kempo 4.2.19 → 4.2.21

package/middleware/kempo.js

@@ -1,10 +1,12 @@
-import { dirname, join, extname } from 'path';
+import { dirname, join, extname, isAbsolute, resolve } from 'path';
 import { readFile, stat, readdir } from 'fs/promises';
 import { pathToFileURL, fileURLToPath } from 'url';
 import { renderExternalPage } from 'kempo-server/templating';
 import getSession from '../server/utils/auth/getSession.js';
 import currentUserHasPermission from '../server/utils/permissions/currentUserHasPermission.js';
 import { getEnabledExtensions } from '../server/utils/extensions/scopeCache.js';
+import triggerHook from '../server/utils/hooks/triggerHook.js';
+import { ADMIN_GLOBALS_DIR } from '../server/utils/admin-global-content/helpers.js';
 
 const MIME_TYPES = {
   '.js': 'application/javascript',
@@ -25,8 +27,17 @@ const ROUTE_FILES = ['GET.js','POST.js','PUT.js','DELETE.js','PATCH.js','HEAD.js
 
 const NODE_MODULES = join(process.cwd(), 'node_modules');
 
-// Resolves to dist/admin relative to this file — works both in this repo and as a consumer dependency
-const ADMIN_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', 'dist', 'admin');
+/*
+  Admin portal source. Defaults to dist/admin relative to this file, which works both in this repo
+  and as a consumer dependency. Set `middleware.adminRoot` in the server config (resolved from cwd)
+  to point at src/admin instead, so admin pages can be edited without rebuilding.
+*/
+const DEFAULT_ADMIN_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', 'dist', 'admin');
+
+const resolveAdminRoot = adminRoot => {
+  if(!adminRoot) return DEFAULT_ADMIN_ROOT;
+  return isAbsolute(adminRoot) ? adminRoot : resolve(process.cwd(), adminRoot);
+};
 
 const buildResolveDir = (base, url) => {
   const parts = url.replace(/\/+$/, '').split('/').filter(Boolean);
@@ -51,6 +62,13 @@ const walkDynamic = async (base, segments) => {
       return { filePath: join(base, head), params: {} };
     }
   }
+  if(rest.length === 0){
+    for(const entry of entries){
+      if(entry.isFile() && entry.name === `${head}.page.html`){
+        return { filePath: join(base, entry.name), params: {} };
+      }
+    }
+  }
   for(const entry of entries){
     if(!entry.isDirectory() || !entry.name.startsWith('[') || !entry.name.endsWith(']')) continue;
     const paramName = entry.name.slice(1, -1);
@@ -69,15 +87,55 @@ const executeRouteFile = async (filePath, request, response, params = {}) => {
   return true;
 };
 
-const serveDir = async (dirPath, method, request, response, resolveDir, rootDir, params = {}) => {
+/*
+  Every .page.html render must go through here. The `middleware:before_page` hook lets extensions
+  veto a render (throw `{code}` to send that status, or `{redirect}` to redirect), which is how
+  extensions guard their own private pages. Rendering a page anywhere without this helper silently
+  bypasses those guards.
+*/
+const renderGuardedPage = async (pageFilePath, request, response, rootDir, resolveDir, params = {}, extraGlobalDirs = []) => {
+  try {
+    await triggerHook('middleware:before_page', {
+      url: request.url.split('?')[0],
+      query: request.query || {},
+      params,
+      cookies: request.cookies || {},
+    }, { bail: true });
+  } catch(e) {
+    if(e?.redirect) return response.redirect(e.redirect);
+    response.writeHead(e?.code || 404, { 'Content-Type': 'text/html; charset=utf-8' });
+    response.end('');
+    return;
+  }
+
+  const html = await renderExternalPage(pageFilePath, rootDir, resolveDir, {}, {}, 10, extraGlobalDirs);
+  response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+  response.end(html);
+};
+
+/*
+  Directories that contribute *.global.html to an admin render, on top of ADMIN_ROOT itself.
+
+  Each enabled extension's admin/ directory is read straight from its package at render time — the
+  same way its admin pages and public pages are resolved — so nothing is copied into kempo's
+  dist/admin on install. Enabling, disabling, upgrading or removing an extension takes effect
+  immediately, and a rebuild of kempo cannot discard it.
+
+  Admin globals authored through the admin UI live in the consumer's project instead, since those
+  are genuinely mutable and cannot live inside a package.
+*/
+export const adminGlobalDirs = async () => [
+  ADMIN_GLOBALS_DIR,
+  ...(await getEnabledExtensions()).map(ext => join(NODE_MODULES, ext.name, 'admin')),
+];
+
+const serveDir = async (dirPath, method, request, response, resolveDir, rootDir, params = {}, extraGlobalDirs = []) => {
   const candidates = [`${method}.js`, 'index.page.html', 'index.js', 'index.html', 'CATCH.js'];
   for(const candidate of candidates){
     const candidatePath = join(dirPath, candidate);
     try { await stat(candidatePath); } catch { continue; }
     if(candidate.endsWith('.page.html')){
-      const html = await renderExternalPage(candidatePath, rootDir, resolveDir);
-      response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-      response.end(html);
+      await renderGuardedPage(candidatePath, request, response, rootDir, resolveDir, params, extraGlobalDirs);
       return true;
     }
     if(ROUTE_FILES.includes(candidate)){
@@ -93,6 +151,7 @@ const serveDir = async (dirPath, method, request, response, resolveDir, rootDir,
 
 export default config => {
   const PROJECT_PUBLIC = config.rootPath || join(process.cwd(), 'public');
+  const ADMIN_ROOT = resolveAdminRoot(config.adminRoot);
 
   return async (request, response, next) => {
     const { path } = request;
@@ -127,9 +186,10 @@ export default config => {
       if(!url.startsWith('/admin/extension/')){
         const segments = url.slice('/admin'.length).replace(/^\//, '').split('/').filter(Boolean);
         const resolveDir = buildResolveDir(ADMIN_ROOT, url);
+        const globalDirs = await adminGlobalDirs();
 
         if(segments.length === 0){
-          const served = await serveDir(ADMIN_ROOT, method, request, response, resolveDir, ADMIN_ROOT);
+          const served = await serveDir(ADMIN_ROOT, method, request, response, resolveDir, ADMIN_ROOT, {}, globalDirs);
           if(served) return;
         } else {
           const walked = await walkDynamic(ADMIN_ROOT, segments);
@@ -139,14 +199,12 @@ export default config => {
             try { fileStat = await stat(filePath); } catch { /* not found */ }
 
             if(fileStat?.isDirectory()){
-              const served = await serveDir(filePath, method, request, response, resolveDir, ADMIN_ROOT, params);
+              const served = await serveDir(filePath, method, request, response, resolveDir, ADMIN_ROOT, params, globalDirs);
               if(served) return;
             } else if(fileStat?.isFile()){
               const name = filePath.split(/[/\\]/).pop();
               if(name.endsWith('.page.html')){
-                const html = await renderExternalPage(filePath, ADMIN_ROOT, resolveDir);
-                response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-                response.end(html);
+                await renderGuardedPage(filePath, request, response, ADMIN_ROOT, resolveDir, params, globalDirs);
                 return;
               }
               if(ROUTE_FILES.includes(name)){
@@ -174,6 +232,7 @@ export default config => {
       const adminDir = join(NODE_MODULES, extName, 'admin');
       const resolveDir = buildResolveDir(ADMIN_ROOT, url);
       const method = request.method?.toUpperCase() || 'GET';
+      const globalDirs = await adminGlobalDirs();
 
       const pageCandidates = subPath.endsWith('/')
         ? [join(adminDir, subPath, 'index.page.html')]
@@ -185,11 +244,9 @@ export default config => {
       for(const pagePath of pageCandidates){
         try {
           await stat(pagePath);
-          const html = await renderExternalPage(pagePath, ADMIN_ROOT, resolveDir);
-          response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-          response.end(html);
-          return;
-        } catch { /* try next */ }
+        } catch { continue; }
+        await renderGuardedPage(pagePath, request, response, ADMIN_ROOT, resolveDir, {}, globalDirs);
+        return;
       }
 
       const staticPath = join(adminDir, subPath === '/' ? 'index.html' : subPath);
@@ -210,14 +267,12 @@ export default config => {
         let walkedStat;
         try { walkedStat = await stat(walkedPath); } catch { /* not found */ }
         if(walkedStat?.isDirectory()){
-          const served = await serveDir(walkedPath, method, request, response, resolveDir, ADMIN_ROOT, params);
+          const served = await serveDir(walkedPath, method, request, response, resolveDir, ADMIN_ROOT, params, globalDirs);
           if(served) return;
         } else if(walkedStat?.isFile()){
           const name = walkedPath.split(/[/\\]/).pop();
           if(name.endsWith('.page.html')){
-            const html = await renderExternalPage(walkedPath, ADMIN_ROOT, resolveDir);
-            response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-            response.end(html);
+            await renderGuardedPage(walkedPath, request, response, ADMIN_ROOT, resolveDir, params, globalDirs);
             return;
           }
           if(ROUTE_FILES.includes(name)){
@@ -276,9 +331,7 @@ export default config => {
         } else if(fileStat?.isFile()){
           const name = filePath.split(/[/\\]/).pop();
           if(name.endsWith('.page.html')){
-            const html = await renderExternalPage(filePath, PROJECT_PUBLIC, resolveDir);
-            response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-            response.end(html);
+            await renderGuardedPage(filePath, request, response, PROJECT_PUBLIC, resolveDir, params);
             return;
           }
           if(ROUTE_FILES.includes(name)){
@@ -292,7 +345,28 @@ export default config => {
         }
       }
 
-      return next();
+      // File not found in extension's public dir — fall through to consumer page routing
+      break;
+    }
+
+    /*
+      Consumer public page routing: intercept .page.html before kempo-server SSR handles them
+    */
+    {
+      const resolveDir = buildResolveDir(PROJECT_PUBLIC, url);
+      const urlPath = url.replace(/\/+$/, '');
+
+      // Mirror kempo-server's SSR probe: url.page.html and url/index.page.html
+      const candidates = [
+        join(PROJECT_PUBLIC, urlPath + '.page.html'),
+        join(PROJECT_PUBLIC, urlPath, 'index.page.html'),
+      ];
+
+      for(const pageFilePath of candidates){
+        try { await stat(pageFilePath); } catch { continue; }
+        await renderGuardedPage(pageFilePath, request, response, PROJECT_PUBLIC, resolveDir);
+        return;
+      }
     }
 
     next();

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "kempo",
-  "version": "4.2.19",
+  "version": "4.2.21",
   "type": "module",
   "description": "A fullstack CMS framework for creating websites with user authentication",
   "scripts": {
-    "dev": "node dev.mjs",
+    "dev": "node scripts/dev.js",
     "build": "node scripts/build.js",
     "db:generate": "drizzle-kit generate",
     "db:migrate": "drizzle-kit migrate",
@@ -12,7 +12,10 @@
     "db:studio": "drizzle-kit studio",
     "makeAdmin": "node ./scripts/make-admin.js",
     "removeAdmin": "node ./scripts/removeAdmin.js",
-    "test:email": "node ./scripts/test-email.js"
+    "test:email": "node ./scripts/test-email.js",
+    "test": "kempo-test -n",
+    "test:node": "kempo-test -n",
+    "link:local": "npm install ../kempo-server ../kempo-ui --no-save"
   },
   "author": "Dustin Poissant",
   "license": "MIT",
@@ -44,16 +47,20 @@
     "dotenv": "^17.2.3",
     "drizzle-kit": "^0.31.7",
     "drizzle-orm": "^0.44.7",
-    "html-minifier-terser": "^7.2.0",
     "inquirer": "^12.6.1",
-    "kempo": "^4.2.16",
-    "kempo-server": "^3.1.0",
-    "kempo-testing-framework": "^1.4.6",
-    "kempo-ui": "^0.4.6",
     "lexical": "^0.42.0",
     "monaco-editor": "^0.55.1",
     "postgres": "^3.4.7",
-    "resend": "^6.5.2",
+    "resend": "^6.5.2"
+  },
+  "peerDependencies": {
+    "kempo-css": ">=2.2.5",
+    "kempo-server": ">=3.1.4",
+    "kempo-ui": ">=0.4.39"
+  },
+  "devDependencies": {
+    "html-minifier-terser": "^7.2.0",
+    "kempo-testing-framework": "^1.4.6",
     "terser": "^5.46.2"
   },
   "repository": {

package/server/utils/admin-global-content/createAdminGlobalContent.js

@@ -1,10 +1,10 @@
-import { readFile, writeFile } from 'fs/promises';
+import { readFile, writeFile, mkdir } from 'fs/promises';
 import { join } from 'path';
 import { existsSync } from 'fs';
 import crypto from 'crypto';
-import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries } from './helpers.js';
+import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries, ADMIN_GLOBALS_DIR } from './helpers.js';
 
-export default async ({ adminDir, name, location, priority, owner, markup }) => {
+export default async ({ adminDir = ADMIN_GLOBALS_DIR, name, location, priority, owner, markup }) => {
   if(!adminDir){
     return [{ code: 400, msg: 'Admin directory is required' }, null];
   }
@@ -37,6 +37,7 @@ export default async ({ adminDir, name, location, priority, owner, markup }) =>
   };
 
   entries.push(entry);
+  await mkdir(adminDir, { recursive: true });
   await writeFile(filePath, serializeEntries(entries) + '\n', 'utf-8');
 
   return [null, entry];

package/server/utils/admin-global-content/deleteAdminGlobalContent.js

@@ -1,9 +1,9 @@
 import { readFile, writeFile } from 'fs/promises';
 import { join } from 'path';
 import { existsSync } from 'fs';
-import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries } from './helpers.js';
+import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries, ADMIN_GLOBALS_DIR } from './helpers.js';
 
-export default async ({ adminDir, ids }) => {
+export default async ({ adminDir = ADMIN_GLOBALS_DIR, ids }) => {
   if(!adminDir){
     return [{ code: 400, msg: 'Admin directory is required' }, null];
   }

package/server/utils/admin-global-content/deleteAdminGlobalContentByOwner.js

@@ -1,9 +1,9 @@
 import { readFile, writeFile } from 'fs/promises';
 import { join } from 'path';
 import { existsSync } from 'fs';
-import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries } from './helpers.js';
+import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries, ADMIN_GLOBALS_DIR } from './helpers.js';
 
-export default async ({ adminDir, owner }) => {
+export default async ({ adminDir = ADMIN_GLOBALS_DIR, owner }) => {
   if(!adminDir){
     return [{ code: 400, msg: 'Admin directory is required' }, null];
   }

package/server/utils/admin-global-content/disableAdminGlobalContent.js

@@ -1,9 +1,9 @@
 import { readFile, writeFile } from 'fs/promises';
 import { join } from 'path';
 import { existsSync } from 'fs';
-import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries } from './helpers.js';
+import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries, ADMIN_GLOBALS_DIR } from './helpers.js';
 
-export default async ({ adminDir, id }) => {
+export default async ({ adminDir = ADMIN_GLOBALS_DIR, id }) => {
   if(!adminDir){
     return [{ code: 400, msg: 'Admin directory is required' }, null];
   }

package/server/utils/admin-global-content/enableAdminGlobalContent.js

@@ -1,9 +1,9 @@
 import { readFile, writeFile } from 'fs/promises';
 import { join } from 'path';
 import { existsSync } from 'fs';
-import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries } from './helpers.js';
+import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries, ADMIN_GLOBALS_DIR } from './helpers.js';
 
-export default async ({ adminDir, id }) => {
+export default async ({ adminDir = ADMIN_GLOBALS_DIR, id }) => {
   if(!adminDir){
     return [{ code: 400, msg: 'Admin directory is required' }, null];
   }

package/server/utils/admin-global-content/getAdminGlobalContent.js

@@ -1,9 +1,9 @@
 import { readFile } from 'fs/promises';
 import { join } from 'path';
 import { existsSync } from 'fs';
-import { ADMIN_GLOBAL_FILE, parseEntries } from './helpers.js';
+import { ADMIN_GLOBAL_FILE, parseEntries, ADMIN_GLOBALS_DIR } from './helpers.js';
 
-export default async ({ adminDir, id }) => {
+export default async ({ adminDir = ADMIN_GLOBALS_DIR, id }) => {
   if(!adminDir){
     return [{ code: 400, msg: 'Admin directory is required' }, null];
   }

package/server/utils/admin-global-content/helpers.js

@@ -4,6 +4,17 @@ import { existsSync } from 'fs';
 
 const ADMIN_GLOBAL_FILE = 'kempo-global.global.html';
 
+/*
+  Admin global content created through the admin UI is per-installation state, so it lives in the
+  consumer's project rather than in kempo's dist/admin — `npm run build` deletes dist/ wholesale and
+  reinstalling or upgrading kempo replaces it, either of which would silently discard it.
+
+  Extension-owned admin globals are NOT stored here. Each extension ships its own *.global.html
+  inside its package and the middleware scans it at render time, the same way extension pages are
+  resolved, so there is nothing to write on install or clean up on uninstall.
+*/
+const ADMIN_GLOBALS_DIR = join(process.cwd(), '.kempo', 'admin-globals');
+
 const parseEntries = raw => {
   const entries = [];
   const regex = /<content\s([^>]*)>([\s\S]*?)<\/content>/g;
@@ -44,4 +55,4 @@ const serializeEntries = entries => entries.map(e => {
   return `<content ${attrs}>\n${e.markup}\n</content>`;
 }).join('\n');
 
-export { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries };
+export { ADMIN_GLOBAL_FILE, ADMIN_GLOBALS_DIR, parseEntries, serializeEntries };

package/server/utils/admin-global-content/listAdminGlobalContent.js

@@ -1,9 +1,9 @@
 import { readFile } from 'fs/promises';
 import { join } from 'path';
 import { existsSync } from 'fs';
-import { ADMIN_GLOBAL_FILE, parseEntries } from './helpers.js';
+import { ADMIN_GLOBAL_FILE, parseEntries, ADMIN_GLOBALS_DIR } from './helpers.js';
 
-export default async ({ adminDir }) => {
+export default async ({ adminDir = ADMIN_GLOBALS_DIR } = {}) => {
   if(!adminDir){
     return [{ code: 400, msg: 'Admin directory is required' }, null];
   }

package/server/utils/admin-global-content/updateAdminGlobalContent.js

@@ -1,9 +1,9 @@
 import { readFile, writeFile } from 'fs/promises';
 import { join } from 'path';
 import { existsSync } from 'fs';
-import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries } from './helpers.js';
+import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries, ADMIN_GLOBALS_DIR } from './helpers.js';
 
-export default async ({ adminDir, id, name, location, priority, markup }) => {
+export default async ({ adminDir = ADMIN_GLOBALS_DIR, id, name, location, priority, markup }) => {
   if(!adminDir){
     return [{ code: 400, msg: 'Admin directory is required' }, null];
   }

package/server/utils/email/sendEmail.js

@@ -1,12 +1,18 @@
 import { Resend } from 'resend';
 
-const resend = new Resend(process.env.RESEND_API_KEY);
+/*
+  Constructed on first send, not at import. The Resend constructor throws when the key is missing,
+  and this module is reachable from the server SDK, so building it at module scope made an unset
+  RESEND_API_KEY fail every route that transitively imports it rather than just disabling email.
+*/
+let resend = null;
+const client = () => (resend ??= new Resend(process.env.RESEND_API_KEY));
 
 export default async ({ to, subject, html }) => {
   if(!process.env.RESEND_API_KEY){
     return [{ code: 500, msg: 'RESEND_API_KEY not configured' }, null];
   }
-  
+
   if(!to){
     return [{ code: 400, msg: 'Recipient email is required' }, null];
   }
@@ -22,7 +28,7 @@ export default async ({ to, subject, html }) => {
   const from = process.env.SMTP_FROM || 'onboarding@resend.dev';
 
   try {
-    const { data, error } = await resend.emails.send({
+    const { data, error } = await client().emails.send({
       from,
       to,
       subject,

package/server/utils/extensions/uninstallExtension.js

@@ -1,13 +1,28 @@
 import db from '../../db/index.js';
-import { extension, hook, permission, setting, group } from '../../db/schema.js';
-import { eq, inArray } from 'drizzle-orm';
+import { extension, hook, permission, setting, group, groupPermission, userGroup } from '../../db/schema.js';
+import { eq, inArray, like } from 'drizzle-orm';
 import { join } from 'path';
 import { pathToFileURL } from 'url';
 import { sql } from 'drizzle-orm';
 import triggerHook, { clearHandlerCache } from '../hooks/triggerHook.js';
 import { invalidateScopeCache } from './scopeCache.js';
 
-export default async ({ name }) => {
+/*
+  Uninstall an extension.
+
+  `purgeData` false (the default) deregisters the extension but leaves everything it created in
+  place — its tables and their rows, group memberships, permissions, groups and settings — so
+  reinstalling restores the site exactly as it was. This is the right mode for reinstalling to pick
+  up a fix.
+
+  `purgeData` true additionally destroys all of that. For an extension like kempo-blog that means
+  every post and comment, so it must always be a deliberate choice rather than a default.
+
+  Hooks and the extension row are removed either way. A registered hook whose module is no longer
+  installed cannot be tolerated: `middleware:before_page` is triggered with `bail: true`, so a
+  handler that fails to import now aborts the render and every page 404s.
+*/
+export default async ({ name, purgeData = false }) => {
   if(!name){
     return [{ code: 400, msg: 'Extension name is required' }, null];
   }
@@ -32,9 +47,9 @@ export default async ({ name }) => {
   } catch {}
 
   /*
-    Drop declarative schema tables
+    Drop declarative schema tables. Only when purging — these hold the extension's actual content.
   */
-  if(kempoConfig.schema){
+  if(purgeData && kempoConfig.schema){
     try {
       const extRoot = join(process.cwd(), 'node_modules', name);
       const schemaModule = await import(pathToFileURL(join(extRoot, kempoConfig.schema)).href);
@@ -48,25 +63,43 @@ export default async ({ name }) => {
   }
 
   /*
-    Remove declarative groups
-  */
-  const groupNames = (kempoConfig.groups || []).map(g => g.name);
-  if(groupNames.length){
-    await db.delete(group).where(inArray(group.name, groupNames)).catch(() => {});
-  }
+    Remove declarative groups, permissions and settings. Only when purging: these are what a
+    reinstall would otherwise restore, and group memberships in particular represent real user
+    state — every registered user of kempo-blog belongs to kempo-blog:member.
 
-  /*
-    Remove declarative permissions
+    userGroup and groupPermission both reference group.name, and groupPermission also references
+    permission.name, none of them cascading. The membership and grant rows therefore have to go
+    first or these deletes fail the foreign key — which they used to do silently, leaving every
+    uninstalled extension's groups and permissions behind forever.
   */
-  const permNames = (kempoConfig.permissions || []).map(p => p.name);
-  if(permNames.length){
-    await db.delete(permission).where(inArray(permission.name, permNames)).catch(() => {});
-  }
+  if(purgeData){
+    const groupNames = (kempoConfig.groups || []).map(g => g.name);
+    const permNames = (kempoConfig.permissions || []).map(p => p.name);
 
-  /*
-    Remove declarative settings (owner-namespaced: "extname:settingname")
-  */
-  await db.delete(setting).where(eq(setting.owner, name)).catch(() => {});
+    try {
+      if(groupNames.length){
+        await db.delete(userGroup).where(inArray(userGroup.groupName, groupNames));
+        await db.delete(groupPermission).where(inArray(groupPermission.groupName, groupNames));
+      }
+      if(permNames.length){
+        await db.delete(groupPermission).where(inArray(groupPermission.permissionName, permNames));
+      }
+      if(groupNames.length){
+        await db.delete(group).where(inArray(group.name, groupNames));
+      }
+      if(permNames.length){
+        await db.delete(permission).where(inArray(permission.name, permNames));
+      }
+    } catch(error) {
+      return [{ code: 500, msg: `Failed to remove extension groups and permissions: ${error.message}` }, null];
+    }
+
+    /*
+      Ownership is encoded in the setting name as "extname:settingname" — the setting table has no
+      owner column, so these have to be matched by prefix.
+    */
+    await db.delete(setting).where(like(setting.name, `${name}:%`));
+  }
 
   try {
     await db.delete(hook).where(eq(hook.owner, name));

package/server/utils/fragments/listFragments.js

@@ -3,6 +3,14 @@ import { relative } from 'path';
 import scanDir from '../fs/scanDir.js';
 import parseFrontmatter from '../fs/parseFrontmatter.js';
 
+const parseLocations = content => {
+  const locations = [];
+  const regex = /<location\s[^/]*?name="([^"]+)"[^/]*?\/>/g;
+  let match;
+  while((match = regex.exec(content)) !== null) locations.push(match[1]);
+  return locations;
+};
+
 export default async ({ rootDir }) => {
   if(!rootDir){
     return [{ code: 400, msg: 'Root directory is required' }, null];
@@ -24,7 +32,8 @@ export default async ({ rootDir }) => {
       disabled: isDisabled,
       author: meta.author || '',
       createdAt: meta.created || '',
-      updatedAt: meta.updated || ''
+      updatedAt: meta.updated || '',
+      locations: parseLocations(content)
     };
   });
 

package/server/utils/hooks/triggerHook.js

@@ -1,28 +1,21 @@
 import db from '../../db/index.js';
 import { hook } from '../../db/schema.js';
 import { eq } from 'drizzle-orm';
-import { createRequire } from 'module';
-import { dirname, join } from 'path';
+import { join } from 'path';
+import { pathToFileURL } from 'url';
 
 const handlerCache = new Map();
 
 export const clearHandlerCache = () => handlerCache.clear();
 
-const requireFromProject = createRequire(join(process.cwd(), 'package.json'));
-
 const resolveHandler = (owner, callback) => {
   if(callback.startsWith('./') || callback.startsWith('../')){
-    try {
-      const pkgPath = requireFromProject.resolve(`${owner}/package.json`);
-      return join(dirname(pkgPath), callback);
-    } catch {
-      return null;
-    }
+    return join(process.cwd(), 'node_modules', owner, callback);
   }
   return callback;
 };
 
-export default async (event, data = {}) => {
+export default async (event, data = {}, { bail = false } = {}) => {
   if(!event){
     return [{ code: 400, msg: 'Event is required' }, null];
   }
@@ -38,10 +31,17 @@ export default async (event, data = {}) => {
       let handler = handlerCache.get(handlerPath);
       if(!handler){
         try {
-          const mod = await import(handlerPath);
+          const mod = await import(pathToFileURL(handlerPath).href);
           handler = mod.default || mod;
           handlerCache.set(handlerPath, handler);
-        } catch {
+        } catch(err) {
+          /*
+            Never fail silently: a hook that cannot load is indistinguishable from one that
+            allowed the request. For bailing events (guards) that would fail open, so rethrow.
+          */
+          console.error(`[kempo] Hook handler failed to load for "${event}" (${h.owner}): ${err.message}`);
+          if(bail) throw err;
+          results.push({ hookId: h.id, owner: h.owner, error: err.message });
           continue;
         }
       }
@@ -50,12 +50,14 @@ export default async (event, data = {}) => {
         const result = await handler(data);
         results.push({ hookId: h.id, owner: h.owner, result });
       } catch(err) {
+        if(bail) throw err;
         results.push({ hookId: h.id, owner: h.owner, error: err.message });
       }
     }
 
     return [null, { results }];
   } catch(error) {
+    if(bail) throw error;
     return [{ code: 500, msg: 'Failed to trigger hooks' }, null];
   }
 };