deleted: true } };
+		});
+		if (result.success) invalidateRedirectCache();
+		return result;
 	} catch {
 		return {
 			success: false,