kempo 4.2.3 → 4.2.5

package/middleware/extension-scope-router.js

@@ -0,0 +1,255 @@
+import { dirname, join, extname } from 'path';
+import { readFile, stat, readdir } from 'fs/promises';
+import { pathToFileURL } from 'url';
+import { renderExternalPage } from 'kempo-server/templating';
+import { getEnabledExtensions } from '../server/utils/extensions/scopeCache.js';
+
+const MIME_TYPES = {
+  '.js': 'application/javascript',
+  '.css': 'text/css',
+  '.json': 'application/json',
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.gif': 'image/gif',
+  '.svg': 'image/svg+xml',
+  '.ico': 'image/x-icon',
+  '.woff': 'font/woff',
+  '.woff2': 'font/woff2',
+  '.ttf': 'font/ttf',
+};
+
+const ROUTE_FILES = ['GET.js','POST.js','PUT.js','DELETE.js','PATCH.js','HEAD.js','OPTIONS.js','index.js','CATCH.js'];
+
+const NODE_MODULES = join(process.cwd(), 'node_modules');
+const ADMIN_ROOT = join(process.cwd(), 'dist', 'admin');
+
+const buildResolveDir = (base, url) => {
+  const parts = url.replace(/\/+$/, '').split('/').filter(Boolean);
+  let dir = base;
+  for(const part of parts) dir = join(dir, part);
+  return dir;
+};
+
+const walkDynamic = async (base, segments) => {
+  if(segments.length === 0) return { filePath: base, params: {} };
+  const [head, ...rest] = segments;
+  let entries;
+  try {
+    entries = await readdir(base, { withFileTypes: true });
+  } catch { return null; }
+  for(const entry of entries){
+    if(entry.name !== head) continue;
+    if(entry.isDirectory()){
+      const result = await walkDynamic(join(base, head), rest);
+      if(result) return result;
+    } else if(entry.isFile() && rest.length === 0){
+      return { filePath: join(base, head), params: {} };
+    }
+  }
+  for(const entry of entries){
+    if(!entry.isDirectory() || !entry.name.startsWith('[') || !entry.name.endsWith(']')) continue;
+    const paramName = entry.name.slice(1, -1);
+    const result = await walkDynamic(join(base, entry.name), rest);
+    if(result) return { filePath: result.filePath, params: { [paramName]: head, ...result.params } };
+  }
+  return null;
+};
+
+const executeRouteFile = async (filePath, request, response, params = {}) => {
+  const fileUrl = pathToFileURL(filePath).href + `?t=${Date.now()}`;
+  const module = await import(fileUrl);
+  if(typeof module.default !== 'function') return false;
+  if(params && Object.keys(params).length) request.params = { ...(request.params || {}), ...params };
+  await module.default(request, response);
+  return true;
+};
+
+const serveDir = async (dirPath, method, request, response, resolveDir, projectPublic, params = {}) => {
+  const candidates = [`${method}.js`, 'index.page.html', 'index.js', 'index.html', 'CATCH.js'];
+  for(const candidate of candidates){
+    const candidatePath = join(dirPath, candidate);
+    try { await stat(candidatePath); } catch { continue; }
+    if(candidate.endsWith('.page.html')){
+      const html = await renderExternalPage(candidatePath, projectPublic, resolveDir);
+      response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+      response.end(html);
+      return true;
+    }
+    if(ROUTE_FILES.includes(candidate)){
+      return executeRouteFile(candidatePath, request, response, params);
+    }
+    const mime = MIME_TYPES[extname(candidatePath)] || 'text/html';
+    response.writeHead(200, { 'Content-Type': mime });
+    response.end(await readFile(candidatePath));
+    return true;
+  }
+  return false;
+};
+
+export default config => {
+  const PROJECT_PUBLIC = config.rootPath || join(process.cwd(), 'public');
+
+  return async (request, response, next) => {
+    const url = request.url.split('?')[0];
+
+    /*
+      Core admin routing: /admin/** -> dist/admin/
+      Renders .page.html files with ADMIN_ROOT so the admin template and fragments are resolved correctly.
+      Must run before kempo-server's custom route handler, which would incorrectly use app-public as rootDir.
+    */
+    if(url === '/admin' || url.startsWith('/admin/')){
+      const subPath = url.slice('/admin'.length) || '/';
+      const segments = subPath.replace(/^\//, '').split('/').filter(Boolean);
+      const method = request.method?.toUpperCase() || 'GET';
+
+      // Don't intercept extension admin pages here — they're handled below
+      if(!url.startsWith('/admin/extension/')){
+        const resolveDir = buildResolveDir(ADMIN_ROOT, url);
+
+        if(segments.length === 0){
+          const served = await serveDir(ADMIN_ROOT, method, request, response, resolveDir, ADMIN_ROOT);
+          if(served) return;
+        } else {
+          const walked = await walkDynamic(ADMIN_ROOT, segments);
+          if(walked){
+            const { filePath, params } = walked;
+            let fileStat;
+            try { fileStat = await stat(filePath); } catch { /* not found */ }
+
+            if(fileStat?.isDirectory()){
+              const served = await serveDir(filePath, method, request, response, resolveDir, ADMIN_ROOT, params);
+              if(served) return;
+            } else if(fileStat?.isFile()){
+              const name = filePath.split(/[/\\]/).pop();
+              if(name.endsWith('.page.html')){
+                const html = await renderExternalPage(filePath, ADMIN_ROOT, resolveDir);
+                response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+                response.end(html);
+                return;
+              }
+              if(ROUTE_FILES.includes(name)){
+                await executeRouteFile(filePath, request, response, params);
+                return;
+              }
+              const mime = MIME_TYPES[extname(filePath)] || 'application/octet-stream';
+              response.writeHead(200, { 'Content-Type': mime });
+              response.end(await readFile(filePath));
+              return;
+            }
+          }
+        }
+        // Not found in dist/admin — fall through to next()
+        return next();
+      }
+    }
+
+    /*
+      Admin extension routing: /admin/extension/{name}/** -> extension's admin/ directory
+      Protected by kempo-auth; no enabled check needed here.
+    */
+    const adminMatch = url.match(/^\/admin\/extension\/((?:@[^/]+\/)?[^/]+)(\/.*)?$/);
+    if(adminMatch){
+      const extName = adminMatch[1];
+      const subPath = adminMatch[2] || '/';
+      const extRoot = join(NODE_MODULES, extName);
+      const adminDir = join(extRoot, 'admin');
+      const pageCandidates = subPath.endsWith('/')
+        ? [join(adminDir, subPath, 'index.page.html')]
+        : [
+            join(adminDir, subPath.replace(/\.html$/, '') + '.page.html'),
+            join(adminDir, subPath, 'index.page.html'),
+          ];
+
+      const resolveDir = buildResolveDir(ADMIN_ROOT, url);
+      for(const pagePath of pageCandidates){
+        try {
+          await stat(pagePath);
+          const html = await renderExternalPage(pagePath, ADMIN_ROOT, resolveDir);
+          response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+          response.end(html);
+          return;
+        } catch { /* try next candidate */ }
+      }
+
+      const filePath = join(adminDir, subPath === '/' ? 'index.html' : subPath);
+      try {
+        const stats = await stat(filePath);
+        if(stats.isFile()){
+          const mime = MIME_TYPES[extname(filePath)] || 'application/octet-stream';
+          response.writeHead(200, { 'Content-Type': mime });
+          response.end(await readFile(filePath));
+          return;
+        }
+      } catch { /* fall through to next() */ }
+
+      return next();
+    }
+
+    /*
+      Public scope routing: /{scope}/** -> enabled extension's public/ directory
+      Supports: .page.html templates, JS route handlers (GET.js etc.), dynamic [param] dirs, static files.
+    */
+    const extensions = await getEnabledExtensions();
+
+    for(const ext of extensions){
+      let pkgPath, pkg;
+      try {
+        pkgPath = join(NODE_MODULES, ext.name, 'package.json');
+        pkg = JSON.parse(await readFile(pkgPath, 'utf-8'));
+      } catch {
+        continue;
+      }
+
+      const scope = pkg.kempo?.['public-scope'];
+      if(!scope) continue;
+
+      const scopePrefix = `/${scope}`;
+      if(url !== scopePrefix && !url.startsWith(`${scopePrefix}/`)) continue;
+
+      const publicDir = join(dirname(pkgPath), 'public');
+      const subPath = url.slice(scopePrefix.length) || '/';
+      const method = request.method?.toUpperCase() || 'GET';
+      const resolveDir = buildResolveDir(PROJECT_PUBLIC, url);
+      const segments = subPath.replace(/^\//, '').split('/').filter(Boolean);
+
+      if(segments.length === 0){
+        const served = await serveDir(publicDir, method, request, response, resolveDir, PROJECT_PUBLIC);
+        if(served) return;
+        return next();
+      }
+
+      const walked = await walkDynamic(publicDir, segments);
+      if(walked){
+        const { filePath, params } = walked;
+        let fileStat;
+        try { fileStat = await stat(filePath); } catch { /* not found */ }
+
+        if(fileStat?.isDirectory()){
+          const served = await serveDir(filePath, method, request, response, resolveDir, PROJECT_PUBLIC, params);
+          if(served) return;
+        } else if(fileStat?.isFile()){
+          const name = filePath.split(/[/\\]/).pop();
+          if(name.endsWith('.page.html')){
+            const html = await renderExternalPage(filePath, PROJECT_PUBLIC, resolveDir);
+            response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            response.end(html);
+            return;
+          }
+          if(ROUTE_FILES.includes(name)){
+            await executeRouteFile(filePath, request, response, params);
+            return;
+          }
+          const mime = MIME_TYPES[extname(filePath)] || 'application/octet-stream';
+          response.writeHead(200, { 'Content-Type': mime });
+          response.end(await readFile(filePath));
+          return;
+        }
+      }
+
+      return next();
+    }
+
+    next();
+  };
+};

package/middleware/kempo-auth.js

@@ -0,0 +1,26 @@
+import getSession from '../server/utils/auth/getSession.js';
+import currentUserHasPermission from '../server/utils/permissions/currentUserHasPermission.js';
+
+export default (config) => async (request, response, next) => {
+  const { path } = request;
+  if(path.startsWith('/account') || path.startsWith('/admin')){
+    const sessionToken = request.cookies.session_token;
+    const [error, session] = await getSession({ token: sessionToken });
+    if(error || !session || !session.user){
+      return response.redirect('/login');
+    }
+    if(request.path.startsWith('/admin')){
+      const [permError, hasPermission] = await currentUserHasPermission(sessionToken, 'system:admin:access');
+      if(permError || !hasPermission){
+        return response.redirect('/account');
+      }
+      if(request.path.startsWith('/admin/pages/edit')){
+        const [editPermError, hasEditPermission] = await currentUserHasPermission(sessionToken, 'system:pages:update');
+        if(editPermError || !hasEditPermission){
+          return response.redirect('/admin/pages');
+        }
+      }
+    }
+  }
+  return next();
+};

package/package.json

@@ -1,30 +1,57 @@
 {
   "name": "kempo",
-  "version": "4.2.3",
+  "version": "4.2.5",
   "type": "module",
-  "description": "A web component library",
-  "exports": {
-    ".": "./dist/index.js",
-    "./utils/": "./dist/utils/",
-    "./utils/*": "./dist/utils/*.js",
-    "./components/": "./dist/components/",
-    "./components/*": "./dist/components/*.js"
-  },
+  "description": "A fullstack CMS framework for creating websites with user authentication",
   "scripts": {
-    "test": "node ./test/index.js",
-    "build": "node ./scripts/build.js",
-    "docs": "node ./scripts/docs.js",
-    "docs-src": "node ./scripts/docs.js -s"
+    "dev": "kempo-server --root app-public --port 9876",
+    "build": "node scripts/build.js",
+    "db:generate": "drizzle-kit generate",
+    "db:migrate": "drizzle-kit migrate",
+    "db:push": "drizzle-kit push",
+    "db:studio": "drizzle-kit studio",
+    "makeAdmin": "node ./scripts/make-admin.js",
+    "removeAdmin": "node ./scripts/removeAdmin.js",
+    "test:email": "node ./scripts/test-email.js"
   },
   "author": "Dustin Poissant",
   "license": "MIT",
-  "dependencies": {},
-  "devDependencies": {
-    "terser": "^5.29.2"
+  "bin": {
+    "kempo": "./bin/cli.js"
   },
-  "directories": {
-    "doc": "docs",
-    "test": "test"
+  "files": [
+    "bin",
+    "dist",
+    "app-public",
+    "app-server",
+    "app-drizzle.config.js",
+    "server",
+    "middleware",
+    "app-templates",
+    "scripts/init-db.js"
+  ],
+  "dependencies": {
+    "@lexical/history": "^0.42.0",
+    "@lexical/html": "^0.42.0",
+    "@lexical/list": "^0.42.0",
+    "@lexical/rich-text": "^0.42.0",
+    "@lexical/selection": "^0.42.0",
+    "@lexical/utils": "^0.42.0",
+    "bcrypt": "^6.0.0",
+    "dotenv": "^17.2.3",
+    "drizzle-kit": "^0.31.7",
+    "drizzle-orm": "^0.44.7",
+    "html-minifier-terser": "^7.2.0",
+    "inquirer": "^12.6.1",
+    "kempo": "^4.2.4",
+    "kempo-server": "^3.1.0",
+    "kempo-testing-framework": "^1.4.6",
+    "kempo-ui": "^0.3.17",
+    "lexical": "^0.42.0",
+    "monaco-editor": "^0.55.1",
+    "postgres": "^3.4.7",
+    "resend": "^6.5.2",
+    "terser": "^5.46.2"
   },
   "repository": {
     "type": "git",

package/scripts/init-db.js

@@ -0,0 +1,211 @@
+import crypto from 'crypto';
+import db from '../server/db/index.js';
+import { permission, group, groupPermission, setting, createSettingProtectionTrigger, createGroupProtectionTrigger, createPermissionProtectionTrigger } from '../server/db/schema.js';
+import { eq, and, sql } from 'drizzle-orm';
+
+const DEFAULT_PERMISSIONS = [
+  { name: 'system:user:create', description: 'Create new users' },
+  { name: 'system:user:read', description: 'View users' },
+  { name: 'system:user:update', description: 'Edit users' },
+  { name: 'system:user:delete', description: 'Delete users' },
+  
+  { name: 'system:group:create', description: 'Create new groups' },
+  { name: 'system:group:read', description: 'View groups' },
+  { name: 'system:group:update', description: 'Edit groups and manage membership' },
+  { name: 'system:group:delete', description: 'Delete groups' },
+  
+  { name: 'system:permissions:read', description: 'View permissions for all users' },
+  { name: 'system:permissions:manage', description: 'Add or remove permissions' },
+  
+  { name: 'system:settings:read', description: 'View private settings' },
+  { name: 'system:settings:update', description: 'Update settings' },
+  { name: 'system:custom-settings:manage', description: 'Create and delete custom settings' },
+  
+  { name: 'system:pages:read', description: 'View pages in admin' },
+  { name: 'system:pages:create', description: 'Create new pages' },
+  { name: 'system:pages:update', description: 'Edit pages' },
+  { name: 'system:pages:delete', description: 'Delete pages' },
+  
+  { name: 'system:menus:create', description: 'Create new menus' },
+  { name: 'system:menus:read', description: 'View menus in admin' },
+  { name: 'system:menus:update', description: 'Edit menus and menu items' },
+  { name: 'system:menus:delete', description: 'Delete menus' },
+  
+  { name: 'system:fragments:read', description: 'View fragments in admin' },
+  { name: 'system:fragments:create', description: 'Create new fragments' },
+  { name: 'system:fragments:update', description: 'Edit fragments' },
+  { name: 'system:fragments:delete', description: 'Delete fragments' },
+  
+  { name: 'system:globals:read', description: 'View global content in admin' },
+  { name: 'system:globals:create', description: 'Create new global content' },
+  { name: 'system:globals:update', description: 'Edit global content' },
+  { name: 'system:globals:delete', description: 'Delete global content' },
+
+  { name: 'system:extensions:read', description: 'View installed extensions' },
+  { name: 'system:extensions:install', description: 'Install extensions' },
+  { name: 'system:extensions:uninstall', description: 'Uninstall extensions' },
+  { name: 'system:extensions:manage', description: 'Enable and disable extensions' },
+
+  { name: 'system:admin:access', description: 'Access admin panel' },
+];
+
+const DEFAULT_GROUPS = {
+  'system:Users': {
+    description: 'Default group for all users',
+    permissions: []
+  },
+  'system:Administrators': {
+    description: 'Full system access',
+    permissions: [
+      'system:admin:access',
+      'system:user:create', 'system:user:read', 'system:user:update', 'system:user:delete',
+      'system:group:create', 'system:group:read', 'system:group:update', 'system:group:delete',
+      'system:permissions:list-own', 'system:permissions:check-others', 'system:permissions:list-others', 'system:permissions:manage',
+      'system:settings:read', 'system:settings:update', 'system:custom-settings:manage',
+      'system:pages:read', 'system:pages:create', 'system:pages:update', 'system:pages:delete',
+      'system:menus:create', 'system:menus:read', 'system:menus:update', 'system:menus:delete',
+      'system:fragments:read', 'system:fragments:create', 'system:fragments:update', 'system:fragments:delete',
+      'system:globals:read', 'system:globals:create', 'system:globals:update', 'system:globals:delete',
+      'system:extensions:read', 'system:extensions:install', 'system:extensions:uninstall', 'system:extensions:manage'
+    ]
+  }
+};
+
+console.log('=== Seeding Permissions ===\n');
+
+for(const perm of DEFAULT_PERMISSIONS) {
+  const existing = await db.select()
+    .from(permission)
+    .where(eq(permission.name, perm.name))
+    .limit(1);
+  
+  if(existing.length === 0) {
+    await db.insert(permission).values({
+      name: perm.name,
+      description: perm.description,
+      owner: 'system',
+      createdAt: new Date()
+    });
+    console.log(`✓ Created permission: ${perm.name}`);
+  } else {
+    console.log(`- Permission exists: ${perm.name}`);
+  }
+}
+
+console.log('\n=== Creating Groups ===\n');
+
+const allPermissions = await db.select().from(permission);
+const permissionMap = Object.fromEntries(
+  allPermissions.map(p => [p.name, p.name])
+);
+
+for(const [groupName, groupData] of Object.entries(DEFAULT_GROUPS)) {
+  let groupRecord = await db.select()
+    .from(group)
+    .where(eq(group.name, groupName))
+    .limit(1);
+  
+  if(groupRecord.length === 0) {
+    groupRecord = await db.insert(group).values({
+      name: groupName,
+      description: groupData.description,
+      owner: 'system',
+      createdAt: new Date()
+    }).returning();
+    console.log(`✓ Created group: ${groupName}`);
+  } else {
+    console.log(`- Group exists: ${groupName}`);
+  }
+  
+  if(groupName === 'system:Administrators') {
+    console.log(`  Skipping permission assignments (admin has all permissions)`);
+    continue;
+  }
+  
+  console.log(`  Assigning permissions to ${groupName}:`);
+  
+  for(const permName of groupData.permissions) {
+    if(!permissionMap[permName]) {
+      console.log(`  ⚠ Permission not found: ${permName}`);
+      continue;
+    }
+    
+    const existing = await db.select()
+      .from(groupPermission)
+      .where(and(
+        eq(groupPermission.groupName, groupName),
+        eq(groupPermission.permissionName, permName)
+      ))
+      .limit(1);
+    
+    if(existing.length === 0) {
+      await db.insert(groupPermission).values({
+        id: crypto.randomUUID(),
+        groupName: groupName,
+        permissionName: permName,
+        createdAt: new Date()
+      });
+      console.log(`  ✓ ${permName}`);
+    }
+  }
+}
+
+console.log('\n=== Creating Default Settings ===\n');
+
+const DEFAULT_SETTINGS = [
+  { owner: 'system', name: 'site_name', value: 'Kempo Site', type: 'string', isPublic: true, description: 'The name of the website' },
+  { owner: 'system', name: 'session_duration_days', value: 7, type: 'number', isPublic: false, description: 'Session duration in days' },
+  { owner: 'system', name: 'allow_registration', value: true, type: 'boolean', isPublic: true, description: 'Allow new users to register' },
+  { owner: 'system', name: 'require_email_verification', value: false, type: 'boolean', isPublic: false, description: 'Require email verification before account access' },
+  { owner: 'system', name: 'verification_url', value: 'http://localhost:3000/verify-email/{{token}}', type: 'string', isPublic: false, description: 'Email verification URL template' },
+  { owner: 'system', name: 'password_reset_url', value: 'http://localhost:3000/reset-password/{{token}}', type: 'string', isPublic: false, description: 'Password reset URL template' },
+];
+
+const { default: setSetting } = await import('../server/utils/settings/setSetting.js');
+for(const s of DEFAULT_SETTINGS){
+  await setSetting(s.owner, s.name, s.value, s.type, s.isPublic, s.description);
+  console.log(`✓ Created setting: ${s.owner}:${s.name} = ${s.value}`);
+}
+
+console.log('\n=== Updating Existing Records ===\n');
+
+const updatedPerms = await db.update(permission)
+  .set({ owner: 'system' })
+  .where(sql`name LIKE 'system:%'`)
+  .returning();
+console.log(`✓ Updated ${updatedPerms.length} permissions to owner='system'`);
+
+const updatedGroups = await db.update(group)
+  .set({ owner: 'system' })
+  .where(sql`name LIKE 'system:%'`)
+  .returning();
+console.log(`✓ Updated ${updatedGroups.length} groups to owner='system'`);
+
+console.log('\nCreating database triggers to protect system resources...');
+
+try {
+  await db.execute(sql.raw('DROP TRIGGER IF EXISTS protect_system_settings ON setting'));
+  await db.execute(sql.raw(createSettingProtectionTrigger()));
+  console.log('✓ System settings protection trigger created');
+} catch(e) {
+  console.log('- Settings trigger already exists');
+}
+
+try {
+  await db.execute(sql.raw('DROP TRIGGER IF EXISTS protect_system_groups ON "group"'));
+  await db.execute(sql.raw(createGroupProtectionTrigger()));
+  console.log('✓ System groups protection trigger created');
+} catch(e) {
+  console.log('- Groups trigger already exists');
+}
+
+try {
+  await db.execute(sql.raw('DROP TRIGGER IF EXISTS protect_system_permissions ON permission'));
+  await db.execute(sql.raw(createPermissionProtectionTrigger()));
+  console.log('✓ System permissions protection trigger created');
+} catch(e) {
+  console.log('- Permissions trigger already exists');
+}
+
+console.log('\n=== Group & Permission Seeding Complete ===');
+process.exit(0);

package/server/db/index.js

@@ -0,0 +1,24 @@
+import { drizzle } from 'drizzle-orm/postgres-js';
+import postgres from 'postgres';
+import { existsSync, realpathSync } from 'fs';
+import { join } from 'path';
+import { fileURLToPath, pathToFileURL } from 'url';
+import 'dotenv/config';
+import * as frameworkSchema from './schema.js';
+
+/*
+  Load app schema if it exists at <project root>/server/db/schema.js
+*/
+
+let appSchema = {};
+const appSchemaPath = join(process.cwd(), 'server', 'db', 'schema.js');
+const frameworkSchemaPath = fileURLToPath(new URL('./schema.js', import.meta.url));
+
+if(existsSync(appSchemaPath) && realpathSync(appSchemaPath) !== realpathSync(frameworkSchemaPath)){
+  appSchema = await import(pathToFileURL(appSchemaPath).href);
+}
+
+const client = postgres(process.env.DATABASE_URL);
+const db = drizzle(client, { schema: { ...frameworkSchema, ...appSchema } });
+
+export default db;