kempo 4.2.20 → 4.2.21

package/server/utils/admin-global-content/deleteAdminGlobalContent.js

@@ -1,9 +1,9 @@
 import { readFile, writeFile } from 'fs/promises';
 import { join } from 'path';
 import { existsSync } from 'fs';
-import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries } from './helpers.js';
+import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries, ADMIN_GLOBALS_DIR } from './helpers.js';
 
-export default async ({ adminDir, ids }) => {
+export default async ({ adminDir = ADMIN_GLOBALS_DIR, ids }) => {
   if(!adminDir){
     return [{ code: 400, msg: 'Admin directory is required' }, null];
   }

package/server/utils/admin-global-content/deleteAdminGlobalContentByOwner.js

@@ -1,9 +1,9 @@
 import { readFile, writeFile } from 'fs/promises';
 import { join } from 'path';
 import { existsSync } from 'fs';
-import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries } from './helpers.js';
+import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries, ADMIN_GLOBALS_DIR } from './helpers.js';
 
-export default async ({ adminDir, owner }) => {
+export default async ({ adminDir = ADMIN_GLOBALS_DIR, owner }) => {
   if(!adminDir){
     return [{ code: 400, msg: 'Admin directory is required' }, null];
   }

package/server/utils/admin-global-content/disableAdminGlobalContent.js

@@ -1,9 +1,9 @@
 import { readFile, writeFile } from 'fs/promises';
 import { join } from 'path';
 import { existsSync } from 'fs';
-import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries } from './helpers.js';
+import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries, ADMIN_GLOBALS_DIR } from './helpers.js';
 
-export default async ({ adminDir, id }) => {
+export default async ({ adminDir = ADMIN_GLOBALS_DIR, id }) => {
   if(!adminDir){
     return [{ code: 400, msg: 'Admin directory is required' }, null];
   }

package/server/utils/admin-global-content/enableAdminGlobalContent.js

@@ -1,9 +1,9 @@
 import { readFile, writeFile } from 'fs/promises';
 import { join } from 'path';
 import { existsSync } from 'fs';
-import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries } from './helpers.js';
+import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries, ADMIN_GLOBALS_DIR } from './helpers.js';
 
-export default async ({ adminDir, id }) => {
+export default async ({ adminDir = ADMIN_GLOBALS_DIR, id }) => {
   if(!adminDir){
     return [{ code: 400, msg: 'Admin directory is required' }, null];
   }

package/server/utils/admin-global-content/getAdminGlobalContent.js

@@ -1,9 +1,9 @@
 import { readFile } from 'fs/promises';
 import { join } from 'path';
 import { existsSync } from 'fs';
-import { ADMIN_GLOBAL_FILE, parseEntries } from './helpers.js';
+import { ADMIN_GLOBAL_FILE, parseEntries, ADMIN_GLOBALS_DIR } from './helpers.js';
 
-export default async ({ adminDir, id }) => {
+export default async ({ adminDir = ADMIN_GLOBALS_DIR, id }) => {
   if(!adminDir){
     return [{ code: 400, msg: 'Admin directory is required' }, null];
   }

package/server/utils/admin-global-content/helpers.js

@@ -4,6 +4,17 @@ import { existsSync } from 'fs';
 
 const ADMIN_GLOBAL_FILE = 'kempo-global.global.html';
 
+/*
+  Admin global content created through the admin UI is per-installation state, so it lives in the
+  consumer's project rather than in kempo's dist/admin — `npm run build` deletes dist/ wholesale and
+  reinstalling or upgrading kempo replaces it, either of which would silently discard it.
+
+  Extension-owned admin globals are NOT stored here. Each extension ships its own *.global.html
+  inside its package and the middleware scans it at render time, the same way extension pages are
+  resolved, so there is nothing to write on install or clean up on uninstall.
+*/
+const ADMIN_GLOBALS_DIR = join(process.cwd(), '.kempo', 'admin-globals');
+
 const parseEntries = raw => {
   const entries = [];
   const regex = /<content\s([^>]*)>([\s\S]*?)<\/content>/g;
@@ -44,4 +55,4 @@ const serializeEntries = entries => entries.map(e => {
   return `<content ${attrs}>\n${e.markup}\n</content>`;
 }).join('\n');
 
-export { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries };
+export { ADMIN_GLOBAL_FILE, ADMIN_GLOBALS_DIR, parseEntries, serializeEntries };

package/server/utils/admin-global-content/listAdminGlobalContent.js

@@ -1,9 +1,9 @@
 import { readFile } from 'fs/promises';
 import { join } from 'path';
 import { existsSync } from 'fs';
-import { ADMIN_GLOBAL_FILE, parseEntries } from './helpers.js';
+import { ADMIN_GLOBAL_FILE, parseEntries, ADMIN_GLOBALS_DIR } from './helpers.js';
 
-export default async ({ adminDir }) => {
+export default async ({ adminDir = ADMIN_GLOBALS_DIR } = {}) => {
   if(!adminDir){
     return [{ code: 400, msg: 'Admin directory is required' }, null];
   }

package/server/utils/admin-global-content/updateAdminGlobalContent.js

@@ -1,9 +1,9 @@
 import { readFile, writeFile } from 'fs/promises';
 import { join } from 'path';
 import { existsSync } from 'fs';
-import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries } from './helpers.js';
+import { ADMIN_GLOBAL_FILE, parseEntries, serializeEntries, ADMIN_GLOBALS_DIR } from './helpers.js';
 
-export default async ({ adminDir, id, name, location, priority, markup }) => {
+export default async ({ adminDir = ADMIN_GLOBALS_DIR, id, name, location, priority, markup }) => {
   if(!adminDir){
     return [{ code: 400, msg: 'Admin directory is required' }, null];
   }

package/server/utils/email/sendEmail.js

@@ -1,12 +1,18 @@
 import { Resend } from 'resend';
 
-const resend = new Resend(process.env.RESEND_API_KEY);
+/*
+  Constructed on first send, not at import. The Resend constructor throws when the key is missing,
+  and this module is reachable from the server SDK, so building it at module scope made an unset
+  RESEND_API_KEY fail every route that transitively imports it rather than just disabling email.
+*/
+let resend = null;
+const client = () => (resend ??= new Resend(process.env.RESEND_API_KEY));
 
 export default async ({ to, subject, html }) => {
   if(!process.env.RESEND_API_KEY){
     return [{ code: 500, msg: 'RESEND_API_KEY not configured' }, null];
   }
-  
+
   if(!to){
     return [{ code: 400, msg: 'Recipient email is required' }, null];
   }
@@ -22,7 +28,7 @@ export default async ({ to, subject, html }) => {
   const from = process.env.SMTP_FROM || 'onboarding@resend.dev';
 
   try {
-    const { data, error } = await resend.emails.send({
+    const { data, error } = await client().emails.send({
       from,
       to,
       subject,

package/server/utils/extensions/uninstallExtension.js

@@ -1,13 +1,28 @@
 import db from '../../db/index.js';
-import { extension, hook, permission, setting, group } from '../../db/schema.js';
-import { eq, inArray } from 'drizzle-orm';
+import { extension, hook, permission, setting, group, groupPermission, userGroup } from '../../db/schema.js';
+import { eq, inArray, like } from 'drizzle-orm';
 import { join } from 'path';
 import { pathToFileURL } from 'url';
 import { sql } from 'drizzle-orm';
 import triggerHook, { clearHandlerCache } from '../hooks/triggerHook.js';
 import { invalidateScopeCache } from './scopeCache.js';
 
-export default async ({ name }) => {
+/*
+  Uninstall an extension.
+
+  `purgeData` false (the default) deregisters the extension but leaves everything it created in
+  place — its tables and their rows, group memberships, permissions, groups and settings — so
+  reinstalling restores the site exactly as it was. This is the right mode for reinstalling to pick
+  up a fix.
+
+  `purgeData` true additionally destroys all of that. For an extension like kempo-blog that means
+  every post and comment, so it must always be a deliberate choice rather than a default.
+
+  Hooks and the extension row are removed either way. A registered hook whose module is no longer
+  installed cannot be tolerated: `middleware:before_page` is triggered with `bail: true`, so a
+  handler that fails to import now aborts the render and every page 404s.
+*/
+export default async ({ name, purgeData = false }) => {
   if(!name){
     return [{ code: 400, msg: 'Extension name is required' }, null];
   }
@@ -32,9 +47,9 @@ export default async ({ name }) => {
   } catch {}
 
   /*
-    Drop declarative schema tables
+    Drop declarative schema tables. Only when purging — these hold the extension's actual content.
   */
-  if(kempoConfig.schema){
+  if(purgeData && kempoConfig.schema){
     try {
       const extRoot = join(process.cwd(), 'node_modules', name);
       const schemaModule = await import(pathToFileURL(join(extRoot, kempoConfig.schema)).href);
@@ -48,25 +63,43 @@ export default async ({ name }) => {
   }
 
   /*
-    Remove declarative groups
-  */
-  const groupNames = (kempoConfig.groups || []).map(g => g.name);
-  if(groupNames.length){
-    await db.delete(group).where(inArray(group.name, groupNames)).catch(() => {});
-  }
+    Remove declarative groups, permissions and settings. Only when purging: these are what a
+    reinstall would otherwise restore, and group memberships in particular represent real user
+    state — every registered user of kempo-blog belongs to kempo-blog:member.
 
-  /*
-    Remove declarative permissions
+    userGroup and groupPermission both reference group.name, and groupPermission also references
+    permission.name, none of them cascading. The membership and grant rows therefore have to go
+    first or these deletes fail the foreign key — which they used to do silently, leaving every
+    uninstalled extension's groups and permissions behind forever.
   */
-  const permNames = (kempoConfig.permissions || []).map(p => p.name);
-  if(permNames.length){
-    await db.delete(permission).where(inArray(permission.name, permNames)).catch(() => {});
-  }
+  if(purgeData){
+    const groupNames = (kempoConfig.groups || []).map(g => g.name);
+    const permNames = (kempoConfig.permissions || []).map(p => p.name);
 
-  /*
-    Remove declarative settings (owner-namespaced: "extname:settingname")
-  */
-  await db.delete(setting).where(eq(setting.owner, name)).catch(() => {});
+    try {
+      if(groupNames.length){
+        await db.delete(userGroup).where(inArray(userGroup.groupName, groupNames));
+        await db.delete(groupPermission).where(inArray(groupPermission.groupName, groupNames));
+      }
+      if(permNames.length){
+        await db.delete(groupPermission).where(inArray(groupPermission.permissionName, permNames));
+      }
+      if(groupNames.length){
+        await db.delete(group).where(inArray(group.name, groupNames));
+      }
+      if(permNames.length){
+        await db.delete(permission).where(inArray(permission.name, permNames));
+      }
+    } catch(error) {
+      return [{ code: 500, msg: `Failed to remove extension groups and permissions: ${error.message}` }, null];
+    }
+
+    /*
+      Ownership is encoded in the setting name as "extname:settingname" — the setting table has no
+      owner column, so these have to be matched by prefix.
+    */
+    await db.delete(setting).where(like(setting.name, `${name}:%`));
+  }
 
   try {
     await db.delete(hook).where(eq(hook.owner, name));

package/server/utils/hooks/triggerHook.js

@@ -34,7 +34,14 @@ export default async (event, data = {}, { bail = false } = {}) => {
           const mod = await import(pathToFileURL(handlerPath).href);
           handler = mod.default || mod;
           handlerCache.set(handlerPath, handler);
-        } catch {
+        } catch(err) {
+          /*
+            Never fail silently: a hook that cannot load is indistinguishable from one that
+            allowed the request. For bailing events (guards) that would fail open, so rethrow.
+          */
+          console.error(`[kempo] Hook handler failed to load for "${event}" (${h.owner}): ${err.message}`);
+          if(bail) throw err;
+          results.push({ hookId: h.id, owner: h.owner, error: err.message });
           continue;
         }
       }